A hybrid approach for efficient anomaly detection using metaheuristic methods

Tamer F Ghanem; Wail S Elkilani; Hatem M Abdul-Kader

doi:10.1016/j.jare.2014.02.009

A hybrid approach for efficient anomaly detection using metaheuristic methods

J Adv Res. 2015 Jul;6(4):609-19. doi: 10.1016/j.jare.2014.02.009. Epub 2014 Mar 5.

Authors

Tamer F Ghanem¹, Wail S Elkilani², Hatem M Abdul-Kader³

Affiliations

¹ Department of Information Technology, Faculty of Computers and Information, Menofiya University, Shebin El Kom, Menofiya, Egypt.
² Department of Computer Systems, Faculty of Computers and Information, Ain Shams University, Cairo, Egypt.
³ Department of Information Systems, Faculty of Computers and Information, Menofiya University, Shebin El Kom, Menofiya, Egypt.

Abstract

Network intrusion detection based on anomaly detection techniques has a significant role in protecting networks and systems against harmful activities. Different metaheuristic techniques have been used for anomaly detector generation. Yet, reported literature has not studied the use of the multi-start metaheuristic method for detector generation. This paper proposes a hybrid approach for anomaly detection in large scale datasets using detectors generated based on multi-start metaheuristic method and genetic algorithms. The proposed approach has taken some inspiration of negative selection-based detector generation. The evaluation of this approach is performed using NSL-KDD dataset which is a modified version of the widely used KDD CUP 99 dataset. The results show its effectiveness in generating a suitable number of detectors with an accuracy of 96.1% compared to other competitors of machine learning algorithms.

Keywords: Anomaly detection; Genetic algorithms; Intrusion detection; Multi-start methods; Negative selection algorithm.