A Manhattan distance-based binary bat algorithm vs. integer ant colony optimisation for intrusion detection in the audit trails. (8th April 2019)

• Record Type: Journal Article
• Authors: Guendouzi, Wassila; Boukra, Abdelmadjid
• Is Part Of: International journal of computational science and engineering. Volume 18:Number 4(2019)
• Page Start: 424
• Page End: 437
• Publication Date: 2019-04-08
• Subjects: intrusion detection -- security audit trail analysis -- combinatorial optimisation problem -- NP-hard -- Manhattan distance -- bat algorithm -- ant colony system -- ACS -- simulated annealing; Computer science -- Mathematics -- Periodicals; Computer simulation -- Mathematical aspects -- Periodicals; Computational intelligence -- Periodicals; 004.015105
• Languages: English
• ISSNs: 1742-7185

Abstract

Intrusion detection system (IDS) is the process of monitoring and analysing security activities occurring in computer or network systems. The detection method can perform either anomaly-based or misuse-based detection. The misuse mechanism aims to detect predefined attack scenarios in the audit trails, whereas the anomaly detection mechanism aims to detect deviations from normal user behaviour. In this paper, we deal with misuse detection. We propose two approaches to solve the NP-hard security audit trail analysis problem. Both rely on the Manhattan distance measure to improve the intrusion detection quality. The first proposed method, named enhanced binary bat algorithm (EBBA), is an improvement of bat algorithm (BA). The second one, named enhanced integer ant colony system (EIACS), is a combination of two metaheuristics: ant colony system (ACS) and simulated annealing (SA). Experiment results indicate that, for large problem size, the performance of EIACS is more significant than EBBA.