A Framework for an Adaptive Intrusion Detection System with Data Mining

The goal of a network-based intrusion detection system (IDS) is to identify patterns of known intrusions (misuse detection) or to differentiate anomalous network activity from normal network traffic (anomaly detection). Data mining methods have been used to build automatic intrusion detection systems based on anomaly detection. The goal is to characterize the normal system activities with a profile by applying mining algorithms to audit data so that abnormal intrusive activities can be detected by comparing the current activities with the profile. A major difficulty of any anomaly-based intrusion detection system is that patterns of normal behavior change over time and the system must be retrained. An IDS must be able to adapt to these changes, and be able to distinguish these changes in normal behavior from intrusive behavior. The goal of this paper is to provide a general framework for an adaptive anomaly detection module that utilizes fuzzy association rule mining.