Mining System Audit Data: Opportunities and Challenges

Intrusion detection is an essential component of computer security mechanisms. It requires accurate and efficient analysis of a large amount of system and network audit data. It can thus be an application area of data mining. There are several characteristics of audit data: abundant raw data, rich system and network semantics, and ever "streaming". Accordingly, when developing data mining approaches, we need to focus on: feature extraction and construction, customization of (general) algorithms according to semantic information, and optimization of execution efficiency of the output models. In this paper, we describe a data mining framework for mining audit data for intrusion detection models. We discuss its advantages and limitations, and outline the open research problems.

• Type: Conference
• Year: 2001
• Where: SIGMOD
• Authors: Wenke Lee, Wei Fan
• Keywords: Data Mining Framework, Database, Mining Audit Data, Network Audit Data, SIGMOD 2001