Abstract -How to find and detect novel o r unknown network attacks is one of the most important objectives in current intrusion detection systems. In this paper, a rule evolution approach based on Genetic Programming (GP) for detecting novel attacks on network is presented and four genetic operators namely reproduction, mutation, crossover and dropping condition operators a r e used to evolve new rules. New rules are used to detect novel o r known network attacks. A training and testing dataset proposed by DARPA is used to evolve and evaluate these new rules. The proof of concept implementation shows that the rule generated by GP has a low false positive rate (FPR), a low false negative rate (FNR) and a high rate of detecting unknown attacks. Moreover, the rule base composed of new rules has high detection rate (DR) with low false alarm rate (FAR).
Lu et al. proposed a rule evolution approach based on GP to evolve initial rules which were selected based on background knowledge from known attacks REF .
Detecting new forms of network intrusion using genetic programming
The 2003 Congress on Evolutionary Computation, 2003. CEC '03.
The 2003 Congress on Evolutionary Computation, 2003. CEC '03.
Computer Science