Intelligent progression for anomaly intrusion detection

This paper describes a technique of combining K-Means clustering (KMC) and genetic algorithm (GA) to network intrusion detection systems (IDSs). A brief overview of the intrusion detection system, K-Means clustering, genetic algorithm, and related detection techniques is presented. Parameters and evolution process for GA are discussed in detail. Unlike other implementations of the same problem, this implementation combines K-Means clustering and genetic algorithm resulting in a better result to generate rules in IDS. This is helpful for identification of complex anomalous behaviors. This work is focused on the TCP/IP network protocols.