Houping Xiao, Yaliang Li, et al.
SDM 2015
Intrusion detection is an essential component of computer security mechanisms. It requires accurate and efficient analysis of a large amount of system and network audit data. It can thus be an application area of data mining. There are several characteristics of audit data: abundant raw data, rich system and network semantics, and ever "streaming". Accordingly, when developing data mining approaches, we need to focus on: feature extraction and construction, customization of (general) algorithms according to semantic information, and optimization of execution efficiency of the output models. In this paper, we describe a data mining framework for mining audit data for intrusion detection models. We discuss its advantages and limitations, and outline the open research problems.
Houping Xiao, Yaliang Li, et al.
SDM 2015
Jiangtao Ren, Xiaoxiao Shi, et al.
SDM 2008
Wei Fan
KDD 2004
Wenke Lee, S.J. Stolfo, et al.
DISCEX 2001