Network Intrusion Detection System using Sequential Clustering and Genetic Classification Algorithms

Intrusion Detection System (IDS) is a topic that has recently secured much interest in the computer security community. The main function of IDS is distinguishing and predicting normal or abnormal behaviors. The problem of intrusion detection has been studied and received a lot of attention in machine learning and data mining in the literature survey. The existing techniques are not effective to improve the classification accuracy and to reduce high false alarm rate. Therefore, it is necessary to propose new technique for IDS. In this work, we propose a new K-means clustering method with a different Preprocessing and Genetic Algorithm for identifying intrusion and classification for both anomaly and misuse. The experiments of the proposed IDS are performed with KDD cup’99 data set. The experiments will clearly results the proposed method provides better classification accuracy over existing method. Introduction: A network intrusion attack can be any use of a network that compromises its stability or the security of information that is stored on computers connected to it. A wide range of activity falls under this definition, including attempt to de-stabilize the network as a whole, gain unauthorized access to files or privileges, simply mishandling and misuse of software. Added security measures can stop all such attacks. The goal of intrusion detection is to build a system which would automatically scan network activity and detect such intrusion attacks. Once an attack is detected, the system administrator could be informed and thus take corrective action. Detecting such abusive not only provides information on damage assessment, but also helps to prevent future attacks. These attacks are usually detected by tools referred to as intrusion detection system. The most popular and well-known data for an intrusion detection system is the audit data. An audit trail refers to the records of all the activities on a system kept in chronological order. Since there exist a record for each activity (which may even correspond to one system call) on the system, theoretically it is possible to manually analyze the source data and detect any abnormal activity on the system. However, the vastness of the audit data provided by an audit collection system often makes manual analysis impractical. Therefore, an automated audit data analysis tool is the only solution. An intrusion detection system (IDS) is software and/or hardware designed to detect unwanted attempts at accessing, manipulating, and/or disabling of computer system, mainly through a network, such as the internet. One of the main challenges in the security management of large-scale high-speed networks (LSHSN) is the detection of anomalies in network traffic. A secure network must provide the following: • Data confidentiality: Data that are being transferred through the network should be accessible only to those that have been properly authorized. • Data integrity: Data should maintain their integrity from the moment they are transmitted to the moment they are actually received. No corruption or data loss is accepted either from random events or malicious activity. • Data availability: The network should be resilient to Denial of Service attacks. In the recent years, as the second line of defense after firewall, the intrusion detection technique has gotten rapidly development. It plays very an important role in attack detection, security check and network inspect. With the rapidly growing connectivity of the internet, network computer systems are increasingly playing vital roles in our modern society. While the internet has brought great benefits to this society, it has also made critical system vulnerable to malicious attacks. Since a preventive approach such as firewall is not sufficient to provide sufficient security for a computer system.