Attack Signature creation using KDD dataset

Question

I need to create Attack signatures for Signature-Based Intrusion Detection using the KDD data set. Is it possible to use Apriori (or any Association rule learning algorithm) for this task? If not please suggest alternative method.

Because it is 1990s type of attacks and *simulated*. It's entirely useless for modern intrusion detection. You won't find any SQL injection, or XSS in there. It's too old, and it was never good. Just Google for the data set. It's useless. — Has QUIT--Anony-Mousse, Aug 20 '16 at 18:28
But most of the researchers use this data set for their researches, do you know any new data set? — Anuradha, Aug 21 '16 at 04:14
Do they? See: http://www.kdnuggets.com/news/2007/n18/4i.html and no, I don't know any newer such data set, because **these attacks no longer exist**. Also, many results on this data set are *false* because the authors do not clean up duplicates, and then overfit. — Has QUIT--Anony-Mousse, Aug 21 '16 at 06:01

score -1 · Accepted Answer · answered Aug 17 '16 at 13:59

-1

Sure, you can use association rules to create attack signatures. I guess, even frequent itemsets would be sufficient: Extract of known attacks common attributes and create therefore frequent itemsets to detect an up coming attack. From those frequent itemsets you can extract association rules. Those would be handy in so far, that one could predict i.e. the next step of an current attack.

answered Aug 17 '16 at 13:59

n01dea

1,532
1
16
33

Priori Algorithms are only can be used with nominal values, How generate attack signatures using numeric values? – Anuradha Aug 22 '16 at 16:32
You can use the Apriori algorithm with every value you like. What kind of implemenatation of the Apriori algorithm do you use? I guess, you haven't written you own one. – n01dea Aug 22 '16 at 18:52

score -1 · Answer 2 · answered Aug 18 '16 at 02:09

Yes, you can use pattern mining algorithm to create attack signatures. Itemset and association rule is a good idea. But you could also considers sequential rules (an association rule that consider the sequential ordering), or sequential patterns. This may be more appropriate perhaps. If you want to try such algorithm, you can check the SPMF library which offer more than 100 algorithms for these types of problems: http://www.philippe-fournier-viger.com/spmf/ (I am the founder, by the way). You could try different algorithms to see what work best for your problem.

Attack Signature creation using KDD dataset

2 Answers2