Multiobjective classification with moGEP: an application in the network traffic domain

ABSTRACT

The paper proposes a multiobjective approach to the problem of malicious network traffic classification, with specificity and sensitivity criteria as objective functions for the problem. The multiobjective version of Gene Expression Programming (GEP) called moGEP is proposed and applied to find proper classifiers in the multiobjective search space. The purpose of the classifiers is to discriminate information about the network traffic obtained from Idiotypic Network-based Intrusion Detection System (INIDS), transformed into time series. The proposed approach is validated using the network traffic simulator ns2. Classifiers of high accuracy are obtained and their diversity offers interesting possibilities to the domain of network security.

REFERENCES

• 1: A. Abraham, C. Grosan, and C. Martin-Vide. Evolutionary Design of Intrusion Detection Programs. International Journal of Network Security, 4(3):328--339, 2007.
• 2: Brian Caswell , Jay Beale , Andrew R.. Baker, Snort Intrusion Detection and Prevention Toolkit, Syngress Publishing, 2007
• 3: D. Dasgupta and F. Gonzalez. An Immunity-Based Technique to Characterize Intrusions in Computer Networks. Transactions On Evolutionary Computation, 6(3):1081--1088, 2002.
• 4: L. L. DeLooze. Attack Characterization and Intrusion Detection using an Ensemble of Self-Organizing Maps. In IJCNN '06, pages 2121--2128. IEEE, 2006.
• 5: T. Fawcett. ROC graphs: Notes and practical considerations for data mining researchers. Technical report, Hewlett-Packard, 2003.
• 6: Cândida Ferreira, Gene Expression Programming: Mathematical Modeling by an Artificial Intelligence (Studies in Computational Intelligence), Springer-Verlag New York, Inc., Secaucus, NJ, 2006
• 7: Cândida Ferreira, Gene Expression Programming: Mathematical Modeling by an Artificial Intelligence (Studies in Computational Intelligence), Springer-Verlag New York, Inc., Secaucus, NJ, 2006
• 8: K. Joshua and C. David. The Pareto Archived Evolution Strategy: A New Baseline Algorithm for Pareto Multiobjective Optimisation. In Proceedings of the Congress on Evolutionary Computation, volume 1, pages 98--105, Washington D.C., USA, 1999. IEEE.
• 9: Hilmi Güneş Kayacik , Malcolm Heywood , Nur Zincir-Heywood, On evolving buffer overflow attacks using genetic programming, Proceedings of the 8th annual conference on Genetic and evolutionary computation, July 08-12, 2006, Seattle, Washington, USA [doi>10.1145/1143997.1144271]
• 10: LibGEP. https://libgep.gforge.uni.lu, 2008.
• 11: H. S. Lopez and W. R. Weinert. A gene expression programming system for time series modeling. In CILAMCE '04: Proceedings of XXV Iberian Latin American Congress on Computational Methods in Engineering, Recife, Brasil, 2004.
• 12: Marek Ostaszewski , Pascal Bouvry , Franciszek Seredynski, Denial of service detection and analysis using idiotypic networks paradigm, Proceedings of the 10th annual conference on Genetic and evolutionary computation, July 12-16, 2008, Atlanta, GA, USA [doi>10.1145/1389095.1389107]
• 13: Tao Peng , Christopher Leckie , Kotagiri Ramamohanarao, Survey of network-based defense mechanisms countering the DoS and DDoS problems, ACM Computing Surveys (CSUR), v.39 n.1, p.3-es, 2007 [doi>10.1145/1216370.1216373]
• 14: Rocketfuel: An ISP Topology Mapping Engine. http://www.cs.washington.edu/research/networking/rocketfuel/.
• 15: T. Stibor. On the Appropriateness of Negative Selection for Anomaly Detection and Network Intrusion Detection. PhD thesis, Darmstadt University of Technology, 2006.
• 16: The Network Simulator - ns-2. http://www.isi.edu/nsnam/ns/, 2008.
• 17: Web Traffic Generation in NS-2 with PackMime-HTTP. http://dirt.cs.unc.edu/packmime/, 2008.

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
      I.2.8 Problem Solving, Control Methods, and Search
          Subjects: Heuristic methods

General Terms:
Algorithms, Experimentation

Keywords:
gene expression programming, multiobjective classification