Data mining for network intrusion detection: A comparison of alternative methods

Decision Sciences

Volumn 32, Issue 4, 2001, Pages 635-660

  Zhu, Dan ^a   Premkumar, G ^a   Zhang, Xiaoning ^b   Chu, Chao Hsien ^c  

^a IOWA STATE UNIVERSITY   (United States)

^b Tellabs Operations Inc   (United States)

^c PENNSYLVANIA STATE UNIVERSITY   (United States)

Author keywords

Data mining; Inductive learning; Intrusion detection; Network security; Neural networks; Rough sets; Telecommunications

Indexed keywords

EID: 0040431304     PISSN: 00117315     EISSN: None     Source Type: Journal    
DOI: 10.1111/j.1540-5915.2001.tb00975.x     Document Type: Article

References (56)

1. Berry, M. J. A., & Linoff, G. (1997). Data mining techniques for marketing, sales, and customer support. New York: John Wiley & Sons, Inc.
2. Bigus, J. (1996). Data mining with neural networks - Solving business problems from application development to decision support. New York: McGraw-Hill.
3. Bonifacio, J. M. Jr., Cansian, A. M., Carvalho, A. C. P. L. F., & Moreira, E. S. (1997). Neural networks applied in intrusion detection systems. Proceedings of the International Conference on Computational Intelligence and Multimedia Application. Gold Coast, Australia, 276-280.
4. th IEEE International Carnahan Conference on Security Technology, Taipei, Taiwai ROC.
5. Chen, M. S., Han, J., & Yu, S. (1996). Data mining: An overview from database perspective. IEEE Transactions on Knowledge and Data Engineering, 8, 866-883.
6. Chin, S. K. (1999). High confidence design for security. Communication of the ACM, 42(7), 33-37.
7. Chu, C. H., & Widjaja, D. (1994). A neural network system for forecasting method selection. Decision Support Systems, 12, 13-24.
8. Chung, H. M., & Gray, P. (1999). Special section: Data mining. Journal of Management Information Systems, 16(1), 11-16.
9. Chung, H. M., & Tam, K. Y. (1993). A comparative analysis of inductive learning algorithms. Intelligent Systems in Accounting, Finance and Management, 2 (1), 3-18.
10. Debar, H., Becker, M., & Siboni, D.(1992). A neural network component for an intrusion detection system. Proceedings of the 1992 IEEE Symposium on Research in Security and Privacy. Oakland, CA: IEEE Computer Society Press, 240-250.
11. Denning, D. E. (1987). An intrusion-detection model. IEEE Transaction on Soft-ware Engineering, 12(2), 222-232.
12. Desai, V. S., Crook, J. N., & Overstreet, G. A. (1996). A comparison of neural networks and linear scoring models in the credit union environment. European Journal of Operational Research, 95, 24-37.
13. Dimitras, A. I., Slowinski, R., Susmaga, R., & Zopounidis, C. (1999). Business failure prediction using rough sets. European Journal of Operational Research, 114, 263-280.
14. Durst, R., Champion, T., Witten, B., Miller, E., & Spagnuolo, L. (1999). Testing and evaluating computer intrusion detection systems. Communications of the ACM, 42(7), 53-61.
15. Fanning, K., & Cogger, K. O. (1998). Neural network detection of management fraud using published financial data. Intelligent Systems in Accounting, Finance and Management, 7, 21-41.
16. Farmer, D., & Spafford, E. (1990). The COPS security checker system. Proceedings of the Summer USENIX Conference. Berkely, CA: Usenix Assoc., 165-190.
17. Fayyad, U. M., Piatetsky-Shapiro, G., & Smyth, P. (1996). From data mining to knowledge discovery in databases. AI Magazine, 17(3), 37-54.
18. Forrest, S., Hofmeyr, S. A., Somayaji, A., & Longstaff, T. A. (1996). A sense of self for UNIX processes. Proceedings of the 1996 IEEE Symposium on Security and Privacy. Oakland, CA: IEEE Computer Society Press, 120-128.
19. Forrest, S., Jovornik, B., Smith, R. E., & Perelson, A. S. (1993). Using genetic algorithms to explore pattern recognition in the immune system. Evolutionary Computation, 1(3), 191-211.
20. Fox, K. L., Henning, R. R., Reed, J. H., & Simonian, R. P. (1990) A neural network approach towards intrusion detection. Proceedings of the 13th National Computer Security Conference, Washington, D.C. Gaithersburg, MD: NIST, 125-134.
21. th National Computer Security Conference, 372-385.
22. Hashemi, R. R., Le Blanc, L. A., Rucks, C. T., & Rajaratnam, A. (1998). A hybrid intelligent system for predicting bank holding structures. European Journal of Operational Research, 109, 390-402.
23. Hofmeyr, S. A., & Forrest, S. (1999). Immunity by design: An artificial immune system. Proceedings of Genetic and Evolutionary Computation Conference (GECCO '99). Vol. 2, San Mateo, CA: Morgan Kaufmann, 1289-1296.
24. Hofmeyr, S. A., Forrest, S., & Somayaji, A. (1998). Intrusion detection using sequences of system calls. Journal of Computer Security, 6, 151-180.
25. Hosmer, H. H. (1995). Security is fuzzy! Applying fuzzy logic to the multipolicy paradigm. Computer Security Journal, 11(2), 35-45.
26. Kim, J., & Bentley, P. (1999). Negative selection and niching by an artificial immune system for network intrusion detection. A late-breaking paper submitted to Genetic and Evolutionary Computation Conference (GECCO '99). Vol. 2, San Mateo, CA: Morgan Kaufmann, 149-158.
27. Lee, W., & Stolfo, S. J. (2000). Data mining approaches for intrusion detection. Available at http://www.cs.columbia.edu/~sal/hpapers/USENIX/usenix.html, Computer Science Dept., Columbia University, New York, NY
28. Lee, W., Stolfo, S. J., & Chan, P. K. (1999). Learning patterns from Unix process execution traces for intrusion detection. AAAI Workshop: AI Approaches to Fraud Detection and Risk Management. Menlo Park, CA: AAAI Press 50-56.
29. Lee, W., Stolfo, S. J., & Mok, K. W. (2000). Mining audit data to build intrusion detection models. In R. Agrawal, P. E. Stolorz, & G. Piatetsky-Shapiro (Eds.), Proceedings of the Fourth International Conference on Knowledge Discovery and Data Mining (KDD-98), Menlo Park, CA: AAAI Press, 66-72.
30. Lippmann, R., & Cunningham, R. K. (2000). Improving intrusion detection performance using keyword selection and neural networks. Computer Networks, 34, 597-603
31. Lippmann, R., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000). The 1999 DARPA off-line intrusion detection evaluation. Computer Networks, 34, 579-595.
32. Lunt, T. F. (1993). A survey of intrusion detection techniques. Computer & Security, 12.
33. Lunt T. F., Tamaru A., Gilham F., Jagannathan R., Neumann P. G., Javitz H. S., Valdes A., & Garvey, T. D. (1992). A real-time intrusion detection expert system (IDES). Technical Report, Computer Science Laboratory. Menlo Park, CA: SRI International.
34. Mé, L. (1998). GASSATA - A genetic algorithm as an alternative tool for security audit trails analysis. First International Workshop on the Recent Advances in Intrusion Detection (RAID98). Louvain-la-Neuve, Belgium. Available at http://www.zurich.ibm.com/~dac/Prog_RAID98/Table_of_content.html
35. Messier, W. F., & Hansen, J. V. (1988). Inducing rules for expert system development: An example using default and bankruptcy rules. Management Science 34(12), 1403-1415.
36. Pawlak, Z. (1982). Rough sets. International Journal of Computation and Information Sciences, 11, 341-356.
37. Pawlak, Z., Grzymala-Busse, J., Slowinski, R., & Ziarko, W. (1995). Rough sets. Communications of the ACM, 38(11), 89-95.
38. Porras, P. A. (1992). STAT: A state transition analysis tool for intrusion detection. Master's Thesis. University of California, Santa Barbara.
39. Porras, P. A., & Valdes, A. (1998). Live traffic analysis of TCP/IP gateways. Proceedings of the Network and Distributed System Security Symposium. San Diego, CA: Internet Society, March, 11-13, Available at http:// www.sdl.sri.com/papers/gateway98/
40. Quinlan, J. R. (1984). Learning efficient classification procedures and their application to chess end games. In R. S. Michalski, J. G. Carbonell, & T. M. Mitchell (Eds.), Machine learning, An artificial intelligence approach. Palo Alto, CA: Tioga Publishing Company, 463-482.
41. Quinlan, J. R. (1993). C4.5: Programs for machine learning. San Mateo, CA: Morgan Kaufmann.
42. Rumelhart, D. E., Hinton, G. E., & Williams, R. J. (1986). Learning internal representations by error propagation. In D. E. Rumelhart & J. L. McClelland (Eds.), Parallel distributed processing. Cambridge, MA: The MIT Press, 318-362.
43. Sasisekharan, R., Seshadri, V., & Weiss, S. M. (1994). Using machine learning to monitor network performance. IEEE Conference on Artificial Intelligence Applications. Oakland, CA: IEEE Press, 92-98.
44. Sen, T. K., & Gibbs, A. M. (1994). An evaluation of the corporate takeover model using neural networks. Intelligent Systems in Accounting, Finance and Management, 3(4), 279-292.
45. Slowinski, R., & Zopounidis, C. (1995). Application of the rough set approach to evaluation of bankruptcy risk. International Journal of Intelligent Systems in Accounting, Finance, and Management, 4(1), 27-41.
46. Slowinski, R., Zopounidis, C., & Dimitras, A. I. (1997). Prediction of company acquisition in Greece by means of the rough set approach. European Journal of Operations Research, 100, 1-15.
47. Snapp, S. R., & Smaha, S. E. (1992). Signature analysis model definition and formalism, Proceedings of the Fourth Workshop on Computer Security Incident Handling, Denver, CO.
48. Spangler, W., May, J. H., & Vargas, L. G. (1999). Choosing data-mining methods for multiple classification: Representational and performance measure implication for decision support. Journal of Management Information Systems, 16(1), 37-62.
49. Stillerman, M., Marceau, C., & Stillman, M. (1999). Intrusion detection on distributed systems. Communications of the ACM, 42(7), 62-69.
50. Sun, X., Wang, Q., & Zhu, D. (1997). Function approximations and predictions: A comparative study. In C. H. Dagl, M. Akay, O. Ersoy, B. Fernand, & A. Smith (Eds.), Intelligent systems through artificial neural networks smart engineering systems, neural networks, fuzzy logic, data mining and evolutionary programming. Volume 7, New York: ASME Press.
51. Sung, T. K., Chang, N., & Lee, G. (1999). Dynamics of modeling in data mining: Interpretive approach to bankruptcy prediction. Journal of Management Information Systems, 16(1), 63-85.
52. Tam, K., & Kiang, M. (1992). Managerial applications of neural networks: The case of bank failure prediction. Management Science, 38(1), 926-947.
53. Warrender, C., Forrest, S. & Pearlmutter, B. (1999). Detecting intrusion using system calls: Alternative data models. Proceedings of the IEEE Symposium on Security and Privacy. Oakland, CA: IEEE Computer Society Press, 133-145.
54. Weiss, S. M., & Kapouleas, I. (1989). An empirical comparison of pattern recognition, neural nets, and machine learning classification methods. Proceedings of the Eleventh International Joint Conference on Artificial Intelligence, San Francisco: Morgan Kaufmann, 781-787.
55. Wilson, R. L., & Sharda, R. (1994). Bankruptcy prediction using neural networks. Decision Support Systems, 11, 545-557.
56. Zhu, D., & Padman, R. (1997). Connectionist approaches for solver selection in constrained project scheduling. Annals of Operations Research, 72, 265-298.