Rule Learner and Multithreading Technique with Genetic Algorithm for Inline Intrusion Detection System for High Speed Network | Chapter 11 | Theory and Practice of Mathematics and Computer Science Vol. 10

 The importance of an intrusion detection system in detecting unauthorised users, anomalous packets, and malicious code in a network is critical. Many methodologies and strategies for intrusion detection systems have been proposed by investigators. Finding a suitable approach with a low false positive rate and high classification accuracy is a difficult issue in intrusion detection systems. For intrusion detection systems, rule-based classifiers or learners are the best option. These are both complicated and simple to use. The rules generated by the rule learner determine the performance of a rule-based intrusion detection system. Due to the large number of packets in networks, the rule creation process is slow and time demanding. The intrusion detection system uses an ensemble of rule learners to deliver excellent accuracy.

In this chapter, an unique intrusion detection system architecture based on a single rule learner is introduced. The rule learner with multi-threading methodology was used to create the system. The Ripple Down Rule learner is utilised as a classifier in this implementation, while the Genetic Algorithm is employed as a feature selection method with Multithreading. The advantages of multi-parallel threading's processing capabilities enable to handle massive traffic in high-speed networks. The system's cache management module is utilised to lower the memory access rate. The classification accuracy and false positive rate of the proposed intrusion detection system are assessed. The suggested intrusion detection system outperforms the existing standard classifier, according to the findings of the performance evaluation. The suggested system's logging method can be used to reprocess and analyse logged packets in the future for investigative and forensic purposes. It was also discovered that the time necessary to produce rules from the training data set is less than the time required to develop models in existing rule-based intrusion detection systems.

Author(s) Details

D. P. Gaikwad
Department of Computer Engineering, AISSMS College of Engineering, Pune, Maharashtra, India.

View Book :- https://stm.bookpi.org/TPMCS-V10/article/view/1081