Genetic Programming Approach for Multi-Category Pattern Classification Appliedto Network Intrusions Detection

This paper describes a new approach of classification using genetic programming. The proposed technique consists of genetically coevolving a population of non-linear transformations on the input data to be classified, and map them to a new space with a reduced dimension, in order to get a maximum inter-classes discrimination. The classification of new samples is then performed on the transformed data, and so become much easier. Contrary to the existing GP-classification techniques, the proposed one use a dynamic repartition of the transformed data in separated intervals, the efficacy of a given intervals repartition is handled by the fitness criterion, with a maximum classes discrimination. Experiments were first performed using the Fisher-s Iris dataset, and then, the KDD-99 Cup dataset was used to study the intrusion detection and classification problem. Obtained results demonstrate that the proposed genetic approach outperform the existing GP-classification methods [1],[2] and [3], and give a very accepted results compared to other existing techniques proposed in [4],[5],[6],[7] and [8].

Authors:

• K.M. Faraoun
• A. Boukelif

Keywords:

• Genetic programming
• patterns classification
• intrusion detection

References:

[1] Dong Song, Malcolm I. Heywood, and A. Nur Zincir-Heywood.
"Training Genetic Programming on Half a Million Patterns: An Example
from Anomaly Detection", IEEE Transactions on Evolutionary
Computation, 9(3), pp 225-240, 2005
[2] Dong Song, Malcolm I. Heywood, and A. Nur Zincir-Heywood. "A
Linear Genetic Programming Approach to Intrusion Detection ». E.
Cant├║-Paz et al. (Eds.): GECCO 2003, LNCS 2724, pp. 2325-2336,
2003. ┬® Springer-Verlag Berlin Heidelberg 2003
[3] J. K. Kishore, L. M. Patnaik, V. Mani, and V. K. Agrawal, "Application
of genetic programming for multicategory pattern classification," IEEE
Trans. Evol. Comput., vol. 4, pp. 242-258, Sept. 2000.
[4] Pfahringer B.: Winning the KDD99 Classification Cup: Bagged
Boosting. SIGKDD Explorations. ACM SIGKDD. 1(2) (2000) 65- 66
[5] Levin I.: KDD-99 Classifier Learning Contest LLSoft-s Results
Overview. SIGKDD Explorations. ACM SIGKDD. 1(2) (2000) 67- 75
[6] Vladimir M., Alexei V., Ivan S.: The MP13 Approach to the KDD'99
Classifier Learning Contest. SIGKDD Explorations. ACM SIGKDD.
1(2) (2000) 76-77
[7] Eskin E., Arnold A., Prerau M., Portnoy L., and Stolfo S. A Geometric
Framework for Unsupervised Anomaly Detection: Detecting intrusions
in unlabeled data. In D. Barbara and S. Jajodia, editors, Applications of
Data Mining in Computer Security. Kluwer, 2002. ISBN 1-4020-7054-
3, 2002.
[8] Kayacik G., Zincir-Heywood N., and Heywood M. On the Capability of
an SOM based Intrusion Detection System. In Proceedings of
International Joint Conference on Neural Networks, 2003.
[9] Koza, J. R. 1994. Genetic Programming II: Automatic Discovery of
Reusable Programs. The MIT Press.
[10] Mengjie Zhang and Victor Ciesielski. Genetic programming for multiple
class object detection. In Norman Foo (editor), Proceedings of the 12th
Australian Joint Conference on Artificial Intelligence, Volume 1747,
Lecture Notes in Artificial Intelligence, pages 180-191. Springer,
Heidelberg, Dec 1999.
[11] Mengjie Zhang, Will Smart. "Multiclass Object Classification Using
Genetic Programming". Technical Report CS-TR-04/2, Feb 2004,
School of Mathematical and Computing Sciences, Victoria University.
[12] Loveard, T. & Ciesielski, V. Representing classification problems in
genetic programming, in 'Proceedings of the Congress on Evolutionary
Computation', Vol. 2, IEEE Press, COEX, World Trade Center, 159
Samseongdong, Gangnam-gu, Seoul, Korea, pp. 1070ÔÇö1077 (2001).
http://goanna.cs.rmit.edu.au/toml/cec2001.ps
[13] B.-C. Chien, J. Y. Lin, and T.-P. Hong, "Learning discriminant functions
with fuzzy attributes for classification using genetic programming,"
Expert Syst. Applicat., vol. 23, pp. 31-37, 2002.
[14] R. R. F. Mendes, F. B.Voznika, A. A. Freitas, and J. C. Nievola,
"Discovering fuzzy classification rules with genetic programming and
co-evolution," in Lecture Notes in Artificial Intelligence, vol. 2168,
Proc. 5th Eur. Conf. PKDD, 2001, pp. 314-325.
[15] Durga Prasad Muni, Nikhil R. Pal, Senior Member, IEEE, and Jyotirmoy
Das, "A Novel Approach to Design Classifiers Using Genetic
Programming », ieee transactions on evolutionary computation, vol. 8,
no. 2, pp. 183-196. April 2004.
[16] Crosbie, Mark and Spafford, Gene, Applying Genetic Programming
Techniques to Intrusion Detection, In Proceedings of the AAAI 1995
Fall Symposium, November 1995.
[17] Bob Adolf . New Paradigms for Intrusion Detection Using Genetic
Programming. Technical report January 2004.
[18] Cosbie M. Gene Spafford. Applying genetic programming to intrusion
detection October 1998. In procedding of the 18 th NISSC Conference
October 1998.
[19] R. A. Fisher, "The use of multiple measurements in taxonomic
problems," Ann. Eugenics, pt. II, vol. 7, pp. 179-188, 1936.
[20] KDD data set, 1999; http://kdd.ics.uci.edu/databases/
kddcup99/kddcup99.html, cited April 2003
[21] C. Elkan, "Results of the KDD-99 Classifier Learning", SIGKDD
Explorations, ACM SIGKDD, Jan 2000.
[22] Lee W. and Stolfo S. A Framework for Constructing Features and
Models for Intrusion Detection Systems. Information and System
Security, 3(4):227-261, 2000.
[23] Application of Machine Learning Algorithms to KDD Intrusion
Detection Dataset within Misuse Detection Context, Maheshkumar
Sabhnani, Gursel Serpen, Proceedings of the International Conference
on Machine Learning, Models, Technologies and Applications
(MLMTA 2003), Las Vegas, NV, June 2003, pages 209-215.
[24] Ayse Küçükyılmaz; Pattern Classification: A Survey and Comparison.
Department of Computer Engineering, Bilkent University, 06800,
Ankara, Turkey. http://www.cs.bilkent.edu.tr/~guvenir/ courses/cs550/
Workshop/Ayse_Kucukyilmaz.pdf . April 7, 2005
[25] Anil K. Jain, Robert P.W. Duin, and Jianchang Mao, Statistical pattern
recognition: a review, IEEE Transactions on Pattern Analysis and
Machine Intelligence, Vol. 22. No. 1, pp. 4-37, January 2000.
[26] R. Agarwal, and M. V. Joshi, "PNrule: A New Framework for
Learning Classifier Models in Data Mining", Technical Report TR
00-015, Department of Computer Science, University of Minnesota,
2000.