Chapter 3 minds- minnesota intrusion detection system

a suite of data mining techniques to automatically detect attacks against computer net-works and systems. While the long-term objective of MINDS is to address all aspects of intrusion detection, in this paper we focus on two specic contributions. First, we show how the behavior-based anomaly detection approach of MINDS is suitable for de-tecting new and previously unknown types of intrusions, which often indicate emerging threats. Specically, we present an anomaly detection algorithm that assigns a score to each connection based on its probability of being an intrusion. Experimental results on live network trafc at the University of Minnesota show that our anomaly detection techniques are very promising and are successful in automatically detecting several novel intrusions that could not be identied using popular signature-based tools such as SNORT. Many of these have been reported on the CERT/CC list of recent advisories and incident notes. Second, we show how association pattern analysis can be used to summarize and characterize anomalous network connections. Given the very high vol-1 2 CHAPTER THREE ume of connections observed per unit time, such characterization of novel attacks is essential in enabling a security analyst to understand emerging threats. Experimental evaluation shows that the MINDS approach is useful in creating accurate summaries of attacks