Adaptive intrusion detection with data mining
Md. Ali Hossain, S.M. Bridges, Rayford B. Vaughn · 2004
A major constraint of an anomaly-based intrusion detection system (IDS) lies in its inability to adapt to distinguish these changes from intrusive behavior. To overcome these obstacles, the normal profile must be updated at regular intervals. The naive approach of exhaustively recomputing the normal profile is often not viable and can incorporate patterns of intrusive behavior as normal. We address technical issues and present an adaptive data mining framework for anomaly detection. We employ a sliding window approach and use only the audit data inside that sliding window to update the profile. Instead of performing an exhaustive update, we use some heuristics to decide when to update. Experimental results using real network traffic data (containing simulated intrusion attacks) demonstrate the effectiveness of the proposed framework.