Patent Document ID: 10084822
Application ID: 15158605
Patent Flag: 1

Claim One:
1. A detection rules generation engine, comprising one or more processors and/or servers, which alone or in combination, are configured to provide for execution of the following steps: receiving filtered network traffic instances from a network tap and building an initial population of decision trees having nodes which are sorted based on an information gain of network features of the traffic instances; selecting two individuals from the population based on a selection probability, wherein the selection probability is given by: 
 F ( I i )=α f 1 ( I i )+β f 2 ( I i )+γ f 3 ( I i ), where: f 1 (I i ) is the class-based selection function for the i th individual, f 2 (I i ) is the actual fitness function for the i th individual, f 3 (I i ) is the missing classes function of the best individual, and α, β and γ are the weights of f 1 , f 2 and f 3 , respectively (where α+β+γ=1); selecting a depth among the nodes of the decision trees; applying a crossover operation on the selected individuals; applying a mutation operation on the selected individuals; and generating a next population.