APHRODITE: an Anomaly-based Architecture for False Positive Reduction

We present APHRODITE, an architecture designed to reduce false positives in network intrusion detection systems. APHRODITE works by detecting anomalies in the output traffic, and by correlating them with the alerts raised by the NIDS working on the input traffic. Benchmarks show a substantial reduction of false positives and that APHRODITE is effective also after a "quick setup", i.e. in the realistic case in which it has not been "trained" and set up optimall

An Artificial Immune System-Inspired Multiobjective Evolutionary Algorithm with Application to the Detection of Distributed Computer Network Intrusions

Today\u27s predominantly-employed signature-based intrusion detection systems are reactive in nature and storage-limited. Their operation depends upon catching an instance of an intrusion or virus after a potentially successful attack, performing post-mortem analysis on that instance and encoding it into a signature that is stored in its anomaly database. The time required to perform these tasks provides a window of vulnerability to DoD computer systems. Further, because of the current maximum size of an Internet Protocol-based message, the database would have to be able to maintain 25665535 possible signature combinations. In order to tighten this response cycle within storage constraints, this thesis presents an Artificial Immune System-inspired Multiobjective Evolutionary Algorithm intended to measure the vector of trade-off solutions among detectors with regard to two independent objectives: best classification fitness and optimal hypervolume size. Modeled in the spirit of the human biological immune system and intended to augment DoD network defense systems, our algorithm generates network traffic detectors that are dispersed throughout the network. These detectors promiscuously monitor network traffic for exact and variant abnormal system events, based on only the detector\u27s own data structure and the ID domain truth set, and respond heuristically. The application domain employed for testing was the MIT-DARPA 1999 intrusion detection data set, composed of 7.2 million packets of notional Air Force Base network traffic. Results show our proof-of-concept algorithm correctly classifies at best 86.48% of the normal and 99.9% of the abnormal events, attributed to a detector affinity threshold typically between 39-44%. Further, four of the 16 intrusion sequences were classified with a 0% false positive rate

Vulnerability analysis of AIS-based intrusion detection systems using genetic and evolutionary hackers

In this thesis, an overview of current intrusion detection methods, evolutionary computation, and immunity-based intrusion detection systems (IDSs) is presented. An application named Genetic Interactive Teams for Intrusion Detection Design and Analysis (GENERTIA) is introduced which uses genetic algorithm (GA)-based hackers known as a red team in order to find vulnerabilities, or holes, in an artificial immune system (AlS)-based IDS. GENERTIA also uses a GA-based blue team in order to repair the holes it finds. The performance of the GA-based hackers is tested and measured according to the number of distinct holes that it finds. The GA-based red team�s behavior is then compared to that of 12 variations of the particle swarm optimization (PSO)-based red team named SWO, SW0+, SW1, SW2, SW3, SW4, CCSWO, CCSW0+, CCSW1, CCSW2, CCSW3, and CCSW4. Each variant of the PSO-based red team differs in terms of the way that it searches for holes in an IDS. Through this test, it is determined that none of the red teams based on PSO perform as well as the one based on a GA. However, two of the twelve PSO-based red teams, CCSW4 and SW0+, provide hole finding capabilities closest to that of the GA. In addition to the ability of the different red teams to find holes in an AlS-based IDS, the search behaviors of the GA-based hackers, PSO-based hackers that use a variable called a constriction coefficient, and PSO-based hackers that do not use the coefficient are compared. The results of this comparison show that it may be possible to implement a red team based on a hybrid �genetic swarm� that improves upon the performance of both the GA- and PSO-based red teams

Adapting Artificial Immune Algorithms For University Timetabling

Penjadualan kelas dan peperiksaan di universiti adalah masalah pengoptimuman berkekangan tinggi. University class and examination timetabling are highly constrained optimization problems