What is Misuse Detection

Over the past few years, the Internet has changed computing as we know it. The more possibilities and opportunities develop, the more systems are subject to attack by intruders. Thus, the big question is about how to recognize and handle subversion attempts. One answer is to undertake the prevention of subversion itself by building a completely secure system. However, the complete prevention of breaches of security does not yet appear to be possible to achieve. Therefore these intrusion attempts need to be detected as soon as possible (preferably in real time) so that appropriate action might be taken to repair the damage. This is what an intrusion detection system (IDS) does. IDSs monitor and analyze the events occurring in a computer system in order to detect signs of security problems. However, intrusion detection technology has not yet reached perfection. This fact has provided data mining with the opportunity to make several important contributions and improvements to the field of IDS technology (Julisch, 2002).