Detecting New Forms of Network Intrusion Using Genetic Programming

Abstract

-How to find and detect novel o r unknown network attacks is one of the most important objectives in current intrusion detection systems. In this paper, a rule evolution approach based on Genetic Programming (GP) for detecting novel attacks on network is presented and four genetic operators namely reproduction, mutation, crossover and dropping condition operators a r e used to evolve new rules. New rules are used to detect novel o r known network attacks. A training and testing dataset proposed by DARPA is used to evolve and evaluate these new rules. The proof of concept implementation shows that the rule generated by GP has a low false positive rate (FPR), a low false negative rate (FNR) and a high rate of detecting unknown attacks. Moreover, the rule base composed of new rules has high detection rate (DR) with low false alarm rate (FAR).

A Multi-objective Optimisation Approach to IDS Sensor Placement

“…We plot our experiment results in Figure 3, where each point corresponds to a placement's properties in the objective space 3 The results validate our multiobjective optimisation approach and demonstrate that functional trade-offs are indeed possible for sensor placement problem. Figure 3 shows the trend that the more sensors we use, the more attacks we will be able to detect (higher detection rates), whilst the more false alarms (higher false alarm rate) we will have to dismiss.…”

“…These experiments serve as proof of concept and to demonstrate the validity and potential of the proposed approach. Researchers have used Genetic Programming (GP) and Grammatical Evolution to determine IDS detection rules [3], but our experiments reported here report the first use of heuristic optimisation techniques to evolve optimal IDS sensor placements.…”

Genetic Programming Feature Extraction with Different Robust Classifiers for Network Intrusion Detection

“…Lu and Traore [26] used GP to evolve new rules from initially created rules that cover already-known attacks. New rules are generated by four operators including: Mutation, reproduction, crossover and a dropping condition operator.…”

Neural visualization of network traffic data for intrusion detection

“…ID has been approached from several different points of view up to now; many different intelligent and Soft Computing techniques (such as Genetic Programming [2,3], Data Mining [4][5][6][7][8][9][10], Expert Systems [11,12], Fuzzy Logic [13,14], or Neural Networks [15][16][17][18][19][20] among others) together with statistical [21] and signature verification [22] techniques have been applied mainly to perform a 2-class classification (normal/anomalous or intrusive/non-intrusive). Most of these systems can generate different alarms when an anomalous situation is detected, but they can not provide a general overview of what is happening inside a computer network.…”