Architecture-centric network behavior model generation for detecting internet worms

Data mining techniques have been popular in the research area of intrusion detections. However, most researches have mainly focused on the intrusion detection in the view of model generation techniques, but not in the view of system architectures. In this paper, we propose the architecture of network-intrusion detection model generation system. Our architecture creates candidate models by various data mining techniques and one new technique (sC4.5) for the network behavior data set and then elects the best appropriate model according to user requirements after evaluating candidate models. We also present sC4.5 as a decision tree classification algorithm by complimenting existing C4.5 algorithm. sC4.5 preserves classification accuracy like C4.5 and makes the decision tree smaller than C4.5.