Sciweavers

SP
1999
IEEE

A Data Mining Framework for Building Intrusion Detection Models

13 years 8 months ago
A Data Mining Framework for Building Intrusion Detection Models
There is often the need to update an installed Intrusion Detection System (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. In this paper, we describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learnin...
Wenke Lee, Salvatore J. Stolfo, Kui W. Mok
Added 04 Aug 2010
Updated 04 Aug 2010
Type Conference
Year 1999
Where SP
Authors Wenke Lee, Salvatore J. Stolfo, Kui W. Mok
Comments (0)