Reducing Network Intrusion Detection using Association rule and Classification algorithms

Association rules is a popular technique to produce a quality misused detection. However, the weaknesses of association rules is the fact that it often produced with thousands rules which reduce the performance of IDS. This project aims to show applying post-mining to reduce the number of rules and remaining the most quality rules to produce quality signature. This experiment uses KDD Cup 99 dataset to detect IDS rules using Apriori Algorithm, which later performing post-mining using ChiSquared (χ2) computation techniques. The quality of rules is measured based on Chi- Square value, which calculated according the support, confidence and lift of each association rule. Decision tree rules are also identified in order to detect attacks in the dataset as well as real time nework traffic dataset. The experimental results demonstrate its effectiveness and efficiency.