Building an Intrusion Detection System for IT Security Based on Data Mining Techniques

Abstract

-This paper aims to research various data mining techniques applied to solve intrusion detection problems. In general, intrusion detection techniques can be divided into two major categories: misuse detection and anomaly detection. Taking into consideration effectiveness of the anomaly detection technique not only against known types of attacks (like misuse detection does by exploiting signature database) but also against new ones, it has become a topical issue in majority of data and computer security researches.The techniques discussed in the paper include the Hidden Markov Model (HMM) method for modelling and evaluating invisible events based on system calls, further development of Stephanie Forrest's idea of the fixed-length audit trail patterns, the principle component analysis based method for anomaly intrusion detection with less computation efforts, algorithm based on k-nearest neighbour method, as well as applying association rule algorithm to audit data.

Developing a hybrid method of Hidden Markov Models and C5.0 as a Intrusion Detection System

“…Model construction is the critical part in Intrusion Detection Systems. Modeling technology can provide quantitative methods for the analysis of data, to represent, or acquire expert knowledge, using inductive logic programming, or algorithms, so that AI, cognitive science and other research fields are afforded broader platforms for the development of IDS [4,6]. This paper presents a hybrid intelligent system for IDS problem.…”

“…In recent years a vast majority of research activities in the area of anomaly detection have been focused on studying the behaviour of programs and the creation of their profiles based on system call log files [4].…”