Classification system ids alerts by using data mining technique

Currently, people are living in a world without borders, which means that nothing is beyond reach. The significant growth in technology has led to new threats in the era of computing. These risks are increasing and we should be dealing with them in a more efficient manner. Therefore, it has become necessary for researchers to focus on protecting networks and to work on the production of software for this purpose, namely 'an intrusion detection system' (IDs) .IDS can reveal various types of attacks and analyze events that arise in networks and computer systems to identify any protection problem. However, an IDS generates a considerable number of alerts each day most of which may be false alarms. Therefore, researchers have attempted to find ways to solve the problem of false alerts. One of these methods is data mining algorithms, which is a process of mining knowledge from huge datasets. Data mining may be suitable for dealing with this large number of alerts. This research presents a methodology involving an improved data mining technique to classify alarms as being a real attack or a false attack. This technique is used in designing the proposed classification system. An application has been designed using C# to test the dataset. The classification system is tested by conducting three experiments on the second, fourth, and fifth week of the DARPA 1999 dataset which extracted from a simulation of a military management network. Each experiment produces high accuracy to classify the alerts in order to facilitate the process of analyzing alerts to help security analysts to distinguish between true and false alerts. The first experiment is conducted on the second week with percentage of false alert (PFA) and percentage of true alerts (PTA) equaling 95%, and 5%, respectively. The second test was conducted on the fourth week and the PFA and PTA equaled 94.19% and 5.81%, respectively. The third experiment was conducted in the fifth week with the PFA and PTA equaling 93.768% and 6.232%, respectively. The proposed system achieved the best results when compared with the literature findings that had used the same dataset.