abstract
Security threats against computer networks and the Internet have emerged as a major and increasing area of concern for end-users trying to protect their valuable information and resources from intrusive attacks. Due to the amount of data to be analysed and the similarities between attack and normal traffic patterns, intrusion detection is considered a complex real world problem. In this paper, we propose a solution that uses a genetic algorithm to evolve a set of simple, interval-based rules based on statistical, continuous-valued input data. Several innovations inthe genetic algorithmwork to keep the ruleset small. We first tune the proposed system using a synthetic data. We then evaluate our system against more complex synthetic data with characteristics associated with network intrusions,the NSL-KDD benchmark dataset, and another dataset constructed based on MIT Lincoln Laboratory normaltraffic and the low-rate DDoS attack scenario from CAIDA. This new approach provides a very compact set of simple, humanreadable rules with strongly competitive detection performance in comparison to other machine learning techniques.
