[Retracted] Application of Data Mining Technology in Software Intrusion Detection and Information Processing

Zhao, Xuemin

doi:https://doi.org/10.1155/2022/3829160

Wireless Communications and Mobile Computing

On this page

Abstract Introduction Literature Review Conclusion Data Availability Conflicts of Interest Acknowledgments References Copyright Related Articles

Research Article Retraction

!

This article has been Retracted. To view the article details, please click the ‘Retraction’ tab above.

Special Issue

Artificial Intelligence Applications in Mobile Virtual Reality Technology 2022

View this Special Issue

Research Article | Open Access

Volume 2022 | Article ID 3829160 | https://doi.org/10.1155/2022/3829160

[Retracted] Application of Data Mining Technology in Software Intrusion Detection and Information Processing

Xuemin Zhao¹

Academic Editor: Balakrishnan Nagaraj

Received30 Apr 2022

Revised14 May 2022

Accepted23 May 2022

Published09 Jun 2022

Abstract

In order to improve the efficiency of the software intrusion detection system, the author proposes an application based on data mining technology in software intrusion detection and information processing. Apply data mining technology to software intrusion detection; first, analyze and research software intrusion detection technology and data mining technology, including the basic concepts of software intrusion detection, the realization technology of software intrusion detection, the classification of software intrusion detection systems, and the typical software intrusion detection system situation. By detecting and analyzing known intrusion data and using association rules, constructing the inspection system rule base enables the system to learn independently and improve itself and has good scalability, while improving the degree of automation and complete intrusion detection. Experimental results show that under the same test sample, the accuracy of the detection system model designed in this paper is 95.67%, higher than the other three detection systems, and the false alarm rate is lower than other systems, which has certain advantages. It is proved that the system in this paper can help improve the accuracy of software intrusion detection, significantly reduce the false alarm rate and false alarm rate of software intrusion detection, and provide reference for the optimization and improvement of software intrusion detection system and information processing. The system has a certain degree of self-adaptation, which can effectively detect external intrusions.

1. Introduction

In recent years, with the rapid development of the Internet, the Internet has a wider range of applications; the scale of Internet users has grown rapidly; the explosive increase of Internet information greatly promotes information exchange, interaction, and information sharing; and it greatly promotes the improvement of work efficiency and the simplicity and convenience of daily life [1]. However, the Internet has its own characteristics of individuality and openness. More and more computers are connected to become computer networks, and every computer on the network may become the target of attack, which makes the information security problem of the Internet more prominent. [2]. The information security of the Internet includes malicious issues such as network information tampering and counterfeiting, viruses, and hacking; it also includes nonmalicious security issues caused by information users who do not pay attention to information security and do not follow information security regulations; malicious information security and nonmalicious security are both serious threats to the information security of the Internet. Figure 1 shows a new data mining technology in the software intrusion detection framework [3]. Software intrusion detection refers to the process of identifying intrusions through various means; specifically, it refers to the collection of various user activity behavior data inside and outside the system; it also comprehensively analyzes various internal and external user activity data to discover and identify abnormal behaviors of the system.

In response to Internet network information security issues, research institutions and equipment manufacturers increase the research and application of Internet network information security technology and products, and a relatively complete firewall system, unified authentication, user authority management system, software intrusion detection system, secure router equipment, and other Internet information security products have been formed. Devices, including firewall systems and unified authentication systems, usually focus on defense functions and focus on preventing the system from being illegally invaded. However, Internet network information security requires equipment that prevents the system from being illegally invaded, and network software intrusion detection systems are also needed to monitor, attack, and counter-attack network security in real time [4]. At present, many research institutions and manufacturers have done a lot of research and practice on software intrusion detection technology and system application. However, improving the accuracy of software intrusion detection and reducing the false alarm rate and false alarm rate of software intrusion detection is the constant pursuit of research and application, which has strong theoretical and practical significance for the research of software intrusion detection technology [5]. Under the current trend of social life informatization, the application of software intrusion detection system is of great significance to financial institutions, government agencies, national defense and military departments, and other security-sensitive units. Timely detection and appropriate response to an intrusion can greatly reduce the damage and impact and help to quickly identify and bring perpetrators to justice [6]. Using data mining technology in updating the intrusion detection model, we should not only improve the accuracy of new intrusion data, but also remove the relatively backward detection data in the intrusion detection model in time, so as to comprehensively improve the performance of intrusion detection.

Based on this research, the author proposes an application of data mining technology in software intrusion detection and information processing, obtain hidden and unknown potentially useful information by mining a large amount of data, accurately obtain the correlation characteristics between intrusion data, avoid the huge workload caused by manual analysis and the interference of human factors, and reduce the operation and maintenance costs.

2. Literature Review

Data mining technology can be widely used in the computer field. Data mining refers to the automatic extraction of potential and useful new technology from the database; it is mainly used to find the internal connection between data and data, so as to make reasonable and appropriate inductive reasoning and make prediction judgments for extracting data from this [7]. Lin, P. L. and others used data mining technology for collaborative intrusion detection and propose a collaborative intrusion rule generation algorithm based on data mining; using distributed collaborative intrusion detection technology based on data mining, it can effectively detect coordinated intrusions, and it also has the ability to detect unknown coordinated attack patterns [8]. Wei, J. et al. analyzed the role of data mining technology in intrusion feature search; a feature mining model is applied in a mixed mode intrusion detection system based on network; and host is proposed [9]. Wan, J. and others analyzed how artificial intelligence methods are applied to intrusion detection systems and discussed the main related technical issues, and a case is used to illustrate the effect of applying clustering methods on enhancing the classification performance of network connections [10]. In order to effectively improve information security, Alidjinou, E. K. and others improve the performance of computer intrusion detection system, and data mining technology can be used and gradually play a very important function and role [11]. Mustiko et al., etc. through information screening or through the information already mastered, it can detect abnormal and known intrusions based on the correlation between different information, so as to comprehensively and scientifically verify the data in the computer, can effectively guarantee information security, at the same time, it can be the first time insecure or unknown in the network, or filter the hidden information, comprehensively improve the security of computer databases [12]. Wang, X. and others applied data mining technology in intrusion detection system, while giving full play to the characteristics of data mining technology, and a new type of intrusion detection model has also been formed [13]. By verifying the experimental data of the intrusion detection prototype experimental system based on data mining, Ngulde, S.I. et al. compared and analyzed the algorithm of the single intrusion detection model.Experimental results further confirm that the data mining model based on association rules and decision tree proposed in this paper is effective, especially in reducing the false positive rate of obvious effect, and has strong practical application [14]. Battini, N. et al. discussed the process of designing and implementing a network intrusion detection system based on data mining and used experiments to verify the prototype system of intrusion detection and to optimize and improve existing problems [15]. J. Zhou et al. used the research of intrusion detection technology based on data mining method as the core, discussed how to apply the clustering algorithm in data mining method in intrusion detection, and tried and proposed a nearest neighbor first algorithm based on the idea of “similar to the same kind” and the shortest distance algorithm [16]. Lin, Z. and others believe that computer intrusion detection systems have very distinct advantages, which is incomparable to previous detection systems. Data mining technology is widely used in intrusion detection system and greatly improved the performance of the intrusion detection system [17].

3. Research Methods

In the computer database, the application of software intrusion detection system plays a very important role and can effectively improve the stability of the computer; it can ensure the safety and efficiency of computer operation to a large extent. At the same time, in the computer database, the application software intrusion detection system can also guarantee the security of information.

3.1. Software Intrusion Detection

3.1.1. Software Intrusion Detection Technology and Classification

Software intrusion detection technology (intrusion detection system, IDS) in the 1980s, as a proactive defense technology, was proposed, by collecting key information in the computer for analysis; then, it can be concluded whether there are violations of security policies and attacked behaviors in the network [18]. Intrusion behavior is divided into internal invasion and external invasion. Internal intrusion mainly refers to the ultra vires behavior of legitimate users; external intrusion refers to the intrusion of hackers or illegal users; intrusion will threaten the integrity, validity, and privacy of network data; and the focus of different intrusion detection technologies is different [19]. Classification of intrusion detection, according to the different results of different objects, anomaly detection, and misuse detection, is divided according to different detection technologies. Network-based and host-based are divided according to different data sources. According to the detection time, it can be divided into real time and nonreal time. The software intrusion detection system model has a unified model and a Snort model, and it is mainly composed of event generator, response unit, and database. The model is shown in Figure 2.

3.1.2. Process Analysis of Software Intrusion Detection

Faced with intrusions, the detection of the network system mainly consists of 4 steps: ① data collection stage, through external sensors or different proxy hosts, in order to search for the initial information of the system, which mainly include user behavior and status and basic data of the network; ② data processing stage, for the different types of data collected, process it, transformed into a uniform format recognized by the computer, and improve the timeliness of testing; ③ data analysis, perform a preliminary analysis of the collected information, through pattern matching with known databases or statistical analysis using probability theory, and transmit the obtained uncertain dangerous data to the control module; and ④ system response, by matching with the rule base, take corresponding countermeasures, such as reconfiguring the router, isolating the intruder’s IP, and modifying file attributes. The software intrusion detection process is shown in Figure 3.

3.2. Application of Data Mining in Software Intrusion Detection and Information Processing

3.2.1. Data Mining Technology

Data mining is in a large amount of fuzzy, noisy, and irregular data and discovers potential and relevant patterns or rules. The realization of data mining is mainly composed of 3 processes: ① the data preparation stage, including data target selection and discovery of operation objects, preprocessing and noise elimination of different types of data, and dimensionality reduction and transformation of data; ② data mining, according to different data mining models, determine the matching mining algorithm and discover potentially relevant data from a large amount of incomplete and irregular data, in order to predict the results; and ③ data representation and evaluation, perform association rules, classification, and cluster analysis on the information obtained by data mining, so as to get the value of mining data, and then express it in a simple and easy-to-understand form and realize the visualization of data. The structure of the data mining system is shown in Figure 4.

3.2.2. Data Mining Algorithm for Software Intrusion Detection

Data mining algorithm for intrusion detection of intrusion software is the most important part of the software intrusion detection system; different data mining algorithms have different advantages and disadvantages for different models; and statistical analysis, feature analysis, change and deviation analysis, and clustering are the frequently used analysis methods of data mining; the association rules are the focus of data mining algorithms and represent the relationship between data. The mathematical description of association rules is as follows: Suppose there is a database , there are pieces of information in the database, each message is , each piece of information is composed of units , and the relationship between them is described as . _{The subset of the database is represented by}_{; if there is}_{, then call the item set}_as; _database_{contains the support degree of item set}_{, denoted by}. _{If there are item sets}_and_{, then, the association rules between them are}where support () is the support degree of item set in database , is the confidence level, and the calculation method is

Therefore, we can use the support and confidence between item set and , in order to determine the association rules between the two projects, assuming that the confidence level of association rule is not less than the minimum confidence level of the item set, and the support of is greater than or equal to the minimum support; that means there is a strong association rule between item sets and ; on the contrary, it means that the association rules between them are extremely weak. The correlation between item sets and can also be expressed by measurement. where the average value of and is and the standard deviation is .

Association rules can extract the correlation between intrusions, and it can then discover potential and related intrusion patterns or rules; through the Apriori algorithm, data mining is performed on the existing intrusion data and get the association rules, and part of the code is:

Aprioribegin
L_I=find_frequent_1-itemset(D);
For(k=2;L_k-1≠φ;k++);
{C_x=apriori(L_k-1, min_sup);
ForeachtransactiontD;//Scan database D
C_t=subset(C_k,t);//Select an associated subset from the candidate set
foreachcandidatecC_t:
returnTRUE:
returnFALSE

3.3. Design of Software Intrusion Detection System Based on Data Mining

In the computer database, using intrusion detection system can effectively improve the efficiency and quality of data detection. In turn, the application of data mining technology can also effectively improve the function and role of the intrusion detection system. The two are in the process of structuring; the main method of use or the method of key use is the correlation analysis method. Through the autonomous function of computer system, we can find the different correlation between them. When the network connection is successful, the system can use the function of network connection to completely analyze the attributes of different parts, in order to analyze and sort out the internal relationship between them, and to effectively analyze from the original data of the network. The results can be summarized through scientific, accurate, and objective analysis of the data without omission. Through the scientific, accurate, and objective analysis of the data, the analysis results can be summarized.

3.4. Overall Design of Software Intrusion Detection System

The performance requirements of the software intrusion detection prototype system mainly include the user scale of the system, concurrent processing capacity, and system response time limit; the specific performance requirements of the software intrusion detection prototype system are shown in Table 1.

In order to realize timely and effective analysis of network data, the author puts the core of the overall design of the software intrusion detection system, defined as the association rules between mining data and the sequence rules between data, according to the classification and identification defined by the rules. Since different system models correspond to different data mining algorithms, therefore, we first need to find a suitable software intrusion detection system. The Snort detection model is a lightweight open source software intrusion detection system and can effectively deal with most cyberattacks; however, the Snort detection model is not efficient, has false positives and false negatives, and cannot perform dynamic detection in real time; therefore, the Snort detection model needs to be improved [20, 21]. The overall design idea is as follows: (1)Add a normal behavior module to the traditional Snort detection model, targeted rule association analysis, and cluster analysis of network behavior; filter out most of the known behavior information according to these rules; and then get abnormal data(2)Match the abnormal data by adding a rule matching module, while reducing false positives and false negatives, improve the detection effect of the system(3)Increase the rule dynamic generation module, so that the new system has a dynamic expansion mechanism; update and iterate the rule base in a timely and effective manner; and improve the completeness of the rule base

The improved Snort system model is shown in Figure 5.

3.4.1. The Realization of Software Intrusion Detection System and Information Processing

Network software intrusion detection based on data mining, through mining and analysis of a large amount of known data, finds out the attack characteristics as the basis for detection. First, data collection is required, and the completeness and accuracy of data collection are the key to system implementation. The author uses the typical representative KDDCUP99 data set, in which the data set is rich in information, contains untrained network data as a test set and a marked training set, and simulates the real network attack environment [22]. The training set contains complete basic information: DOS represents data with attack characteristics, normal represents normal behavior data, U2R represents cross-level access by internal low-level users, R2L represents abnormal visits by external programs, and probing represents the detection and surveillance activities of the system itself. Since the collected raw data contains noise, redundant information cannot do data mining directly; therefore, it is necessary to standardize the data, and the data after the standardized processing, the Apriori decision tree algorithm is used to obtain the association rules and then realize data mining [23, 24]. The algorithm implementation process is as follows: (1)Standardize the collected data and find and discover the decision tree item set(2)Loop processing to obtain the k-item set of the decision tree of the training set(3)Experience each target data to be tested, and obtain the support frequency of the decision tree item set of the target data(4)By calculating the support frequency of the network data packet and the normal option set of the decision tree, in order to determine whether it is abnormal data or normal data and then realize the network software intrusion detection

4. Results Discussion

Experimental verification first needs to build a software and hardware environment; the host server used by the author is Inteli7 processor, 32G memory, and 1 T hard disk; the software environment is VC++6.0 as the development language; the experimental data set is KDDCUP99; the database adopts MySQL8.0.11 version; and the operating system is Windows 7; by verifying the false-positive rate, false-negative rate, and detection time of different network software intrusion detection systems, in order to evaluate the effectiveness of the system, the comparison results of the detection performance of different algorithms are shown in Figure 6.

It can be seen from Figure 6 that the detection system model designed by the author is under the same test sample, and the accuracy rate is 95.67%, which is higher than the other three detection systems; at the same time, the rate of false positives and false negatives is also lower than other systems and has certain advantages. At the same time, in order to verify the timeliness of the algorithm, it is necessary to compare the detection time of different algorithms.In order to verify the detection efficiency of the system, all test sets were used to verify the universality of the system. The specific effect is shown in Figure 7.

It can be seen from Figure 7 that while the algorithm guarantees the detection accuracy, compared with other systems, the detection time also has certain advantages and has certain theoretical and application value.

5. Conclusion

Applying data mining technology to software intrusion detection system can quickly and efficiently perform feature selection, establish a suitable detection model, better improve the software intrusion detection capability of the software intrusion detection system, and reduce its false-positive rate and false-negative rate. The host agent designs the software intrusion detection system. Security software intrusion detection can serve the network server well and avoid losses caused by intrusion and destruction of network servers by unsafe behaviors. Design of the software intrusion detection system management decision center can effectively improve the safety factor of the database and strengthen the security of data information. Research is only one part of data security protection design, and the related technical methods need to be improved. In the computer software intrusion detection system, the application of data mining technology can effectively filter and integrate information, thereby enhancing the role and function of computer software intrusion detection.

Data Availability

The data used to support the findings of this study are available from the corresponding author upon request.

Conflicts of Interest

The author declares that they have no conflicts of interest.

Acknowledgments

This work was supported by the Key Technologies R&D Program of Henan Province under Grant No. 202102210399 (Research on the Secure Sharing Mechanism of General Aviation Flight Data Based on Attribute-based Encryption).

References

Q. Zhou, L. Chen, S. Chen, Q. Cao, and M. Kuang, “Postsurgical multiple-sites sampling procedure for the precise detection of microvascular invasion of hepatocellular carcinoma,” Journal of Clinical Oncology, vol. 37, article e15657, Supplement 15, 2019.
View at: Publisher Site | Google Scholar
S. M. Lee, K. H. Park, S. Y. Kim, Y. M. Kim, S. Hong, and S. Shin, “Cervicovaginal fluid protein microarray for detection of microbial invasion of the amniotic cavity in preterm labor,” Reproductive Sciences, vol. 27, no. 2, pp. 713–721, 2020.
View at: Publisher Site | Google Scholar
G. P. Bombeccari, V. Candotto, A. B. Giannì, F. Carinci, and F. Spadari, “Accuracy of the cone beam computed tomography in the detection of bone invasion in patients with oral cancer: a systematic review,” Eurasian Journal of Medicine, vol. 51, no. 3, pp. 298–306, 2019.
View at: Publisher Site | Google Scholar
D. Romero, B. Sosa, A. Brazeiro, M. Achkar, and J. C. Guerrero, “Factors involved in the biogeography of the honey locust tree (gleditsia triacanthos) invasion at regional scale: an integrative approach,” Plant Ecology, vol. 222, no. 6, pp. 705–722, 2021.
View at: Publisher Site | Google Scholar
K. Pattani and S. Gautam, “Sonicevasion: a stealthy ultrasound based invasion using covert communication in smart phones and its security,” International Journal of Information Technology, vol. 13, no. 4, pp. 1589–1599, 2021.
View at: Publisher Site | Google Scholar
B. Jhih-Hao, H. Min-Shu, H.-C. Liao, M.-W. Lin, and J.-S. Chen, “Prediction of pleural invasion using different imaging tools in non-small cell lung cancer,” Annals of Translational Medicine, vol. 7, no. 2, pp. 33–33, 2019.
View at: Publisher Site | Google Scholar
F. Xin, D. W. Yao, L. Fan, J. H. Liu, and X. D. Liu, “Adenylate kinase 4 promotes bladder cancer cell proliferation and invasion,” Clinical and Experimental Medicine, vol. 19, no. 4, pp. 525–534, 2019.
View at: Publisher Site | Google Scholar
P. L. Lin, K. Y. Chen, H. Ma, C. L. Wang, and Y. J. Lin, “Preliminary study a non-invasion method on early cardiac energy defect based on hilbert huang transform,” Medical Hypotheses, vol. 144, no. 11, article 110205, 2020.
View at: Publisher Site | Google Scholar
J. Wei, K. Peng, J. Zhu, L. Wang, and Q. Lin, “Geranylgeranylation promotes proliferation, migration and invasion of gastric cancer cells through the yap signaling pathway,” American Journal of Translational Research, vol. 12, no. 9, pp. 5296–5307, 2020.
View at: Google Scholar
J. Wan, C. Huang, L. I. Chang-You, H. X. Zhou, and F. H. Wan, “Biology, invasion and management of the agricultural invader: fall armyworm, Spodoptera frugiperda (Lepidoptera: Noctuidae),” Journal of Integrative Agriculture, vol. 20, no. 3, pp. 646–663, 2021.
View at: Publisher Site | Google Scholar
E. K. Alidjinou, N. Lefebvre, A. Dewilde, M. Mki, and I. Engelmann, “Evaluation of the reverse transcription strand invasion based amplification (rt-siba) rsv assay, a rapid molecular assay for the detection of respiratory syncytial virus,” Diagnostic Microbiology and Infectious Disease, vol. 95, no. 1, pp. 55–58, 2019.
View at: Publisher Site | Google Scholar
H. T. Rinonce, R. P. M. Aji, N.’m. Hayati, M. F. Pudjohartono, B. Kameswari, and Irianiwati, “Low braf v600 mutation prevalence in primary skin nodular melanoma in Indonesia: a real-time pcr detection among Javanese patients,” BMC Proceedings, vol. 13, Supplement 11, pp. 15–15, 2019.
View at: Publisher Site | Google Scholar
X. Wang, Y. Cao, M. Ding, J. Liu, and R. Fan, “Oncological and prognostic impact of lymphovascular invasion in colorectal cancer patients,” International Journal of Medical Sciences, vol. 18, no. 7, pp. 1721–1729, 2021.
View at: Publisher Site | Google Scholar
S. I. Ngulde, U. K. Sandabe, R. Abounader, Y. Zhang, and I. M. Hussaini, “Activities of some medicinal plants on the proliferation and invasion of brain tumor cell lines,” Advances in Pharmacological and Pharmaceutical Sciences, vol. 2020, no. 5, p. 7, 2020.
View at: Publisher Site | Google Scholar
N. Battini, C. B. Giachetti, K. L. Castro, A. Bortolus, and E. Schwindt, “Predator–prey interactions as key drivers for the invasion success of a potentially neurotoxic sea slug,” Biological Invasions, vol. 23, no. 4, pp. 1207–1229, 2021.
View at: Publisher Site | Google Scholar
J. Wang, A. Huang, Y. P. Wang, Y. Yin, and J. Zhou, “Circulating tumor dna correlates with microvascular invasion and predicts tumor recurrence of hepatocellular carcinoma,” Annals of Translational Medicine, vol. 8, no. 5, pp. 237–237, 2020.
View at: Publisher Site | Google Scholar
Z. Lin and D. Süsskind, “Exploring the role of baff as biomarker in the detection of uveal melanoma metastases,” Journal of Cancer Research and Clinical Oncology, vol. 147, no. 5, pp. 1389–1405, 2021.
View at: Publisher Site | Google Scholar
C. Yang and Z.-J. Wang, “Microrna-32 inhibits the proliferation, migration and invasion of human colon cancer cell lines by targeting e2f transcription factor 5,” European Review for Medical and Pharmacological Sciences, vol. 23, no. 10, pp. 4156–4163, 2019.
View at: Publisher Site | Google Scholar
S. Shriram, J. Jaya, S. Shankar, and P. Ajay, “Deep learning-based real-time AI virtual mouse system using computer vision to avoid COVID-19 spread,” Journal of Healthcare Engineering, vol. 2021, Article ID 8133076, 8 pages, 2021.
View at: Publisher Site | Google Scholar
A. Sharma, R. Kumar, M. Talib, S. Srivastava, and R. Iqbal, “Network modelling and computation of quickest path for service-level agreements using bi-objective optimization,” International Journal of Distributed Sensor Networks, vol. 15, no. 10, 2019.
View at: Publisher Site | Google Scholar
J. Zhang, S. Guo, Y. Wu, Z. C. Zheng, and Y. Zhao, “P4hb, a novel hypoxia target gene related to gastric cancer invasion and metastasis,” BioMed Research International, vol. 2019, no. 12, p. 13, 2019.
View at: Publisher Site | Google Scholar
A. D. Berry and A. L. Rypstra, “Detection of web builder size via chemical cues present on silk by web- invading cellar spiders (Araneae: Pholcidae),” Animal Behaviour, vol. 172, no. 3, pp. 17–23, 2021.
View at: Publisher Site | Google Scholar
L. Xin, M. Chengyu, and Y. Chongyang, “Power station flue gas desulfurization system based on automatic online monitoring platform,” Journal of Digital Information Management, vol. 13, no. 6, pp. 480–488, 2015.
View at: Google Scholar
R. Huang, S. Zhang, W. Zhang, and X. Yang, “Progress of zinc oxide-based nanocomposites in the textile industry,” IET Collaborative Intelligent Manufacturing, vol. 3, no. 3, pp. 281–289, 2021.
View at: Publisher Site | Google Scholar

Copyright

Copyright © 2022 Xuemin Zhao. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

PDF Download Citation

Download other formats

Order printed copies

Views

375

Downloads

470

Citations