Analysis of an Off-Line Intrusion Detection System: A Case Study in Multi-Objective Genetic Algorithms.
Pedro A. Diaz-Gomez, Dean F. Hougen · 2005
A primary approach to computer security is the Intru-sion Detection System (IDS). Off-line intrusion detec-tion can be accomplished by searching audit trail logs of user activities for matches to patterns of events re-quired for known attacks. Because such search is NP-complete, heuristic methods will need to be employed as databases of events and attacks grow. Genetic Algo-rithms (GAs) can provide appropriate heuristic search methods. However, balancing the need to detect all pos-sible attacks in an audit trail with the need to avoid warnings of attacks that do not exist is a challenge, given the scalar fitness values required by GAs. A case study of a previously proposed GA-based IDS shows this difficulty with respect to its fitness function and pro-poses a new method to overcome it. Such analysis can be of benefit to the study of other multi-objective GAs.