Applying genetic algorithm techniques in network intrusion detection systems

Abstract

The Internet has grown to an essential media for human beings that facilitate communication, information searching, banking, marketing, online education and advertising among the numerous use cases that it offers. The benefits that are offered by the Internet are negated due to the fact that the intruders abuse and compromise the Internet through sophisticated cybercrimes and computer crimes. Cybercrime and computer crime has caused great havoc and panic in the Internet usage and network security. As a result it has become very important to protect the information residing in the computer systems that are connected especially to the networks, as it is the primary target for criminal activities. It is impossible to build a completely secure system as intruders find new methods to compromise the system. The least that can be done is to detect the intrusions; in–order to either fix the vulnerability or to avoid the intrusions from re–occurring. One such tool that detects intrusions is an Intrusion Detection System (IDS). However IDSs have their own challenges such as the incapability of detecting new intrusions and generating a multitude of false alarms. The focus of this research is to alleviate the current issues in IDSs by designing a Network IDS using Genetic Algorithms (GAs). The study thus aims at making the intrusion detection process robust by detecting unknown intrusions with less number of false alarms using GA principles. Further, a prototype of an IDS using GAs was developed to substantiate the study and evaluate the effectiveness, uniqueness and flexibility. The results showed that the GA–NIDS proved to be flexible and unique in accepting any format of rule as well as detecting both known and unknown intrusions.