Abstract: Data Mining algorithm which is applied as an anomaly detection system has been considered as one of the essential techniques in malicious behaviour detection. Unfortunately, such detection system is known for its inclination in detecting a cyber-malicious activity more accurately (i.e. maximizing malicious and non-malicious behaviours detection) and has become a persistent limitation in the deployment of intrusion detection systems. Consequently, these constraints will affect a number of important performance factors such as the accuracy, detection rate and false alarms. In this research, KMDT proposed as an anomaly detection model that utilized k-means clustering and decision tree classifier to maximize the detection of malicious behaviours by scrutinizing packet headers. The k-means clustering employed for labelling and plots the whole behaviours into identical cluster, which characterized the behaviours into suspicious or non-suspicious composition. Subsequently, these dissimilar clustered behaviours are reordered within two classes of types such as malicious and non-malicious via decision tree classifier. KMDT is a profitable finding which improved the anomaly detection performance in identifying suspicious and non-suspicious behaviours as well as characterizes it into malicious and non-malicious behaviours more accurately. These criteria have been validated by the result from the experiments throughout banking system environment dataset 2016. KMDT have detected more malicious behaviours accurately as contrast to discrete and diversely combined methods.

Warusia Yassin, Siti Rahayu, Faizal Abdollah and Hazlin Zin, “An Improved Malicious Behaviour Detection Via k-Means and Decision Tree” International Journal of Advanced Computer Science and Applications(IJACSA), 7(12), 2016. http://dx.doi.org/10.14569/IJACSA.2016.071227

@article{Yassin2016,
title = {An Improved Malicious Behaviour Detection Via k-Means and Decision Tree},
journal = {International Journal of Advanced Computer Science and Applications},
doi = {10.14569/IJACSA.2016.071227},
url = {http://dx.doi.org/10.14569/IJACSA.2016.071227},
year = {2016},
publisher = {The Science and Information Organization},
volume = {7},
number = {12},
author = {Warusia Yassin and Siti Rahayu and Faizal Abdollah and Hazlin Zin}
}