A new feature selection IDS based on genetic algorithm and SVM

Intrusion detection systems (IDS) are the main components of network security. IDSs monitor events of a system in a network, analyze the behavior in order to detect intrusions. One of the IDS models is anomaly based IDS which train to distinguish between normal and abnormal traffic. One of the anomaly based IDSs is based on Genetic algorithm as an evolutionary optimization algorithm. This paper has proposed an anomaly based IDS using Genetic algorithm and Support Vector Machine (SVM) with a new feature selection method. The new model has used a feature selection method based on Genetic with an innovation in fitness function reduce the dimension of the data, increase true positive detection and simultaneously decrease false positive detection. In addition, the computation time for training will also have a remarkable reduction. Results show that the proposed method can reach high accuracy and low false positive rate (FPR) simultaneously, though it had earlier been achieved in earlier studies separately. This study proposes a method which can achieve more stable features in comparison with other techniques. The proposed model experiment and test on KDD CUP 99 and UNSW-NB15 datasets. Numeric Results and comparison to other models have been presented.

I. Introduction

With the rapid progress in Technology and Network based applications, Intrusion detection has become one of the most vital things for security infrastructure, in order to detect, identify and track the attackers or intruders. Performance of an Intrusion Detection system (IDS) has become a concern as the researchers continue searching for an Intrusion Detection technology with high detection accuracy [1]. IDS systems are classified in two models: anomaly and misuse detection. Misuse based IDSs have an attack signature database which collects patterns of known attack. So the IDS can detect any attack which matches the signature in the database. On the other hand, Anomaly based IDS detect intrusions by monitoring system activity classifying to normal activity and any others to abnormal. The classification is based on rules rather than signatures. The big advantage of Anomaly based IDS is the ability to detect more type of unknown attacks [2].