data mining and machine learning technology has been extensively applied in network intrusion detection and prevention systems by discovering user behavior patterns from the network traffic data. Some commercial tools...
详细信息
ISBN:
(纸本)9781424427505
data mining and machine learning technology has been extensively applied in network intrusion detection and prevention systems by discovering user behavior patterns from the network traffic data. Some commercial tools for collecting network traffic data exist, such as SNORT. The traffic data collected from the network using these tools, however, usually doesn't fit the format requirement of the input data for data mining systems. Thus transforming the network traffic data into the required format is mandate for a data mining system to induce network intrusion detection rules. In this paper, collecting the network packet information using SNORT is introduced, storing the collected data into the MySq1 database is presented, and selecting the significant data in the database and transforming them to the format of input data for a data mining system See5 is discussed. The datacollection, selection, and transformation approaches illustrated in this paper have been used in the Information Fusion in Sensor Based Intrusion Detection System that is being under development in our Computer Security Research Laboratory. The system framework is briefly introduced and the preliminary results for datacollection from multiple resources are illustrated.
暂无评论