A parallel genetic local search algorithm for intrusion detection in computer networks

Engineering Applications of Artificial Intelligence,Vol. 20, Page 1058-1069, Dec. 2007Authors ： Mohammad Saniee Abadeh, Jafar Habibi,

Zeynab Barzegar and Muna SergiPresent ： Jheng-Hen Jiang2010/7/22 1

Outline

Introduction Related Work Proposed Scheme Experimental Result Conclusions

2010/7/22 2

Introduction

Finding high-quality fuzzy if-then rules to predict the class of input patterns correctly.

Generating low false alarms.

2010/7/22 3

Related Work

Genetic algorithm. Pittsburgh approach.

Michigan approach.

2010/7/22 4

Proposed Scheme(1/7)

2010/7/22 5

Proposed Scheme(2/7)

2010/7/22 66

Initialization

Selection

Crossover

Mutation

Local Search

Replacement

Reinitialization

Internal Termination Test External Termination

Test

Fuzzy Rule Set Pool

Proposed Scheme(3/7)

2010/7/22 7

Initialization

Proposed Scheme(4/7)

2010/7/22 8

Selection

Proposed Scheme(5/7)

2010/7/22 9

Crossover and Mutation

Crossover

Mutation

One-point crossover.

Mrepeat = 50

Proposed Scheme(6/7)

2010/7/22 10

Local search

Fitness(Rj) > Threshold

Change attribute’s value

It’s a fuzzy rule

Reject

Proposed Scheme(7/7)

2010/7/22 11

Replace and Reinitialization

Prep = Replacement percentage of the classifier system.

Fitness(Rj) > Threshold

Change attribute’s value

Experimental Result(1/4)

2010/7/22 12

Experimental Result(2/4)

2010/7/22 13

Experimental Result(3/4)

2010/7/22 14

Experimental Result(4/4)

2010/7/22 15

Conclusions

It can increasing the detection rate and decreasing the false alarm rate.

Training time is decreased by using the suggested parallel learning framework.

Every sub dataset’s class are all the same.

2010/7/22 16