A Distributed Intrusion Detection Framework Based on Evolved Specialized Ensembles of Classifiers

摘要: Modern intrusion detection systems must handle many complicated issues in real-time, as they have to cope with a real data stream; indeed, for the task of classification, typically classes are unbalanced and, addition, distributed attacks and quickly react changes data. Data mining techniques particular, ensemble classifiers permit combine different that together provide complementary information can be built an incremental way. This paper introduces architecture framework detector module based on meta-ensemble, which is used problem detecting intrusions, number minor than normal connections. To this aim, we explore usage ensembles specialized detect particular types attack or connections, Genetic Programming adopted generate non-trainable function each ensemble. Non-trainable functions evolved without any extra phase training therefore, particularly apt concept drifts, also case real-time constraints. Preliminary experiments, conducted well-known KDD dataset more up-to-date dataset, ISCX IDS, show effectiveness approach.