Author(s)

Nong Ye & Xiangyang Li

Abstract

There is an increasing demand for techniques to detect intrusions into a computer and network system for information security and assurance. This paper describes our research effort on the application of a data mining technique, decision trees, to automatically learn and recognize intrusion signatures for intrusion detection. In our study, decision tree classifiers are used to classify activities in a computer and network system into different states and determine the possibility of an intrusion based on the state classification. Our design of decision tree classifiers is based on an incremental tree induction algorithm. Two decision tree classifiers are developed. One decision tree classifier examines single events of activities in a computer and network system for intrusion detection (single event ve

Keywords