Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 1,148

The DOI matches its Crossref record; 10 of the 10 references it cites were found in a registry or an index.

A data mining framework for building intrusion detection models

Open access
Wenke Lee, Stolfo, S.J., Mok, K.W.·2003·Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)
DOI 10.1109/secpri.1999.766909
Open this paper in CoChat — free account

Abstract

There is often the need to update an installed intrusion detection system (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. We describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learning, association rules, and frequent episodes. We report on the results of applying these programs to the extensively gathered network audit data for the 1998 DARPA Intrusion Detection Evaluation Program.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/secpri.1999.766909

Cites

10 of 10 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 10 references

Cited by

See all 1,148

Metadata

Authors
Lee, W., Stolfo, S. J., & Mok, K. W.
Venue
Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)
Publisher
IEEE Comput. Soc
Published
2003-01-20
Pages
120-132
ISSN
1081-6011 (ISSN-L)
DOI
10.1109/secpri.1999.766909
OpenAlex
W1884606608
Cited by
1,148
References
10
FWCI
44.35
Type
conference paper
Language
en
Open access
green

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: A data mining framework for building intrusion detection models. https://app.cochat.ai/papers/10.1109/secpri.1999.766909
The paper
Lee, W., Stolfo, S. J., & Mok, K. W. (2003). A data mining framework for building intrusion detection models. Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344). https://doi.org/10.1109/secpri.1999.766909

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.