Attacks Classification in Adaptive Intrusion Detection using Decision Tree
Recently, information security has become a key issue
in information technology as the number of computer security
breaches are exposed to an increasing number of security threats. A
variety of intrusion detection systems (IDS) have been employed for
protecting computers and networks from malicious network-based or
host-based attacks by using traditional statistical methods to new data
mining approaches in last decades. However, today's commercially
available intrusion detection systems are signature-based that are not
capable of detecting unknown attacks. In this paper, we present a
new learning algorithm for anomaly based network intrusion
detection system using decision tree algorithm that distinguishes
attacks from normal behaviors and identifies different types of
intrusions. Experimental results on the KDD99 benchmark network
intrusion detection dataset demonstrate that the proposed learning
algorithm achieved 98% detection rate (DR) in comparison with
other existing methods.
[1] James P. Anderson, "Computer security threat monitoring and
surveillance," Technical Report 98-17, James P. Anderson Co., Fort
Washington, Pennsylvania, USA, April 1980.
[2] Dorothy E. Denning, "An intrusion detection model," IEEE Transaction
on Software Engineering, SE-13(2), 1987, pp. 222-232.
[3] Barbara, Daniel, Couto, Julia, Jajodia, Sushil, Popyack, Leonard, Wu,
and Ningning, "ADAM: Detecting intrusion by data mining," IEEE
Workshop on Information Assurance and Security, West Point, New
York, June 5-6, 2001.
[4] N.B. Amor, S. Benferhat, and Z. Elouedi, "Naïve Bayes vs. decision
trees in intrusion detection systems," In Proc. of 2004 ACM Symposium
on Applied Computing, 2004, pp. 420-424.
[5] Mukkamala S., Janoski G., and Sung A.H., "Intrusion detection using
neural networks and support vector machines," In Proc. of the IEEE
International Joint Conference on Neural Networks, 2002, pp.1702-
1707.
[6] J. Luo, and S.M. Bridges, "Mining fuzzy association rules and fuzzy
frequency episodes for intrusion detection," International Journal of
Intelligent Systems, John Wiley & Sons, vol. 15, no. 8, 2000, pp. 687-
703.
[7] YU Yan, and Huang Hao, "An ensemble approach to intrusion detection
based on improved multi-objective genetic algorithm," Journal of
Software, vol. 18, no. 6, June 2007, pp. 1369-1378.
[8] Shon T., Seo J., and Moon J., "SVM approach with a genetic algorithm
for network intrusion detection," In Proc. of 20th International
Symposium on Computer and Information Sciences (ISCIS 2005),
Berlin: Springer-Verlag, 2005, pp. 224-233.
[9] Lazarevic, A., Ertoz, L., Kumar, V., Ozgur,. A., Srivastava, and J., "A
comparative study of anomaly detection schemes in network intrusion
detection," In Proc. of the SIAM Conference on Data Mining, 2003.
[10] Dorothy E. Denning, and P.G. Neumann "Requirement and model for
IDES- A real-time intrusion detection system," Computer Science
Laboratory, SRI International, Menlo Park, CA 94025-3493, Technical
Report # 83F83-01-00, 1985.
[11] D. Anderson, T. Frivold, A. Tamaru, and A. Valdes, "Next generation
intrusion detection expert system (NIDES)," Software Users Manual,
Beta-Update Release, Computer Science Laboratory, SRI International,
Menlo Park, CA, USA, Technical Report SRI-CSL-95-0, May 1994.
[12] D. Anderson, T.F. Lunt, H. Javitz, A. Tamaru, and A. Valdes, "Detecting
unusual program behavior using the statistical component of the next
generation intrusion detection expert system (NIDES)," Computer
Science Laboratory, SRI International, Menlo Park, CA, USA, Technical
Report SRI-CSL-95-06, May 1995.
[13] S.E. Smaha, and Haystack, "An intrusion detection system," in Proc. of
the IEEE Fourth Aerospace Computer Security Applications
Conference, Orlando, FL, 1988, pp. 37-44.
[14] N. Ye, S.M. Emran, Q. Chen, and S. Vilbert, "Multivariate statistical
analysis of audit trails for host-based intrusion detection," IEEE
Transactions on Computers 51, 2002, pp. 810-820.
[15] Martin Roesch, "SNORT: The open source network intrusion system,"
Official web page of Snort at http://www.snort.org/
[16] L. C. Wuu, C. H. Hung, and S. F. Chen, "Building intrusion pattern
miner for sonrt network intrusion detection system," Journal of Systems
and Software, vol. 80, Issue 10, 2007, pp. 1699-1715.
[17] S. Forrest, S.A. Hofmeyr, A. Somayaji, T.A. Longstaff, "A sense of self
for Unix processes," in Proc. of the IEEE Symposium on Research in
Security and Privacy, Oakland, CA, USA, 1996, pp. 120-128.
[18] A. Valdes, K. Skinner, "Adaptive model-based monitoring for cyber
attack detection," in Recent Advances in Intrusion Detection Toulouse,
France, 2000, pp. 80-92.
[19] C. Kruegel, D. Mutz, W. Robertson, F. Valeur, "Bayesian event
classification for intrusion detection," in Proc. of the 19th Annual
Computer Security Applications Conference, Las Vegas, NV, 2003.
[20] M.L. Shyu, S.C. Chen, K. Sarinnapakorn, L. Chang, "A novel anomaly
detection scheme based on principal component classifier," in Proc. of
the IEEE Foundations and New Directions of Data Mining Workshop,
Melbourne, FL, USA, 2003, pp. 172-179.
[21] D.Y. Yeung, Y. Ding, "Host-based intrusion detection using dynamic
and static behavioral models," Pattern Recognition 36, 2003, pp. 229-
243.
[22] W. Lee, S.J. Stolfo, "Data mining approaches for intrusion detection," In
Proc. of the 7th USENIX Security Symposium (SECURITY-98),
Berkeley, CA, USA, 1998, pp. 79-94.
[23] J.E. Dickerson, J.A. Dickerson, "Fuzzy network profiling for intrusion
detection," In Proc. of the 19th International Conference of the North
American Fuzzy Information Processing Society (NAFIPS), Atlanta,
GA, 2000, pp. 301-306.
[24] M. Ramadas, S.O.B. Tjaden, "Detecting anomalous network traffic with
self-organizing maps," In Proc. of the 6th International Symposium on
Recent Advances in Intrusion Detection, Pittsburgh, PA, USA, 2003, pp.
36-54.
[25] L. Ertoz, E. Eilertson, A. Lazarevic, P.N. Tan, V. Kumar, J. Srivastava,
P. Dokas, "The MINDS: Minnesota intrusion detection system," In:
Next Generation Data Mining, MIT Press, Boston, 2004.
[26] J. R. Quinlan, "Induction of Decision Tree," Machine Learning Vol. 1,
pp. 81-106, 1986.
[27] J. R. Quinlan, "C4.5: Programs for Machine Learning," Morgan
Kaufmann Publishers, San Mateo, CA, 1993.
[28] L. Breiman, J. H. Friedman, R. A. Olshen and C.J. Stone, "Classification
and Regression Trees," Statistics probability series, Wadsworth,
Belmont, 1984.
[29] John Shafer, Rakesh Agarwal, and Manish Mehta, "SPRINT: A Scalable
Parallel Classifier for Data Maining," in Proceedings of the VLDB
Conference, Bombay, India, September 1996.
[30] The KDD Archive. KDD99 cup dataset, 1999.
http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
[1] James P. Anderson, "Computer security threat monitoring and
surveillance," Technical Report 98-17, James P. Anderson Co., Fort
Washington, Pennsylvania, USA, April 1980.
[2] Dorothy E. Denning, "An intrusion detection model," IEEE Transaction
on Software Engineering, SE-13(2), 1987, pp. 222-232.
[3] Barbara, Daniel, Couto, Julia, Jajodia, Sushil, Popyack, Leonard, Wu,
and Ningning, "ADAM: Detecting intrusion by data mining," IEEE
Workshop on Information Assurance and Security, West Point, New
York, June 5-6, 2001.
[4] N.B. Amor, S. Benferhat, and Z. Elouedi, "Naïve Bayes vs. decision
trees in intrusion detection systems," In Proc. of 2004 ACM Symposium
on Applied Computing, 2004, pp. 420-424.
[5] Mukkamala S., Janoski G., and Sung A.H., "Intrusion detection using
neural networks and support vector machines," In Proc. of the IEEE
International Joint Conference on Neural Networks, 2002, pp.1702-
1707.
[6] J. Luo, and S.M. Bridges, "Mining fuzzy association rules and fuzzy
frequency episodes for intrusion detection," International Journal of
Intelligent Systems, John Wiley & Sons, vol. 15, no. 8, 2000, pp. 687-
703.
[7] YU Yan, and Huang Hao, "An ensemble approach to intrusion detection
based on improved multi-objective genetic algorithm," Journal of
Software, vol. 18, no. 6, June 2007, pp. 1369-1378.
[8] Shon T., Seo J., and Moon J., "SVM approach with a genetic algorithm
for network intrusion detection," In Proc. of 20th International
Symposium on Computer and Information Sciences (ISCIS 2005),
Berlin: Springer-Verlag, 2005, pp. 224-233.
[9] Lazarevic, A., Ertoz, L., Kumar, V., Ozgur,. A., Srivastava, and J., "A
comparative study of anomaly detection schemes in network intrusion
detection," In Proc. of the SIAM Conference on Data Mining, 2003.
[10] Dorothy E. Denning, and P.G. Neumann "Requirement and model for
IDES- A real-time intrusion detection system," Computer Science
Laboratory, SRI International, Menlo Park, CA 94025-3493, Technical
Report # 83F83-01-00, 1985.
[11] D. Anderson, T. Frivold, A. Tamaru, and A. Valdes, "Next generation
intrusion detection expert system (NIDES)," Software Users Manual,
Beta-Update Release, Computer Science Laboratory, SRI International,
Menlo Park, CA, USA, Technical Report SRI-CSL-95-0, May 1994.
[12] D. Anderson, T.F. Lunt, H. Javitz, A. Tamaru, and A. Valdes, "Detecting
unusual program behavior using the statistical component of the next
generation intrusion detection expert system (NIDES)," Computer
Science Laboratory, SRI International, Menlo Park, CA, USA, Technical
Report SRI-CSL-95-06, May 1995.
[13] S.E. Smaha, and Haystack, "An intrusion detection system," in Proc. of
the IEEE Fourth Aerospace Computer Security Applications
Conference, Orlando, FL, 1988, pp. 37-44.
[14] N. Ye, S.M. Emran, Q. Chen, and S. Vilbert, "Multivariate statistical
analysis of audit trails for host-based intrusion detection," IEEE
Transactions on Computers 51, 2002, pp. 810-820.
[15] Martin Roesch, "SNORT: The open source network intrusion system,"
Official web page of Snort at http://www.snort.org/
[16] L. C. Wuu, C. H. Hung, and S. F. Chen, "Building intrusion pattern
miner for sonrt network intrusion detection system," Journal of Systems
and Software, vol. 80, Issue 10, 2007, pp. 1699-1715.
[17] S. Forrest, S.A. Hofmeyr, A. Somayaji, T.A. Longstaff, "A sense of self
for Unix processes," in Proc. of the IEEE Symposium on Research in
Security and Privacy, Oakland, CA, USA, 1996, pp. 120-128.
[18] A. Valdes, K. Skinner, "Adaptive model-based monitoring for cyber
attack detection," in Recent Advances in Intrusion Detection Toulouse,
France, 2000, pp. 80-92.
[19] C. Kruegel, D. Mutz, W. Robertson, F. Valeur, "Bayesian event
classification for intrusion detection," in Proc. of the 19th Annual
Computer Security Applications Conference, Las Vegas, NV, 2003.
[20] M.L. Shyu, S.C. Chen, K. Sarinnapakorn, L. Chang, "A novel anomaly
detection scheme based on principal component classifier," in Proc. of
the IEEE Foundations and New Directions of Data Mining Workshop,
Melbourne, FL, USA, 2003, pp. 172-179.
[21] D.Y. Yeung, Y. Ding, "Host-based intrusion detection using dynamic
and static behavioral models," Pattern Recognition 36, 2003, pp. 229-
243.
[22] W. Lee, S.J. Stolfo, "Data mining approaches for intrusion detection," In
Proc. of the 7th USENIX Security Symposium (SECURITY-98),
Berkeley, CA, USA, 1998, pp. 79-94.
[23] J.E. Dickerson, J.A. Dickerson, "Fuzzy network profiling for intrusion
detection," In Proc. of the 19th International Conference of the North
American Fuzzy Information Processing Society (NAFIPS), Atlanta,
GA, 2000, pp. 301-306.
[24] M. Ramadas, S.O.B. Tjaden, "Detecting anomalous network traffic with
self-organizing maps," In Proc. of the 6th International Symposium on
Recent Advances in Intrusion Detection, Pittsburgh, PA, USA, 2003, pp.
36-54.
[25] L. Ertoz, E. Eilertson, A. Lazarevic, P.N. Tan, V. Kumar, J. Srivastava,
P. Dokas, "The MINDS: Minnesota intrusion detection system," In:
Next Generation Data Mining, MIT Press, Boston, 2004.
[26] J. R. Quinlan, "Induction of Decision Tree," Machine Learning Vol. 1,
pp. 81-106, 1986.
[27] J. R. Quinlan, "C4.5: Programs for Machine Learning," Morgan
Kaufmann Publishers, San Mateo, CA, 1993.
[28] L. Breiman, J. H. Friedman, R. A. Olshen and C.J. Stone, "Classification
and Regression Trees," Statistics probability series, Wadsworth,
Belmont, 1984.
[29] John Shafer, Rakesh Agarwal, and Manish Mehta, "SPRINT: A Scalable
Parallel Classifier for Data Maining," in Proceedings of the VLDB
Conference, Bombay, India, September 1996.
[30] The KDD Archive. KDD99 cup dataset, 1999.
http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
@article{"International Journal of Information, Control and Computer Sciences:54740", author = "Dewan Md. Farid and Nouria Harbi and Emna Bahri and Mohammad Zahidur Rahman and Chowdhury Mofizur Rahman", title = "Attacks Classification in Adaptive Intrusion Detection using Decision Tree", abstract = "Recently, information security has become a key issue
in information technology as the number of computer security
breaches are exposed to an increasing number of security threats. A
variety of intrusion detection systems (IDS) have been employed for
protecting computers and networks from malicious network-based or
host-based attacks by using traditional statistical methods to new data
mining approaches in last decades. However, today's commercially
available intrusion detection systems are signature-based that are not
capable of detecting unknown attacks. In this paper, we present a
new learning algorithm for anomaly based network intrusion
detection system using decision tree algorithm that distinguishes
attacks from normal behaviors and identifies different types of
intrusions. Experimental results on the KDD99 benchmark network
intrusion detection dataset demonstrate that the proposed learning
algorithm achieved 98% detection rate (DR) in comparison with
other existing methods.", keywords = "Detection rate, decision tree, intrusion detectionsystem, network security.", volume = "4", number = "3", pages = "429-5", }
