Applying Data Mining to Intrusion Detection: The Quest for Automation, Efficiency, and Credibility Wenke Lee   View Paper (PDF)   Return to December 2002 - Volume 4, Issue 2 Abstract Intrusion detection is an essential component of the layered computer security mechanisms. It requires accurate and efficient models for analyzing a large amount of system and network audit data. This paper is an overview of our research in applying data mining techniques to build intrusion detection models. We describe a framework for mining patterns from system and network audit data, and constructing features according to analysis of intrusion patterns. We discuss approaches for improving the run-time efficiency as well as the credibility of detection models. We report the ideas, algorithms, and prototype systems we have developed, and discuss open research problems. DiSC'03 © 2003 Association for Computing Machinery