Abstract:Intrusion detection is an important technique in the defense-in-depth network security framework. In recent years, it has been a widely studied topic in computer network security. In this paper, we present two methods, namely, the Hidden Markov Models (HMM) method and the Self Organizing Maps (SOM) method, to profile normal program behavior for anomaly intrusion detection based on computer audit data. The HMM method utilizes the transition property of events while SOM method relies on the frequency property of events. Two data sets, CERT synthetic Sendmail system call data collected in the University of New Mexico (UNM) and Live FTP system call data collected in the CNSIS lab of Xi'an Jiaotong University, were used to assess the two methods. Testing results show that the HMM method using the transition property of events produces good detection performance while high computational expense is required both for training and detection. The HMM method is better than other two methods reported previously in terms of detection accuracy for the same data set. The SOM method considering the frequency property of events, on the other hand, is suitable for real-time intrusion detection because of its capability of processing a large amount of data with low computational overhead.

New algorithm mining intrusion patterns

Study of Adaptive Intrusion Detection with Data Mining

Research on Data Mining-based Intrusion Detection in Real-time Environment

New method for intrusion features mining in IDS

Research on Network Intrusion Detection Based on Data Mining

Hybrid Intrusion Detection Based on Data Mining

Intrusion Detection And Simulation For High-Speed Networks

Applications of data mining to network intrusion detection

Worm Intrusion Alarm Modeling Based on Network Traffic Character

Research of a Model of Database Intrusion Detection

Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data

Process Mining Algorithm for Online Intrusion Detection System

Mining Network Traffic with the k -Means Clustering Algorithm for Stepping-Stone Intrusion Detection

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Mining Frequent Patterns from Network Flows for Monitoring Network

Study on Abnormal Detection Based on System Call and Data Mining Technique

Study of Data Mining in Intrusion Detection

Network traffic monitoring based on mining frequent patterns

Research of Anomaly Detection System Based on Data Mining

Implementation of Association Rule Mining for Network Intrusion Detection

A Two-Phase Approach for Unexpected Pattern Mining.