Adam

Abstract

Intrusion detection systems have traditionally been based on the characterization of an attack and the tracking of the activity on the system to see if it matches that characterization. Recently, new intrusion detection systems based on data mining are making their appearance in the field. This paper describes the design and experiences with the ADAM (Audit Data Analysis and Mining) system, which we use as a testbed to study how useful data mining techniques can be in intrusion detection.

Cyberspace Security Using Adversarial Learning and Conformal Prediction

“…Data mining, however, lacks the local estimation and training aspects characteristics of conformal prediction, in general, and transduction, in particular, which provide for locality that reveals specific context, location, and time stamps. One early example for data mining use is audit data analysis and mining (ADAM) system [55] to discover attacks in a TCP dump audit trail using KDD 1999 for test bed and seeking DOS and PROBE attacks. ADAM leverages A Priori association mining to derive (antecedent to consequent) rules of legitimate behavior (e.g., profiles free of attacks) in terms of "normal" frequent item sets.…”

Critical analysis of genetic algorithm based IDS and an approach for detecting intrusion in MANET using data mining techniques

“…However, it is also a fact that the minority intrusions are more dangerous than the majority attacks. One of the problems of supervised anomaly intrusion detection approaches [26] is the high dependency on training data for normal activities.…”

“…ad hoc is Latin and means "for this purpose‖. Each device in a MANET is free to move independently in any direction, and will therefore change its links to other devices frequently [30]. Each must forward traffic unrelated to its own use, and therefore be a router.…”

“…The technique of intrusion detection can be termed as the mechanism which is used for detecting the suspicious activities at host as well as at the network level. The two major intrusion detection techniques are the misuse detection and the anomaly detection [26]. In the anomaly based technique the audit data is utilized to differentiate the abnormal data from the normal data.…”

Mining Complex Network Data for Adaptive Intrusion Detection

“…Finally, developing a clustering or classification model for intrusion detection, which provide decision support to intrusion management for detecting known and unknown intrusions by discovering intrusion patterns [4,5].…”