KRF-AD: Innovating anomaly detection with KDE-KL and random forest fusion

Abstract

Anomaly detection in Intrusion Detection System (IDS) data refers to the process of identifying and flagging unusual or abnormal behavior within a network or system. In the context of IoT, anomaly detection helps in identifying any abnormal or unexpected behavior in the data generated by connected devices. Existing methods often struggle with accurately detecting anomalies amidst massive data volumes and diverse attack patterns. This paper proposes a novel approach, KDE-KL Anomaly Detection with Random Forest Integration (KRF-AD), which combines Kernel Density Estimation (KDE) and Kullback-Leibler (KL) divergence with Random Forest (RF) for effective anomaly detection. Additionally, Random Forest (RF) integration enables classification of data points as anomalies or normal based on features and anomaly scores. The combination of statistical divergence measurement and density estimation enhances the detection accuracy and robustness, contributing to more effective network security. Experimental results demonstrate that KRF-AD achieves 96% accuracy and outperforms other machine learning models in detecting anomalies, offering significant potential for enhancing network security.