1. copyright 2002, Center for Secure Information Systems 1 Panel: Role of Data Mining in Cyber Threat Analysis Professor Sushil Jajodia Center for Secure Information Systems George Mason University jajodia@gmu.edu ise.gmu.edu/~csis

2. copyright 2002, Center for Secure Information Systems 2 Limitations of current intrusion detection systems  Use misuse detection techniques  Designed to detect well-known attacks (attack signatures) and their slight variations  Limitations –Require prior knowledge of attacks –Unable to detect novel attacks –Difficulty of gathering the required information –Operation is labor intensive –High false alarm rate –Cannot deal with large volume of data

3. copyright 2002, Center for Secure Information Systems 3 Anomaly detection  Designed to capture any deviation from the established profiles of users and systems normal behavior patterns  Advantage  Has potential to detect new attacks  Disadvantage  Requires prior knowledge of systems and user’s normal behavior

4. copyright 2002, Center for Secure Information Systems 4 Current research efforts Network-based anomaly detection systems –Analyze TCP/IP traffic data –Aim to detect DOS and Probe attacks as well as attacks with repeating behavior

5. copyright 2002, Center for Secure Information Systems 5 GoalsGoals  Process efficiently with large volume of audit trails to achieve fast and ideally real time intrusion detection  Reduce false alarm rate  Detect new attacks

6. copyright 2002, Center for Secure Information Systems 6 Basic architecture Composed of 3 modules:  Preprocessing Engine  Mining Engine  Classification Engine Works in 2 phases :  Training Phase  Detecting Phase

7. copyright 2002, Center for Secure Information Systems 7 Training phase Static mining Training (attack-free) data profile Dynamic mining Training data Feature selection Labeler: false alarms attacks Decision tree

8. copyright 2002, Center for Secure Information Systems 8 Detecting phase Feature selection Test data Dynamic mining profile Decision tree Attacks, False alarms, Unknown

9. copyright 2002, Center for Secure Information Systems 9 ChallengesChallenges  Better test data  Training data  How to obtain good training data  What if training data is not available  More interesting attacks