Data mining

Data mining is a growing collection of computational techniques for automatic analysis of structured, semi-structured, and unstructured data with the purpose of identifying important trends and previously unknown behavioral patterns. Data mining is widely recognized as the most important and central technology for homeland security in general and for cyber warfare in particular. This chapter covers the following relevant areas of data mining: • Web mining is the application of data mining techniques to web-based data. While Web usage mining is already used by many intrusion detection systems, Web content mining can lead to automated identification of terrorist-related content on the Web. • Web information agents are responsible for filtering and organizing unrelated and scattered data in large amounts of web documents. Agents represent a key technology to cyber warfare due to their capability to monitor multiple diverse locations, communicate their findings asynchronously, collaborate with each other, and profile possible threats. • Anomaly detection and activity monitoring. Real-time monitoring of continuous data streams can lead to timely identification of abnormal, potentially criminal activities. Anomalous behavior can be automatically detected by a variety of data mining methods.