A novel adaptive intrusion detection system based on data mining
Zhixin Yu, Jing-Ran Chen, Tianqing Zhu · 2005
A data mining based adaptive intrusion detection model (DMAIDM) is presented in this paper. The DMAIDM applies a fast heuristic clustering algorithm for mixed data (FHCAM) to distinguish intrusions from legal behaviors efficiently and an attribute-constrained based fuzzy mining algorithm (ACFMA) to construct intrusion pattern-database automatically. Verification tests are carried out by using the 10% subset of KDD Cup 1999 data set, the average detection rate is 71.67% and the average false detection rate is 0.92%. And the detection rate increases from 65.25% (the second subset) to 85.7% (the ninth subset) adaptively. The experimental results reveal that the DMAIDM is successful in terms of not only accuracy but also efficiency in networks intrusion detection.