Integrating Data Mining Techniques with Intrusion Detection Methods

Intrusion detection systems like NIDES depend on the ability to characterize a user's past behavior based on his/her usage patterns. The characterization is typically made in terms of statistics drawn on system parameters such as CPU, I/0 and network loads, and file access patterns. For example, NIDES main­ tains statistics on approximately 25 such parameters for each user. The cost of data collection, statistics computation, and intrusion detection are directly pro­ portional to the number of parameters maintained per user. If we would like to achieve real-time responses to intrusion detection, then we need to minimize the number of parameters without adversely affecting the detection capabilities. In this chapter, we propose to use some of the feature reduction and selection tech­ niques commonly used in data mining applications to reduce the computational and storage requirements of the intrusion detection methods. Since typically sev­ eral of the user behavioral parameters are correlated, applying these techniques may reduce the number of parameters needed to represent the user behavior.