are evolved. In the Automatic Induction of Machine Code byGenetic Programming, individuals are manipulated directly asbinary code in memory and executed directly without passingan interpreter during fitness calculation. The LGP tournamentselection procedure puts the lowest selection pressure on theindividuals by allowing only two individuals to participate ina tournament. A copy of the winner replaces the loser of eachtournament. The crossover points only occur betweeninstructions. Inside instructions the mutation operationrandomly replaces the instruction identifier, a variable or theconstant from valid ranges. In LGP the maximum size of theprogram is usually restricted to prevent programs without
As LGP could be implemented at machine codelevel, it will be fast to detect intrusions in a near real timemode.
Multi adaptive regression splines
Splines can be considered as an innovative mathematicalprocess for complicated curve drawings and functionapproximation. To develop a spline the X-axis is broken into aconvenient number of regions. The boundary between regionsis also known as a knot. With a sufficiently large number of knots virtually any shape can be well approximated. While itis easy to draw a spline in 2-dimensions by keying on knotlocations (approximating using linear, quadratic or cubicpolynomial etc.), manipulating the mathematics in higherdimensions is best accomplished using basis functions. TheMARS model is a regression model using basis functions aspredictors in place of the original data. The basis functiontransform makes it possible to selectively blank out certainregions of a variable by making them zero, and allows MARSto focus on specific sub-regions of the data. It excels atfinding optimal variable transformations and interactions, andthe complex data structure that often hides in high-dimensional data .
We partition the data into the two classes of “Normal”and “DoS” patterns, where the DoS attack is a collection of six different attacks (back, neptune, ping of death, land,smurf, and teardrop). The objective is to separate normal andDoS patterns. The (training and testing) data set contains11982 randomly generated from data described in section 3,with the number of data from each class proportional to itssize, except that the smallest class is completely included. Adifferent randomly selected set of 6890 points of the total dataset (11982) is used for testing different soft computingparadigms. Results of SVM, MARS and LGP classificationsare given in Table 2.
TABLE 2: Classifier Evaluation for Offline DoS Data
Classifier Accuracy (%)ClassSVM LGP MARSNormal 98.42 99.64 99.71DoS 99.45 99.90 96
Significant feature identification
Feature selection and ranking is an important issue inintrusion detection. Of the large number of features that canbe monitored for intrusion detection purpose, which are trulyuseful, which are less significant, and which may be useless?The question is relevant because the elimination of uselessfeatures enhances the accuracy of detection while speeding upthe computation, thus improving the overall performance of an IDS. In cases where there are no useless features, byconcentrating on the most important ones we may wellimprove the time performance of an IDS without affecting theaccuracy of detection in statistically significant ways.
Having a large number of input variables x = (x
) of varying degrees of importance to the output y; i.e.,some elements of x are essential, some are less important,some of them may not be mutually independent, andsome may be useless or irrelevant (in determining thevalue of y)
Lacking an analytical model that provides the basis for amathematical formula that precisely describes the input-output relationship, y = F (x)
Having available a finite set of experimental data, basedon which a model (e.g. neural networks) can be built forsimulation and prediction purposes
Support vector decision function ranking
Information about the features and their contributiontowards classification is hidden in the support vector decisionfunction. Using this information one can rank theirsignificance, i.e., in the equationF (X) =
WiXi+ b (3)The point X belongs to the positive class if F(X) is apositive value. The point X belongs to the negative class if F(X) is negative. The value of F(X) depends on thecontribution of each value of X and W
. The absolute value of
(IJCSIS) International Journal of Computer Science and Information Security,Vol. 8, No. 1, April 2010108http://sites.google.com/site/ijcsis/ISSN 1947-5500