Effective Intrusion Detection System using Data Mining Technique

VAWKUM Transactions on Computer Sciences

As the research increased in computer science highlight the scientists mind for the growing research world towards security. Researchers have done a lot of research work in network Security. Cybersecurity has progressively become a zone of alarm for officials, Government agencies and industries, including big commercialized infrastructure, are under attack daily. First signature-based intrusion detection systems were developed, and it detects only novel attacks. To detect strange attacks statistical IDS came into being recognized as anomaly-based IDS. It is not as much efficient as it detects all. In this, study the author focus on the efficiency of IDS using NSL-KDD99 dataset and support vector machine (SVM) technique to identify attacks. NSL-KDD dataset is used for the evaluation of these type of systems.

2014

Now a day’s security is the primary concerned in the field of computer science. Intrusion detection system provides stronger security services with the help of rules. Intrusion Detection System (IDS) has recently emerged as an important component for enhancing information system security. However, constructing and maintaining a misuse intrusion detection system for a network is labor– intensive, since attack scenarios and patterns need to be analyzed and categorized. Moreover, the rules corresponding to the scenarios and patterns need to be carefully hand-coded. In such situations, data mining can be used to ease this inconvenience. All most all-existing intrusion detection systems focus on attacks at low-level, and only produced isolated alerts. It is known that existing IDS can’t find any type of logical relations among alerts. This research proposes an intrusion detection system that uses a combination of classification and clustering algorithms to detect intrusions. Basically th...

Communications in Computer and Information Science, 2012

The aim of this study is to simulate a network traffic analyzer that is part of an Intrusion Detection System -IDS, the main focus of research is data mining and for this type of application the steps that precede the data mining : data preparation (possibly involving cleaning data, data transformations, selecting subsets of records, data normalization) are considered fundamental for a good performance of the classifiers during the data mining stage. In this context, this paper discusses and presents as a contribution not only the classifiers that were used in the problem of intrusion detection, but also the initial stage of data preparation. Therefore, we tested the performance of three classifiers on the KDDCUP'99 benchmark intrusion detection dataset and selected the best classifiers. We initially tested a Decision Tree and a Neural Network using this dataset, suggesting improvements by reducing the number of attributes from 42 to 27 considering only two classes of detection, normal and intrusion. Finally, we tested the Decision Tree and Bayesian Network classifiers considering five classes of attack: Normal, DOS, U2R, R2L and Probing. The experimental results proved that the algorithms used achieved high detection rates (DR) and significant reduction of false positives (FP) for different types of network intrusions using limited computational resources.

Network intrusion detection is very important mechanism for detecting intrusions in networks. Data mining techniques play very important role in detecting intrusions in networks. Intrusions cause damage to the data and compromise integrity and confidentiality and availability of the data. Though many intrusions preventing software's are developed and installed in network stations and network operating systems still finds vulnerabilities of the systems using network hacking techniques and tries to break the security walls of the system and enters despite the intrusion preventive mechanism built in. Hence network administrators and data management team feels the intrusion detection techniques are essential in-order to know that intrusion occurred or not and track them in and out entries in the network, so that steps can be taken for further for preventing intrusions or to block the intrusions that keep coming in. though In Corporate world many intrusion detection software's and detections techniques of different solutions are being developed still the people are not satisfied with the performance of the IDS. So many researches are still carrying on in this area to seek efficient techniques which are used for Intrusion detection. In this research papers gives the idea of what is network intrusion detection system and what it supposed to do and what are the problems with this technology and finally focus on Data Mining Techniques & data mining process to build more effective intrusion detection systems. 1. INTRODUCTION In the field of networking the area of security comprise policies adapted by the network administrator to prevent and monitor unauthorized access. Network security involves authorization of network access which is controlled by the network administrator. Internet is network of networks and not network of host. In information security the Network Intrusions are the activities that violate the security norms of the network system. Network Intrusion Detection system is Mechanism used to identify, monitor intrusions that travel through on a network wire and analyze the traffic packets on a network for intrusion detection. The main goal of the network IDS is to identify the attacks and security threats as and when happen by providing the real time network monitoring and second provide attack information to the network administrator and third fix the attacks by taking preventing measures and finally store attack events in the disk for analysis to identify which is normal and intrusion. [1] We need intrusion detection techniques looking at a perspective of building a secure network. Secure a network first analyzing the vulnerability of the network environment. In second line of defense is intrusion prevention system. If the prevention fails the intrusion detection system comes in to the picture. If Intrusion detection system do fails (for example denial of service) then we want to rely on intrusion respond/tolerance systems. In this paper mainly focused on Intrusion detection system and their techniques. Intrusion detection to work First assumption is that system activities can be or are observable, second assumption is that normal and intrusive activities must have distinct evidence. The goal of intrusion detection is to analyze audit data and find out the evidence of Intrusion. Main techniques used are misuse detection & Anomaly detection. Misuse detection which is based on patterns finding of well known attack and anomaly detection which based on deviation from normal pattern usage of system. This paper gives new ideas and insights on the intrusion detection development process using data mining and focuses mainly on intrusion detection techniques. [16] 2. DRAWBACKS OF CURRENT INTRUSION DETECTION TECHNIQUES The reasons for drawbacks of current state of intrusion detection techniques mainly due to Poor theoretical foundations and development methodology, development process to develop intrusion detection systems. So most of the IDS pure based knowledge on software engineering techniques involves studying particular network configuration, operating system environment and application software and possible attack methods that can be launched, so based on that knowledge IDS developed and hoping that will work. But the networking environment really too complicated. So just going through software engineering process is very slow and very expensive process. [2]

The prosperity of technology worldwide has made the concerns of security tend to increase rapidly. The enormous usage of internetworking has raised the need of protecting system(s) as well as network(s) from the unauthorized access (intrusion). To tackle the intrusive activities, several countermeasures have been found in literature viz. firewall, antivirus and currently widely preferred Intrusion detection System (IDS). IDS, is a detection mechanism for detecting the intrusive activities hidden among the normal activities. The revolutionary establishment of IDS has attracted analysts to work dedicatedly enabling the system to deal with technological advancements. Hence in this regard, various beneficial schemes and models have been proposed in order to achieve enhanced IDS. This paper proposes a novel hybrid model for intrusion detection. The proposed framework in this paper may be expected as another step towards advancement of IDS. The framework utilizes the crucial data mining classification algorithms beneficial for intrusion detection. The Hybrid framework would henceforth, will lead to effective, adaptive and intelligent intrusion detection.

Data mining has been gaining popularity in knowledge discovery field, particularity with the increasing availability of digital documents in various languages from all around the world. Network intrusion detection is the process of monitoring the events occurring in a computing system or network and analyzing them for signs of intrusions. In this paper, intrusion detection & several areas of intrusion detection in which data mining technology applied are discussed. Data mining techniques are used to discover consistent and useful patterns of system features that describe program and user behavior. Data mining can improve variant detection rate, control false alarm rate and reduce false dismissals. By using these set of relevant system features to compute classifiers that recognize anomalies & known intrusion.

Data mining has been gaining popularity in knowledge discovery field, particularity with the increasing availability of digital documents in various languages from all around the world. Network intrusion detection is the process of monitoring the events occurring in a computing system or network and analysing them for signs of intrusions. In this paper, intrusion detection & several areas of intrusion detection in which data mining technology applied are discussed. Data mining techniques are used to discover consistent and useful patterns of system features that describe program and user behaviour. Data mining can improve variant detection rate, control false alarm rate and reduce false dismissals. By using these set of relevant system features to compute classifiers that recognize anomalies & known intrusion.

With the growth of cyber-attacks as observed over the last couple of decades safety, protection and privacy of information has become a major concern for organizations across the globe. Intrusion detection systems (IDSs) have thus gained important place and play a key role in detecting large number of attacks. There are a number of intrusion detection systems in market and most of them have the problem of having a relatively large number of false positives. Hence a need has arisen in the networking society of addressing the issue of false alarm and false positives and has resulted in an interest for researchers in IDS area. The main motivation of this research is in enhancing the performance of different data mining techniques to handle the alerts, reduce them and classify real attacks and reduce false positives .In this paper, the authors propose a novel hybrid model of RT and PART as to lower the rate of false positives. The algorithms are first trained for detecting attacks on KDD99 Dataset and then are tested on live traffic to classify whether the flow is normal or there are attacks. Random Tree (RT) and PART algorithms statistically validate the experimental results. The Hybrid framework on comparative analysis outperforms its counterparts and may lead to improved intelligent intrusion detection.

International Journal of Computer Applications, 2016

In today's world people are extensively using internet and thus are also vulnerable to its flaws. Cyber security is the main area where these flaws are exploited. Intrusion is one way to exploit the internet for search of valuable information that may cause devastating damage, which can be personal or on a large scale. Thus Intrusion detection systems are placed for timely detection of such intrusion and alert the user about the same. Intrusion Detection using hybrid classification technique consist of a hybrid model i.e. misuse detection model (AdTree based) and Anomaly model (svm based).NSL-KDD intrusion detection dataset plays a vital role in calibrating intrusion detection system and is extensively used by the researchers working in the field of intrusion detection. This paper presents Association rule mining technique for IDS.

International Journal of Computer Applications, 2014

With the growth of hacking and exploiting tools and invention of new ways of intrusion, Intrusion detection and prevention is becoming the major challenge in the world of network security. It is becoming more demanding due to increasing network traffic and data on Internet. There are various approaches being utilized in intrusion detections, but unfortunately any of the systems so far is not completely flawless. So, the quest of betterment continues. Intrusion detection systems using data mining approaches make it possible to search patterns and rules in large amount of audit data. Classification-based data mining models for intrusion detection are often ineffective in dealing with dynamic changes in intrusion patterns and characteristics. Unsupervised learning methods are efficient in detecting unknown attacks in large datasets. In this paper we investigate clustering approaches for network intrusion detection. We carried out our experiments on K-means clustering algorithm and measured the performance based on detection rates and false positive rate with different cluster values. The KDD dataset which is freely available online is used for our experimentation and results are compared. Our intrusion detection system using clustering approach is able to detect different types of intrusions, while maintaining a low false positive rate.

Information security is one of the cornerstones of Information Society. Integrity and privacy of financial transactions, personal information and critical infrastructure data, all depend on the availability of strong and trustworthy security mechanisms. In recent years, many researchers are using data mining techniques for building IDS. Here, we propose a new approach by utilizing data mining techniques such as neuro-fuzzy and radial basis support vector machine (SVM) for helping IDS to attain higher detection rate. The proposed technique has four major steps: primarily, k-means clustering is used to generate different training subsets. Then, based on the obtained training subsets, different neuro-fuzzy models are trained. Subsequently, a vector for SVM classification is formed and in the end, classification using radial SVM is performed to detect intrusion has happened or not. To illustrate the applicability and capability of the new approach, the results of experiments on KDD CUP 1999 dataset is demonstrated. Experimental results shows that our proposed new approach do better than Conditional random fields (CRF) with respect to specificity and detection accuracy.

2016

With significant advancement of web, security of system activity is turning into a major issue PC system framework. Cyber attacks on system are expanding day-by-day. Intrusion is considered as most pitched attack on system traffic. Intrusion recognition framework has been utilized for finding out intrusion and to protect the security objectives of data from attacks. Data mining systems are utilized to screen and investigate extensive measure of system information and group this system information into anomalous and typical information. Since information originates from different sources, system traffic is substantial. Data mining methods such as classification and clustering are connected to design of intrusion detection framework. A viable Intrusion detection framework requires high recognition rate, low false caution rate and additionally high precision. This paper exhibits the audit on IDS and diverse Data mining methods connected on IDS for the powerful detection of pattern for ...

2014

Today, Intrusion Detection Systems have been employed by majority of the organizations to safeguard the security of information systems. Firewalls that are used for intrusion detection possess certain drawbacks which are overcome by various data mining approaches. Data mining techniques play a vital role in intrusion detection by analyzing the large volumes of network data and classifying it as normal or anomalous. Several data mining techniques like Classification, Clustering and Association rules are widely used to enhance intrusion detection. Among them clustering is preferred over classification since it does not require manual labelling of the training data and the system need not be aware of the new attacks. This paper discusses three different clustering algorithms namely K-Means Clustering, Y-Means Clustering and Fuzzy C-Means Clustering. K-Means clustering results in degeneracy and is not suitable for large databases. Y-Means is an improvement over K-means that eliminates e...