An architecture for mining the Egyptian e-government network traffic for intrusion detection

This paper presents MEGNTID; an architecture for mining the Egyptian e-government network traffic for intrusion detection. This architecture adapts a layering approach to detect intrusions, where known attacks are detected at a global layer defined for the Egyptian e-government network (EEGN) as a whole and normal behavior is filtered out at a local layer defined for each ministry´s site. Clustering is used to focus the analysis on the remaining suspicious activity and identify whether it represents new intrusive or normal behavior. This architecture is intended to detect intrusions in real-time, achieve low false alarm rates, and continuously adapt to the environment changes and emergence of new intrusive behavior. The implementation plan is discussed at the end of the paper