Identifying False Alarm for Network Intrusion Detection System Using Hybrid Data Mining and Decision Tree

Malaysian Journal of Computer Science

Omar Zakaria¹  Hasimi Sallehudin¹  Nor Badrul Anuar¹  Abdullah Gani¹ 

关键词: False Positive;    False Negative;    Intrusion Detection;    Data Mining;    Decision Tree;    Rule-Based;   

DOI  :  

学科分类：社会科学、人文和艺术（综合）

来源: University of Malaya * Faculty of Computer Science and Information Technology

【 摘 要 】

Although intelligent intrusion and detection strategies are used to detect any false alarms within the network critical segments of network infrastructures, reducing false positives is still a major challenge. Up to this moment, these strategies focus on either detection or response features, but often lack of having both features together.Without considering those features together, intrusion detection systems probably will not be able to highly detect on low false alarm rates. To offset the abovementioned constraints, this paper proposes a strategy to focus on detection involving statistical analysis of both attack and normal traffics based on the training data of KDD Cup99. This strategy also includes a hybrid statistical approach which uses Data Mining and Decision TreeClassification. As a result, the statistical analysis can be manipulated to reduce misclassification of false positivesand distinguish between attacks and false positives for the data of KDD Cup 99. Therefore, this strategy can be used to evaluate and enhance the capability of the IDS to detect and at the same time to respond to the threats and benign traffic in critical segments of network, application and database infrastructures.

【 授权许可】

Unknown