Novel Network Intrusion Detection Based on Feature Filtering Using FLAME and New Cuckoo Selection in a Genetic Algorithm

Abstract

Recently, networks have faced a significant challenge in terms of security due to constant unauthorized access by hackers, resulting in the compromise of network user data. To enhance network security, there are various approaches that can be employed, including the utilization of firewalls, encryption, and antivirus software. Among these methods, one type of system that can be implemented is an intrusion detection system (IDS), which actively monitors the network to identify any intrusions. In order to effectively detect any unauthorized or malicious activities, sophisticated techniques such as genetic algorithms, cuckoo searches, and FLAME are employed. This research proposes a novel IDS that aims to improve the detection of intrusions. The proposed IDS initially conducts feature filtration using fuzzy clustering through the local approximation of the membership algorithm (FLAME), which effectively reduces the number of features that need to be analyzed and processed. Subsequently, the system detects attacks by implementing an extended classifier system (XCS) that incorporates a genetic algorithm (GA) to enhance the accuracy of intrusion detection. By incorporating the cuckoo search and selection within GA, while considering different crossover and mutation probabilities, instead of solely relying on traditional GA, it is anticipated that intrusion detection accuracy will be improved. To evaluate the performance of the proposed IDS, it was tested on the KDD99 dataset and compared with several other IDSs that were also tested on the same dataset. The experimental results clearly indicate that the proposed IDS significantly enhances the detection rate (DR) and accuracy while also significantly reducing the false alarm rate (FAR) and these impressive results were 100%, 99.99% and 0.05% respectively. The performance comparisons reveal that, overall, the proposed IDS outperforms several existing IDSs in terms of intrusion detection performance.