Data Mining and Intruston Detection - Samuel Ginn College of 数据挖掘和intruston检测-吉恩塞缪尔学院.pptVIP

Data Mining and Intrusion Detection Alan Hunt Will Fletcher Auburn University Outline Intrusion Detection Systems Data Mining Data Mining and Intrusion Detection Data Mining Traffic Analysis to Determine and Predict User Behavior A Priest, a Rabbi, an Intrusion Detection System, a Data Miner and a Graduate Student Walk into a Bar The Bartender Says: I’m sorry, we don’t serve miners Resources Questions? Intrusions Intrusions are actions aimed to compromise the confidentiality, integrity, and/or availability of a computer or computer network. Solution: Intrusion Detection Systems Intrusion Detection Systems Monitors network traffic looking for suspicious activity. Various approaches Network based intrusion detection (NIDS) – monitors network traffic Host based intrusion detection (HIDS) – monitors a single host Signature based (similar to antivirus software), also known as “misuse detection” Anomaly detection Intrusion Detection Limitations of Signature based IDS Signature database has to be manually revised for each new type of discovered intrusion They cannot detect emerging threats Substantial latency in deployment of newly created signatures Limitations of Anomaly Detection False Positives – alert when no attack exists. Typically, anomaly detection is prone to a high number of false alarms due to previously unseen legitimate behavior. Data Overload The amount of data for analysts to examine is growing too large. This is the problem that data mining looks to solve. Lack of Adaptability Data Mining Data Mining - Extraction of interesting (non-trivial, implicit, previously unknown and potentially useful) information or patterns from data in large databases [Han and Kamber 2005]. Data mining is used to sort through the tremendous amounts of data stored by automated data collection tools. Extracts rules, regularities, patterns, and constraints from databases. Data Mining Techniques Association rule mining Finding frequent patterns, associations, correlations, or