Title :
Real time data mining-based intrusion detection
Author :
Lee, Wenke ; Stolfo, Salvatore J. ; Chan, Philip K. ; Eskin, Eleazar ; Fan, Wei ; Miller, Matthew ; Hershkop, Shlomo ; Zhang, Junxin
Author_Institution :
Dept. of Comput. Sci., North Carolina State Univ., Raleigh, NC, USA
Abstract :
We present an overview of our research in real time data mining-based intrusion detection systems (IDSs). We focus on issues related to deploying a data mining-based IDS in a real time environment. We describe our approaches to address three types of issues: accuracy, efficiency, and usability. To improve accuracy, data mining programs are used to analyze audit data and extract features that can distinguish normal activities from intrusions; we use artificial anomalies along with normal and/or intrusion data to produce more effective misuse and anomaly detection models. To improve efficiency, the computational costs of features are analyzed and a multiple-model cost-based approach is used to produce detection models with low cost and high accuracy. We also present a distributed architecture for evaluating cost-sensitive models in real-time. To improve usability, adaptive learning algorithms are used to facilitate model construction and incremental updates; unsupervised anomaly detection algorithms are used to reduce the reliance on labeled data. We also present an architecture consisting of sensors, detectors, a data warehouse, and model generation components. This architecture facilitates the sharing and storage of audit data and the distribution of new or updated models. This architecture also improves the efficiency and scalability of the IDS
Keywords :
data mining; data warehouses; real-time systems; security of data; supervisory programs; unsupervised learning; accuracy; adaptive learning; artificial anomalies; audit data; computational costs; cost-sensitive models; data warehouse; detectors; distributed architecture; model construction; model generation; multiple-model cost-based approach; network security; real time data mining-based intrusion detection; real time environment; sensors; unsupervised anomaly detection algorithms; usability; Computational efficiency; Computer architecture; Costs; Data analysis; Data mining; Detection algorithms; Feature extraction; Intrusion detection; Real time systems; Usability;
Conference_Titel :
DARPA Information Survivability Conference & Exposition II, 2001. DISCEX '01. Proceedings
Conference_Location :
Anaheim, CA
Print_ISBN :
0-7695-1212-7
DOI :
10.1109/DISCEX.2001.932195