Intrusion Detection System Using Computational Intelligence

Abstract

Traditional intrusion prevention techniques, such as firewalls, access control or encryption, failed to fully protect networks and systems from increasing attacks. Therefore, an intrusion detection system (IDS) has become an important component of security infrastructure and a key part of system defense to detect these attacks before they make a disaster in the system, intrusion detection based upon computational intelligence (CI) is currently attracting considerable interest from the research community. Characteristics of CI systems, such as adaptation, fault tolerance, high computational speed and error resilience in the face of noisy information fit the requirements of building a good intrusion detection model. The scope of this thesis will be on core methods of CI. One of the important research challenges for constructing high performance Network Intrusion Detection Models (NIDS) is dealing with data containing large number of features. Which make it harder to detect and classify the intrusion, causing slow training and testing process, higher resource consumption as well as poor detection rate. Therefore, feature selection methods were used to reduce the dimensionality of the dataset by removing redundant features. Feature selection improves the NIDS classification performance by searching for the subset of features, which decrease the size of the structure without significantly decreasing prediction accuracy of the classifier built using only the selected features. Therefore, applying feature selection as a preprocessing step when building NIDS is very important if real-time detection is desired. This thesis proposed different NIDS models; PCA-SVM model, GA-NB model and GAIEM-C4.5

model; those models involves data preprocessing, data reduction and intrusion classification. All this implemented in Weka machine learning tools, with KDD CUP 99 and NSL-KDD intrusion detection data sets. Experimental results show the advantages of enhancing the detection accuracy and testing speed by reducing the feature dimension space.