An IDS monitors network traffic searching for suspicious activity and known threats, sending up to alerts when it finds such items. In the recent avocation, Intrusion detection as a magnificence still remains censorial in cyber safety. But maybe not as a lasting resolution. To understand intrusion detection firstly understand what is intrusion. Cambridge dictionary defines an intrusion as "an occasion when someone goes into a place or situation where they are not wanted or expected to be". For the purpose of this article, here it defines intrusion as any un-possessed system or network festivity on one (or more) computer(s) or network(s). This is an illustration of a lawful user of a system trying to intensify his privileges to gain greater entrance to the system that he is currently entrusted, or the same user trying to connect to an unauthorized remote port of a server. These are the intrusions that can engender from the outside world, a aggrieved ex-employee who was fired lately, or from your faithful staff. In this clause, the mediocre data is discovered as invasion when the case is false positive. Here they are focusing on this problem with an illustration & offering one solution for the same problem. The KDD CUP 1999 data set is used. In the outcome of this experiment it can be seen that if a class has higher number of counts then this class is opined as an anomaly class. But it will be count as anomaly if the true person is passing the threshold value. One solution is proposed to detect the true person and to remove false positive.

Data mining Anomaly Detection System (ADS) K-Means Ensemble Detection rate False alarm rate false positive Clustering