Research of Network Intrusion Detection(网路入侵检测系统研究)

Chapter130Research of Network Intrusion Detection System Based on Data Mining ApproachesXiao-chun Guo,Dong-mei Ma,Ying-juan Sun and Hong-ying MaAbstract This paper provides a network intrusion detection system based on data mining approaches.The framework of the intrusion detection system and the function of components are introduced.An anomaly intrusion detection system is implemented based on association rule.This system does not depend on experi-ences,it hasflexibility.Keywords Network securityÁAnomaly detectionÁData miningÁAssociation rule 130.1IntroductionAs network-based computer systems play increasingly vital roles in modern society,they have become the targets of our enemies and criminals.Therefore, we need tofind the best ways possible to protect our systems.Xiao-chun Guo(1972–)—Female,Shenyang,Master,Associate professor,main research direction for information security and confidentiality.X.GuoÁD.MaÁH.MaSchool of Information Engineering,Shenyang Broadcasting TV University,Shenyang110003,Liaoning,Chinae-mail:guoxc72@D.Mae-mail:mdm1226@H.Mae-mail:mahy@Y.Sun(&)College of Computer Science and Technology,Changchun Normal University,Changchun,Chinae-mail:syj_pyf@Y.Yang and M.Ma(eds.),Green Communications and Networks,1101 Lecture Notes in Electrical Engineering113,DOI:10.1007/978-94-007-2169-2_130,ÓSpringer Science+Business Media B.V.20121102X.Guo et al.Intrusion prevention techniques,such as user authentication,avoiding programming errors,information protection andfirewall technology have been used to protect computer systems as afirst line of defense.Intrusion prevention alone is not sufficient because as systems become ever more complex,there are always exploitable weaknesses in the systems due to design and programming errors,or various‘‘socially engineered’’penetration techniques.Intrusion detec-tion is therefore needed as another wall to protect computer systems.Currently,many intrusion detection systems are constructed by expert systems or based on statistical methods,which need more experience.Data mining approaches have the advantage that they extract knowledge and rules which people are interested in from a large number of data.Data mining approaches do not rely on the experience.Intrusion detection system based on data mining approaches[1] can help tofind knowledge and rules from the system logs,audit data,and network traffic work security using this technology is a new attempt at home and abroad.130.2Intrusion DetectionIntrusion detection can identify people who are not authorized to use computer systems(e.g.hacking),and authorized users who have abused their authority(such as internal attack).Intrusion detection techniques can be categorized into misuse detection,which uses patterns of well-known attacks or weak spots of the system to identify intrusions;and anomaly detection,which tries to determine whether deviation from the established normal usage patterns can beflagged as intrusions.According to the source of test data[2],intrusion detection system can be divided into host-based intrusion detection system and network-based intrusion detection system.Host-based intrusion detection system can detect possible intrusions by analyzing audit data and system work-based intrusion detection can detect possible intrusions system by analyzing network packets. 130.3Systematic FrameworkWe want to build a network-based anomaly detection model[1,3,4].The premise of establishing model is that the behavior of hosts and servers can reflect some laws during the long running in the network.For example,what is the server which hosts frequently visit,which ports of the server are frequently visited.In the learning phase of establishing model,we should collect data of normal network conditions,so that the law(anomaly detection model)is the normal state of the behavioral pattern of the host and server.In the detecting phase,if there is some connection that does not meet these rules,we have to think that these connections are abnormal.130Research of Network Intrusion Detection System1103The framework of anomaly intrusion detection system shown in Fig.130.1 consists of event generator,event analyzer,response unit and cluster rule set (anomaly detection model).Event generator can capture network packets.Event Analyzer analyzes the network packets which is obtained from the event generator according to the association rules of cluster rule set,and produces results. Response unit can respond to the results of the analysis.Cluster rule set(anomaly detection model)describes the characteristics of the user’s normal behavior. 130.3.1Event GeneratorIn order to establish a TCP connection,two sides of connecting need to be a three-way handshake,therefore a connection contains multiple IP packets.Multiple packets belonging to the same connection should be merged into a connection record.A connection record contains the following attributes:(time,duration,service,src_host,dst_host,src_bytes,dst_bytes,flag)Time:the start time of connection.Duration:the time of connection from the beginning to the end.Service:connection application protocol,such as WWW,FTP,DNS,Telnet,etc. src_host:source host.dst_host:destination host.src_bytes:the bytes which source host sends.dst_bytes:the bytes which destination host sends.flag:the connection status,normal end state and the states whose connection requests are rejected etc.130.3.2Cluster Rule Set(Anomaly Detection Model)Cluster rule set describes the characteristics of the user’s normal behavior. Therefore,in the learning phase of establishing anomaly detection model,data of user’s normal behavior requires collecting.The following describes the process of modeling.130.3.2.1Mining Association RulesThe goal of mining association rules is to derive multi-feature(attribute)corre-lations from a database table.Association rules define as follows: I¼i1;i2;ÁÁÁi mf g is called itemset,let D be a transaction database,any subset of I is called T(T I),and has a unique identifier ID.Define support(X)as the percentage of transactions(records)in D that contain X.An association rule is the expression X!Y;s;c:Here X&T;Y&T;and X\Y¼U:s¼support(X[YÞisthe support of the rule,and c¼supportðX[YÞsupportðXÞis the confidence.The purpose of mining association rules is to identify credible and represen-tative rules,so a minimum support threshold and a minimum confidence threshold should be given.Mining association rules is to derive association rules which the support and confidence exceed in the specified thresholds.This mining process can be divided into two steps:First,identify all the frequent itemsets that are all itemsets whose support is not less than the minimum support threshold.Second, construct the rules whose confidence is not less than the minimum confidence threshold from the frequent itemsets in thefirst step.Here,we introduce the Apriori algorithm of mining association rules[5]. Introduce a number of notation:k-itemset:itemset of size k;L k:frequent itemset of size k;C k:Candidate itemset of size k.(1)Apriori algorithm:find all frequent itemsetsInput:database D;the minimum support threshold min_sup.Output:the frequent itemsets L in D.L1=find_freguent_1-itemsets(D);for(k=2;L k-1=U;k++){C k=apriori_gen(L k-1,min_sup);for each transaction t[D{//scan D for countsC t=subset(C k,t);//get the subsets of t that are candidatesfor each candidate c[C tc.count++;}L k={c[C k|c.count C min_sup}}return L=^k L k;procedure apriori_gen(L k-1:frequent(k-1)-itemsets;min_sup:minimum support threshold)for each itemset l1[L k-1for each itemset l2[L k-1if(l1[1]=l2[1])^(l1[2]=l2[2])^…^(l1[k-2]=l2[k-2])^(l1[k-1]\l2[k-1])then{c=l1?l2;//join step:generate candidatesif has_infrequent_subset(c,L k-1)then1104X.Guo et al.delete c;//prune step:remove unfruitful candidateelse add c to C k;}return C k;procedure has_infrequent_subset(c:candidate k-itemset;L k-1:frequent(k-1)-itemset)for each(k-1)-subset s of cif s2L k-1thenreturn TRUE;return FALSE;(2)generating association rules1)For each frequent itemset l,generate all non-empty subset of l.2)s is called each non-empty subset of l,if support countðlÞsupport count(s)!min conf;gen-erate association rule:‘‘s!ðlÀsÞ;min sup,min conf’’.The min_conf is called minimum confidence threshold.In analysis network traffic,a connection is called a transaction T,transaction database D is composed of many connection records.Each transaction T is composed of duration,service,src_host,dst_host,src_bytes,dst_bytes,flag.Time is the Unique identifier for the transaction.The following lists an association rule:src host¼202:96:7:5^dst host¼202:108:35:210!service¼WWW,10,90The association rule indicates that there are10%of network traffic connections which is consistent with the source host IP202.96.7.5,destination host IP is 202.108.35.210and the access service is WWW service.WWW service may be 90%of the access service when the source host IP is202.96.7.5and destination host IP is202.108.35.210.130.3.2.2Clustering Rule SetClustering rule set is the process of learning and training for anomaly detection model(association rules).The basic idea is:Initialize cluster rule set,and then collect a certain amount of network data, mine these network packets and get some association rules.These rules are to be integrated into the cluster rule set.Cluster rule set will be updated.Update process is as follows:(1)For each new association rule,it will be matched with the association rules ofthe cluster rule set.The meaning of the rule matching is that two rules are exactly the same on both sides.(2)If a new association rule matches the association rule of the cluster rule set,the counter of the association rule in cluster rule set will add1,and the support and confidence of the association rule in the cluster rule set will be 130Research of Network Intrusion Detection System1105updated by the weighted average method.Otherwise,if the new association rule does not match the rule of the cluster rule set,this new association rule will be added to the cluster rule set,and the counter of the rule will be set to 1.The cluster rule set is trained many times in this way,until cluster rule set is stable (Little or no new association rules are added).130.3.2.3Generating ModelThe rules of cluster rule set should be compressed.We delete those rules whose counter value is less than the minimum counter value specified by the user.The cluster rule set which will be cut is the anomaly detection model.130.3.3Event AnalyzerThe captured IP packets that we need to test will pretreat and convert into connection record.Connection record set that we need to test execute association rule mining,then generated association rule set to be generated compare with cluster rule set (anomaly detection model),and calculate the similarity [3].If similarity is less than a user-defined a threshold,we consider connection record set that we need to test exist anomaly.Meaning of two rules that match is that rule’s left and right sides are equal and the deviation of two rules’s support and confidence should be in the range of user defined.similarity ¼p n Ãp m ;in which n is cluster rule set’s number of rules,m is the number of rules that is mined from testing records.p is the number of rules with two rules that match.130.3.4Response UnitResponse unit will process the result of the event analyzer.When the test results are abnormal,it will alarm the security administrator,and the alarm information will store to a file for later analysis.When the test results are normal,detection rule set that is generated will integrate into the cluster rule set,and the cluster rule is set to be updated.The process of updating is described in Sect.130.3.2.2.This makes the intrusion detection system to have a self-learning ability.1106X.Guo et al.130Research of Network Intrusion Detection System1107 130.4ConclusionThis paper describes the use of association rules algorithm to construct the process of network intrusion detection model,and how to use anomaly detection models have been established.Because data mining approaches[6]can extract rules quickly from a large number of network data,it greatly improves the performance of intrusion detection system.Acknowledgments This paper is supported by(1)Project of Research on Science and Tech-nology of Jilin Education Ministry of China under Grant No.2007-172and2010-383.(2)Science-technology Development Project of Jilin Province of China under Grant No.20115056.(3)The Natural Science Foundation of Changchun Normal University.References1.Lee W,Stolfo SJ(2000)Data mining approaches for intrusion detection.http:\\2.Debar H,Dacier M,Wespi A(1999)Towards a taxonomy of intrusion-detection systems[J].Comput Netw31:805–8223.Lee W,Stolfo SJ,Mok KW(1999)A data mining framework for building intrusion detectionmodels[C].In:Proceedings of the1999IEEE symposium on security and privacy,pp120–132 4.Lee W,Stolfo SJ,Mok KW(2001)Mining audit data to build intrusion detection models.http:\\5.Han J,Kamber M(2001)Data mining concepts and techniques[M](trans:Ming F,Xiao-FengM).Machinery Industry Press,Beijing6.Liu H,Lin Y,Han J(2009)Methods for mining frequent items in data streams:an overview.Knowl Inf Syst(Online:11Nov2009)。