A study on intrusion detection using neural networks trained with evolutionary algorithms

Abstract

Intrusion detection has been playing a crucial role for making a computer network secure for any transaction. An intrusion detection system (IDS) detects various types of malicious network traffic and computer usage, which sometimes may not be detected by a conventional firewall. Recently, many IDS have been developed based on machine learning techniques. Specifically, advanced detection approaches created by combining or integrating evolutionary algorithms and neural networks have shown better detection performance than general machine learning approaches. The present study reports two new hybrid intrusion detection methods; one is based on gravitational search (GS), and other one is a combination of GS and particle swarm optimization (GSPSO). These two techniques have been successfully implemented to train artificial neural network (ANN) and the resulting models: GS-ANN and GSPSO-ANN are successfully applied for intrusion detection process. The applicability of these proposed approaches is also compared with other conventional methods such as decision tree, ANN based on gradient descent (GD-ANN), ANN based on genetic algorithm (GA-ANN) and ANN based on PSO (PSO-ANN) by testing with NSL-KDD dataset. Moreover, the results obtained by GS-ANN and GSPSO-ANN are found to be statistically significant based on the popular Wilcoxon’s rank sum test as compared to other conventional techniques. The obtained test results reported that the proposed GS-ANN and GSPSO-ANN could achieve a maximum detection accuracy of 94.9 and 98.13 % respectively. The proposed models (GS-ANN and GSPSO-ANN) could also achieve good performance when tested with highly imbalanced datasets.

Appendix

1.1 Complexity analysis of proposed model

As the proposed ANN models are three-layered architecture, i.e., (input–hidden–output), the computation will be carried out in two phases; (i) forward computation is from input to hidden layer which occurs in O(NM) times, (ii) the next computation is from hidden to output layer which takes O(M) times. So total is $T(N,M) = O(NM) + O(M)\approx O(NM)$. For proposed GS-ANN and GSPSO-ANN, O(NM) computations will be carried out for each agent in the system. Hence, the overall algorithmic time complexity of the proposed models is O(NM) multiplied with population size ($N_\mathrm{pop}$). Therefore, algorithmic time complexity of the model is $O(N_\mathrm{pop}\times NM)$.