Data Mining for Improving Intrusion Detection

In this presentation I'll discuss our experiences in applying data mining techniques to improving intrusion detection for the MITRE network. MITRE has a large, distributed network that is hit with approximately 300 incidents per week. These incidents represent an even large number of raw sensor events that all need to be reviewed by human analysts. Our work in applying data mining to this task is primarily focused on reducing this burden on the human analysts. To do this we have worked on deriving useful features and on understanding how clustering, anomaly detection and classication can most effectively be used.