C4.5: programs for machine learning
C4.5: programs for machine learning
Learning decision trees in continuous space
Acta Cybernetica
Learning nonstationary models of normal network traffic for detecting novel attacks
Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining
Designing an inductive data stream management system: the stream mill experience
SSPS '08 Proceedings of the 2nd international workshop on Scalable stream processing system
| Hi-index | 0.00 |
A generation of rule for detecting an attack from enormous network data is very difficult, and this is commonly required an expert's experiences. An auto-generation of detection rules cut down on maintenance or management expenses of intrusion detection systems, but the problem is accuracy for the time being. In this paper, we propose an automatic generation method of detection rules with a tree induction algorithm that is adequate to search special rules based on entropy theory. While we progress the experiment on rule generation and detection with extracted information from network session data, we found a problem in selecting measures. To solve the problem, we present a method of converting the continuous measures into categorical measures and a method of choosing a good measure according to the accuracy of the generated detection rules. As the result, the detection rules for each attack are automatically generated without any help of the experts. Also, the correctness of detection improves according to the selection of network measures.