Abstract
The use of data mining techniques for intrusion detection (ID) is one of the ongoing issues in the field of computer security, but little attention has been placed in engineering ID activities. This paper presents a framework that models the ID process as a set of cooperative tasks each supporting a specialized activity. Specifically, the framework organises raw audit data into a set of relational tables and applies data mining algorithms to generate intrusion detection models. Specialized components of a commercial DBMS have been used to validate the proposed approach. Results show that the framework works well in capturing patterns of intrusion while the availability of an integrated software environment allows a high level of modularity in performing each task.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Lee, W., Stolfo, S.J.: A Framework for Constructing Features and Models for Intrusion Detections Systems. ACM Transactions on Information and System Security 3(4), 227–261 (2000)
Cohen, W.W.: Fast effective rule induction. In: Proceedings of the 12th International Conference on Machine Learning, Lake Tahoe, CA, Morgan Kaufmann, San Mateo (1995)
Bala, J., Baik, S., Hadjarian, A., Gogia, B.K., Chris, M.: Application of a Distributed Data Mining Approach to Network Intrusion Detection. In: Proceedings of AAMAS 2002, Bologna, Italy, July 15-19 (2002)
Krügel, C., Toth, T., Kirda, E.: Service Specific Anomaly Detection for Network Intrusion Detection. In: Proceedings of SAC 2002, Madrid, Spain (2002)
Taylor, C., Alves-Foss, J.: An Empirical Analysis of NATE – Network Analysis of Anomalous Traffic Events. In: New Security Paradigms Workshop 2002, September 23-26, Virginia Beach, Virginia (2002)
Barbará, D., Couto, J., Jajodia, S., Wu, N.: ADAM: A Testbed for Exploring the Use of Data Mining in Intrusion Detection. SIGMOD Records 30(4) (December 2001)
Kruegel, C., Vigna, G.: Anomaly Detection of Web-based Attacks. In: Proceedings of CCS 2003, Washington, DC, USA, October 27-31 (2003)
Oracle 9i Data Mining Concepts, release 9.2.0.2 (October 2002)
UCI KDD Archive, http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
Yarmus, J.S.: ABN: A Fast, Greedy Bayesian Network Classifier (2003)
http://otn.oracle.com/products/bi/pdf/adaptive_bayes_net.pdf
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2004 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Bosin, A., Dessì, N., Pes, B. (2004). Engineering Knowledge Discovery in Network Intrusion Detection. In: Yang, Z.R., Yin, H., Everson, R.M. (eds) Intelligent Data Engineering and Automated Learning – IDEAL 2004. IDEAL 2004. Lecture Notes in Computer Science, vol 3177. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-28651-6_37
Download citation
DOI: https://doi.org/10.1007/978-3-540-28651-6_37
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-22881-3
Online ISBN: 978-3-540-28651-6
eBook Packages: Springer Book Archive