Elitism Enhancements for Genetic Algorithm based Network Intrusion Detection System

Elitism Enhancements for Genetic Algorithm based Network Intrusion Detection System

Abstract:

Traditional signature-based Network Intrusion Detection Systems (NIDS) suffer from high false negative rate because it can detect an intrusion only if there is an existing rule matching the particular real-time attack. The combination of Genetic Algorithms, network security schemes, and IDS practices has created a model of intelligence system that has the ability to derive new best-fit classification rules from already known attack patterns. Nevertheless, the existing NIDS approaches in this paradigm still experience substantial overhead and limited variety of resulting NIDS rules. We propose in this paper a new genetic algorithm-based NIDS called AceGA, which introduces three novel enhancements namely Wildcard Weight Penalty, Ace Comparison Elimination, and Elite's Traits Induction. It is shown that AceGA provides decreased time overhead and better rules quality. For demonstration purposes, DARPA datasets from MIT Lincoln Lab are used for training and testing the intrusion detection rules. Several simulation experiments are conducted to evaluate the efficiency and effectiveness of each of our proposed enhancements including the overall capability of AceGA to detect our selected types of attacks with satisfactory true positive and false positive rates. Additional statistical results depicting the accuracy, precision, sensitivity, and specificity of the resulting rules are thoroughly analyzed.

Keyword  Genetic Algorithms, Intrusion Detection System, Network Security, Support-Confidence Framework, Evolutionary Process.

---

Tanapuch Wanwarang, Machigar Ongtang, "Elitism Enhancements for Genetic Algorithm based Network Intrusion Detection System", JCIT: Journal of Convergence Information Technology, Vol. 8, No. 17, pp. 31 ~ 42, 2013

http://www.aicit.org/jcit/global/paper_detail.html?jname=JCIT&q=4159

http://www.aicit.org/JCIT/ppl/JCIT4159PPL.pdf

Published my first paper.

Dear all,

I haven't been posting on this blog for quite a while now that I've graduated. Got a job at Dimension Data, a system integration firm. Life is alright.

Nevertheless, I and my professor have been able to published our paper:

"Elitism Enhancements for Genetic Algorithm based Network Intrusion Detection System"

Basically, it's about using Genetic Algorithm to auto-generate intrusion detection rules from existing rules.

Please kindly read the abstract and view the paper here:
http://www.aicit.org/jcit/global/paper_detail.html?jname=JCIT&q=4159

Direct access to the paper (PDF format) here:
http://www.aicit.org/JCIT/ppl/JCIT4159PPL.pdf

7200emu.hacki.at

Learning GNS3 at workplace.

Been enjoying it so far. Recommended a community forums for cisco simulator.

http://7200emu.hacki.at/

GANIDS (beta 0.9) - Genetic Algorithms for Deriving Network Intrusion Rules

GANIDS (beta 0.9) - Genetic Algorithms for Deriving Network Intrusion Rules


    For the past month since late March 2013 to today 20th April 2013, I have been developing a Genetic Algorithm that can be used to derive rules for signature-based Network Intrusion Detection Systems(i.e. Snort, Bro etc.) using Python 2.7.3 and DEAP 0.9 (a Python Evolutionary Algorithm library), and DARPA dataset as training and testing data.


"In the computer science field of artificial intelligence, a genetic algorithm (GA) is a search heuristic that mimics the process of natural evolution. This heuristic (also sometimes called a metaheuristic) is routinely used to generate useful solutions to optimization and search problems" - Wikipedia

    By following the papers of Wei Li and Ren Hui Gong, and Brian E. Lavender, I'm able to implement my own with many modifications, serveral add-ons, and optimizations.

    Li suggested an approach to use GA in IDS for anomaly detection and provided a fitness function and chromosome structure. Li promised to deliver the code but it was never published.

   Gong then used Li's approach to provide pseudo codes and class diagram, and certain amount of clarity about the evolutionary process have been given. However, there was not much guideline on how the selection, crossover, and mutation operators could be be implemented. Gong suggested using ECJ Java Library to code the genetic algorithm but his code was never published anywhere.

    Brian E. Lavender was the first person who successfully implemented a genetic algorithm for this approach following the guidelines of the first two. Brian also provided a clearer modified version of pseudo code, a detailed guideline on how to build selection, crossover, and mutation operators. He is currently also the only person who published his code in his project report. His program is called netGA.

    However, while netGA meets its functional requirement and can generate rules with optimized fitness values, it still lacks in extensibility. It was modeled to run only on one sample of DARPA audit training and testing dataset. Many certain options and optimizations could be added if it was to run well on other datasets. And that is what I plan to implement and improve on.

    Nonetheless, Brian had paved for me a stepping stone that conclusively proves the possibility of integration between Network Intrusion Detection System and Genetic Algorithms. He has also been providing help and advices in the emails we have been exchanging. So I'd like to thank Brian here.

    At the moment I call my GA program GANIDS (Renamed to AceGA). It works well on different DARPA datasets, but still needs revisions.

I'll be sure to update the details and write a documentation about it soon.

Please feel free to have a test run and constructively critique.

https://github.com/nixor/GANIDS

Thanks.

(p.s. change the link colors for ****'s sake!)

An Approach to solve Artificial Intelligence 8 queens puzzle with pen and paper, and mind. Tag, Genetic Algorithm.

Just for fun, was thinking about this on my way home:
(**Not related to Network Security, but this term I take an Intro to AI class**)


8 queens puzzle

( 7 4 2 8 6 1 3 5 )
( 3 5 7 1 4 2 8 6 )
( 4 2 8 6 1 3 5 7 )
( 5 7 1 4 2 8 6 3 )

I've found that it's possible to find at least 3 combinations of solution within 5 minutes using only pen and paper, and your mind.

By applying the following conditions:

1. The position 1th-8th must be given each a unique number. (This is to avoid vertical or horizontal attacks)
2. Given any position number 'x', and another position number 'y'
and 'i' is the displacement between 'x' and 'y'
This condition must always be true: i != | x - y |
(This is to avoid the diagonal attack)

No brainer method:

1. First just avoid the diagonal attacks between each pair that has 1 displacement.
2. Just swap around you will find the answer soon enough.
3. I notice the pattern of [4 2 8 6 | 1 3 5 7] to be very useful.

Afterthought:

Would it contribute to the speed of finding a solution when applying this method as a criteria in GA?

or

Would the calculation that comes with this method slow down the process?

Sweet wireshark 802.11 coloring rules.

Click here to Download.

Credit to 'frdy' from Kismet forum.

Wireless Adapter TL-WN7200ND with Kismet and OpenWRT Router TL-WDR4300

Hi,

I bought a wireless adapter TP-Link TL-WN7200ND today.

Features:

1. I'm able to run it in Backtrack with injection mode and monitor mode just fine.

2. I can also use it as another wifi-interface on my router TP-Link TL-WDR4300, set it to monitor mode and use it to transmit packets that the kismet drone captured, parallely with the built in 2.4GHz band interface.

3. It can be used as another attached AP as well with a very high Tx transmitting power 500mW, creating semi-trio band router for TL-WDR4300 (opposed to the original dual bands 5 GHz and 2.4 GHz, now we have two 2.4 GHz and one 5GHz). Thus, We will cover these below.

Technical Infos:

• Wireless Standards: IEEE 802.11n, IEEE 802.11g, IEEE 802.11b
• Frequency: 2.400-2.4835GHz
• 20dBm (EIRP, For countries using CE Standards) 100mW
• 27dBm (EIRP, For countries using FCC Standards) 500mW
• kismet drone ncsource type=rt2870sta (/etc/kismet/kismet_drone.conf)
• Chipset: Ralink RT3070

A. How to get it to work with Backtrack

I won't say much but just have a look at this page. Search on that page for the word 'Bolivia'. ;)

B. How to get it to work with an OpenWRT router

So after plugging it in to the robust TL-WDR4300 router running Attitude Adjustment 12.09rc1 (Yours could be a different router, or a different version of OpenWRT firmware), you should install these packages.

opkg update
opkg install kmod-rt2800-lib kmod-rt2800-usb kmod-rt2x00-lib kmod-rt2x00-usb

Now use the command 'wifi detect' to let the router know the existence of your new adapter.

Please test to see what the command prints first, because we are going to merge the result with our existing /etc/config/wireless

cd ~
wifi detect > newwifi
cat newifi

it should display:

config wifi-device  radio2
    option type     mac80211
    option channel  11
    option macaddr    6F:79:AA:BB:CC:D2
    option hwmode    11ng
    option htmode    HT20
    list ht_capab    GF
    list ht_capab    SHORT-GI-20
    list ht_capab    SHORT-GI-40
    list ht_capab    RX-STBC1
    # REMOVE THIS LINE TO ENABLE WIFI:
    option disabled 1 #(You might want to put this to 0)

config wifi-iface
    option device   radio2
    option network  lan
    option mode     ap
    option ssid     OpenWrt
    option encryption none

If so you are good to go, so type in these commands to merge the result with the existing /etc/config/wireless:

wifi detect >> /etc/config/wireless


Next, reboot your router, and you should have another Wifi AP running, you can double check with the LuCI web UI in the wifi section.

Now you have got yourself a Trio bands router :D !!

C. How to use it to pass captured packets from Kismet Drone.
If you haven't a clue yet what this is, please check this page: here.
(It will tell you what Kismet is, and how to edit the .conf files in general)

So go to the /etc/kismet/kismet_drone.conf

The only line you need to add or change is this:

ncsource=wlan2:type=rt2870sta

Notice the type=rt2870sta 

(Look at this from the Documentation page at Kismet for other types section 7)

You can also run 2 ncsources with a kismet drone at once, I have tested and I think it works together. (If somehow one source fails, the other would still continue to work, no worries.)

So after running this command it should show something this:

kismet_drone

Notes:

Thanks for reading, I'm happy that the traffic to my blog increases alot, although no one's ever commented :( haha. I'm not driven to get attention but if you think some of these posts are useful to you, please comment or +1 for me, it would mean so much....

And if I ever make any mistake, please kindly correct, or positively criticize at will :)


Coming next: Integration of OpenWRT + Kismet + Snort

References:

https://gpuhash.com/?menu=en-articles-view-2
(To help fix the low Tx power issue)

http://www.sans.org/reading_room/whitepapers/wireless/remote-access-point-ids_33914
(Best paper yet for my research)

http://www.andrewklau.com/openwrt-and-a-4-usb-wifi-adapter/
(OpenWRT and kmod-2800-usb)