Data mining for intrusion detection

This paper presents an approach to detect intrusion based on a data mining framework. In the framework, intrusion detection is thought of as a classification. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. We provide the results from experiments in using classification on real world traffic data