Mining in a data-flow environment: experience in network intrusion detection

摘要: We discuss the KDD process in “data-flow” environments, where unstructured and time dependent data can be processed into various levels of structured semanticallyrich forms for analysis tasks. Using network intrusion detection as a concrete application example, we describe how to construct models that are both acczLrate describing underlying concepts, efficient when used analyze real-time. present procedures analyzing frequent patterns from lower level constructing appropriate features formulate higher data. The generated have different computational costs (in space). show order minimize required using classification real-time environment, exploit “necessary conditions” associated with lowcost determine whether some high-cost need computed corresponding rules checked. applied our tools problem building models. report experiments provided part 1998 DARPA Intrusion Detection Evaluation program. also experience mined NFR, system.