Network Threat Characterization in Multiple Intrusion Perspectives using Data Mining Technique

Abstract

For effective security incidence response on the network, a reputa ble approach must be in placeat both protected and unprotected region of the network. Thisis because compromise in the demilitarized zone could be precursor to threat inside the network. The improv ed complexity of attacks in present times and vulnerability of system are motivationsfor this work. Past and present approachesto intrusion detection and prevention have neglected victim and attackerproperties despite the fact that for intrusion to occur, an overt act by an attacker and a manifestation, observable by the intended victim, which results from that act are required. Therefore, this paper presents athreat characterization model forattacks from the victim and the attacker perspective of intrusionusing data mining technique. The data mining technique combines Frequent Temporal Sequence Assoc iation Mining and Fuzzy Logic. AprioriAssociation Mining algorithm was used to mine temporal rule patterns from alertsequences while Fuzzy Control Systemwas used to rate exploits. The results of the experiment showthat accurate threat characterization inmultiple intrusion perspectives could be actualized using Fuzzy Association Mining . Also, the results proved that sequence of exploits could be used to rate threat and are motivated by victim properties and attacker objectives.