Rule constraint and evolution strategy for network intrusion detection based on gene expression programming

Wan Tang,Ximin Yang,Xia Xie,Yang Cao
2008-01-01
Abstract:The large time and memory space requirement during training data preprocessing and evolution, and high false alarm rate are major drawbacks of network intrusion detection techniques based on evolutionary computation. The intrusion detection rules were representated using gene expression programming (GEP). A formal definition of rule constraint grammar for intrusion detection GEP-based rule was proposed. In order to generate constraint-satisfied rules, the rule constraint judgement and processing was added into GEP basic evolution processes. Finally, the KDD CUP'99 DATA was used for evaluation. In the test set, the probability of detection is 89.79% and false alarm rate is 0.41%. The results indicate that the rules can be generated in small populations and less evolution generation through the proposed constraint and evolution strategy. The rules are effective, simple, and capable of detecting unknown intrusions. The false alarm rate is low remaining the high probability of detection.
What problem does this paper attempt to address?