Improvement of NID According to Selection of Continuous Measures in Tree Induction Algorithm

1. Improvement of NID According to Selection of Continuous Measures in Tree Induction Algorithm 2004. 8. 24. Il-Ahn Cheong Linux Security Research Center Chonnam National University, Korea

2. Contents • Introduction • Related Works • Automatic Generation of Rules using TIA • The Experiments • Conclusions LSRC, Chonnam National University

3. I. Introduction • Signature-based Network Intrusion Detection • Require more time generating rules because of dependence on knowledge of experts • Varies according to selection of network measures in the detection • Our approaches • Automatically generates the detection rules by using tree induction algorithms • Improve the detection by automatic selection of network measures • Our expectations • Detection rules generated independent of knowledge of experts • The performance of detection could be improved LSRC, Chonnam National University

4. II. Related Works • The previous researches • Florida Univ. • LERAD (Learning Rules for Anomaly Detection) • Generating conditional rules • New Mexico Univ. • SVM (Support Vector Machine) • SVM based Ranking method • Applied Research Lab. of Teas Univ. • NEDAA (Exploitation Detection Analyst Assistant) • Genetic algorithm & Decision Tree • Problems • Used limited measures (src/dst. IP/Port, Protocol, etc.) • Not treats of the continuous measures LSRC, Chonnam National University

5. III. Automatic Generation of Rules (1/5) • Tree Induction Algorithms • A classification method using data mining • The constructed trees provide • a superior measure selection • an easy explanation for constructed tree models • The C4.5 algorithm • Automatically generates trees by calculating the IG (Information Gain) according to the Entropy Reduction • Could be classified in case of existing along with variables having continuous and discrete attributes LSRC, Chonnam National University

6. Automatic Generation of Rules (2/5) • Automatic Generation Model of Rules LSRC, Chonnam National University

7. Automatic Generation of Rules (3/5) • Modified C4.5 algorithm LSRC, Chonnam National University

8. Automatic Generation of Rules (4/5) • Treatment of Continuous Distributions f(x) Continuous  Discrete LSRC, Chonnam National University

9. Automatic Generation of Rules (5/5) • Change of Selection for Network Measures • GRR (Good Rule Rate) • To select measures having high priority • Threshold value is 0.5 as binary (G | B) • RG (Good Rule) • affected positively generating of detection rules • Reflected next learning • RB (Bad Rule) • affected negatively generating of detection rules • Excluded next learning LSRC, Chonnam National University

10. IV. The Experiments (1/3) • Experiment Dataset • The 1999 DARPA IDS Evaluation dataset (DARPA99) • 191,077 TCP sessions in Week 4 dataset • After treats of continuous measures • The detection rate increased 20% • The false rate decreased 15% LSRC, Chonnam National University

11. The Experiments (2/3) • The Result of GRR Calculation • Network measure selected from Ostermann’s TCPtrace (80 measures) • G(Good), B(Bad), I(Ignore), RST(Result;G|B|I), SLT(Select; O|X) • Step#: The # of repeat experiment Threshold value = 0.5 LSRC, Chonnam National University

12. Step0 Step1 Step2 Step3 Step0 Step1 Step2 Step3 The Experiments (3/3) • The ROC Evaluation • According to selection of priority measures • Detection rate increased • False rate decreased LSRC, Chonnam National University

13. V. Conclusions • Automatically generates detection rules • using Tree Induction algorithm • without support of experts • Solve the problems according to measure selection • continuous type converting into categorical type • selection of priority measures by calculating GRR • detection rate was increased and false rate was decreased LSRC, Chonnam National University

14. Q & A • Contact Us E-mail: mir@lsrc.jnu.ac.kr • Thank You! LSRC, Chonnam National University