Application of genetic-based AI methods for enhancing network intrusion detection systems.

Abstract

The detection and evaluation of potential threats within communication networks is a vital role performed by network intrusion detection systems (NIDS). The information obtained from these systems, such as the frequency and nature of attacks, provides significant support to other protective measures like firewalls. A typical NIDS employs sensors that examine all inbound and outbound traffic, identify suspicious packets, and then forward those packets along with an alert message to a central server for storage and correlation with additional events. In this study, the protocol structure was first standardised. Next, a genetic technique was implemented to create mutation and crossover values for device recognition. Following this, a modified J48 decision tree algorithm was applied to perform the search process. The proposed approach achieves superior performance compared to existing methods. As an initial stage in intrusion recognition, a 64-byte structured protocol standardisation method was introduced. The Wireshark tool was utilised to capture the communication activity of the network, covering all possible interactions. The gathered packets were arranged into an array containing details such as frame information, protocol type, hardware identifiers, source and destination IP addresses, MAC addresses, and data. These elements were then processed through the 64-byte structured protocol standardisation. Since all required attributes are extracted in a unified manner, identification of MAC and IP addresses from packets is achieved more efficiently. In the subsequent stage, product and device characteristics were derived from the least and most significant 16 bits of the MAC address. Using crossover and mutation functions, the genetic method compared unknown devices against the Current Active Directory List (CADL).