Comparing local search with respect to genetic evolution to detect intrusions in computer networks

Published 7 November 2002

Filippo Neri

DOI10.1109/cec.2000.870301

Citations25

TL;DR

This work provides an empirical proof that representation change of the network data can result in a significant increase in the classification performances of the traffic models and compares models of network traffic acquired by a system based on a distributed genetic algorithm with the ones acquired by one based on greedy heuristics.

Abstract

The detection of intrusions over computer networks (i.e., network access by non-authorized users) can be cast to the task of detecting anomalous patterns of network traffic. In this case, models of normal traffic have to be determined and compared against the current network traffic. Data mining systems based on genetic algorithms can contribute powerful search techniques for the acquisition of patterns of the network traffic from the large amount of data made available by audit tools. We compare models of network traffic acquired by a system based on a distributed genetic algorithm with the ones acquired by a system based on greedy heuristics. Also we provide an empirical proof that representation change of the network data can result in a significant increase in the classification performances of the traffic models. Network data made available from the Information Exploration Shootout project and the 1998 DARPA Intrusion Detection Evaluation have been chosen as experimental testbed.

Keywords

Computer Science

Choice Reviews OnlineGenetic algorithms in search, optimization, and machine learning

49,278 Citations1989

This book brings together the computer techniques, mathematical tools, and research results that will enable both students and practitioners to apply genetic algorithms to problems in many fields.

C4.5: Programs for Machine Learning

23,665 Citations1992J. R. Quinlan

A complete guide to the C4.5 system as implemented in C for the UNIX environment, which starts from simple core learning methods and shows how they can be elaborated and extended to deal with typical problems such as missing data and over hitting.

Elsevier eBooksFast Effective Rule Induction

3,767 Citations1995William W. Cohen

This paper evaluates the recently-proposed rule learning algorithm IREP on a large and diverse collection of benchmark problems, and proposes a number of modifications resulting in an algorithm RIPPERk that is very competitive with C4.5 and C 4.5rules with respect to error rates, but much more efficient on large samples.

IEEE Transactions on Software EngineeringAn Intrusion-Detection Model

3,358 Citations1987Dorothy E. Denning

Computer CompactsA theory and methodology of inductive learning

778 Citations1983Ryszard S. Michalski

Learning program behavior profiles for intrusion detection

401 Citations1999A. K. Ghosh, Aaron Schwartzbard +1 more

Three anomaly detection techniques for prooling program behavior that evolve from memorization to generalization are presented, which start from a simple equality matching algorithm for determining anomalous behavior, and evolve to a feed-forward backpropagation neural network for learning program behavior.

Machine LearningA Theory and Methodology of Inductive Learning

231 Citations1983Ryszard S. Michalski

Mining in a data-flow environment

223 Citations1999Wenke Lee, Salvatore J. Stolfo +1 more

It is shown that in order to minimize the time required in using the classification models in a real-time environment, the “necessary conditions” associated with the lowcost features can be exploited to determine whether some high-cost features need to be computed and the corresponding classification rules need to been checked.

View PDF

Machine LearningA THEORY AND METHODOLOGY OF INDUCTIVE LEARNING

205 Citations1983Ryszard S. Michalski

The presented theory views inductive learning as a heuristic search through a space of symbolic descriptions, generated by an application of various inference rules to the initial observational statements.

Evolutionary ComputationSearch-Intensive Concept Induction

191 Citations1995Attilio Giordana, Filippo Neri

Regional, a distributed genetic algorithm-based system, designed for learning first-order logic concept descriptions from examples, suggests that genetic search may be a valuable alternative to logic-based approaches to learning concepts, when no (or little) a priori knowledge is available and a very large hypothesis space has to be explored.