Study of building misuse detection models based on genetic algorithms

The attack model bases of traditional intrusion detection systems are manually built, hampering the popularization and application of such systems. A study was conducted to realize the automation of intrusive feature extraction and attack rule generation. An adaptive method based on genetic algorithms was presented for learning the intrusion detection rules. This method uses heuristic search in the data space of network features. The genetic operations run through some operators. The individuals with high fitness produced, and the same attributes of an intrusion are found. In the simulations and experiments the features of an attack are summarized inductively through the databases of the DAPRA Intrusion Detection Evaluation Program, and it accorded with the objectivity and attack rule summarized by research experts. This method can process the noise data with robustness. The adaptive method for building misuse detection models can automatically create the model bases of attacks and strengthen the transplantation of intrusion detection systems.