A Comprehensive Approach to Detect Unknown Attacks Via Intrusion Detection Alerts
Intrusion detection system(IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it still suffers from detecting an unknown attack, i.e., 0-day attack, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack. This paper presents a novel approach that is quite different from the traditional detection models based on raw traffic data. The proposed method can extract unknown activities from IDS alerts by applying data mining technique. We evaluated our method over the log data of IDS that is deployed in Kyoto University, and our experimental results show that it can extract unknown(or under development) attacks from IDS alerts by assigning a score to them that reflects how anomalous they are, and visualizing the scored alerts.
KeywordsTraining Data Intrusion Detection Intrusion Detection System Association Rule Mining Representative Point
Unable to display preview. Download preview PDF.
- 5.Zurutuza, U., Uribeetxeberria, R.: Intrusion Detection Alarm Correlation: A Survey. In: Proceedings of the IADAT International Conference on Telecommunications and Computer Networks (December 1-3, 2004)Google Scholar
- 6.Bass, T.: Intrusion detection systems and multisensor data fusion. In: Communications of the ACM, pp. 99–105. ACM Press, New York (2000)Google Scholar
- 7.Giacinto, G., Perdisci, R., Roli, F.: Alarm Clustering for Intrusion Detection Systems in Computer Networks. In: Perner, P., Imiya, A. (eds.) MLDM 2005. LNCS (LNAI), vol. 3587, pp. 184–193. Springer, Heidelberg (2005)Google Scholar
- 9.Symantec Network Security 7100 SeriesGoogle Scholar