Data Mining for Cybersecurity

Abstract

Summary. This chapter provides an overview of the Minnesota Intrusion Detection System (MINDS), which uses a suite of data mining based algorithms to address difierent aspects of cyber security. The various components of MINDS such as the scan detector, anomaly detector and the proflling module detect difierent types of attacks and intrusions on a computer network. The scan detector aims at detecting scans which are the percusors to any network attack. The anomaly detection algorithm is very efiective in detecting behavioral anomalies in the network tra‐c which typically translate to malicious activities such as denial-of-service (DoS) tra‐c, worms, policy violations and inside abuse. The proflling module helps a network analyst to understand the characteristics of the network tra‐c and detect any deviations from the normal proflle. Our analysis shows that the intrusions detected by MINDS are complementary to those of traditional signature based systems, such as SNORT, which implies that they both can be combined to increase overall attack coverage. MINDS has shown great operational success in detecting network intrusions in two live deployments at the University of Minnesota and as a part of the Interrogator architecture at the US Army Research Labs Center for Intrusion Monitoring and Protection (ARL-CIMP). The conventional approach to securing computer systems against cyber threats is to design mechanisms such as flrewalls, authentication tools, and virtual private networks that create a protective shield. However, these mechanisms almost always have vulnerabilities. They cannot ward ofi attacks that are continually being adapted to exploit system weaknesses, which are often caused by careless design and implementation ∞aws. This has created the need for intrusion detection [6], security technology that complements conventional security approaches by monitoring systems and identifying computer attacks. Traditional intrusion detection methods are based on human experts’ extensive knowledge of attack signatures which are character strings in a messages payload