Using Genetic Algorithms for Network Intrusion Detection and Integration into nProbe
summary
Genetic algorithms generate SNORT-style detection rules from DARPA tcpdump-labeled training data, implemented in C using Gong’s chromosome attributes and a 400-rule population where the top two per attack (six attack types → 12 elites) survive each generation. Three-way parent selection with crossover and bit-flip mutation evolves rules; fitness measures true attack matches versus false positives. Resulting rule set is compiled into an nProbe plugin that runs every second; several evolved rules reach perfect-score rules that match attacks only.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:46SNORT Experience
- 1:04SNORT Plugin. Disappeared!!!
- 1:16MS Project - What to do?
- 2:18Training Data Source
- 2:49Individual Chromosome
- 3:04Individual Evolution
- 3:20Individual Elitism
- 3:35Individual Crossover. Making Children
- 3:50Individual Mutation
- 4:37nProbe Layout
- 4:52nProbe code Development and Testing
related talks
24mA Study on Intrusion Detection Systems with a Practical Experiment on Snort
20mFrom Intention to Practice: Towards Systematic Validation of NIDS Rule Enforcement
43mOpen Source Intelligence Based Intrusion Detection System
27mSpecification Mining for Intrusion Detection in Networked Control Systems
29mSurvival of the Safest: Automating LLM Defense with Genetic Programming
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
35mThe Best Defense is a Great Offense: Leveraging Automated...
48mTight Genes: Intro to Genetic Algorithms