I. INTRODUCTION DARPA dataset covers four major categories of attacks: Denial of Service (DOS),

The big item in the news lately from a cyber security standpoint has been Distributed Denial of Service (DDoS) attacks, their frequency and size being the two big sticking points for the media. The one thing that the media tends not to do is explain what a DDoS is, what attack vector was used, realistically all the information that leads to a clear picture of what really happened during the attack. With that this paper will explain the process from beginning to end of a DDoS attack in a way that is easy to understand and hopefully debunks a lot of the misconceptions about DDoS that have been posted in class discussion.

CSEC 630 Lab2 -Intrusion Detection System and Protocol Analysis Lab (n.d.). University of Maryland University College. Retrieved from: https://learn.umuc.edu/d2l/common/viewFile.d2lfile/Database/NzkyMzkw/CSEC630_lab2_LEO.pdf?ou=33745

In the next step of catching the fraud, the application helps to narrow down interesting traffic worked like its diagnosing networking issues by logging events from all providers. When assisted support or further troubleshooting is necessary, the improved network trace logs can enable developers and support professionals to quickly isolate network activities and view the combined event data and packet captures in a single file, grouped by a network task and the related network activity. The output file, the messages will provide the Log Analytics where it offers predefined of common event log names. You can find the full name of user, time of access, privilege used. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). Using Event ID is just one way, where the EventlD is a rich database of logging events. However, it’s not the only way of detecting and monitoring network traffic for fraud or intrusion. There are an open source tools and paid software, nevertheless we offer our suggestion for whom love programming and creative way. This solution came based on variety researches and experiment that held back in our school Bowie State University, as we are pursuing the perspective of being updated with technology, we also welcoming of the old research cause all what we have today its based of invested yesterday mistakes and flows.

1. What are the four basic classic threats to IT systems and data? Give an example of each.

Nowadays, data mining and machine learning become rapidly growing topics in both industry and academic areas. Companies, government laborites and top universities are all contributing in knowledge discovery of pattern recognition, text categorization, data clustering, classification prediction and more. In general, data mining is the technique used to analyze data from multi perspectives and reveal the hidden gem behind the enormous amount of data. With the explosive growth of data collections, it becomes time-consuming less effective to extract valuable information from massive databases through the use of traditional data analysis methods. An alternative way to solve this problem is to apply data mining, given considerations

Data Mining is defined as extracting information from huge sets of data. In other words, we can say that data mining is the procedure of mining knowledge from data. There is a huge amount of data available in the Information Industry. This data is of no use until it is converted into useful information. It is necessary to analyse this huge amount of data and extract useful information from it. Extraction of information is not the only process we need to perform; data mining also involves other processes such as Data Cleaning, Data Integration, Data Transformation, Data Mining, Pattern Evaluation and Data Presentation [12].

The possibility of signs of cyber security incidents may arise every day and recorded or logged in security software, but it will be difficult to trace each one of threats as high importance and low importance. Based on requirements organization need to identify the most applicable software for detecting and logging the cyber-attack, It is not only the case of logging and monitoring cyber-attack analysis is very important part need to be considered before choosing any software.

Association rule mining may be assumed as positive association rule mining. Effective affiliation rule is verbalized as ‘‘if individual purchase the item like spread and bread, at

Incidents are defined as the 'exploiting of a vulnerability to attack the confidentiality, integrity or availability of an information system' [Pfleeger]. Specifically, NBA is designed to detect abnormal traffic flows from DoS attacks, reconnaissance of the network, data ex-filtration (IDPS is also one of the few defenses against the troublesome 'insider threat'), and other attacks that traverse the internal network;

To perform adaptive cyber-security analytics using a computer implemented method that includes receiving a report on a network activity, It works as follows, a scoring method is used wherein a score responsive to the network activity is calculated. The score indicates a likelihood of security breach. This score is validated and the scoring model is automatically updated, responsive to the results of the validation. If the score falls within a threshold value of a security violation rule, the network activity is reported as suspicious. This basically relates generally to cyber-security monitoring, and more particularly to monitoring incoming security events to determine if any activity is violating security rules.

Data mining is the process of extracting useful knowledge from large databases or data warehouses. It can be also said as a set of mathematical functions and data manipulation techniques to extract useful data from databases. Data mining can also be said as knowledge discovery process in other words. It explores a large collection of data into a meaningful patterns and rules based on the queries provided by users using data mining query language. The meaningful patterns and rules are generated by analysing the database. Data mining makes use several techniques such as clustering, classification, association rule mining and so on to generate the meaningful patterns from the databases. The purpose of this report is to describe how data are prepared for data

The whole set of association rules on FCI (frequent closed item sets) can be mined By using CLOSET algorithm we can worthily mine the frequent closed item sets.

This technique follows the same notion of how human brain works. It consists of collection of highly interconnected processing elements that convert a set of given inputs to a set of desired outputs. The widely used neural network for intrusion detection is Multilayer Perceptions (MLP).Neural Network based intrusion detection systems are intended to classify the normal and intrusion patterns and the type of the attack. For this purpose, the network is trained on various types of attacks and normal data. One input node is present for each element of the feature vector, and one output node for each class, to which a feature may be assigned, as shown in fig.4. The nodes in the hidden layer are connected to the input

Knowledge based detection Technique can be used for both signature based IDS as well as anomaly based IDS. It accumulates the knowledge about specific attacks and system vulnerabilities. It uses this knowledge to exploit the attacks and vulnerabilities to generate the alarm. Any other event that is not recognized as an attack is accepted. Therefore the accuracy of knowledge based intrusion detection systems is considered good. However their completeness requires that their knowledge of attacks be updated regularly [29].

These necessities have prompted the conception of Data Mining that has been changing the live from the data age toward the coming information age. A considerable amount of literature has been published on Data Mining and the aim of this survey is concerned with the ideas behind the processes; purpose and techniques of Data Mining. [1][2]