Network anomaly detection tools based on association rules

With the growth of computer networks, the number of attacks posing serious security risks for networks has grown extensively. Many organizations are faced with the problem of detecting whether or not they have an anomaly in their network transactions. The Network Intrusion Detection System (NIDS) is one of the popular tools used to secure and protect networks. In order to secure a network the signature rules in NIDS should be updated with the latest signature detection rule. Therefore, this research aims to develop a network anomaly detection tool which focuses on association rule data mining techniques to detect anomalies and also produce anomaly detection rules. The tool, named as NASSR, consists of the following functions: pre-processing of the raw data network transaction that is captured using Wireshark and transforming the data into three types of data sets (2, 5 and 10 seconds), normalization (min., max.) and mining (Appriori, Fuzzy Appriori, and FP-Growth). The anomaly detection is calculated by comparing it with a normal network data set, which is validated by CACE tools. The data set is determined as having no intrusion, if the similarity results are higher than the user threshold, and vice versa. This paper also presents the interface tools used to analyse the 7GB real network data set obtained from Pusat Teknologi Maklumat (PTM), Universiti Kebangsaan Malaysia (UKM), which consists of three days´ accumulation of network traffic data, and presents the data sets that have anomalies and their rules. The best result shows that the best technique for pre-processing is in the form of two seconds. Fuzzy Appriori presents the most accurate result while FP-growth has been shown as a faster mining technique. The tools can be easily used to detect anomalies for any network traffic.