Design of a Network-Based Anomaly Detection System Using VFDT Algorithm

ABSTRACT: Despite the rapid progress in information technology, the problem of protecting computer and network security remained a major challenge for most researchers, especially after the expansion of networks and evolution of technology and the increasing number of network users and the internet. Networks need some tools for protection, such as firewall, Intrusion Detection Systems (IDSs) and Intrusion Prevention System (IPS). The aim of this thesis is to build a Network-based Anomaly Detection System (NADS). This system depends on the normal behavior of the network, in that it can distinguish each abnormal behavior. This system can work in two modes, online and offline modes. Very Fast Decision Tree (VFDT) algorithm was used to build the classifier for intrusions. VFDT is one of the data mining algorithms that deal with high data streams in a very short time. Experimental results demonstrated that NADS system is highly successful in detecting known and unknown attacks by 93%. Keywords: Network Security, Intrusion Detection, Very Fast Decision Tree Algorithm, KKD CUP99 dataset. …………………………………………………………………………………………………………………………