Data Mining for Network Intrusion Detection

TLDR

The study develops rare‑class prediction models to detect known intrusions and anomaly/outlier detection schemes to identify novel attacks. Experimental results on KDDCup’99, DARPA 1998, and live traffic demonstrate that the proposed models outperform standard classifiers and successfully detect novel intrusions, including several on the CERT/CC advisory list.

Abstract

This paper gives an overview of our research in building rare class prediction models for identifying known intrusions and their variations and anomaly/outlier detection schemes for detecting novel attacks whose nature is unknown. Experimental results on the KDDCup’99 data set have demonstrated that our rare class predictive models are much more efficient in the detection of intrusive behavior than standard classification techniques. Experimental results on the DARPA 1998 data set, as well as on live network traffic at the University of Minnesota, show that the new techniques show great promise in detecting novel intrusions. In particular, during the past few months our techniques have been successful in automatically identifying several novel intrusions that could not be detected using state-of-the-art tools such as SNORT. In fact, many of these have been on the CERT/CC list of recent advisories and incident notes.