Mining Audit Data to Build Intrusion Detection Models

Proceedings of the 4th International Conference on Knowledge Discovery and Data Mining, KDD 1998

Volumn , Issue , 1998, Pages

  Lee, Wenke ^a   Stolfo, Salvatore J ^a   Mok, Kui W ^a  

^a Columbia University ^*  (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BEHAVIORAL RESEARCH; CLASSIFICATION (OF INFORMATION); DATA MINING; FEATURE SELECTION; INTRUSION DETECTION;

AUDIT DATA; DATA FEATURE; DATA MINING FRAMEWORKS; FREQUENT EPISODES; INTRUSION DETECTION MODELS; PROGRAM BEHAVIOR; SYSTEM AUDIT; SYSTEM FEATURES; USEFUL PATTERNS; USER BEHAVIORS;

ITERATIVE METHODS;

EID: 85141038051     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (18)

1. Agrawal, R., and Srikant, R. 1994. Fast algorithms for mining association rules. In Proceedings of the 20th VLDB Conference.
2. Agrawal, R.; Imielinski, T.; and Swami, A. 1993. Mining association rules between sets of items in large databases. In Proceedings of the ACM SIGMOD Conference on Management of Data, 207-216.
3. Bellovin, S. M. 1989. Security problems in the tcp/ip protocol suite. Computer Communication Review 19(2):32-48.
4. Chan, P. K., and Stollo, S. J. 1993. Toward parallel and distributed learning by meta-learning. In AAAI Workshop in Knowledge Discovery in Databases, 227240.
5. Cohen, W. W. 1995. Fast effective rule induction. In Machine Learning: the 12th International Conference. Lake Taho, CA: Morgan Kaulmann.
6. Fawcett, T., and Provost, F. 1996. Combining data mining and machine learning for effective user profiling. In Proceedings of the 2nd International Conference on Knowledge Discovery and Data Mining, 8-13. Portland, OR: AAAI Press.
7. Han, J., and Fu, Y. 1995. Discovery of multiple-level association rules from large databases. In Proceedings ofthe 21th VLDB Conference.
8. Ilgun, K.; Kemmerer, R. A.; and Porras, P. A. 1995. State transition analysis: A rule-based intrusion detection approach. IEEE Transactions on Software Engineering 21(3):181-199.
9. Jacobson, V.; Leres, C.; and McCanne, S. 1989. tcpdump. available via anonymous ftp to ftp.ee.lbl.gov.
10. Klemettinen, M.; Mannila, H.; Ronkainen, P.; Toivonen, H.; and Verkamo, A. I. 1994. Finding interesting rules from large sets of discovered association rules. In Proceedings of the Third International Conference on Information and Knowledge Management (CIKM'94), 401-407.
11. Lee, W., and Stollo, S. J. 1998. Data mining approaches for intrusion detection. In Proceedings ofthe 7th USENIX Security Symposium.
12. Lent, B.; Swami, A.; and Widom, J. 1997. Clustering association rules. In Proceedings of the Thirteenth International Conference on Data Engineering.
13. Lunt, T.; Tamaru, A.; Gilham, F.; Jagannathan, R.; Neumann, P.; Javitz, H.; Valdes, A.; and Garvey, T. 1992. A real-time intrusion detection expert system (IDES) - final technical report. Technical report, Computer Science Laboratory, SRI International, Menlo Park, Calilornia.
14. Mannila, H., and Toivonen, H. 1996. Discovering generalized episodes using minimal occurences. In Proceedings of the Second International Conference on Knowledge Discovery in Databases and Data Mining.
15. Mannila, H.; Toivonen, H.; and Verkamo, A. I. 1995. Discovering lrequent episodes in sequences. In Proceedings of the First International Conference on Knowledge Discovery in Databases and Data Mining.
16. Srikant, R.; Vu, Q.; and Agrawal, R. 1997. Mining association rules with item constraints. In Proceedings of the 3rd International Conference on Knowledge Discovery and Data Mining, 67-73. Newport Beach, Calilornia: AAAI Press.
17. Stollo, S. J.; Prodromidis, A. L.; Tselepis, S.; Lee, W.; Fan, D. W.; and Chan, P. K. 1997. JAM: Java agents for meta-learning over distributed databases. In Proceedings of the 3rd International Conference on Knowledge Discovery and Data Mining, 74-81. Newport Beach, CA: AAAI Press.
18. Utgoff, P. E.; Berkman, N. C.; and Clouse, J. A. 1997. Decision tree induction based on efficient tree restructuring. Machine Learning 29:5-44.