Design of an Evolutionary Approach for Intrusion Detection

Abstract EN

A novel evolutionary approach is proposed for effective intrusion detection based on benchmark datasets.

The proposed approach can generate a pool of noninferior individual solutions and ensemble solutions thereof.

The generated ensembles can be used to detect the intrusions accurately.

For intrusion detection problem, the proposed approach could consider conflicting objectivessimultaneously like detection rate of each attack class, error rate, accuracy, diversity, and so forth.

The proposed approach can generatea pool of noninferior solutions and ensembles thereof having optimized trade-offs values of multiple conflicting objectives.

In this paper, a three-phase, approach is proposed to generate solutions to a simple chromosome design in the first phase.

In thefirst phase, a Pareto front of noninferior individual solutions is approximated.

In the second phase of the proposed approach,the entire solution set is further refined to determine effective ensemble solutions considering solution interaction.

In this phase,another improved Pareto front of ensemble solutions over that of individual solutions is approximated.

The ensemble solutions inimproved Pareto front reported improved detection results based on benchmark datasets for intrusion detection.

In the third phase,a combination method like majority voting method is used to fuse the predictions of individual solutions for determining predictionof ensemble solution.

Benchmark datasets, namely, KDD cup 1999 and ISCX 2012 dataset, are used to demonstrate and validatethe performance of the proposed approach for intrusion detection.

The proposed approach can discover individual solutions andensemble solutions thereof with a good support and a detection rate from benchmark datasets (in comparison with well-knownensemble methods like bagging and boosting).

In addition, the proposed approach is a generalized classification approach that is applicable to the problem of any field having multiple conflicting objectives, and a dataset can be represented in the form of labelled instances in terms of its features.