Intrusion discovery with data mining on Honeynet

In order to construct a secure network, attack and intrusion mode of intruders are analyzed for improving the capability of IDS and firewall systems. This paper presents a method for constructing a network intrusion and attack detection system on Honeynet, which is a true network that is constructed for the purpose of gathering information of intruders and attackers. Analyzing these data with data mining algorithm can work our attack modes, in this paper, we propose some method for mining patterns on various data from firewall records and log server in Honeynet, and the result can be in various forms such as associated rules of historic data or certain data structures required by IDS and firewall systems.