Abstract
This paper represents the first step in an on-going work for designing an unsupervised method based on genetic algorithm for intrusion detection. Its main role in a broader system is to notify of an unusual traffic and in that way provide the possibility of detecting unknown attacks. Most of the machine-learning techniques deployed for intrusion detection are supervised as these techniques are generally more accurate, but this implies the need of labeling the data for training and testing which is time-consuming and error-prone. Hence, our goal is to devise an anomaly detector which would be unsupervised, but at the same time robust and accurate. Genetic algorithms are robust and able to avoid getting stuck in local optima, unlike the rest of clustering techniques. The model is verified on KDD99 benchmark dataset, generating a solution competitive with the solutions of the state-of-the-art which demonstrates high possibilities of the proposed method.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Goldberg, D.: Genetic Algorithms in Search, Optimization, and Machine Learning. Addison Wesley, Longman (1989)
GAlib A C++ Library of Genetic Algorithm Components, http://lancet.mit.edu/ga/
http://www.wireshark.org (accessed, 2007)
Duda, R.O., Hart, P.E., Stork, D.G.: Pattern Classification, 2nd edn. Wiley InterScience, Chichester (2000)
Bolshakova, N., Azuaje, F.: Cluster Validation Techniques for Genome Expression Data. Signal Processing 83, 825–833 (2003)
KDD Cup 1999 data (October 1999) (accessed, 2006/2007), http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
Bouzida, Y., Cuppens, F.: Detecting Novel and Known Intrusions, IFIP/SEC 2006. In: 21st IFIP TC-11 International Information Security Conference Karlstad University, Karlstad, Sweden (May 2006)
McHugh, J.: Testing Intrusion Detection Systems: A Critique of the 1998 and 1999 DARPA Intrusion Detection System Evaluations as Performed by Lincoln Library. ACM Transactions on Information and System Security 3(4), 262–294 (2000)
Bandyopadhyay, S., Maulik, U.: Nonparametric genetic clustering: comparison of validity indices. IEEE Transactions on Systems, Man, Cybernetics, Part C (2001)
Wang, K., Stolfo, S.J.: Anomalous Payload-based Network Intrusion Detection. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, pp. 203–222. Springer, Heidelberg (2004)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2008 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Banković, Z., Bojanić, S., Nieto, O., Badii, A. (2008). Unsupervised Genetic Algorithm Deployed for Intrusion Detection. In: Corchado, E., Abraham, A., Pedrycz, W. (eds) Hybrid Artificial Intelligence Systems. HAIS 2008. Lecture Notes in Computer Science(), vol 5271. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-87656-4_17
Download citation
DOI: https://doi.org/10.1007/978-3-540-87656-4_17
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-87655-7
Online ISBN: 978-3-540-87656-4
eBook Packages: Computer ScienceComputer Science (R0)