Developing Custom Intrusion Detection Filters Using Data Mining

Dec 10, 1999

Abstract

Detecting intrusions requires analyzing vast amounts of network traffic. Data mining technology exists to analyze vast amounts of data. The connection appears obvious; as evidenced by the recent KDD'99 classifier learning contest. In this talk, I will discuss possible applications of data mining to intrusion detection, and highlight possible pitfalls.

We are approaching this from the perspective that we must build on, not supplant, existing intrusion detection work. I will present an overview of and preliminary results from a new project in this area. We are using generalized frequent episodes to analyze intrusion detection system output. This will enable development of site-specific filters to reduce the flow of information from intrusion detection systems to manageable levels.