\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Intrusion Detection System with Data Mining Approach A Review},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2011-04 2011-03-09 (revised: April 2011 09 March 2011)}
\def\TheID{\makeatother }
\def\TheDate{2011-04 2011-03-09}
\title{Intrusion Detection System with Data Mining Approach A Review}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{DR. Madjid  Khalilian}

             \author[2]{Norwati  Mustapha}

             \affil[1]{  university putra malaysia}

\renewcommand\Authands{ and }

\date{\small \em Received: 7 February 2011 Accepted: 27 February 2011 Published: 9 March 2011}

\maketitle


\begin{abstract}
        


Despite of growing information technology widely, security has remained one challenging area for computers and networks. Recently many researchers have focused on intrusion detection system based on data mining techniques as an efficient strategy. The main problem in intrusion detection system is accuracy to detect new attacks therefore unsupervised methods should be applied. On the other hand, intrusion in system must be recognized in realtime, although, intrusion detection system is also helpful in off-line status for removing weaknesses of network?s security. However, data mining techniques can lead us to discover hidden information from network?s log data. In this survey, we try to clarify: first,the different problem definitions with regard to network intrusion detection generally; second, the specific difficulties encountered in this field of research; third, the varying assumptions, heuristics, and intuitions forming the basis of erent approaches; and how several prominent solutions tackle different problems.

\end{abstract}


\keywords{Data mining, Intrusion Detection, Clustering, Classification.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{INTRODUCTION}]{INTRODUCTION}\par
owadays we have many applications with massive amount of data which causes limitation in data storage capacity and processing time. Furthermore, many applications must operate in realtime to achieve theirs objectives. As an important case for these kinds of application, Network Intrusion Detection System (NIDS) can be pointed. Generally we define NIDS as the detection of intrusions or intrusions attempts either manually or via software expert systems that operate on logs or other information available from the system or the network. An intrusion is a deliberate, unauthorized attempt to access or manipulate information or system and to render them unreliable or unusable. If a suspicious activity is from your internal network or system it will also be classified as intrusion. Some popular intrusion as follows:\par
? Denial of service (DoS): attempts to starve a host of resources needed to function correctly. ? Scan: reconnaissance on the network or a particular host. ? Worms and viruses: replicating on other hosts.\par
? Compromises: obtain privileged access to a host by known vulnerabilities.\par
About-Computer science and information technology University Putra Malaysia E-mails-khalilian@ieee.org,\{norwati, nasir, ali\}@fsktm.upm.edu.my Furthermore, we identify some important objectives for IDS as below:\par
? Detect wide variety of attacks.\par
? Detect intrusions in timely fashion.\par
? Present analysis in simple, easy-to-understand format. ? Minimize false positives, false negatives:\par
1. False positive: An event, incorrectly identified by the IDS as being an intrusion when none has occurred 2. False negative: An event that the IDS fails to identify as an intrusion when one has in fact occurred There are many solutions for intrusion detection that we categorize them into four main groups: anomaly detection, signature based misuse, host based and network based. Many researchers have applied data mining techniques, which are powerful methods for extracting hidden information from huge datasets, for network intrusion detection system. On the other part, traditional data mining is not suitable for this kind of applications so they should be tuned and changed or designed with new algorithms. Besides of speed up and storage capacity, real-life concepts tend to change over time e.g. new attacks should be recognized.\par
The growth of volume of existing data and insufficiency of data storage capacity lead us to the dynamic processing data and extracting knowledge. The problem is that current IDS are tuned specifically to detect known service level network attacks. At the same time, enough data exists or could be collected to allow network administrators to detect these policy violations. Unfortunately, the data is so enormous, and the analysis process so time-consuming, that the administrators don't have the resources to proactively analyze the data for policy violations, especially in the presence of a high number of false positives that cause them to waste their limited resources.\par
The nature solution is utilizing data mining techniques. However, data mining can be applied in offline status. Most previous work focused on off-line environment while on-line system for detecting policy violations is needed.\par
In next section we addressed general problems in this domain, after that we discuss different solutions in four groups with pros and cons, finally we will have the conclusion.  
\section[{II.}]{II.} 
\section[{Gaps}]{Gaps} 
\section[{traffic based Methods}]{traffic based Methods}\par
If we want to categorize intrusion detection methods, we will recognize two main aspects for grouping approaches, which one group refers to type of attack includes host based and network based. Another group of approaches refers to solutions techniques which are signature based and anomaly detection methods. In continue we review these techniques with their pros and cons. 
\section[{a) Host based methods}]{a) Host based methods}\par
This method is based on data source category; consequently, its data comes from the records of various activities of hosts, including system logs, audit operation system information, etc. the main architecture for this kind of methods is similar to network based which is described in the next section. Ref \hyperref[b0]{[1]} presents a host-based combinatorial method based on k-Means clustering and ID3 decision tree learning algorithms for unsupervised classification of anomalous and normal activities in computer network.  
\section[{IV. approaches to solutions}]{IV. approaches to solutions}\par
A powerful survey can be found in \hyperref[b1]{[2]} that it discusses data mining for cyber security applications. For example, anomaly detection techniques could be used to detect unusual patterns and behaviors, Link analysis may be used to trace the viruses to the perpetrators, Classification may be used to group various cyber attacks and then use the profiles to detect an attack when it occurs, Prediction may be used to determine potential future attacks depending in a way on information learnt about terrorists through email and phone conversations. This paper also mentioned about real-time problem in IDS and other challenges include mining unstructured data types.\par
We divide approaches in two main groups: misuse detection which the main study is the classification algorithms and anomaly detection which the main study is the pattern comparison( association rules and sequence rules) and the cluster algorithms. 
\section[{a) Signature-based methods}]{a) Signature-based methods}\par
The research \hyperref[b2]{[3]} compares accuracy, detection rate, false alarm rate and accuracy of other attacks under different proportion of normal information. For comparison results of C4.5 and SVM, they demonstrate that C4.5 is superior to SVM in accuracy and detection; in accuracy for Probe, Dos and U2R attacks, C4.5 is also better than SVM; but in false alarm rate, SVM is better. Through test and comparison, the accuracy and detection rate of C4.5 is higher than that of SVM, but false alarm rate of SVM is better. In sampling, the research supposes that the distribution of attack data other than normal data is even, which cannot surely get optimal results, and this should be improved and validated. Another weakness refers to C4.5 parameters that is not optimal, thus the future work should optimize the parameters according to C4.5 parameters and different training dataset. For huge datasets optimizing parameter in SVM takes too much time; however, it is not suitable, for intrusion detection system requires realtimeliness. The future research should aim at the direction where the parameters can be optimized rapidly.\par
With the concept of field in physics, \hyperref[b3]{[4]} proposed a data field based method for discrimination of network behaviors. Similar to electric charge or particle, each data point we concerned has its own influence region and the influence is a function of position giving the force on each point placed at that position. Furthermore, the positive potential and negative potential have been described, by which it can determine the test point's class. This scheme is based on "supervised" learning, whereas unsupervised methods are preferred. Some advantages and disadvantages are as follows:\par
? Advantages o Specifying exact class of attacks. o Efficiency is high and complexity is low.\par
? disadvantages o Many false positives: prone to generating alerts when there is no problem in fact. o Cannot detect unknown intrusions. 
\section[{b) Anomaly based methods}]{b) Anomaly based methods}\par
The basic idea of clustering analysis originates in the difference between intrusion and normal pattern; consequently, we can put data sets into different categories and detect intrusion by distinguish normal and abnormal behaviors. The common clustering algorithms in data mining include two main categories: hierarchical and partitioning clustering algorithms. Clustering intrusion detection is detection for anomaly with no supervision, and it detects intrusion by training the unmarked data.\par
Ref \hyperref[b4]{[5]} considered the outlier factor of clusters for measuring the deviation degree of a cluster. A method has been proposed to compute the cluster radius threshold. The data classification has been performed by an improved nearest neighbor (INN) method. For the unsupervised intrusion detection, they applied a clustering based method that its time complexity is linear with the size of dataset and the number of attributes.\par
Ref \hyperref[b5]{[6]} outline a data mining framework for constructing intrusion detection models. To facilitate adaptability and extensibility, they use of meta-learning as a means to construct a combined model that incorporate evidence from multiple base models. They also extend the basic association rules and frequent episodes algorithms to accommodate the special requirements in analyzing audit data. The main shortcoming is lack of devising a mechanical procedure to translate automatically learned detection rules into modules for real-time IDS. \hyperref[b6]{[7]} proposed a new weighted support vector clustering algorithm; it can cluster large data set and high-dimensional data effectively. They also introduced the new weighted SVC method to network intrusion detection. The experiments with KDD Cup1999 data demonstrate that proposed method achieves highly detection rate with low false alarm rate.\par
Ref \hyperref[b7]{[8]} have presented a fast distributed outlier detection algorithm for mixed attribute datasets that deals with sparse high-dimensional data. The algorithm called outlier detection for mixed attribute datasets identifies outliers based on the categorical attributes first, and then focuses on subsets of data in the continuous space by utilizing information about these subsets from the categorical attribute space.\par
Ref \hyperref[b9]{[9]} improved the speed of intrusion detection system, keep the high detect date and the low false positive rate using the Parallel Clustering Ensemble based on Evidence Accumulation algorithm, it overcomes the disadvantages of conventional Parallel K-means algorithm. Through paralleling, the algorithm clusters more speedily facing to mass data, and keep the advantages of the Evidence Accumulation which combines the results of multiple clustering into a single data partition.\par
Ref \hyperref[b10]{[10]} present a method for outlier detection that uses HPSO clustering based on swarm intelligence, which is capable of providing clustering at different levels of compactness. Merging clusters and attribute evolution help in learning about the correct cluster solution and outlier data. Experiments show that the approach is capable of identifying true outliers as well as a good clustering configuration of data. Setting parameters automatically is a challenging problem in this method. High dimension data is also problematic in this research.\par
Ref \hyperref[b11]{[11]} is an anomaly detection algorithm based on hierarchical clustering, called ADBHC. ADBHC generates clusters using density-based partitioning method which has less computational cost. It uses the improved hierarchical clustering tree to carry out fast scalable and adaptive anomaly detection. The improved hierarchical clustering tree supports updating profiles at any time. They extend the clustering algorithm and apply branch and bound mechanism for filtering noise. ADBHC had lower false alarm rate and higher detection rate. The superior performance of detection was mainly due to the high accuracy of normality profiles and the capability of filtering noise. Various parameters had pernicious impacts on the adaptive captivity of ADBHC.\par
? Advantages: Anomaly detection can detect novel attacks to increase the detection rate. Compared to supervised approaches, unsupervised approach breaks the dependency on attack-free training datasets. The performance of unsupervised anomaly detection approaches achieve higher detection rate over supervised approach. Also, unsupervised approach have high false positive rate over supervised approach. Using unsupervised anomaly detection techniques, however, the system can be trained with unlabeled data and is capable of detecting previously unseen attacks \hyperref[b12]{[12]}.\par
? Disadvantages: Obviously, not all typical behaviors are attacks or intrusion attempts. This represents one drawback of intrusion detection methods based on clustering \hyperref[b13]{[13]}. 
\section[{c) Hybrid methods}]{c) Hybrid methods}\par
Through analyzing the advantages and disadvantages between anomaly detection and misuse detection, a mixed intrusion detection system (IDS) model is designed. \hyperref[b14]{[14]}First, data is examined by the misuse detection module, then abnormal data detection is examined by anomaly detection module.\par
Ref \hyperref[b0]{[1]}proposed combinatorial approach for unsupervised classification of anomalous and normal activities in computer network. The proposed approach combines the two well-known machine learning methods: the k-Means clustering and the ID3 decision tree learning approaches. The k-Means method was first applied to partition the training instances into k disjoint clusters. The ID3 decision tree built on each cluster learns the subgroups within the cluster and partitions the decision space into finer classification regions; thereby improving the overall classification performance.\par
Ref \hyperref[b15]{[15]}An incremental intrusion detecting model is proposed. This model integrates unsupervised Self Organizing Map and supervised Radial Basis Function to complete incremental learning. Self Organizing Map can get new type intrusion information and generate new nodes in Radial Basis Function. By this model, intrusion of unknown type can be detected online.\par
Fuzzy clustering algorithm is an unsupervised anomaly detection technique without training; it does not need to know the type of attack in Intrusion Detection data samples, so it can detect a variety of known and unknown characteristics of network intrusion simultaneously. This article combined QPSO with the FCM algorithm, using QPSO algorithm has better features to find the global optimal value, using particle swarm flying in the solution space search best value to replace FCM iterative process to obtain a more suitable mix of clustering algorithm \hyperref[b16]{[16]}.\par
In order to reduce or eliminate the noise impact on constructing the hyper plane of SVM, firstly it preprocesses the data, after that the fuzzy membership function is introduced into SVM. The fuzzy membership function acquires different values for each input data according to different effects on the classification result. Because different network protocol has different attributes, that must affect the detection effect. This paper proposes cooperative network intrusion detection Based on Fuzzy SVM. Three types of detecting agents are generated according to TCP, UDP and ICMP protocol. How to improve the accuracy of UDP detection agent in existing data set will be the major weakness \hyperref[b17]{[17]}.\par
V. 
\section[{Conclusions}]{Conclusions}\par
In this paper we have demonstrated some difficulties in Network Intrusion Detection Systems where its log files are high scale and dimensions; consequently, new methods need to be developed for processing these huge data sources. Furthermore concept drift is nature of data in IDS and should be managed by new methods. On the other hand, efficiency in terms of accuracy is one of the most critical measurements which are mostly defined by ratio of false positive and false negative alarms. Therefore, we need to design efficient algorithms whereas scan data once and extract hidden patterns inside it. Evolving data, visiting data once, accuracy in intrusion detections and space limitations are major issues in intrusion detection systems. However, there are two main approaches for intrusion detection: firs group employs signature-based methods to identify attacks and second one refers to anomaly detection techniques but devising new framework with combining these two main approaches can overcame most drawbacks.\par
VI.			\footnote{Intrusion Detection System with Data Mining Approach A Review ©2011 Global Journals Inc. (US)} 		 		\backmatter   			 
\subsection[{Acknowledgement}]{Acknowledgement}\par
This work was supported by grant 03-04-10-875FR from the Basic Research Program of the University Putra Malaysia. 			  			  				\begin{bibitemlist}{1}
\bibitem[Jiang et al. ()]{b4}\label{b4} 	 		‘A clustering-based method for unsupervised intrusion detections’.  		 			S Y Jiang 		,  		 			X Song 		,  		 			H Wang 		,  		 			J J Han 		,  		 			Q H Li 		.  	 	 		\textit{Pattern Recognition Letters}  		2006. 27 p. .  	 
\bibitem[Teng et al. ()]{b17}\label{b17} 	 		‘A Cooperative Network Intrusion detection Based on Fuzzy SVMs’.  		 			S Teng 		,  		 			H Du 		,  		 			N Wu 		,  		 			W Zhang 		,  		 			J Su 		.  	 	 		\textit{Journal of Networks}  		2010. 5 p. 475.  	 
\bibitem[Lee et al. ()]{b5}\label{b5} 	 		\textit{A data mining framework for building intrusion detection models},  		 			W Lee 		,  		 			S J Stolfo 		,  		 			K W Mok 		.  		2002.  	 
\bibitem[Koufakou and Georgiopoulos (2011)]{b7}\label{b7} 	 		\textit{A fast outlier detection strategy for distributed high-Global Journal of Computer Science and Technology Volume XI Issue V Version},  		 			M Koufakou 		,  		 			Georgiopoulos 		.  		April 2011.  	 
\bibitem[Zhang et al. ()]{b14}\label{b14} 	 		\textit{A Mixed Unsupervised Clustering-Based Intrusion Detection Model},  		 			G Zhang 		,  		 			S Zhang 		,  		 			Sun 		.  		2009.  	 
\bibitem[Yasami and Mozaffari ()]{b0}\label{b0} 	 		‘A novel unsupervised classification approach for network anomaly detection by k-Means clustering and ID3 decision tree learning methods’.  		 			Y Yasami 		,  		 			S P Mozaffari 		.  	 	 		\textit{The Journal of Supercomputing}  		2010. 53 p. .  	 
\bibitem[Gao et al. ()]{b9}\label{b9} 	 		\textit{A Parallel Clustering Ensemble Algorithm for Intrusion Detection System},  		 			H Gao 		,  		 			D Zhu 		,  		 			X Wang 		.  		2010.  	 
\bibitem[Alam et al. ()]{b10}\label{b10} 	 		\textit{A swarm intelligence based clustering approach for outlier detection},  		 			S Alam 		,  		 			G Dobbie 		,  		 			P Riddle 		,  		 			M A Naeem 		.  		2010.  	 
\bibitem[Sun and Wang ()]{b6}\label{b6} 	 		\textit{A Weighted Support Vector Clustering Algorithm and its Application in Network Intrusion Detection},  		 			S Sun 		,  		 			Y Z Wang 		.  		2009.  	 
\bibitem[Liang et al. ()]{b11}\label{b11} 	 		\textit{An Adaptive Anomaly Detection Based on Hierarchical Clustering},  		 			H Liang 		,  		 			R Wei-Wu 		,  		 			R Fei 		.  		2009.  	 
\bibitem[Gogoi et al. ()]{b12}\label{b12} 	 		‘Anomaly Detection Analysis of Intrusion Data using Supervised \& Unsupervised Approach’.  		 			P Gogoi 		,  		 			B Borah 		,  		 			D K Bhattacharyya 		.  	 	 		\textit{Journal of Convergence Information Technology}  		2010. 5.  	 
\bibitem[Thuraisingham et al. ()]{b1}\label{b1} 	 		\textit{Data mining for security applications},  		 			B Thuraisingham 		,  		 			L Khan 		,  		 			M M Masud 		,  		 			K W Hamlen 		.  		2009.  	 
\bibitem[Wu and Yen ()]{b2}\label{b2} 	 		‘Data mining-based intrusion detectors’.  		 			S Y Wu 		,  		 			E Yen 		.  	 	 		\textit{Expert Systems with Applications}  		2009. 36 p. .  	 
\bibitem[Tian and Liu ()]{b15}\label{b15} 	 		\textit{Incremental intrusion detecting method based on SOM/RBF},  		 			L Y Tian 		,  		 			W P Liu 		.  		2010.  	 
\bibitem[Singh et al. ()]{b13}\label{b13} 	 		‘Mining Common Outliers for Intrusion Detection’.  		 			G Singh 		,  		 			F Masseglia 		,  		 			C Fiot 		,  		 			A Marascu 		,  		 			P Poncelet 		.  	 	 		\textit{Advances in Knowledge Discovery and Management},  				2010. p. .  	 
\bibitem[Wang et al. ()]{b16}\label{b16} 	 		\textit{Network intrusion detection based on hybrid Fuzzy Cmean clustering},  		 			H Wang 		,  		 			Y Zhang 		,  		 			D Li 		.  		2010.  	 
\bibitem[US) dimensional data sets with mixed attributes Data Mining and Knowledge Discovery ()]{b8}\label{b8} 	 		‘US) dimensional data sets with mixed attributes’.  	 	 		\textit{Data Mining and Knowledge Discovery}  		2010. 20 p. .  	 	 (©2011 Global Journals Inc.) 
\bibitem[Xie and Bai ()]{b3}\label{b3} 	 		\textit{Using Data Field to Analyze Network Intrusions},  		 			F Xie 		,  		 			S Bai 		.  		2006. p. .  	 	 (Information Security Practice and Experience) 
\end{bibitemlist}
 			 		 	 
\end{document}
