Name
Abstract | ||
|---|---|---|
Most of the existing commercial NIDS products are signature-based but not adaptive. In this paper, an adaptive NIDS using data mining technology is developed. Data mining approaches are used to accurately capture the actual behavior of network traffic, and portfolio mined is useful for differentiating "normal" and "attack" traffics. On the other hand, most of the current researches are using only one engine for detection of various attacks; the proposed system is constructed by a number of agents, which are totally different in both training and detecting processes. Each of the agents has its own strength on capturing a kind of network behavior and hence the system has strength on detecting different types of attack. In addition, its ability on detecting new types of attack as well as a higher tolerant to fluctuations were shown. The experimental results showed that the frequent patterns mined from the audit data could be used as reliable agents, which outperformed from traditional signature-based NIDS. |
Year | DOI | Venue |
|---|---|---|
2005 | 10.1109/ICITA.2005.57 | ICITA (1) |
Keywords | Field | DocType |
data mining approach,adaptive nids,traditional signature-based nids,audit data,various attack,agent-based network intrusion detection,network behavior,actual behavior,data mining approaches,data mining technology,different type,existing commercial nids product,software agents,data mining,fluctuations,association rules,engines,authorisation,computer security,intrusion detection | Data mining,Network intrusion detection,Computer science,Authorization,Software agent,Multi-agent system,Association rule learning,Cluster analysis,Intrusion detection system,Network behavior | Conference |
ISBN | Citations | PageRank |
0-7695-2316-1 | 7 | 0.60 |
References | Authors | |
12 | 3 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Cheung-Leung Lui | 1 | 7 | 0.60 |
| Tak-chung Fu | 2 | 407 | 21.29 |
| Ting-Yee Cheung | 3 | 7 | 0.60 |