Using Genetic Algorithm to Improve an Online Response System for Anomaly Traffic by Incremental Mining
Ming‐Yang Su, Sheng‐Cheng Yeh, Chun-Yuen Lin, Chen-Han Tsai · 2010
This paper presents an online real-time network response system, which can determine whether a LAN is suffering from a flooding attack within a very short time unit. The detection engine of the system is based on the incremental mining of fuzzy association rules from network packets, in which membership functions of fuzzy variables are optimized by a genetic algorithm. The proposed online system belongs to anomaly detection, not misuse detection. Moreover, a mechanism for dynamic firewall updating is embedded in the proposed system for the function of eliminating suspicious connections when necessary.