Data mining in Cyber security

Data Mining in Cyber Security Intrusion Detection
Presented by : Sagar Deepak Thapa
Guided By : Prof Nagaraju Bogiri
KJ College Of Engineering And Management Research Pune
4072

Outline
What is Cyber Security?
What is Cyber Crime?
Applications of Data Mining in Cyber Security.
Intrusion detection.
Why Can Data Mining Help?
Data Mining approaches for Intrusion Detection.
Conclusion.

Cyber Security
Set of technologies and processes designed to protect computers,
networks, programs, and data from attack, unauthorized access, change,
or destruction.
A Majorpart of Cyber Security
is to fix broken Software.
Cyber
Security
Computer
SecuritySystem
Network
SecuritySystem

Cyber Crime
Encompasses anycriminal act dealingwith computers and networks.
Include:
• Malicious programs.
• Illegal imports.
• Computers Vandalism.

Cyber Security VS CyberCrime
Cyber
Security
CyberCrime CyberSecurity
Cyber
Crime
One side of the
coin
Other side of the
coin

Applications of Data Mining in Cyber Security
Malwaredetection.
Intrusion detection.
Fraud detection.

Intrusion Detection
The process of monitoring the events occurring in a computer systemor
network and analyzing them for signs of intrusion.

Intrusion Detection System (IDS)
Combination of software and hardware that attempts to perform
intrusion detection.
Raise the alarm when possible intrusion happens.
Steps:
 Monitoring and analyzing traffic.
 Identifying abnormal activities.
 Assessing severity and raisingalarm.

Detector – ID Engine
Response
Component
Data gathering (sensors)
Raw data
Information Source - Monitored System
Events
Knowledge base Configuration
Alarms
Actions
SystemState
System
State
Intrusion Detection System Architecture

Goals of Intrusion Detection System (IDS)
Detect wide variety of intrusions.
Detect intrusions in timelyfashion.
Present analysis in simple, easy-to-understand format.
Be accurate.

WhyWeNeed Intrusion Detection?
Security mechanisms always have inevitable vulnerabilities.
Multiple levels of data confidentiality in commercial and government
organizations needs multi-layer protection in firewalls.

Why Can Data MiningHelp?
 Successful applications in related domains, e.g., fraud detection,
fault/alarm management.
 Learn from traffic data
 Maintain or update models on dynamic data.
 Data mining: applying specific algorithms to extract patterns from
data.
 From the data-centric point view
, intrusion detection is a data
analysisprocess.

Data Mining approaches for Intrusion Detection

Classification Methods
 Neural networks.
 Bayesian classification.
 Support vector
machines.

Email Worm Detection Using Data Mining
Outgoing Emails
TrainingData
TestData
Classifier
Feature
Extraction
Machine
Learning
Themodel
CleanorInfected

Clustering
Group data into clusters
ClusteringApproaches
• K-means
• Hierarchical Clustering

Clustering for Intrusion Detection
Anomaly detection.
Any significant deviations from the expected behavior are reported as
possible attacks.
Build clusters as models for normal activities.

Conclusion
Data mining has great potential as a malware detection tool. It allows you
to analyze huge sets of information and extract new knowledge from it.
The main benefit of using data mining techniques for detecting
malicious software is the ability to identify both known and zero-day
attacks.

Data mining in Cyber security

More Related Content

What's hot (20)

Similar to Data mining in Cyber security (20)

Recently uploaded (20)

Data mining in Cyber security