Detection of Malicious Transactions using Frequent Closed Sequential Pattern Mining and Modified Particle Swarm Optimization Clustering

In current times, with data security being recognised as an irrefutable requirement within an organisation, the importance of institution of intrusion detection system has grown manifolds. Identification of outsider attacks as well as misuse of database privileges by authorised entity has been a primary requirement in modern intrusion detection systems. In this paper we present BIDE (BI-Directional Extension) an efficient algorithm for mining frequent closed sequences without candidate maintenance and modified Particle Swarm Optimization clustering based malicious query detection (BPSOMQD), an advanced approach that detects and prevents malicious transactions from disrupting the consistency of the database. This method incorporates frequent closed sequential pattern mining which forms the basis for generation of data dependency rules. Further to recognise anomalous user activity, modified Particle Swarm Optimization algorithm is proposed which is used to generate role profiles associated with the transaction. A combination of Multilevel Rule Similarity Score (MRSS) between data dependency rules with incoming transaction and Cluster Similarity Index (CSI) with generated role profiles is considered to categorise the transaction as malicious or non-malicious. Experimental evaluation of proposed approach shows remarkable results on a characteristic banking database with accuracies over 92.37%.