Data mining based network intrusion detection system: A database centric approach

Abstract

Network security technology has become crucial in protecting government and industry computing infrastructure. Modern intrusion detection applications face complex requirements — they need to be reliable, extensible, easy to manage, and have low maintenance cost. In recent years, data mining — based intrusion detection systems (IDSs) have demonstrated high accuracy, good generalization to novel types of intrusion, and robust behaviour in a changing environment. Still, significant challenges exist in design and implementation of production quality IDSs. Instrumenting components such as data transformations, model deployment, and cooperative distributed detection remain a labour intensive and complex engineering endeavour. This paper describes a database centric architecture that leverages data mining with .NET to address these challenges. It also offers numerous advantages in terms of alert infrastructure, security, scalability, reliability and also has data analysis tools. The database centric architecture is illustrated with a Data mining Based Intrusion detection system application prototype using .NET.