An efficient data structure for storing network intrusion detection dataset

Network based intrusion detection (NID) involves collection of raw packets from network and analyzing them for anomalous content. This deals with careful collection of required features from the header and payloads of packet. Data mining is one of the most popular technique to mine NID database. Most of the mining algorithms require multiple scans of database which increases the I/O operations and thus consume time. To cater this, data abstraction is used which reduces the memory requirement and scan time of database. In this paper we propose a novel data structure called Prefix Runlength tree (PR-Tree) for efficiently storing NID dataset. We used KDD 99 evaluation dataset for our experimentation and results are promising.