Why machine learning algorithms fail in misuse detection on KDD intrusion detection data set

Intelligent Data Analysis

Volumn 8, Issue 4, 2004, Pages 403-415

  Sabhnani, Maheshkumar ^a   Serpen, Gursel ^a  

^a The University of Toledo   (United States)

Author keywords

cross validation; decision trees; intrusion detection; KDD data set; machine learning

Indexed keywords

CLASSIFICATION (OF INFORMATION); DECISION TREES; INTRUSION DETECTION; LEARNING SYSTEMS; MACHINE LEARNING; PATTERN RECOGNITION; SET THEORY; STATISTICAL TESTS; TREES (MATHEMATICS);

ANALYSIS TECHNIQUES; C4.5 DECISION TREE ALGORITHM; CLASSIFICATION ALGORITHM; COMPARATIVE ANALYSIS; CROSS VALIDATION; DATA SET; DECISION TREE CLASSIFIERS; TRAINING AND TESTING;

LEARNING ALGORITHMS;

EID: 49649112245     PISSN: 1088467X     EISSN: 15714128     Source Type: Journal    
DOI: 10.3233/ida-2004-8406     Document Type: Article

References (23)

1. R. Agarwal and M.V. Joshi, PNrule: A New Framework for Learning Classifier Models in Data Mining (A Case-Study in Network Intrusion Detection), IBM Research Division Technical Report No. RC-21719, 2000.
2. I. Levin, KDD-99 Classifier Learning Contest LLSoft's Results Overview, ACM SIGKDD Explorations 1(2) (2000), 67-75.
3. C. Elkan, Results of the KDD'99 Classifier Learning, ACMSIGKDD International Conference on Knowledge Discovery and Data Mining, Boston, MA 1(2) (2000), 63-64.
4. L. Ertoz, M. Steinbach and V. Kumar, Finding Clusters of Different Sizes, Shapes, and Densities in Noisy, High Dimensional Data, Technical Report, 2002.
5. W. Fan, M. Miller, S. Stolfo, W. Lee and P. Chan, Using Artificial Anomalies to Detect Unknown and Known Network Intrusions, IEEE International Conference on Data Mining, San Jose, CA, 2001, pp. 123-130.
6. J. Gomez and D. Dasgupta, Evolving Fuzzy Classifiers for Intrusion Detection, In Proceedings of the IEEEWorkshop on Information Assurance, United States Military Academy, West Point, NY, 2001, pp. 68-75.
7. M.V. Joshi, R.C. Agarwal and V. Kumar, Mining Needles in a Haystack: Classifying Rare Classes via Two-Phase Rule Induction, ACM SIGMOD Conference on Management of Data, Santa Barbara, CA, 2001, pp. 91-102.
8. W. Lee and S. Stolfo, A Framework for Constructing Features and Models for Intrusion Detection Systems, ACM Transactions on Information and System Security 3 (2000), 227-261.
9. D.Y. Yeung and C. Chow, Parzen-window Network Intrusion Detectors, In Proceedings of the Sixteenth International Conference on Pattern Recognition, Quebec City, Canada, 2002, pp. 385-388.
10. DARPA 1998 data set, http://www.ll.mit.edu/IST/ideval/data/1998/1998 data index.html, cited August 2003.
11. W. Lee, S.J. Stolfo and K.W. Mok, A Data Mining Framework for Building Intrusion Detection Models, IEEE Symposium on Security and Privacy, Oakland, California, 1999, pp. 120-132.
12. KDD 1999 data set, http://kdd.ics.uci.edu/databases/kddcup99/kddcup99. html, cited August 2003.
13. W. Lee, S.J. Stolfo and K.W. Mok, Mining in a Data-Flow Environment: Experience in Network Intrusion Detection, in Proceedings of the 5th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Diego, CA, 1999, pp. 114-124.
14. B. Pfahringer, Winner of KDD'99 classifier learning contest, Australian Research Institute for Artificial Intelligence, http://www.ai.univie.ac.at/ bernhard/kddcup99.html, cited August 2003.
15. M.R. Sabhnani and G. Serpen, Application of Machine Learning Algorithms to KDD Intrusion Detection Dataset within Misuse Detection Context, Proceedings of International Conference on Machine Learning: Models, Technologies, and Applications, Las Vegas, Nevada, 2003, pp. 209-215.
16. J.R. Quinlan, C4.5: Program for Machine Learning, Morgan Kaufmann Publishing, 1992.
17. C4.5 Simulator, Developer Site: http://www.rulequest.com; Download code from: http://www.cs.uregina.ca/dbd/cs831/notes/ml/dtrees/c4.5/tutorial.html, cited August 2003.
18. P.J.Werbos, Beyond Regression: New Tools for Prediction and Analysis in the Behavioural Sciences, Ph.D. dissertation, Committee on Applied Mathematics, Harvard University, Cambridge, MA, 1974.
19. R.O. Duda and P.E. Hart, Pattern Classification and Scene Analysis, New York: Wiley, 1973.
20. L. Breiman, J.H. Friedman, R.A. Olshen and C.J. Stone, Classification and Regression Trees, Belmont, California, Wadsworth, Inc., 1984.
21. LNKnet software, http://www.ll.mit.edu/IST/lnknet/index.html, cited August 2003.
22. T. Mitchell, Machine Learning, McGraw-Hill series in computer science, 1997.
23. E. Parzen, On Estimation of A Probability Density and Mode, Annals of Mathematical Statistics 35 (1962), 1065-1076.