Reducing Network Intrusion Detection using Association rule and Classification algorithms

IDS (Intrusion Detection system) is an active and driving defense technology. This project mainly focuses on intrusion detection based on data mining. Data mining is to identify valid, novel, potentially useful, and ultimately understandable patterns in massive data. This project presents an approach to detect intrusion based on data mining frame work. Intrusion Detection System (IDS) is a popular tool to secure network. Applying data mining has increased the quality of intrusion detection neither as anomaly detection or misused detection from large scale network traffic transaction. Association rules is a popular technique to produce a quality misused detection. However, the weaknesses of association rules is the fact that it often produced with thousands rules which reduce the performance of IDS. This project aims to show applying post-mining to reduce the number of rules and remaining the most quality rules to produce quality signature. This experiment uses KDD Cup 99 dataset to detect IDS rules using Apriori Algorithm, which later performing post-mining using ChiSquared (χ2) computation techniques. The quality of rules is measured based on ChiSquare value, which calculated according the support, confidence and lift of each association rule. Decision tree rules are also identified in order to detect attacks in the dataset as well as real time nework traffic dataset. The experimental results demonstrate its effectiveness and efficiency.