Share This Article:

A Decision Tree Classifier for Intrusion Detection Priority Tagging

Full-Text HTML XML Download Download as PDF (Size:254KB) PP. 52-58
DOI: 10.4236/jcc.2015.34006    4,223 Downloads   4,798 Views Citations


Snort rule-checking is one of the most popular forms of Network Intrusion Detection Systems (NIDS). In this article, we show that Snort priorities of true positive traffic (real attacks) can be approximated in real-time, in the context of high speed networks, by a decision tree classifier, using the information of only three easily extracted features (protocol, source port, and destination port), with an accuracy of 99%. Snort issues alert priorities based on its own default set of attack classes (34 classes) that are used by the default set of rules it provides. But the decision tree model is able to predict the priorities without using this default classification. The obtained tagger can provide a useful complement to an anomaly detection intrusion detection system.

Cite this paper

Ammar, A. (2015) A Decision Tree Classifier for Intrusion Detection Priority Tagging. Journal of Computer and Communications, 3, 52-58. doi: 10.4236/jcc.2015.34006.

Copyright © 2018 by authors and Scientific Research Publishing Inc.

Creative Commons License

This work and the related PDF file are licensed under a Creative Commons Attribution 4.0 International License.