Comparing local search with respect to genetic evolution to detect intrusions in computer networks
Abstract
The detection of intrusions over computer networks (i.e., network access by non-authorized users) can be cast to the task of detecting anomalous patterns of network traffic. In this case, models of normal traffic have to be determined and compared against the current network traffic. Data mining systems based on genetic algorithms can contribute powerful search techniques for the acquisition of patterns of the network traffic from the large amount of data made available by audit tools. We compare models of network traffic acquired by a system based on a distributed genetic algorithm with the ones acquired by a system based on greedy heuristics. Also we provide an empirical proof that representation change of the network data can result in a significant increase in the classification performances of the traffic models. Network data made available from the Information Exploration Shootout project and the 1998 DARPA Intrusion Detection Evaluation have been chosen as experimental testbed.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Murray et al., 2014 used genetic algorithms to develop simple rules for network traffic.
“Murray et al., 2014 [174] used genetic algorithms (GA) to develop simple rules for network traffic.”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [174]
Cites
Genetic algorithms in search, optimization, and machine learning
(1989) · Choice Reviews Online · doi:10.5860/choice.27-0936 · Cited by 49,169 · see citing works
(1992) · Cited by 23,431 · see citing works
Goldberg, D. E. (1989) · Medical Entomology and Zoology · Cited by 10,030 · see citing works
Cohen, W. W. (1995) · Elsevier eBooks · doi:10.1016/b978-1-55860-377-6.50023-2 · Cited by 3,890 · see citing works
Denning, D. E. (1987) · IEEE Transactions on Software Engineering · doi:10.1109/tse.1987.232894 · Cited by 3,428 · see citing works
A Sense of Self for Unix Processes
Forrest, S., Hofmeyr, S. A., Somayaji, A., et al. (1996) · Cited by 1,104 · see citing works
A theory and methodology of inductive learning
Michalski, R. S. (1983) · Computer Compacts · doi:10.1016/0167-7136(83)90132-4 · Cited by 776 · see citing works
Learning Program Behavior Profiles for Intrusion Detection
Ghosh, A. K., Schwartzbard, A., & Schatz, M. X. (1999) · Cited by 399 · see citing works
Mining in a data-flow environment
Lee, W., Stolfo, S. J., & Mok, K. W. (1999) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/312129.312212 · Cited by 223 · see citing works
A Theory and Methodology of Inductive Learning
Michalski, R. S. (1983) · Springer eBooks · doi:10.1007/978-3-662-12405-5_4 · Cited by 222 · see citing works
A THEORY AND METHODOLOGY OF INDUCTIVE LEARNING
Michalski, R. S. (1983) · Machine Learning · doi:10.1016/b978-0-08-051054-5.50008-x · Cited by 206 · see citing works
Search-Intensive Concept Induction
Giordana, A., & Neri, F. (1995) · Evolutionary Computation · doi:10.1162/evco.1995.3.4.375 · Cited by 189 · see citing works
Self-citationAn Application of Machine Learning to Anomaly Detection
Lane, T. D. R. (1999) · Cited by 182 · see citing works
A Coevolutionary Approach to Learning Sequential Decision Rules
Potter, M. A., Jong, K. A. D., & Grefenstette, J. J. (1995) · Cited by 143 · see citing works
Approaches to online learning and concept drift for user identification in computer security
Lane, T. D. R., & Brodley, C. E. (1998) · Cited by 120 · see citing works
Results of the DARPA 1998 offline intrusion detection evaluation
Lippmann, R. P., Cunningham, R. K., Fried, D. J., et al. (1999) · Recent Advances in Intrusion Detection · Cited by 91 · see citing works
Exploring the power of genetic search in learning symbolic classifiers
Neri, F., & Saitta, L. (1996) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/34.544085 · Cited by 48 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265 · see citing works
- Authors
- Neri, F.
- Affiliations
- Università degli Studi del Piemonte Orientale “Amedeo Avogadro” (IT)
- Corresponding author
- Neri, F.
- ORCID
- Neri, F.
- Venue
- Proceedings of the 2000 Congress on Evolutionary Computation. CEC00 (Cat. No.00TH8512)
- Publisher
- IEEE
- Published
- 2002-11-07
- Volume
- 1
- Pages
- 238-243
- OpenAlex
- W2104247747
- Cited by
- 24
- References
- 17
- Citations by year
- 2024: 1 · 2023: 3 · 2020: 1 · 2016: 2 · 2015: 1 · 2014: 1 · 2012: 1
- FWCI
- 0.93
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE Congress on Evolutionary Computation (CEC) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- intrusion detection, network traffic anomaly detection, genetic algorithm, local search, greedy algorithm, distributed genetic algorithm, network traffic modeling, classification performance
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
