1. Applying Knowledge Discovery in Database Techniques in Modeling Packet Header Anomaly Intrusion Detection Systems
- Author
-
Michael E. Woodward and Solahuddin B. Shamsuddin
- Subjects
Database ,Anomaly-based intrusion detection system ,Network packet ,Computer science ,ComputerSystemsOrganization_COMPUTER-COMMUNICATIONNETWORKS ,Intrusion detection system ,computer.software_genre ,Computer Science::Performance ,Human-Computer Interaction ,Host-based intrusion detection system ,Internet Control Message Protocol ,Artificial Intelligence ,Transport layer ,Header ,Computer Science::Networking and Internet Architecture ,Data mining ,Anomaly (physics) ,computer ,Software ,Computer Science::Cryptography and Security - Abstract
This paper describes packet header anomaly intrusion detection system modeling. The essence of the discussion in this paper is on applying knowledge discovery in database technique to produce expert production rules which is one of the main components of our model which we call as Protocol based Packet Header Anomaly Detector (PbPHAD) Intrusion Detection System. PbPHAD is designed to detect the anomalous behavior of network traffic packets based on three specific network and transport layer protocols namely UDP, TCP and ICMP to identify the degree of maliciousness from a set of detected anomalous packets identified from the sum of statistically modeled individually rated anomalous field values.
- Published
- 2008