An evolutionary wrapper to support intrusion detection system configuration

Abstract

Detecting and classifying attacks is one of the building blocks of cybersecurity. This is a difficult task, as classification algorithms must deal with a profusion of data used to detect attacks which may be very time consuming. In this paper, an evolutionary approach is proposed to obtain information about a given set of features, as well as to select the best features as input for attack classification algorithms. With this approach, each individual represents an optimized set of features, such that a cybersecurity analyst can evaluate which features and how many of them are required to obtain a suitable metric to detect a specific attack. This set of features improves the quality of attack detection while also reducing the CPU time required for the classification itself. This approach is evaluated using well-known datasets and decision trees generated by C4.5 and Random Forest algorithms for the evaluation and classification. We compare our findings with state-of-the-art results, demonstrating promising advances. Additionally, the features information that can be obtained using this approach is reported, which is useful for making decisions for attack discrimination.