A framework for constructing features and models for intrusion detection systems

By Wenke Lee, Salvatore J. Stolfo. ACM Transactions on Privacy and Security, 2000

1,123 citations recorded by the source corpus.

Intrusion detection (ID) is an important component of infrastructure protection mechanisms. Intrusion detection systems (IDSs) need to be accurate, adaptive, and extensible. Given these requirements and the complexities of today's network environments, we need a more systematic and automated IDS development process rather that the pure knowledge encoding and engineering approaches. This article describes a novel framework, MADAM ID, for Mining Audit Data for Automated Models for Instrusion Detection. This framework uses data mining algorithms to compute activity patterns from system audit data and extracts predictive features from the patterns. It then applies machine learning algorithms to the audit records taht are processed according to the feature definitions to generate intrusion detection rules. Results from the 1998 DARPA Intrusion Detection Evaluation showed that our ID model was one of the best performing of all the participating systems. We also briefly discuss our experience in converting the detection models produced by off-line data mining programs to real-time modules of existing IDSs.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/35b3233e521f1e9a34837c30be1957858f8f35fe

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Deep Learning Approach for Intelligent Intrusion Detection System (2019, methodology): “• Content features [10-22]: Content features are”
AdaBoost-Based Algorithm for Network Intrusion Detection (2008, methodology): “The framework for constructing these features can be found in [10]. b) Data labeling: Because the AdaBoost algorithm uses supervised learning, a set of data has to be labeled for training.”
IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection (2018, background): “As shown in (Lee and Stolfo 2000), the functional features of each category of attacks in NSL-KDD are presented in Table 1.”
NETWORK INTRUSION DETECTION USING NAÏVE BAYES (2007, background): “MADAM ID (Mining Audit Data for Automated Models for Intrusion Detection) [6] is one of the best known data mining projects in intrusion detection.”
Finding Frequent Patterns in a Large Sparse Graph* (2004, background): “Such graphs arise naturally in a number of different application domains including network intrusion (Lee and Stolfo, 2000; Ko, 2000), semantic web (Berendt et al., 2002), behavioral modeling (Wasserman et al., 1994; Mooney et al., 2004), VLSI reverse engineering (Yoshida and Motoda, 1995), link…”
A survey of coordinated attacks and collaborative intrusion detection (2010, methodology): “…in detail machine learning based data mining methods for intrusion detection, DoS defense and network wide anomaly detection, which have been previously surveyed in (Brugger, 2004; Lee and Stolfo, 2000; Stolfo et al., 2001; Mirkovic and Reiher, 2004; Peng et al., 2006; Lakhina et al., 2004, 2005).”
Random-Forests-Based Network Intrusion Detection Systems (2008, methodology): “Many data mining approaches have been proposed for intrusion detection based on association rules [8], [19], [20], [39].”
The monitoring and early detection of Internet worms (2005, neutral): “of system calls”; the automatic model-construction intrusion detection system based on data-mining of audit data [24], etc.”
Language models for detection of unknown attacks in network traffic (2007, background): “Some early approaches consider only packet header information or statistical properties of sets of packets and connections [7; 14].”
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade (2020, methodology): “For the hybrid-based intrusion, ANN and association rules were applied over the host [421], [422].”
Data preprocessing for anomaly based network intrusion detection: A review (2011, methodology): “These were constructed using data mining techniques and expert domain knowledge when creating a machine learning misuse-based NIDS (Lee and Stolfo, 2000, 1998).”
Detecting Unknown Network Attacks Using Language Models (2006, background): “Some early approaches consider only packet header information or statistical properties of sets of packets and connections (13; 15).”
Anomalous Payload-Based Network Intrusion Detection (2004, background): “Some of the systems reconstruct the network packets and extract features that describe the higher level interactions between end hosts like MADAMID [9], Bro [15], EMERALD [18], STAT [24], ALAD [13], etc.”