Abstract: Network anomaly detection has become one of the focus research topics in the field of intrusion detection. However, issues on accurate selection of key date in training set, the long selection time, and the high rate of detection misstatement arc still unresolved. Regarding to those problems, to integrate K-MEANS and Branch and Bound Algo- rithm,and to build up a network anomaly detection model on it can significantly improve the accuracy of key data selec- tion,and reduce time consumption as well. A series of experiments on well known KDD Cup 1999 dataset demonstrate that the model can achieve a high detection accuracy and efficiently constrain the false alarms caused by detection.

Key words: Anomaly detection, K-MEANS, Branch and bound