AI Techniques Applied To Intrusion Detection System

Abstract

Network Intrusion Detection is an important tool to detect and analyze security threats to a communication network. It complements other network security techniques, such as firewalls, by providing information about the frequency and nature of attacks. A network intrusion detection system (NIDS) often consists of a sensor that analyzes every packet on the network under observation, and forwards the packets which are deemed interesting, together with an alert message to a backend system, that stores them for further analysis and correlation with other events. newlineThis research work has been designed and executed in three phases, namely, protocol structure standardization, generation of cross over and mutation values for device identification using the genetic approach and the modified J48 decision tree algorithm for search process. The performance of the developed algorithms/methods is compared with the existing methods, and found to be good. newlineIn the first phase, the 64 byte structured protocol standardization technique is developed to identify the intruder. The communication process network is monitored using the wire shark tool, with all possible transactions. The packets are captured and converted as an array. The array consists of the frame information, the source IP, destination IP, source MAC address, destination MAC address, protocol type, hardware device type and data. These details are converted by the 64byte protocol structured standardization. This common protocol structure process is identified the required attributes from the same location; so it is required to minimize the search time of the identification of the MAC and IP address from the packets. newlineIn the second phase, the least and most significant 16 bits of MAC address provide the information about the device manufacture and the product. In the genetic iv approach, the cross over and mutation functions are used to detect the intruder device in comparison with the Current Active Directory List (CADL). newlineIn the third phase, the fitness evaluation proc