Data Mining Approaches for Intrusion Detection: Issues and Research Directions

The goal of an intrusion detection system (IDS) is to identify authorized and unauthorized intruders by differentiating anomalous network activity from normal network traffic. Data mining methods have been used to build automatic intrusion detection systems. The central idea is to utilize auditing programs to extract a set of features that describe each network connection or host session, and apply data mining programs to learn rules that capture intrusive and non-intrusive behavior. The goal of this paper is to provide a survey of some works that employ data mining techniques for intrusion detection and to address some technical issues. A new idea is proposed in the paper that will view intrusion detection from a data warehouse perspective and integrate data mining and on-line analytical processing (OLAP) for intrusion detection purposes.