Data Fusion based on Big Data Techniques in Intrusion Detection Context

Abstract

Abstract Intrusion detection is seen as the most promising way for computer security. It is used to protect computer networks against different types of attacks. The major problem in the literature is the data classification problem in two main classes: normal or intrusive. To solve this problem, several approaches have been proposed but the problem of false alarms is still present. To provide a solution to this problem we have proposed a new intrusion detection approach based on Big data techniques. The objective of this work is to present an approach of data fusion using Big Data techniques in order to detect intrusions. This article presents how to merge two or more intrusion detection datasets using the Hadoop ecosystem and Neo4j graph database. The main objective of this paper is to build one dataset which combines various datasets and contains all the attack types. This research consists in merging the heterogeneous datasets and removing redundancy information using Hadoop and Neo4j. In final step fuzzy decision tree algorithm is implemented for learning. This algorithm is called SSDM (Semantically Similar Data Miner), it is to classify the data detected in intrusive or normal classes and uses fuzzy logic whose purpose is to generate association rules between the different elements extracted from the database. The K2 algorithm is also implemented in order to learn from data and detect intrusions. Experimentation results prove that data fusion contributes to have better results in terms of detection rates and false positives.