Overview

In this chapter, we discuss some key problems in network security and present some possible ways to solve these problems, especially some data mining based methods. The problem of network security and intrusion detection is discussed at first. Then, data mining technique is briefly introduced. The problems, possibilities, and methods of data mining solutions for intrusion detection are further analyzed. Several new techniques such as data reduction, incremental mining, uncertain data mining, and initiative data mining are suggested to solve the problems of intrusion detection systems.

23.1 Introduction of Network Security

With the growing rate of interconnections among computer systems, network based computer systems is playing increasingly vital roles in modern society. They have become the target of intrusions by our enemies and criminals. Network security is becoming a major challenge. In order to meet this challenge, intrusion detection systems (IDS) are being designed to protect the availability, confidentiality and integrity of critical networked information systems.

Though they both relate to network security, an IDS differs from a firewall in that a firewall looks out for intrusions in order to stop them from happening. The firewall limits the access between networks in order to prevent intrusion and does not signal an attack from inside the network. An IDS evaluates a suspected intrusion once it has taken place and signals an alarm. An IDS also watches for attacks that originate...