Premium
Data Mining for Network Intrusion Detection: A Comparison of Alternative Methods *
Author(s) -
Zhu Dan,
Premkumar G.,
Zhang Xiaoning,
Chu ChaoHsien
Publication year - 2001
Publication title -
decision sciences
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 1.238
H-Index - 108
eISSN - 1540-5915
pISSN - 0011-7315
DOI - 10.1111/j.1540-5915.2001.tb00975.x
Subject(s) - data mining , computer science , intrusion detection system , variety (cybernetics) , representation (politics) , external data representation , artificial neural network , anomaly based intrusion detection system , machine learning , artificial intelligence , politics , political science , law
Intrusion detection systems help network administrators prepare for and deal with network security attacks. These systems collect information from a variety of systems and network sources, and analyze them for signs of intrusion and misuse. A variety of techniques have been employed for analysis ranging from traditional statistical methods to new data mining approaches. In this study the performance of three data mining methods in detecting network intrusion is examined. An experimental design (3times2x2) is created to evaluate the impact of three data mining methods, two data representation formats, and two data proportion schemes on the classification accuracy of intrusion detection systems. The results indicate that data mining methods and data proportion have a significant impact on classification accuracy. Within data mining methods, rough sets provide better accuracy, followed by neural networks and inductive learning. Balanced data proportion performs better than unbalanced data proportion. There are no major differences in performance between binary and integer data representation.