Intrusion detection using data mining
- 1. By Shishir Shandilya(0610101041) Rajesh Ghildiyal(06180101036) Balbeer Singh Rawat(06180101006) Under the Guidance of MR. Ajit Singh
- 2. Problem Definition An Intrusion Detection System is an important part of the Security Management system for computers and networks that tries to detect break-ins or break-in attempts. Approaches to Solution Signature-Based Anomaly Based.
- 3. Types of Intrusion Detection Classification I Real Time After-the-fact (offline) Classification II Host Based Network Based
- 4. Approaches to IDS Technique Signature Based Anomaly Based Concept Model well-known Model is based on normal behavior of the attacks system use these known Try to flag the deviation from normal patterns to identify pattern as intrusion intrusion. Pros and Specific to attacks Usual changes due to traffic etc may lead Cons can not extend to higher number of false alarms . unknown intrusion patterns( False Negatives)
- 5. Approaches for IDS Network-Based Host-Based •Are installed on N/W •Are installed locally on Switches host machines •Detect some of the attacks, that host-based systems don’t. E.g.. DOS, Fragmented Packets.
- 6. Recommended Approach None provides a complete solution A hybrid approach using HIDS on local machines as well as powerful NIDS on switches
- 7. Attack Simulation Types of attacks NIDS ○ SYN-Flood Attack HIDS ○ ssh Daemon attack.
- 8. NIDS – Data Preprocessing Input data tcpdump trace. Huge One data record per packet Features extracted(Using Perl Scripts) Content-Based Group records and construct new features corresponding to single connection Time-Based Adding time-window based information to the connection records (Param: Time-window) Connection-Based Adding connection-window based information (Param: Time-window)
- 9. Preprocessing on tcpdump From the tcpdump data we extracted following fields src_ip ,dst_ip src_port, dst_port num_packets_src_dest / num_packets_dest_src num_ack_src_dst/ num_ack_dst_src num_bytes_src_dst/ num_bytes_dst_src num_retransmit_src_dst/ num_retransmit_dst_src num_pushed_src_dst/ num_pushed_dst_src num_syn_src_dst/ num_syn_dst_src num_fin_src_dst/ num_fin_dst_src connection status
- 10. Preprocessing on tcpdump cont… Time-Window Based Features Count_src/count_dst Count_serv_src/ count_serv_dest Connection-Window Based Count_src1 /count_dst1 Count_serv_src1/ count_serv_dest1
- 11. NIDS- Datamining Technique Outlier Detection Clustering Based Approach(K-Means) ○ Outlier Threshold ○ Preprocessed dataset K-NN Based Approach ○ distance threshold ○ Preprocessed dataset Results Clustering did not give good results. ○ Limited Data K-NN ○ Giving Alarms
- 12. HIDS – Data Preprocesing Input data “strace” system call logs for a particular process(sshd) One data record per system call Sliding-Window Size for grouping. Features extracted(Using Perl Scripts) Sliding the window over the trace to generate possible sequences of system calls.
- 13. HIDS – Data Preprocessing cont… a d f g a e d a e b s d e a ad f g d f g a f g a e g a e d a e d a e d a e d a e b a e b s e b s d b s d e s d e a
- 14. Datamining Technique Used Learning to predict system calls Predict ith system call for each test record<p1, p2,p3> Done using Classification (Decision Trees) Anomaly Detection Use of misclassification score to detect anomalies
- 15. Literature Survey Types of attacks (Host and Network Based) Techniques Association rules and Frequent Episode Rules over host based and network based Outlier Detection using clustering classification
- 16. Future Work NIDS To incorporate threshold distance as a configurable parameter for K-Means Algorithm used HIDS Try out meta-learning algorithms for classification A small user Interface for configuring parameters.
- 17. References “Mining in a data-flow Environment: Experience in Network Intrusion Detection”, W. Lee, S. Stolfo, K. Mok. “Mining audit data to build intrusion detection models”, W. Lee, S. Stolfo, K. Mok. “Data Mining approaches for Intrusion Detection”, W. Lee S. Stolfo. “A comparative study of anomaly detection schemes in network intrusion detection”, A. Lazarevic, A ozgur, L. Ertoz, J. Srivastava, Vipin Kumar. “Anomaly Intrusion detection by internet datamining pf traffic episodes” Min Qin & Kai Gwang. “A database of computer attacks for the evaluation of Intrusion Detection System”, Thesis by Kristopher Kendall.