A Decision Tree Classifier for Intrusion Detection Priority Tagging

• 作者: Adel Ammar
• 来源期刊: 电脑和通信(英文)
• 学科: 工学
• 关键词: INTRUSION Detection Network Security SNORT Machine Learning Classification DECISION TREE
• 年，卷（期）: 2015,（4）
• 页码范围: 52-58
• 页数: 7页
• 分类号: TP39

摘要

Snort rule-checking is one of the most popular forms of Network Intrusion Detection Systems (NIDS). In this article, we show that Snort priorities of true positive traffic (real attacks) can be approximated in real-time, in the context of high speed networks, by a decision tree classifier, using the information of only three easily extracted features (protocol, source port, and destination port), with an accuracy of 99%. Snort issues alert priorities based on its own default set of attack classes (34 classes) that are used by the default set of rules it provides. But the decision tree model is able to predict the priorities without using this default classification. The obtained tagger can provide a useful complement to an anomaly detection intrusion detection system.