침입탐지시스템의 정확도 향상을 위한 개선된 데이터마이닝 방법론
Reinforcement Data Mining Method for Anomaly&Misuse Detection
2
조회
0
다운로드
6
인용
0
참고문헌
키워드
초록
Recently, large amount of information in IDS(Intrusion Detection System) can be un manageable and also be mixed with false prediction error. In this paper, we propose a data mining methodology for IDS, which contains uncertainty based on training process and post-processing analysis additionally. Our system is trained to classify the existing attack for misuse detection, to detect the new attack pattern for anomaly detection, and to define border patter between attack and normal pattern. In experimental results show that our approach improve the performance against existing attacks and new attacks,from 0.62 to 0.84 about 35%.
Abstract
Recently, large amount of information in IDS(Intrusion Detection System) can be un manageable and also be mixed with false prediction error. In this paper, we propose a data mining methodology for IDS, which contains uncertainty based on training process and post-processing analysis additionally. Our system is trained to classify the existing attack for misuse detection, to detect the new attack pattern for anomaly detection, and to define border patter between attack and normal pattern. In experimental results show that our approach improve the performance against existing attacks and new attacks,from 0.62 to 0.84 about 35%.
참고문헌 (18)
- D. Moore, "Inferring Internet Denial-of-Service Activity", presented at USENIX Security symposium (2001)
- 김정현, "마이닝을 이용한 이상트래픽 탐지: 사례 분석을 통한 접근", 정보과학회논문지 : 정보통신, 33(3), pp.201~217 (2006), 한국정보과학회
- 최윤정, "학습방법개선과 후처리 분석을 이용한 자동문서분류의 성능향상 방법", 정보처리학회논문지B, 12(7), pp.811~822 (2005), 한국정보처리학회
- 엄남경, "SVM과 의사결정틀를 이용한 혼합형 침입탐지 모델", 한국 정보처리학회논문지, 14-C(1) (2007)
- 김병구, "침입탐지 기술의 현황과 전망", 정보과학회지, 18(1), pp.29~39 (2000)
- 유신근, "침입탐지 시스템의 평가 방법론", 한국정보처리학회논문지, 7(11), pp.3445~3460 (2000)
- Axelsson S, "The Base-rate Fallacy and the Difficulty of Intrusion Detection", ACM Transactions on Information and System Security, 3(3), pp.186~205 (2000)
- M. V. Joshi, "Mining Needles in a Haystack: Classifying Rare Classed vis Two-Phase Rule Induction", ACM SIGMOD, ~ (2001)
- 김미희, "분산 서비스거부 공격 탐지를 위한 데이타 마이닝 기법", 정보과학회논문지 : 정보통신, 32(3), pp.279~290 (2005), 한국정보과학회
- A. K. Ghosh, "A Study in using Neural Networks for Anomaly and Misuse Detection", Proc. of the 8th USENIX Security Symposium (1999)
- L. Feinstein, "Statistical Approaches to DDoS Attack Detection and Response", Proc. of the DARPA Information Survivability Conference and Exposition (2003)
- Wenke Lee, "Data Mining Approaches for Intrusion Detection", proceedings of the 7th USENIX Security Symposium (1998)
- Wenke Lee, "Mining Audit Data to Build Intrusion Detection Models", proceedings of the 4th International Conference on Knowledge Discovery and DataMining (1998)
- 박명언, "가우시안 혼합모델을 이용한 네트워크 침입탐지시스템", 제32회 추계학술발표회 논문집, 32(2), 한국 정보과학회
- D. Koller, "Active Learning for Parameter Estimation in Bayesian Network", Neural Information Processing System, ~ (2001)
- T. Joachims, "Making Large-Scale SVM Learning Practical in : Advanced Kernel Method-support Vector Learning" (1999), MIT Press
- 최윤정, "ETOM+RPost기반의 문서분류시스템의 설계 및 구현", 한국산학기술학회논문지, 11(2), pp.517~524 (2010), 한국산학기술학회
- 최윤정, "경계범주 자동탐색에 의한 확장된 학습체계 구성방법", 정보처리학회논문지B, 16(6), pp.479~488 (2009), 한국정보처리학회