Nannan Lu

An Intrusion-Detection Model Based on Fuzzy Class-Association-Rule Mining Using Genetic Network Programming

As the Internet services spread all over the world, many kinds and a large number of security threats are increasing. Therefore, intrusion detection systems, which can effectively detect intrusion accesses, have attracted attention. This paper describes a novel fuzzy class-association-rule mining method based on genetic network programming (GNP) for detecting network intrusions. GNP is an evolutionary optimization technique, which uses directed graph structures instead of strings in genetic algorithm or trees in genetic programming, which leads to enhancing the representation ability with compact programs derived from the reusability of nodes in a graph structure. By combining fuzzy set theory with GNP, the proposed method can deal with the mixed database that contains both discrete and continuous attributes and also extract many important class-association rules that contribute to enhancing detection ability. Therefore, the proposed method can be flexibly applied to both misuse and anomaly detection in network-intrusion-detection problems. Experimental results with KDD99Cup and DARPA98 databases from MIT Lincoln Laboratory show that the proposed method provides competitively high detection rates compared with other machine-learning techniques and GNP with crisp data mining.

Integrated fuzzy GNP rule mining with distance-based classification for intrusion detection system

With the increased usage of Internet, network security attracts many researchers to propose various kinds of approaches. Data mining techniques are efficient to construct a reliable Intrusion Detection System. Classification is an essential task in data mining. In this paper, a new classification method is proposed to build an accurate and efficient classifier for intrusion detection. The new classification method utilizes the average distances of the new data to its closest neighbor points to classify it as normal or intrusion. Then, the distances of the data to the centroids of normal, misuse intrusion and anomaly intrusion is used to get the accurate class label of the data. In addition, this paper integrates Fuzzy GNP-based class association rule mining method to extract rules. Fuzzy GNP avoids the use of the domain knowledge and solves the continuous attributes efficiently. On the basis of the extracted rules, the multi-feature space is projected into a two-dimensional average matching degree space. The benchmark data KDD Cup 1999 and NSL-KDD are used to evaluate the performance of the proposed method.

Classification based on a multi-dimensional probability distribution and its application to network intrusion detection

With the rapid growth of the Internet, to make sure of the computer security has been a crucial problem, therefore, many techniques for Intrusion detection have been proposed in order to detect network attacks efficiently. On the other hand, data mining algorithms based on Genetic Network Programming (GNP) have been proposed recently. GNP is a graph-based evolutionary algorithm and can extract many important class association rules by making use of the distinguished representation ability of the graph structures. In this paper, a probabilistic classification is proposed and combined with the class association rule mining of GNP, and applied to Network intrusion detection for the performance evaluation. The proposed method creates a joint probability density function of normal and intrusion accesses and use it to efficiently classify new access data into normal, known intrusion or unknown intrusion. It is clarified from the experimental results that the proposed method shows high classification accuracy compared to the method without probabilistic classification.