Data Mining in Intrusion Detection: A Comparative Study of Methods, Types and Data Sets

Abstract

Abstract-In the era of info rmation and communicat ion technology, Security is an important issue. A lot of effort and finance are being invested in this sector. Intrusion detection is one of the mos t prominent fields in this area. Data min ing in network intrusion detection can automate the network intrusion detection field with a greater efficiency. This paper presents a literature survey on intrusion detection system. The research papers taken in this literature survey are published fro m 2000 to 2012. We can see that almost 67 % of the research papers are focused on anomaly detection, 23 % on both anomaly and misuse detection and 10 % on misuse detection. In this literature survey statistics shows that 42 % KDD cup dataset, 20 % DA RPA dataset and 38 % other datasets are used by the different researchers for testing the effectiveness of their proposed method for misuse detection, anomaly detection or both.

A Multi-agents Intrusion Detection System Using Ontology and Clustering Techniques

“…Needless to remind that the application of the data mining techniques within the intrusion detection context can effectively improve the detection accuracy, the detection speed, and enhance the system's own security [2]. Thus, as an intelligent analysis task, the AnomalyAgent provides the crossroads of multi-agents systems with the clustering technique, in particular the AD-Clust algorithm.…”

Security Visualization Analytics Model in Online Social Networks Using Data Mining and Graph-based Structure Algorithms

“…Anomaly detection was interested in first priority that presented 67% [18]. S. Sharma et al, presented a centrality measurement and analysis of the social networks for tracking online community by using betweenness, closeness and degree centrality measures [19].…”

Immune-Inspired Self-Protection Model for Securing Grid

“…Intrusion detection Systems (IDSs) [38] is another way to provide system level security. IDSs add an early warning capability for the suspicious activity that mostly occurs before and during an attack.…”