Data mining for network intrusion detection: A comparison of alternative methods

Dan Zhu, G. Premkumar, Xiaoning Zhang, Chao Hsien Chu

Research output: Contribution to journalArticlepeer-review

83 Scopus citations


Intrusion detection systems help network administrators prepare for and deal with network security attacks. These systems collect information from a variety of systems and network sources, and analyze them for signs of intrusion and misuse. A variety of techniques have been employed for analysis ranging from traditional statistical methods to new data mining approaches. In this study the performance of three data mining methods in detecting network intrusion is examined. An experimental design (3 × 2 × 2) is created to evaluate the impact of three data mining methods, two data representation formats, and two data proportion schemes on the classification accuracy of intrusion detection systems. The results indicate that data mining methods and data proportion have a significant impact on classification accuracy. Within data mining methods, rough sets provide better accuracy, followed by neural networks and inductive learning. Balanced data proportion performs better than unbalanced data proportion. There are no major differences in performance between binary and integer data representation.

Original languageEnglish (US)
Pages (from-to)635-660
Number of pages26
JournalDecision Sciences
Issue number4
StatePublished - 2001

All Science Journal Classification (ASJC) codes

  • Business, Management and Accounting(all)
  • Strategy and Management
  • Information Systems and Management
  • Management of Technology and Innovation


Dive into the research topics of 'Data mining for network intrusion detection: A comparison of alternative methods'. Together they form a unique fingerprint.

Cite this