1. Mining Behavior Models Wenke Lee College of Computing Georgia Institute of Technology

2. Prevent Cyber Threats and Counter Measures Detect React/ Survive Security principles: layered mechanisms

3. Elements of Intrusion Detection Primary assumptions: –System activities are observable –Normal and intrusive activities have distinct evidence Components of intrusion detection systems: –From an algorithmic perspective: Features - capture intrusion evidences Models - piece evidences together –From a system architecture perspective: Audit data processor, knowledge base, decision engine, alarm generation and responses

4. Applying Data Mining to Intrusion Detection Motivation –Semi-automatically construct or customize ID models for a given environment Rationales –From the data-centric point view, intrusion detection is a data mining/analysis process –Successful applications in related domains, e.g., fraud detection, fault/alarm management

5. The Iterative DM Process of Building ID Models models raw audit data packets/ events (ASCII) connection/ session records features patterns The MADAM ID Workflow

6. Data Mining System Perspective Analyst Alert on known attacks Offline Step 1: Log system behavior in data warehouse Step 2: Mine data offline User activity Local network activity Host activity System activity Model Evaluation Real-time attack recognition Online Alert on new attacks Audit data Predictive Detection Model Internet Step 3: Produce predictive detection model. Step 4: Integrate new model with existing IDS Step 5: Detect new attacks with enhanced IDS Data Mining Knowledge Base of Signatures Data Warehouse HAWKEYE PLATFORM System Detection Inc.

7. The Nuggets Feature extraction and construction –The key to producing effective ID models –Better pay-off than just applying yet another model learning algorithm –How to semi-automate the feature discovery process Incorporating domain knowledge Semi-structure/text mining

8. The Nuggets (continued) Efficiency –Training Huge amount of audit data –Sampling? Always retrain from scratch or incrementally? –Execution of output model in real-time Consider feature cost (time) Trade-off of cost vs. accuracy

9. The Nuggets (continued) Anomaly detection –Can there be a general approach? –Theoretical foundations –Rare events

10. Conclusions DM can play a key role in ID Research should be focused on the real nuggets: –Feature construction –Efficiency –Anomaly detection

11. Thank You!