This document discusses using data mining techniques for intrusion detection in cyber security. It defines cyber security and cyber crimes, and explains how data mining can help with intrusion detection. Specifically, it describes how classification methods like neural networks and clustering can be used to detect anomalies and build models of normal network activity that may help identify intrusions. The goal of these data mining approaches for intrusion detection is to analyze network traffic data to learn patterns and identify both known and unknown attacks.

1. Data Mining in Cyber Security Intrusion Detection
Presented by : Sagar Deepak Thapa
Guided By : Prof Nagaraju Bogiri
KJ College Of Engineering And Management Research Pune
4072

2. Outline
What is Cyber Security?
What is Cyber Crime?
Applications of Data Mining in Cyber Security.
Intrusion detection.
Why Can Data Mining Help?
Data Mining approaches for Intrusion Detection.
Conclusion.

3. Cyber Security
Set of technologies and processes designed to protect computers,
networks, programs, and data from attack, unauthorized access, change,
or destruction.
A Majorpart of Cyber Security
is to fix broken Software.
Cyber
Security
Computer
SecuritySystem
Network
SecuritySystem

4. Cyber Crime
Encompasses anycriminal act dealingwith computers and networks.
Include:
• Malicious programs.
• Illegal imports.
• Computers Vandalism.

5. Cyber Security VS CyberCrime
Cyber
Security
CyberCrime CyberSecurity
Cyber
Crime
One side of the
coin
Other side of the
coin

6. Applications of Data Mining in Cyber Security
Malwaredetection.
Intrusion detection.
Fraud detection.

7. Intrusion Detection
The process of monitoring the events occurring in a computer systemor
network and analyzing them for signs of intrusion.

8. Intrusion Detection System (IDS)
Combination of software and hardware that attempts to perform
intrusion detection.
Raise the alarm when possible intrusion happens.
Steps:
 Monitoring and analyzing traffic.
 Identifying abnormal activities.
 Assessing severity and raisingalarm.

9. Detector – ID Engine
Response
Component
Data gathering (sensors)
Raw data
Information Source - Monitored System
Events
Knowledge base Configuration
Alarms
Actions
SystemState
System
State
Intrusion Detection System Architecture

10. Goals of Intrusion Detection System (IDS)
Detect wide variety of intrusions.
Detect intrusions in timelyfashion.
Present analysis in simple, easy-to-understand format.
Be accurate.

11. WhyWeNeed Intrusion Detection?
Security mechanisms always have inevitable vulnerabilities.
Multiple levels of data confidentiality in commercial and government
organizations needs multi-layer protection in firewalls.

12. Why Can Data MiningHelp?
 Successful applications in related domains, e.g., fraud detection,
fault/alarm management.
 Learn from traffic data
 Maintain or update models on dynamic data.
 Data mining: applying specific algorithms to extract patterns from
data.
 From the data-centric point view
, intrusion detection is a data
analysisprocess.

13. Data Mining approaches for Intrusion Detection

14. Classification Methods
 Neural networks.
 Bayesian classification.
 Support vector
machines.

15. Email Worm Detection Using Data Mining
Outgoing Emails
TrainingData
TestData
Classifier
Feature
Extraction
Machine
Learning
Themodel
CleanorInfected

16. Clustering
Group data into clusters
ClusteringApproaches
• K-means
• Hierarchical Clustering

17. Clustering for Intrusion Detection
Anomaly detection.
Any significant deviations from the expected behavior are reported as
possible attacks.
Build clusters as models for normal activities.

18. Conclusion
Data mining has great potential as a malware detection tool. It allows you
to analyze huge sets of information and extract new knowledge from it.
The main benefit of using data mining techniques for detecting
malicious software is the ability to identify both known and zero-day
attacks.

19. THANK YOU