A real-time architecture for NIDS based on sequence analysis
Qinghua Liu, Feng Zhaoi, Yanbin Zhao · 2005
Due to customers' demands, network intrusion detection systems (NIDS) are required more real time. Since traditional intelligent NIDS are constructed on the basis of historical network data and system logs, they are expensive and not real time in a network stream environment. This paper presents an improved real time model that based on sequence mining to accelerate the accuracy and efficiency. In this paper, multidimensional item set is used to describes network events, sliding window is used to gather network data stream, and sequence mining algorithms are applied to discover intrusions from normal network stream. Analysis and study on this model indicate that it provide a more accurate and efficient way to building real-time NIDS.