An efficient class association rule‐pruning method for unified intrusion detection system using genetic algorithm. Issue 2 (2nd January 2013)

• Record Type: Journal Article
• Authors: Lu, Nannan; Mabu, Shingo; Wang, Tuo; Hirasawa, Kotaro
• Is Part Of: IEEJ transactions on electrical and electronic engineering. Volume 8:Issue 2(2013)
• Page Start: 164
• Page End: 172
• Publication Date: 2013-01-02
• Subjects: Electrical engineering -- Periodicals; Electronics -- Periodicals; 621.3
• DOI: 10.1002/tee.21836
• Languages: English
• ISSNs: 1931-4973

Abstract

<abstract abstract-type="main" xml:lang="en"> <title>Abstract</title> <p>Genetic network programming (GNP)‐based class association rule mining has been demonstrated to be efficient for misuse and anomaly detection. However, misuse detection is weak in detecting brand new attacks, while anomaly detection has a defect of high positive false rate. In this paper, a unified detection method is proposed to integrate misuse detection and anomaly detection to overcome their disadvantages. In addition, GNP‐based class association rule mining method extracts an overwhelming number of rules which contain much redundant and irrelevant information. Therefore, in this paper, an efficient class association rule‐pruning method is proposed based on matching degree and genetic algorithm (GA). In the first stage, a matching degree‐based method is applied to preprune the rules in order to improve the efficiency of the GA. In the second stage, the GA is implemented to pick up the effective rules among the rules remaining in the first stage. Simulations on KDDCup99 show the high performance of the proposed method. © 2012 Institute of Electrical Engineers of Japan. Published by John Wiley &amp; Sons, Inc.</p> </abstract>