Incremental particle swarm optimisation for intrusion detection

An efficient network management method is essential to high-quality network services. The intrusion detection system (IDS) is one of the most important components of a network management system to prevent attacks from paralysing the entire network. However, detecting the new type of attacks on a network system is a very difficult problem from the perspective of the classification mechanism of an IDS. This study presents an incremental network traffic classification algorithm called incremental particle swarm optimisation to enhance the performance of IDS. Based on semi-supervised particle swarm optimisation, the proposed algorithm is composed of two major phases: (i) the classification phase is employed to create the classifier for differentiating the type of network flows from the training dataset and (ii) the clustering phase is then used to classify the newly incoming patterns, which may contain known and unknown network flow types.