A Data Mining Framework for Building Intrusion Detection Models

Wenke Lee; Salvatore Stolfo; Kui W. Mok

A Data Mining Framework for Building Intrusion Detection Models
Lee, Wenke
Stolfo, Salvatore
Mok, Kui W.
Computer Science
Persistent URL:
Security and Privacy: Proceedings of the 1999 IEEE Symposium on Security and Privacy: May 9-12, 1999, Oakland, California (Los Alamitos, Calif.: IEEE Computer Society Press, 1999), pp. 120-132.
There is often the need to update an installed intrusion detection system (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. We describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learning, association rules, and frequent episodes. We report on the results of applying these programs to the extensively gathered network audit data for the 1998 DARPA Intrusion Detection Evaluation Program.
Computer science
Publisher DOI:
Item views
text | xml
Suggested Citation:
Wenke Lee, Salvatore Stolfo, Kui W. Mok, , A Data Mining Framework for Building Intrusion Detection Models, Columbia University Academic Commons, .

Columbia University Libraries | Policies | FAQ