Publication:
Evolving high-speed, easy-to-understand network intrusion detection rules with genetic programming

Simple item page
dc.affiliation.dptoUC3M. Departamento de Informáticaes
dc.affiliation.grupoinvUC3M. Grupo de Investigación: COSEC (Computer SECurity Lab)es
dc.contributor.authorOrfila Díaz-Pabon, Agustín
dc.contributor.authorEstévez Tapiador, Juan Manuel
dc.contributor.authorRibagorda Garnacho, Arturo
dc.date.accessioned2010-11-02T11:01:49Z
dc.date.available2010-11-02T11:01:49Z
dc.date.issued2009-04
dc.descriptionProceeding of: EvoWorkshops 2009: EvoCOMNET, EvoENVIRONMENT, EvoFIN, EvoGAMES, EvoHOT, EvoIASP, EvoINTERACTION, EvoMUSART, EvoNUM, EvoSTOC, EvoTRANSLOG, Tübingen, Germany, April 15-17, 2009
dc.description.abstractAn ever-present problem in intrusion detection technology is how to construct the patterns of (good, bad or anomalous) behaviour upon which an engine have to make decisions regarding the nature of the activity observed in a system. This has traditionally been one of the central areas of research in the field, and most of the solutions proposed so far have relied in one way or another upon some form of data mining–with the exception, of course, of human-constructed patterns. In this paper, we explore the use of Genetic Programming (GP) for such a purpose. Our approach is not new in some aspects, as GP has already been partially explored in the past. Here we show that GP can offer at least two advantages over other classical mechanisms: it can produce very lightweight detection rules (something of extreme importance for high-speed networks or resource-constrained applications) and the simplicity of the patterns generated allows to easily understand the semantics of the underlying attack.
dc.description.statusPublicado
dc.format.mimetypeapplication/pdf
dc.identifier.bibliographicCitationApplications of Evolutionary Computing. Lecture Notes in Computer Science Springer, vol. 5484, 2009, pp. 93-98
dc.identifier.doi10.1007/978-3-642-01129-0_11
dc.identifier.isbn3-642-01128-4
dc.identifier.isbn978-3-642-01128-3
dc.identifier.issn0302-9743
dc.identifier.publicationfirstpage93
dc.identifier.publicationlastpage98
dc.identifier.publicationvolume5484
dc.identifier.urihttps://hdl.handle.net/10016/9552
dc.language.isoeng
dc.publisherSpringer
dc.relation.eventdateApril 15-17, 2009
dc.relation.eventplaceTübingen (Germany)
dc.relation.eventtitleEvoWorkshops 2009: EvoCOMNET, EvoENVIRONMENT, EvoFIN, EvoGAMES, EvoHOT, EvoIASP, EvoINTERACTION, EvoMUSART, EvoNUM, EvoSTOC, EvoTRANSLOG
dc.relation.ispartofseriesLecture notes in computer science
dc.relation.ispartofseries5484/2009
dc.relation.publisherversionhttp://dx.doi.org/10.1007/978-3-642-01129-0_11
dc.rights© Springer-Verlag
dc.rights.accessRightsopen access
dc.subject.ecienciaInformática
dc.subject.otherGP
dc.subject.otherGenetic programming
dc.subject.otherIDS
dc.subject.otherNetwork intrusion detection
dc.titleEvolving high-speed, easy-to-understand network intrusion detection rules with genetic programming
dc.typeconference paper*
dc.type.reviewPeerReviewed
dspace.entity.typePublication
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Orfila, Estevez.pdf
Size:
165.66 KB
Format:
Adobe Portable Document Format
Download
Collections
DI - COSEC - Artículos en Congresos Internacionales
DI - COSEC - Capítulos de Monografías