Fuzzy Frequent Episodes for Real-time Intrusion Detection

Data mining methods including association rule mining and frequent episode mining have been applied to the intrusion detection problem. In other work, we have introduced modifications of these methods that mine fuzzy association rules and fuzzy frequent episodes and have described off-line methods that utilize these fuzzy methods for anomaly detection from audit data. In this paper we describe another extension that uses fuzzy frequent episodes for near real-time intrusion detection. We first define fuzzy frequent episodes and then describe experiments that explore their applicability for realtime intrusion detection. Experimental results indicate that fuzzy frequent episodes can provide effective approximate anomaly detection.