Name
Abstract | ||
|---|---|---|
A generation of rule for detecting an attack from enormous network data is very difficult, and this is commonly required an expert's experiences. An auto-generation of detection rules cut down on maintenance or management expenses of intrusion detection systems, but the problem is accuracy for the time being. In this paper, we propose an automatic generation method of detection rules with a tree induction algorithm that is adequate to search special rules based on entropy theory. While we progress the experiment on rule generation and detection with extracted information from network session data, we found a problem in selecting measures. To solve the problem, we present a method of converting the continuous measures into categorical measures and a method of choosing a good measure according to the accuracy of the generated detection rules. As the result, the detection rules for each attack are automatically generated without any help of the experts. Also, the correctness of detection improves according to the selection of network measures. |
Year | DOI | Venue |
|---|---|---|
2005 | 10.1007/11540007_20 | FSKD (2) |
Keywords | Field | DocType |
automatic generation method,rule generation,continuous measure,detection rule,network session data,enormous network data,network measure,categorical measure,tree induction algorithm,special rule,intrusion detection system,rule based | Data mining,Computer science,Categorical variable,Correctness,Artificial intelligence,Knowledge base,Entropy (information theory),Intrusion detection system,Expert system,Algorithm,Constant false alarm rate,Rule of inference,Machine learning | Conference |
Volume | ISSN | ISBN |
3614 | 0302-9743 | 3-540-28331-5 |
Citations | PageRank | References |
1 | 0.35 | 6 |
Authors | ||
4 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Min-Soo Kim | 1 | 437 | 51.12 |
| Jae-Hyun Seo | 2 | 45 | 6.55 |
| Il-Ahn Cheong | 3 | 1 | 0.35 |
| Bong-Nam Noh | 4 | 68 | 14.75 |