Analysis of K- Nearest Neighbor for Network Intrusion Detection

Computer network Intrusion is an unauthorised
action or activity on a network. The threat of
intrusions on cyber-security has grown significantly
recently. Various techniques are used to counteract
these dangers with some levels of detection
accuracy. This study models and assesses the
performance of k- Nearest Neighbor (KNN) for
intrusion detection. An online intrusion detection
dataset of National State and Local Knowledge
Discovery in Database (NSL-KDD) from Kaggle
was used for the assessment comprising 43 features
and instances of both normal and abnormal data
streams. The model is implemented in python and
assessed using Precision, Recall, and F1 score. The
assessment results show 99.996% accuracy and
1.00 respectively for Precision, Recall and F1 Score
for the 2-class classification (normal and abnormal)
and 99.988% and also 1.00 respectively for
Precision, Recall and F1 Score for each of the
abnormal multi-class classification (Denial of
service, Remote to user Attack, User to root, and
probe), except for the User to root class that records
a Precision of 9.99. These results suggest that KNN
is an effective algorithm for intrusion detection both
for the binary and multi class classification. and,
therefore, should be adopted for developing an
intrusion detection system.