NDLI: Data mining aided signature discovery in network-based intrusion detection system

Please wait, while we are loading the content...

Data mining aided signature discovery in network-based intrusion detection system

Content Provider	ACM Digital Library
Author	Lu, Jun Bo, Chen Lu, Xian Liang Yong, Ren Li Han, Hong
Abstract	In Network-based Intrusion Detection, signatures discovery is an important issue, since the performance of an intrusion detection system heavily depends on accuracy and abundance of signatures. In most cases, we have to find these signatures manually. This is a time-consuming and error-prone work. Some papers introduce data mining into Intrusion Detection System. However, there are some drawbacks in these schemes. We present a data mining based approach to supporting signature discovery in network-based Intrusion Detection System. It has people find signatures of an intrusion easily. The main idea is that: First, Signature Discovery System (SDS) tries to find the most possible signatures that occur very frequently in the communication monitored. Second, SDS will find the relationships between these candidate signatures and construct rules based on these relationships found. Finally, SDS gives two kinds of hints: one is the signatures whose frequency of occurrence is greater than a threshold; the other is a set of rules composed of a set of signatures that are created by SDS in the second step. An experimental system called SigSniffer has been implemented to test the feasibility of the proposed approach.
Starting Page	7
Ending Page	13
Page Count	7
File Format	PDF
ISSN	01635980
DOI	10.1145/583800.583801
Journal	ACM SIGOPS Operating Systems Review (OPSR)
Volume Number	36
Issue Number	4
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1975-04-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Signature discovery Network-based intrusion detection Intrusion detection system Data mining
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Hardware and Architecture Information Systems

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Virtual machine monitor-based lightweight intrusion detection

Network intrusion detection

Alertwheel: radial bipartite graph visualization applied to intrusion detection system alerts

Cooperating security managers: a peer-based intrusion detection system

Web-based monitoring approach for network-based intrusion detection and prevention

A game theoretic model for dynamic configuration of large-scale intrusion detection signatures

Network Security Alerts Management Architecture for Signature-Based Intrusions Detection Systems within a NAT Environment

Intrusion Detection by Ellipsoid Boundary

Adaptive Multiagent System for Network Traffic Monitoring

Data mining aided signature discovery in network-based intrusion detection system

Similar Documents

Virtual machine monitor-based lightweight intrusion detection

Network intrusion detection

Alertwheel: radial bipartite graph visualization applied to intrusion detection system alerts

Cooperating security managers: a peer-based intrusion detection system

Web-based monitoring approach for network-based intrusion detection and prevention

A game theoretic model for dynamic configuration of large-scale intrusion detection signatures

Network Security Alerts Management Architecture for Signature-Based Intrusions Detection Systems within a NAT Environment

Intrusion Detection by Ellipsoid Boundary

Adaptive Multiagent System for Network Traffic Monitoring

Data mining aided signature discovery in network-based intrusion detection system