Investigative Data Mining for Security and Criminal Detection

10.16 Internet Resources

Finally, there are an assortment of Web sites that provide useful information and programs in the area of intrusion detection. The following listings are some of the most popular tools and utilities:

• DShield.org is a site that collects data about cracker activity from all over the Internet. The data is cataloged and summarized and can be used to discover intrusion trends. Their Distributed Intrusion Detection System accepts firewall log excerpts for analysis. The site also reports on intrusions worldwide, listing the 10 most wanted IP addresses (http://www.dshield.org).

• Incidents.org is a site that provides reports on intrusion attacks. The site provides real-time threat-driven security intelligence through its Internet Storm Center, which performs data correlation collected from thousands of firewalls and intrusion detection systems, monitoring for trends and potential threats (http://www.Incident.org).

• "DOCSHOW" Security Papers Archive is a site that has very timely and insightful papers about IDSs, firewalls, and other security tools (http://www.docshow.net).

• InfoSysSec is a site that provides a collection of IDS and security resources (http://www.infosyssec.net/infosyssec/intdetl.htm).

• An Introduction to Intrusion Detection Systems is a site that provides an introduction to intrusion detection systems illustrated with the Dragon IDS Suite (http://www.intrusion-detection-system-group.co.uk).

Data mining can be used for intrusion detection to automate some of the tasks of data collection and pattern recognition.