Auto-generation of Detection Rules with Tree Induction Algorithm
A generation of rule for detecting an attack from enormous network data is very difficult, and this is commonly required an expert’s experiences. An auto-generation of detection rules cut down on maintenance or management expenses of intrusion detection systems, but the problem is accuracy for the time being. In this paper, we propose an automatic generation method of detection rules with a tree induction algorithm that is adequate to search special rules based on entropy theory. While we progress the experiment on rule generation and detection with extracted information from network session data, we found a problem in selecting measures. To solve the problem, we present a method of converting the continuous measures into categorical measures and a method of choosing a good measure according to the accuracy of the generated detection rules. As the result, the detection rules for each attack are automatically generated without any help of the experts. Also, the correctness of detection improves according to the selection of network measures.
KeywordsContinuous Measure False Alarm Rate Intrusion Detection Intrusion Detection System Network Measure
Unable to display preview. Download preview PDF.
- 1.Mahoney, M., Chan, P.: Learning Nonstationary Models of Normal Network Traffic for Detecting Novel Attacks. In: Proc. of 8th ACM SIGKDD Int. C. on KDD, vol. 1, pp. 376–385 (2002)Google Scholar
- 2.Ross Quinlan, J.: C4.5: Programs for Machine Learning. Morgan Kaufmann Pub, San Francisco (1993)Google Scholar
- 3.Mahoney, M., Chan, P.: Learning Models of Network Traffic for Detecting Novel Attacks. Florida Institute of Tech. TR. CS-2002-08 (2002)Google Scholar
- 4.Mukkamala, S., Sung, A.: Identifying Significant Features for Network Forensic Analysis using Artificial Intelligent Techniques. Int. J. Digit. Evid 1 (2003)Google Scholar
- 5.Chris, S., Lyn, P., Sara, M.: An Application of Machine Learning to Network Intrusion Detection. 54th Ann. Computer Security Applications C. 12 (1999)Google Scholar
- 6.Kamber, H.: Data Mining Concepts and Techniques. Morgan Kaufmann Pub, San Francisco (2001)Google Scholar
- 9.Das, K.: Attack Development for Intrusion Detection Evaluation, vol. 6. MIT Mast. Th., Cambridge (2000)Google Scholar
- 10.Ostermann, S.: TCPtrace (1994), http://www.tcptrace.org