Efficient Intrusion Detection with KNN Classification and DS Theory - Proceedings of All India Seminar on Biomedical Engineering 2012 (AISOBE-2012) - page 179

Table 3 Confusion matrix on test data of KNN and KNN-DS

Metric Predicted Total

Normal Attack

Actual Normal TN FP TN + FP

Attack FN TP TP + FN

Total TP + FN TP + FP Accuracy

Table 4 Parameter result of tested data sets

Metric Accuracy (%) Precision (%) Recall (%)

Data set 1 KNN 92.14 87.24 84.43

KNN-DS 97.14 96.11 94.10

Data set 2 KNN 89.90 84.32 83.23

KNN-DS 95.23 92.14 91.21

TP
TP þ FP

Precision ¼

TP
TP þ FN

Recall ¼

where,
TP True Positive

TN True Negative

FP False Positive

FN False Negative

Confusion matrix: It is used to evaluate the general performance of the different
classifiers and different metrics. These metrics were calculated using the confusion
matrix, which shows the predict and actual classification; the tabular format of the
confusion matrix is shown in Table 3 . In the context of intrusion detection system,
TP means correctly identified attack traffic and TN means correctly identified
normal traffic. FP is the normal traffic being misclassified as an attack and FN are
the attack instances being misclassified as normal (Table 4 ).
Comparative graph chart of KNN and KNN-DS result on given data set for
Intrusion Detection System
DATA SET 1