Packet information collection and transformation for network intrusion detection and prevention

Abstract

Data mining and machine learning technology has been extensively applied in network intrusion detection and prevention systems by discovering user behavior patterns from the network traffic data. Some commercial tools for collecting network traffic data exist, such as SNORT. The traffic data collected from the network using these tools, however, usually doesnpsilat fit the format requirement of the input data for data mining systems. Thus transforming the network traffic data into the required format is mandate for a data mining system to induce network intrusion detection rules. In this paper, collecting the network packet information using SNORT is introduced, storing the collected data into the MySql database is presented, and selecting the significant data in the database and transforming them to the format of input data for a data mining system See5 is discussed. The data collection, selection, and transformation approaches illustrated in this paper have been used in the Information Fusion in Sensor Based Intrusion Detection System that is being under development in our Computer Security Research Laboratory. The system framework is briefly introduced and the preliminary results for data collection from multiple resources are illustrated.