Intelligent algorithms for effective network intrusion detection

Abstract

This research work proposes a novel intrusion detection system using a new framework that provides both anomaly and misuse detection paradigms. This hybrid framework consists of misuse detection, supervised anomaly detection and unsupervised anomaly detection. Each of these three modules employ new ensemble machine learning techniques such as neurotree, neuro-genetic and genetic-X-means for supervised misuse detection, supervised anomaly detection and unsupervised anomaly detection respectively for detecting intrusive activities in networks. The main objective of this module is to improve the generalization ability of the decision making process using neural network and also to improve the comprehensibility using decision tree. In this work, weight adjustment is carried out using a genetic algorithm in the training phase since genetic algorithm used in this work is capable of optimizing the weights of neural network. This genetic-X-means algorithm handles the newly evolving attacks by grouping them into new classes and the known attacks into their respective classes. This work focuses mainly on increasing the detection accuracy and to reduce the false positive rates. Finally, the neuro-genetic approach proposed and implemented in this work has been compared with the conventional NN and GA based approaches that are used for network intrusion detection. In all these three algorithms, GA has been used for feature selection since genetic paradigm employs a weighted sum fitness function to choose the predominant features, which correctly identifies the occurrence of intrusions. The major contributions of this work are the proposal of genetic based feature selection, an error function based on false positive rate and false negative rate in the learning algorithm, weight adjustment in neural networks using genetic algorithm and improvement in detection accuracy through effective clustering and classification. newline newline newline