An efficient network intrusion detection method based on information theory and genetic algorithm

The Internet has been growing at an amazing rate and concurrent with the growth, the vulnerability of the Internet is also increasing. Though the Internet has been designed to withstand various forms of failure, the intrusion tools and attacks are becoming increasingly sophisticated, exposing the Internet to new threats. To make networked systems reliable and robust it becomes highly essential to develop on-line monitoring, analysis and quantification of the behavior of networks under a wide range of attacks and to recover from these attacks. In this paper, we present a hybrid method based on information theory and genetic algorithm to detect network attacks. Our approach uses information theory to filter the traffic data and thus reduce the complexity. We use a linear structure rule to classify the network behaviors into normal and abnormal behaviors. We apply our approach to the kdd99 benchmark dataset and obtain high detection rate of 99.25% as well as low false alarm rate of 1.66%.