The anomaly detection by using DBSCAN clustering with multiple parameters

DBSCAN is one of powerful density-based clustering algorithms for detecting outliers, but there are some difficulties in finding its parameters (epsilon and minpts). Currently, there is also no way to use DBSCAN with different parameters for different cluster when it is applied to anomaly detection when network traffic includes multiple traffic types with different characteristics. In this paper, we propose a new way of finding DBSCAN's parameters and applying DBSCAN with those parameters. Each cluster may have different epsilon and minpts values in our algorithm. The algorithm is called DBSCAN-MP. We also propose a mechanism of updating normal behavior by updating size or creating new clusters when network environment is changing overtime. We evaluate proposed algorithm using the KDD Cup 1999 dataset. The result shows that the performance is improved compare to other clustering algorithms.