An Application of Machine Learning to Network Intrusion Detection

Differentiating anomalous network activity from normal network traffic is difficult and tedious. A human analyst must search through vast amounts of data to find anomalous sequences of network connections. To support the analyst's job, we built an application which enhances domain knowledge with machine learning techniques to create rules for an intrusion detection expert system. We employ genetic algorithms and decision trees to automatically generate rules for classifying network connections. This paper describes the machine learning methodology and the applicationsemploying this methodology.

• Type: Conference
• Year: 1999
• Where: ACSAC
• Authors: Chris Sinclair, Lyn Pierce, Sara Matzner
• Keywords: ACSAC 1999, Anomalous Network Activity, Machine Learning, Network Connections, Security Privacy