Search

Advancements in Information and Communication Technology have led to widespread use of Internet and deployment of services that can be electronically accessed over a computer network. However, the security of computer networks has become a critical issue due to infrastructural vulnerabilities. One of the approaches to address this issue is to build efficient intrusion detection models which can detect and raise appropriate alerts in the event of any possible attacks. In this work, we try to develop intrusion detection models based on fuzzy-rough classifiers. Our main objective is to improve the intrusion detection accuracy and reduce false alarms as far as possible through hybridization of fuzzy-rough set based classification techniques such as Fuzzy NN, Fuzzy Rough NN, Fuzzy Ownership NN, Vaguely Quantified Nearest Neighbors and Ordered Weighted Average Nearest Neighbors for classifying intrusion data. The standard NSL-KDD data set has been used to experiment and evaluate the performance of the proposed hybrid models along different evaluation criteria such as accuracy, detection rate, precision, and false alarm rate.

Intrusion Detection Systems (IDS) are intended to protect computer networks from malicious users. Several data mining techniques have been used to build intrusion detection models for analyzing anomalous behavior of network users. However, the performance of such techniques largely depends on their ability to analyze intrusion data and raise alarm whenever suspicious activities are observed. In this paper, some rule based classification techniques, viz., Decision Table, DTNB, NNGE, JRip, and RIDOR have been applied to build intrusion detection models. Further, in order to improve the performance of the classifiers, six rank based feature selection methods, viz., Chi squared attribute evaluator, One-R, Relief-F, information Gain, Gain Ratio, and Symmetrical Uncertainty have been employed to select the most relevant features. Performance of different combinations of classifiers and feature selection techniques have been studied using a set of performance criteria, viz., accuracy, precision, detection rate, false alarm rate, and efficiency.

Current techniques used for network intrusion detection have limited capabilities in coping with the dynamic and increasingly complex nature of security threats. In this paper, we propose a classification model for detecting intrusions based on Genetic Programming, Artificial Immune Recognition Systems AIRS1, AIRS2, and Clonal Selection Algorithm CLONALG. Further, six Rank based, viz., Information Gain, Gain ratio, Symmetrical Uncertainty, Chi squared Attribute Evaluator, Relief-F, and one-R; and five search based feature selection methods, viz., PSO Search, Genetic Search, Best First Search, Greedy Stepwise, and Rank Search have been employed to select the most relevant attributes before classification. The performance of the model has been evaluated in terms of accuracy, precision, detection rate, F-value, false alarm rate, and fitness value.

The worldwide rapid expansion of computer networks and ever growing dependence of organizations on network based information management have led to serious security concerns. Among other security threats network intrusion has been a major concern which requires considerable attention in order to protect the information resources that are accessible via network infrastructure. Though different intrusion detection approaches have been experimented but none of them can guarantee complete protection against network intrusions. Furthering research in this direction, we have been exploring the use of soft computing techniques to analyze intrusion data in order to detect intrusive behavior in network access patters. In this paper, we have carried out some experiments using techniques such as Radial Basis Function Network (RBFN), Self-Organizing Map (SOM), Support Vector Machine (SVM), back propagation, and J48 on the NSL-KDD intrusion data set in order to evaluate the performance of each of the techniques. We have also compared the performance of these techniques with respect to the detection and false alarm rates.