Home

Real Time Data Mining-based Intrusion Detection

Wenke Lee; Salvatore Stolfo; Philip K. Chan; Eleazar Eskin; Wei Fan; Matthew Miller; Shlomo Hershkop; Junxin Zhang

Title:
Real Time Data Mining-based Intrusion Detection
Author(s):
Lee, Wenke
Stolfo, Salvatore
Chan, Philip K.
Eskin, Eleazar
Fan, Wei
Miller, Matthew
Hershkop, Shlomo
Zhang, Junxin
Date:
Type:
Articles
Department:
Computer Science
Permanent URL:
Notes:
DISCEX'01: DARPA Information Survivability Conference & Exposition II: proceedings: 12-14 June, 2001, Anaheim, California, vol. 1 (Los Alamitos, Calif.: IEEE Computer Society, 2001), pp. 89-100.
Abstract:
We present an overview of our research in real time data mining-based intrusion detection systems (IDSs). We focus on issues related to deploying a data mining-based IDS in a real time environment. We describe our approaches to address three types of issues: accuracy, efficiency, and usability. To improve accuracy, data mining programs are used to analyze audit data and extract features that can distinguish normal activities from intrusions; we use artificial anomalies along with normal and/or intrusion data to produce more effective misuse and anomaly detection models. To improve efficiency, the computational costs of features are analyzed and a multiple-model cost-based approach is used to produce detection models with low cost and high accuracy. We also present a distributed architecture for evaluating cost-sensitive models in real-time. To improve usability, adaptive learning algorithms are used to facilitate model construction and incremental updates; unsupervised anomaly detection algorithms are used to reduce the reliance on labeled data. We also present an architecture consisting of sensors, detectors, a data warehouse, and model generation components. This architecture facilitates the sharing and storage of audit data and the distribution of new or updated models. This architecture also improves the efficiency and scalability of the IDS.
Subject(s):
Computer science
Publisher DOI:
http://dx.doi.org/10.1109/DISCEX.2001.932195
Item views:
385
Metadata:
View

In Partnership with the Center for Digital Research and Scholarship at Columbia University Libraries/Information Services.