Methods of the Data Mining and Machine Learning in Computer Security

Abstract

Due to the expansion of high-speed Internet access, the need for secure and reliable networks has become more critical. Since attacks are becoming more sophisticated and networks are becoming larger there is a need for an efficient intrusion detection systems (IDSs) that can distinguish between legitimate and illegitimate traffic and be able to signal attacks in real time, before serious damages are produced. Although there are some existing mechanisms for intrusion detection, there is need to improve the performance. Data mining techniques and machine learning are a new approach for intrusion detection. In this work naive Bayes classifier and decision trees with C4.5 and CART algorithms for detecting abnormal traffic patterns in the KDD Cup 1999 data are used. The IDS system is supposed to distinguish normal traffic from intrusions and to classify the intrusions into five classes: Normal, DoS, probe, R2L and U2R. Research shows that decision trees gives better overall performance than the naive Bayes classifier.