Detecting security threats in the network core using Data Mining techniques

Security within the Internet is a serious concern. The developing e-business culture is undermined by the security threats posed by Internet crime. Traditionally, network security has been managed on a local basis. Several mature technologies exist for threat detection and mitigation at the edges of the network but certain classes of security threat are best combated within the core of the network. This paper presents a threat detection system deployed within the core of a national network. The approach combines the use of light-weight statistical summaries, gathered at distributed points within the network, with data mining techniques, to identify security threats