Survey of Network Intrusion Detection Methods from the Perspective of the Knowledge Discovery in Databases Process
It provides a structured framework for researchers and practitioners in network security to better understand and evaluate intrusion detection methods, though it is incremental as it builds on existing reviews by applying a KDD perspective.
This survey reviews network intrusion detection methods by analyzing them through the Knowledge Discovery in Databases (KDD) process, focusing on data capture, preparation, transformation, mining, and evaluation techniques, and proposes updated taxonomies and definitions.
The identification of cyberattacks which target information and communication systems has been a focus of the research community for years. Network intrusion detection is a complex problem which presents a diverse number of challenges. Many attacks currently remain undetected, while newer ones emerge due to the proliferation of connected devices and the evolution of communication technology. In this survey, we review the methods that have been applied to network data with the purpose of developing an intrusion detector, but contrary to previous reviews in the area, we analyze them from the perspective of the Knowledge Discovery in Databases (KDD) process. As such, we discuss the techniques used for the capture, preparation and transformation of the data, as well as, the data mining and evaluation methods. In addition, we also present the characteristics and motivations behind the use of each of these techniques and propose more adequate and up-to-date taxonomies and definitions for intrusion detectors based on the terminology used in the area of data mining and KDD. Special importance is given to the evaluation procedures followed to assess the different detectors, discussing their applicability in current real networks. Finally, as a result of this literature review, we investigate some open issues which will need to be considered for further research in the area of network security.