Source-linked AI summary
An Implementation of Intrusion Detection System Using Genetic Algorithm
Mohammad Sazzadul Hoque, Md. Abdul Mukit, Md. Abu Naser Bikas
TL;DR
Existing intrusion detection systems are not fully effective against network intrusions, motivating more dynamic approaches. This paper applies a genetic algorithm to an IDS and reports reasonable detection on KDD’99, including better detection for denial-of-service and user-to-root classes than the winning entry.
Problem
Existing commercial intrusion detection systems are described as relatively ineffective and insufficient, motivating research into more dynamic systems.
Method
The paper builds an intrusion detection system with a genetic algorithm whose detection phase uses selection, crossover, and mutation to predict test-data types.
Results
On KDD’99, the system obtained a reasonable detection rate (DR = 0.9500) and better detection than the winning entry for denial-of-service and user-to-root classes.
Takeaways & Limitations
The paper concludes that its genetic-algorithm IDS can efficiently detect various network intrusions on the KDD’99 benchmark dataset.
Takeaways & Limitations
The paper notes that collected IDS data can be destroyed or modified before analysis, causing misinterpretations or missed intrusion events.
Abstract
from arXiv · showhide
Nowadays it is very important to maintain a high level security to ensure safe and trusted communication of information between various organizations. But secured data communication over internet and any other network is always under threat of intrusions and misuses. So Intrusion Detection Systems have become a needful component in terms of computer and network security. There are various approaches being utilized in intrusion detections, but unfortunately any of the systems so far is not completely flawless. So, the quest of betterment continues. In this progression, here we present an Intrusion Detection System (IDS), by applying genetic algorithm (GA) to efficiently detect various types of network intrusions. Parameters and evolution processes for GA are discussed in details and implemented. This approach uses evolution theory to information evolution in order to filter the traffic data and thus reduce the complexity. To implement and measure the performance of our system we used the KDD99 benchmark dataset and obtained reasonable detection rate.
1. INTRODUCTION
The introduction frames intrusion detection as a response to attacks and misuse, defines intrusions as attempts to compromise computer resources, and motivates research into more dynamic systems because many commercial implementations are ineffective. It also outlines the paper’s progression from prior work and IDS background through system implementation, performance analysis, and conclusions.
- Motivation: Intrusion detection was proposed to counter computer and networking attacks and misuse, but many commercial systems remain relatively ineffective and insufficient.This shortcoming motivates research on more dynamic intrusion detection systems.
- Definitions: An intruder is a system, program, or person attempting to break into an information system or perform an unauthorized action.The paper defines intrusion as actions attempting to compromise the integrity, confidentiality, or availability of a computer resource.
- Paper organization: The paper is organized around prior work, IDS concepts and existing-system problems, the proposed system and implementation, performance analysis, and conclusions.These topics are covered in Sections 2 through 8, respectively.
2. RELATED WORKS
Prior work applied genetic algorithms and genetic programming to network intrusion detection for classification-rule derivation, feature selection, parameter optimization, and traffic filtering. These approaches reported benefits including low complexity, higher detection rates, and low false positives, but also faced implementation, communication, data, and time constraints.
- Soft Computing Approaches: Genetic algorithms and genetic programming were used in network intrusion detection to derive classification rules, select features, and optimize minimal core-function parameters.These methods were applied with different artificial-intelligence techniques and across different intrusion-detection scenarios.
- Earlier Genetic Approaches: In 1995, Crosbie and Spafford applied multiple-agent technology and genetic programming to detect network anomalies, with each agent monitoring one network-audit parameter.The approach benefited from many small autonomous agents but had communication problems among agents.
- Classification and Detection: Li used quantitative and categorical network features with a genetic algorithm to derive anomalous-intrusion classification rules, although no experimental results were available.Including quantitative features could increase the detection rate, according to the passage.
- Classification and Detection: Goyal and Kumar classified all types of smurf attacks with a genetic algorithm, reporting a 0.2% false positive rate and an almost 100% detection rate.The algorithm used a training dataset.
- Fitness Functions and Information Theory: Lu and Traore used genetic programming with a support-confidence fitness framework to classify several intrusions, while Xiao et al. combined mutual information, linear rules, and genetic algorithms to reduce complexity and increase detection rate.Lu and Traore’s genetic-programming implementation required more data and time for training; Gong et al. also used support-confidence to judge genetic-algorithm fitness, while Abdullah et al. used information theory to filter traffic data.
3. INTRUSION DETECTION OVERVIEW
The overview classifies network attacks into four categories and intrusion detection into host-based and network-based systems. It also describes IDS components, analysis approaches, and their stated limitations.
- Networking attacks: Network attacks are grouped into Denial of Service (DoS), Remote to User Attacks (R2L), User to Root Attacks (U2R), and Probing.DoS denies legitimate access by exhausting resources; R2L seeks local-user privileges remotely; U2R escalates normal-user access; probing scans for exploitable weaknesses.
- Intrusion detection classifications: Intrusion detection is classified into Host Based Intrusion Detection, which evaluates host information, and Network Based Intrusion Detection, which analyzes network packet streams.HIDS examines operating-system, system, and application-file contents, whereas NIDS evaluates captured network communications.
- IDS components: An IDS consists of a data-source event generator, an analysis engine, and a response manager.Data sources include host-, network-, application-, and target-based monitors; the response manager acts when possible intrusions are found.
- Analysis approaches: The analysis engine uses misuse/signature-based detection, anomaly/statistical detection, or both to examine data for attacks or policy violations.Signature-based detection follows known attack patterns, while anomaly-based detection searches for rare or unusual activity using statistical techniques.
- Analysis limitations: Signature-based detection may miss unknown future intrusions, while anomaly-based detection is highly expensive and can misclassify intrusive behavior as normal with insufficient data.These limitations are stated as the principal disadvantages of the respective approaches.
4. EXISTING SYSTEMS AND THEIR PROBLEMS
The section reviews representative intrusion detection systems and identifies three recurring weaknesses: fidelity, resource usage, and reliability. These problems arise from potentially altered or incomplete data, continuous monitoring overhead, and susceptibility to program tampering.
- Existing Systems: Existing systems include network, host-based, security-management, and analysis tools such as Snort, OSSEC, OSSIM, Suricata, Bro, BASE, and Sguil.Their functions range from protocol analysis and log monitoring to integrated network visibility and real-time alert analysis.
- System Problems: The fidelity problem occurs because audit or packet data may be modified or destroyed before reaching the IDS, causing misinterpretations or missed events.The IDS must infer system behavior from collected data, which may not faithfully represent the original activity.
- System Problems: The resource usage problem results from IDS components continuously consuming monitoring-system resources even when no intrusion is occurring.These components must remain active at all times to detect intrusions.
- System Problems: The reliability problem arises because separately implemented IDS programs can be tampered with, disabled, or modified by an intruder.Such tampering can render the intrusion detection system useless or unreliable.
5. OUR IDS USING GENETIC ALGORITHM
The proposed intrusion detection system uses a genetic algorithm, whose overview and implementation are presented through general evolutionary operations and a two-phase design. Training data produces comparison chromosomes, while testing applies fitness evaluation and genetic operators to predict intrusion types.
- System overview: The IDS is implemented using a genetic algorithm to support intrusion detection.The section provides an overview of both the algorithm and the system.
- Genetic algorithm: GA evolves chromosome-based candidate solutions through selection, recombination, and mutation using an evolutionary optimization strategy.Chromosomes represent candidate solutions, with positions encoded as genes.
- Precalculation phase: The system has precalculation and detection phases, with training data used to create chromosomes for later comparison.The precalculated chromosome set is used in the detection phase.
- Precalculation phase: During precalculation, training records within Range = 0.125 are merged with the nearest chromosome; otherwise, a new chromosome is created.This procedure initializes chromosomes for comparison from network audit data.
- Detection phase: During detection, test data initializes a population whose chromosomes are evaluated against precalculated chromosomes before selection, crossover, mutation, and intrusion-type prediction.The specified rates are CrossoverRate = 0.15 and MutationRate = 0.35.
6. OUR IMPLEMENTATION
The implementation evaluates the genetic-algorithm IDS on the KDD 99 benchmark, using selected numerical connection features and a staged chromosome-based detection process. Training organizes chromosomes by attack and normal data, while testing iteratively evolves populations for classification.
- The system uses the KDD Cup 1999 standard computer-network intrusion-detection dataset to implement and evaluate the algorithm.
- Each network connection is represented by 41 features, but implementation considers only continuous and discrete numerical features to simplify processing.
- The dataset simulates a military network over seven weeks, with attacks categorized as User to Root, Remote to Local, Denial of Service, or Probe.
- The training set is kddcup.data_10_percent with 494,021 records, while corrected testing contains 311,029 records.
- Precalculation phase: During precalculation, 23 chromosome groups represent attack and normal training data, with group sizes varying by data quantity and relationships.
- Testing / detection phase: For each test record, mutation creates an initial population, loosely related candidates are removed, and crossover and mutation continue until generation size reaches one.
7. EXPERIMENTAL RESULTS AND ANALYSIS
The genetic-algorithm intrusion detection system performs well for most classes, with stronger detection than KDD’99’s winning entry for denial of service and user-to-root intrusions. Its overall detection rate is 0.9500, while the false positive rate is 0.3046.
- Confusion-matrix analysis: The system performs well for most intrusion classes, but normal-data performance is weaker because nonnumerical features were ignored.Compared with KDD’99’s winning entry, detection is better for denial of service and user-to-root, and close for probe and remote-to-local.
- Standard metrics: Detection rate is reported for each data type using Figure 2.The paper also evaluates the system with accuracy, detection rate, and false positive rate as standard metrics.
- Standard metrics: 0.9500 detection rate (DR) is obtained from Table 3.DR is the ratio of correctly detected intrusions to total intrusions.
- Standard metrics: 0.3046 false positive rate (FP) is obtained from Table 3.FP is the ratio of normal connections incorrectly classified as intrusions to total normal connections.
8. CONCLUSIONS
The paper presents an Intrusion Detection System using a genetic algorithm to detect network intrusions, evaluated on the standard KDD99 benchmark dataset with a reasonable detection rate.
- Conclusions: The implemented IDS applies a genetic algorithm to efficiently detect various types of network intrusions.The approach measures chromosome fitness using a standard deviation equation with distance.
- Conclusions: The system was implemented and evaluated using the standard KDD99 benchmark dataset, obtaining a reasonable detection rate.The authors suggest that a better equation or heuristic could improve detection performance.
Authors
The authors are computer science researchers from Shahjalal University of Science and Technology, Bangladesh, whose interests include network security, intrusion detection, and intrusion prevention.
- Mohammad Sazzadul Hoque and Md. Abdul Mukit are B.Sc. students researching computer and network security, intrusion detection, and intrusion prevention.
- Md. Abu Naser Bikas is a lecturer at Shahjalal University of Science and Technology with interests spanning network security, intrusion detection, intrusion prevention, VANET, Bangla OCR, and grid computing.He obtained his B.Sc. degree from the same university.
- Md. Abu Naser Bikas has published approximately 12 research papers in international journals and proceedings.