A Framework for Constructing Features and Models for Intrusion Detection Systems

A Framework for Constructing Features and Models for Intrusion Detection Systems (2000)

Cached

Download Links

[www.cs.unc.edu]
[www.cc.gatech.edu]
[www.csc.ncsu.edu]

Other Repositories/Bibliography

DBLP

by Wenke Lee , Salvatore J. Stolfo

Venue:	ACM Transactions on Information and System Security
Citations:	133 - 6 self

Versions

Version History

Metadata Version 1

Datum	Value	Source
TITLE	A Framework for Constructing Features and Models for Intrusion Detection Systems	SVM HeaderParse 0.2
AUTHOR NAME	Wenke Lee	SVM HeaderParse 0.2
AUTHOR AFFIL	Georgia Institute of Technology; and	SVM HeaderParse 0.2
AUTHOR NAME	Salvatore J. Stolfo	SVM HeaderParse 0.2
AUTHOR AFFIL	; Columbia University; Mailcode	SVM HeaderParse 0.2
AUTHOR ADDR	; 0401, New; York, NY 10027-7003; emai...	SVM HeaderParse 0.2
ABSTRACT	Intrusion detection (ID) is an important component of infrastructure protection mechanisms. Intrusion detection systems (IDSs) need to be accurate, adaptive, and extensible. Given these requirements and the complexities of today’s network environments, we need a more systematic and automated IDS development process rather than the pure knowledge encoding and engineering approaches. This article describes a novel framework, MADAM ID, for Mining Audit Data for Automated Models for Intrusion Detection. This framework uses data mining algorithms to compute activity patterns from system audit data and extracts predictive features from the patterns. It then applies machine learning algorithms to the audit records that are processed according to the feature definitions to generate intrusion detection rules. Results from the 1998 DARPA Intrusion Detection Evaluation showed that our ID model was one of the best performing of all the participating systems. We also briefly discuss our experience in converting the detection models produced by off-line data mining programs to real-time modules of existing IDSs. Categories and Subject Descriptors: C.2.0 [Computer-Communication Networks]: General—Security and protection (e.g., firewalls); C.2.3 [Computer-Communication Networks]:	SVM HeaderParse 0.2
YEAR	2000	INFERENCE
VENUE	ACM Transactions on Information and System Security	INFERENCE
VENUE TYPE	JOURNAL	INFERENCE
PAGES	227--261	INFERENCE
VOLUME	3	INFERENCE
CITATIONS	31 found	ParsCit 1.0