Evolutive modeling of TCP/IP network traffic for intrusion detection

Abstract

The detection of intrusions over computer networks can be cast to the task of detecting anomalous patterns of network Traffic. In this case, patterns of normal Traffic have to be determined and compared against the current network Traffic. Data mining systems based on Genetic Algorithms can contribute powerful search techniques for the acquisition of patterns of the network Traffic from the large amount of data made available by audit tools. In this paper we compare models of data Traffic acquired by a system based on a distributed genetic algorithm with the ones acquired by a system based on greedy heuristics. Also we discuss representation change of the network data and its impact over the performances of the Traffic models.