The research of a adaptive framework for data mining based intrusion detection system
Feng Yu · 2005
Intrusion detection system is an emerging and promising security measure,which is to be against unauthorized internal intrusion and as effective protection against hackers in addition to firewall.Data mining methods have been used to build automatic intrusion detection systems based on anomaly detection.The goal is to characterize the normal system activities with a profile by applying mining algorithms to audit data so that abnormal intrusive activities can be detected by comparing the current activities with the profile.A major difficulty of any anomaly_based intrusion detection system is that patterns of normal behavior changed over time and the system must be retrained.IDS must be able to adapt to these changes,and be able to distinguish these changes in normal behavior from intrusive behavior.The paper describes a framework for an adaptive anomaly detection system that utilizes dynamic association rule mining.