Library Automation and Digital Archive
LONTAR
Fakultas Ilmu Komputer
Universitas Indonesia

Pencarian Sederhana

Find Similar Add to Favorite

Call Number SEM-368
Collection Type Indeks Artikel prosiding/Sem
Title Network Anomaly Detection Tools Based on Association Rules (hal 1355-1361)
Author Zulaiha Ali Othman, Entisar E.Eljadi;
Publisher Proceedings on the 2011 international conference on electrical engineering and informatics July 17-19 2011vo. 3 (Bandung Indonesia)
Subject
Location
Lokasi : Perpustakaan Fakultas Ilmu Komputer
Nomor Panggil ID Koleksi Status
SEM-368 TERSEDIA
Tidak ada review pada koleksi ini: 45992
With the growth of computer networks, the number of attacks posing serious security risks for networks has grown extensively. Many organizations are faced with the problem of detecting whether or not they have an anomaly in their network transactions. The Network Instrusion Detection System (NIDS) is one of popular tools used to secure and protect networks. In order to secure a network the signature rules in NIDS should be updated with the latest signature rules in NIDS should be updated wit the latest signature detection rule. Therefore, this research aims to develop a network anomaly detection tool which focuses on association rule data mining techniques to detect anomalies and also produce anomaly detection rules. The tool, named as NASSR, consist of the following functions: pre-processing of the raw data network transaction that is captured using wireshark and transforming the data into three types of data sets (2,,5 and 10 second), normalization (mi.,max.) and mining (appriori, fuzzy appriori, and FP-Growth). The anomaly detection is calculated by comparing it with a normal network data set, which is validated by CACE tools. The data set is determined as having no instrusion, if the similarity result are higher than the user threshold, and vice versa. This paper also present the interface toos used to analyse the 7GB real network data set obtained from pusat teknologi Maklumat (PTM), University Kebangsaan Malaysia (UKM), which consist of three day's accumulation of network traffic data, and presents the data sets that have anomalies and their rules. The best result shows that the best technique for pre-processing is in the form of two seconds.fuzzy appriori presents the most accurate result while FP-Growth has been shown as a faster mining technique. The tools can be easily used to detect anomalies for any network traffic. Keywords: network intrusion detection system (NIDS), data mining, association rules techniques.