Network Intrusion Detection Data Processing Research Based on Concept Clustering AOI Algorithm

Abstract:

With the development of network technology and the popularity of network applications, network server attack number and severity are significantly increased; attack alarm data is mostly produced by duplicate and invalid. Classic attribute-oriented induction (Attribute-Oriented Induction, AOI) algorithm is used for conceptual clustering can greatly improve the processing of these data workload, but does not seem to be very effective in actual work. This paper makes a detailed discussion on how to improve the algorithm.With the development of network technology, the number of attacks on web services and severity increased significantly, so intrusion detection system (IDS) has been applied to the field of network security. However, IDS protects network, at the same time also brings a new problem: IDS will produce a lot of alarm data, and most of these alarm data are duplicate and invalid. According to the characteristics of the data, effective dealing with distributed IDS has brought a lot of alarm data, and how to eliminate duplicate or invalid data becomes a realistic problem which is urgent to be solved. Although using classic attribute-oriented Induction (AOI) for conceptual clustering algorithm can greatly improve the processing of these data workload, the algorithm have not achieved the result of simple data processing on computer processing, thus how to improve the algorithm is a urgent subject of work efficiency.

• Periodical: Applied Mechanics and Materials (Volumes 644-650)
• Pages: 1162-1165
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.644-650.1162
• Online since: September 2014
• Authors: Rui Ying Xu*
• Keywords: AOI, Conceptual Clustering, Network Intrusion Detection

References

[1] PittL, ReinkeE. Criteria for Polynomial—time(conceptual)Clustering[J]．Machine Learning, 1998, 2(4): 371—396.

[2] HanJ, Cai Y, Cercone N. Knowledge discovery in database: attribute—oriented approach[C]. In Proc. of the 18 VLDB Conference. Vancouver, (1992).

[3] Klaus Juliach, Marc Dacier. Mining intrusion detection alarms for actionable knowledge[J]. Proceedings of the eighth ACM.

DOI: 10.1145/775047.775101

[4] SIGKDD international conference on Knowledge discovery and data mining, July23—26, (2002).

[5] Zhang Huimin. Intrusion event correlation analysis based on data mining in distributed IDS. Journal of Xi 'an Jiaotong University, 2003. 3. 1, 10-11.