Evolutionary Design of Intrusion Detection Programs
Evolutionary Design of Intrusion Detection Programs
复制标题
DOI：
10.6633/ijns.200705.4(3).12
复制
发表时间：
2007-05
期刊：
影响因子：
--
通讯作者：
A. Abraham;C. Grosan;C. Martín-Vide
中科院分区：
文献类型：
--
作者：
A. Abraham;C. Grosan;C. Martín-Vide
入侵检测是监视计算机系统或网络中发生的事件，并分析它们以寻找入侵迹象的过程，定义为试图破坏计算机或网络的机密性，完整性，可用性或绕过安全机制。本文提出了一个入侵检测程序（IDP）的发展，可以检测已知的攻击模式。国内流离失所者并不排除使用任何预防机制，但它是确保系统安全的最后一个防御机制。三个变种的遗传编程技术，即线性遗传编程（LGP），多表达式编程（MEP）和基因表达式编程（GEP）进行了评估，以设计IDP。几个指标用于比较和MEP技术提供了详细的分析。实验结果表明，遗传编程技术可以发挥重要作用，在开发IDP，这是重量轻，准确性相比，一些传统的入侵检测系统的基础上机器学习的范例。
Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of intrusions, defined as attempts to compromise the confidentiality, integrity, availability, or to bypass the security mechanisms of a computer or network. This paper proposes the development of an Intrusion Detection Program (IDP) which could detect known attack patterns. An IDP does not eliminate the use of any preventive mechanism but it works as the last defensive mechanism in securing the system. Three variants of genetic programming techniques namely Linear Genetic Programming (LGP), Multi-Expression Programming (MEP) and Gene Expression Programming (GEP) were evaluated to design IDP. Several indices are used for comparisons and a detailed analysis of MEP technique is provided. Empirical results reveal that genetic programming technique could play a major role in develop- ing IDP, which are light weight and accurate when compared to some of the conventional intrusion detection systems based on machine learning paradigms.