Modern Intrusion Detection Systems Research Articles

INTRUSION DETECTION SYSTEMS AND METHODS: CURRENT SITUATION AND DIRECTIONS FOR IMPROVEMENT

The structure of modern intrusion detection systems (IDS) is reviewed. The main directions of recognition of security violations of protected systems are characterized in modern IDS. The analysis of the used methods and models of the structure of IDS was carried out according to the defined main groups. The main disadvantages of the current IDS are given and directions for their improvement are justified. Intrusion detection systems (IDS) are systems that collect information from various points of a protected computer system (computer network) and analyze this information to identify both attempts to breach and real security breaches (intrusions). It has been shown that in modern detection systems, the following main elements are logically distinguished: the information collection subsystem, the analysis subsystem, and the data presentation module. Each intrusion detection method has been reviewed separately and the disadvantages of the methods have been highlighted. The current situation regarding intrusion detection systems and methods is described and directions for improvement are indicated. Among the methods used in the analysis subsystem of modern IDS, two directions can be distinguished: one is aimed at detecting anomalies in the protected system, and the other is aimed at finding abuses. Each of these directions has its advantages and disadvantages, therefore, in most of the existing IDSs, combined solutions are used based on the synthesis of the corresponding methods. It was noted that there are two groups of methods: with controlled training (“training with an instructor”), and with unsupervised training (“training without an instructor”). The main difference between them is that supervised training methods use a fixed set of evaluation parameters and some a priori knowledge about the values of the evaluation parameters. The main methods of detecting anomalies are explained in detail and detailed in the Tables. It has been pointed out that the methods currently applied in IDS are based on the general concepts of pattern recognition theory. Several main methods of creating an “image” in modern IDS are discussed and the topic of choosing the optimal set of functions for evaluating the protected system is highlighted. Information about Bayesian statistics, Covariance matrices, Confidence networks (Bayesian networks) is reflected. Pros and cons of descriptive statistics, Neural networks, Pattern Generation, abuse detection methods are also discussed. It has been explained that the methods currently implemented in IDS are based on the general concepts of pattern recognition theory. In accordance with them, in order to detect an anomaly, an image of the normal functioning of the information system is formed on the basis of an expert assessment. This image acts as a set of evaluation parameter values. The data presentation subsystem is necessary to inform interested parties about the state of the protected system. Some systems assume the existence of groups of users, each of which controls certain subsystems of the protected system. Therefore, in such IDSs access control, group policies, permissions, and etc. is applied. In the end, the disadvantages of the existing detection systems were noted and recommendations were given for improving the IDS. It has been noted that due to the presence of a significant number of factors of various nature, the functioning of the information system and IDS has a probabilistic nature. Therefore, it is relevant to substantiate the type of probabilistic laws of specific parameters of functioning. Of particular note is the problem of substantiating the loss function of an information system, which is set in accordance with its objective function and on the area of the parameters of the system functioning. At the same time, the objective function should be determined not only at the expert level, but also in accordance with the totality of the parameters of the functioning of the entire information system and the tasks assigned to it. Then the IDS quality indicator will be defined as one of the parameters that affect the objective function, and its admissible values will be determined by the admissible values of the loss function. Based on the foregoing, it can be concluded that considerable experience has been accumulated in practical activities in solving intrusion detection problems. The applied IDS are largely based on empirical schemes of the intrusion detection process, further improvement of IDS is associated with the specification of methods for the synthesis and analysis of complex systems, the theory of pattern recognition as applied to IDS. Keywords: IDS, optimal function, Covariance matrix, Bayes statistics, detection systems.

Leveraging Explainable Artificial Intelligence in Real-Time Cyberattack Identification: Intrusion Detection System Approach

Cyberattacks are part of the continuous race, where research in computer science both contributes to discovering new threats and vulnerabilities and also mitigates them. When new vulnerabilities are not reported but sold to attackers, they are called “zero-days,” and are particularly difficult to identify. Modern intrusion detection systems (IDS) that leverage artificial intelligence (AI) and machine learning (ML) are becoming essential in identifying these cyber threats. This study presents the design of an IDS using ML and Explainable AI (XAI) techniques for real-time classification of various detected cyberattacks. By utilizing frameworks such as Apache Kafka and Spark, along with libraries such as Scikit-learn and SHAP, the system identifies and classifies normal or anomalous network traffic in real-time. The XAI offers the IDS the option to explain the rationale behind each classification. The primary aim of this research is to develop a flexible and scalable IDS that can provide clear explanations for its decisions. The second aim is to compare and analyze different ML models to achieve the best results in terms of accuracy, f1, recall, and precision. Random Forest models proposed in this research article obtained the best results in figuring out the key features identified by the XAI model, which includes Ct_state_ttl, Sttl, Dmean, and Dbytes from the UNSW-NB15 dataset. Finally, this research work introduces different machine learning algorithms with superior performance metrics compared to other real-time classification methods.

Is There a Trojan! : Literature Survey and Critical Evaluation of the Latest ML Based Modern Intrusion Detection Systems in IoT Environments

IoT as a domain has grown so much in the last few years that it rivals that of the mobile network environments in terms of data volumes as well as cybersecurity threats. The confidentiality and privacy of data within IoT environments have become very important areas of security research within the last few years. More and more security experts are interested in designing robust IDS systems to protect IoT environments as a supplement to the more traditional security methods. Given that IoT devices are resource-constrained and have a heterogeneous protocol stack, most traditional intrusion detection approaches don’t work well within these schematic boundaries. This has led security researchers to innovate at the intersection of Machine Learning and IDS to solve the shortcomings of non-learning based IDS systems in the IoT ecosystem. Despite various ML algorithms already having high accuracy with IoT datasets, we can see a lack of sufficient production grade models. This survey paper details a comprehensive summary of the latest learning-based approaches used in IoT intrusion detection systems, and conducts a through critical review of these systems, potential pitfalls in ML pipelines, challenges from an ML perspective and discusses future research scope, and recommendations.

Methodology for identifying anomalies of user interaction with information resources of the organization

The article deals with the problem of detecting anomalies in the interaction of users with the organization's information resources. It is shown that the interaction of users with information resources becomes a key factor of efficiency and security. Most of the methods of detecting anomalies are based on the analysis of various technical and instrumental indicators, such as network activity, use of peripheral devices, system load, intensity of interaction with information systems, etc. Modern intrusion detection systems (IDS ‒ Intrusion Detection System) allow detection of attacks in real time based on a database of attack templates (signatures), machine learning methods and a set of data characterizing the interaction of employees with the organization's information assets. At the same time, most machine learning methods are sufficiently complex for operational implementation and do not allow making unambiguous decisions about the presence of anomalies. The work proposes a technique for detecting anomalies of user interaction with the organization's information resources, which allows using the results of modern intrusion detection systems and is simple enough for practical implementation by information security administrators. The technique is based on the use of a bipartite graph to display the interaction of users (employees of the organization) with assets (information systems) on the basis of network data collected by the IDS system. The simulation results based on the given examples show that this technique is sufficiently sensitive to different user activity. The method makes it possible to determine that the user's interaction with some information asset of the organization is anomalous. The data may be transferred to the information security administrator for further analysis.

A Quantitative Logarithmic Transformation-Based Intrusion Detection System

Intrusion detection systems (IDS) play a vital role in protecting networks from malicious attacks. Modern IDS use machine-learning or deep-learning models to deal with the diversity of attacks that malicious users may employ. However, effective machine-learning methods incur a considerable cost in both the pretraining stage and the online detection process itself. Accordingly, this study proposes a quantitative logarithmic transformation-based intrusion detection system (QLT-IDS) that uses a straightforward statistical approach to analyze network behavior. Compared with machine-learning or deep-learning-based IDS methods, the proposed system requires neither a time-consuming and expensive data collection and training process, nor a GPU-included device to achieve a real-time detection performance. Furthermore, the system can deal not only with North-South attacks, but also East-West attacks, which pose a significant risk in real-world operations. The effectiveness of the proposed system is evaluated for both real-world campus network traffic and simulated traffic. The results confirm that QLT-IDS is able to detect a wide range of malicious attacks with a high precision, even under high down-sampling rate of the NetFlow records.

Application of Bioinformatics Algorithms for 3RO\PRUSKLF Cyberattacks Detection

The functionality of any system can be represented as a set of commands that lead to a change in the state of the system. The intrusion detection problem for signature-based intrusion detection systems is equivalent to matching the sequences of operational commands executed by the protected system to known attack signatures. Various mutations in attack vectors (including replacing commands with equivalent ones, rearranging the commands and their blocks, adding garbage and empty commands into the sequence) reduce the effectiveness and accuracy of the intrusion detection. The article analyzes the existing solutions in the field of bioinformatics and considers their applicability for solving the problem of identifying polymorphic attacks by signature-based intrusion detection systems. A new approach to the detection of polymorphic attacks based on the suffix tree technology applied in the assembly and verification of the similarity of genomic sequences is discussed. The use of bioinformatics technology allows us to achieve high accuracy of intrusion detection at the level of modern intrusion detection systems (more than 0.90), while surpassing them in terms of cost-effectiveness of storage resources, speed and readiness to changes in attack vectors. To improve the accuracy indicators, a number of modifications of the developed algorithm have been carried out, as a result of which the accuracy of detecting attacks increased by up to 0.95 with the level of mutations in the sequence up to 10%. The developed approach can be used for intrusion detection both in conventional computer networks and in modern reconfigurable network infrastructures with limited resources (Internet of Things, networks of cyber-physical objects, wireless sensor networks).

A homogeneous ensemble based dynamic artificial neural network for solving the intrusion detection problem

Network security is a mechanism of protecting the usability and integrity of any given network and its transmitted data. Network security's effectiveness is crucial to the network environment to ensure it is free from any threat, especially in the critical infrastructure (CI). The supervisory control and data acquisition systems in the CI are getting more connected to the internet, putting them in serious security concerns. Any malicious attack against these systems could cause considerable human, economic, and material damages. Thus, it leads to the emergence of the intrusion detection system (IDS). Theoretically, a modern IDS must handle a large amount of data with high accuracy. Ensemble-based, hybrid-based methods and their distinguished applications are a promising way to solve these issues. The efficiency of the IDS is mainly dependent on the selected data features and the used classification method. The artificial neural network (ANN) has been applied in various fields, but it requires adjustment on few parameters to work effectively. This study proposes a homogeneous ensemble based on single-class dynamic ANN (HOE-DANN). Each dynamic ANN (DANN) is optimized by a filter-wrapper method using a modified discrete cuttlefish algorithm based on rough set theory, and a migration-strategy based cuttlefish algorithm. Both algorithms simultaneously optimize the features, ANN structure, weights, and biases for creating the DANN. However, the threshold value of the ensemble model was set using the hill-climbing algorithm. The experiments were applied to well-known benchmark datasets, namely the KDD99, UNSW-NB15, and gas pipeline data logs (GPDL). The results show that the HOE-DANN outperforms the single model based on the DANN. Additionally, a comparison with several state-of-the-art methods has shown that the proposed method offers superior performance in terms of the detection rate (DR), false alarm rate (FAR), and classification accuracy (ACC). The HOE-DANN model was able to achieve DR of 97.47%, FAR of 2.25%, and ACC of 97.52% using the KDD99 dataset, DR of 99.93%, FAR of 13.13%, and ACC of 94.08% using the UNSW-NB15 dataset, and DR of 98.08%, FAR of 2.69%, and ACC of 94.50% using the GPDL dataset.

On learning effective ensembles of deep neural networks for intrusion detection

Classification-oriented Machine Learning methods are a precious tool, in modern Intrusion Detection Systems (IDSs), for discriminating between suspected intrusion attacks and normal behaviors. Many recent proposals in this field leveraged Deep Neural Network (DNN) methods, capable of learning effective hierarchical data representations automatically. However, many of these solutions were validated on data featuring stationary distributions and/or large amounts of training examples. By contrast, in real IDS applications different kinds of attack tend to occur over time, and only a small fraction of the data instances is labeled (usually with far fewer examples of attacks than of normal behavior). A novel ensemble-based Deep Learning framework is proposed here that tries to face the challenging issues above. Basically, the non-stationary nature of IDS log data is faced by maintaining an ensemble consisting of a number of specialized base DNN classifiers, trained on disjoint chunks of the data instances’ stream, plus a combiner model (reasoning on both the base classifiers predictions and original instance features). In order to learn deep base classifiers effectively from small training samples, an ad-hoc shared DNN architecture is adopted, featuring a combination of dropout capabilities, skip-connections, along with a cost-sensitive loss (for dealing with unbalanced data). Tests results, conducted on two benchmark IDS datasets and involving several competitors, confirmed the effectiveness of our proposal (in terms of both classification accuracy and robustness to data scarcity), and allowed us to evaluate different ensemble combination schemes.

Unknown Security Attack Detection Using Shallow and Deep ANN Classifiers

Advancements in machine learning and artificial intelligence have been widely utilised in the security domain, including but not limited to intrusion detection techniques. With the large training datasets of modern traffic, intelligent algorithms and powerful machine learning tools, security researchers have been able to greatly improve on the intrusion detection models and enhance their ability to detect malicious traffic more accurately. Nonetheless, the problem of detecting completely unknown security attacks is still an open area of research. The enormous number of newly developed attacks constitutes an eccentric challenge for all types of intrusion detection systems. Additionally, the lack of a standard definition of what constitutes an unknown security attack in the literature and the industry alike adds to the problem. In this paper, the researchers reviewed the studies on detecting unknown attacks over the past 10 years and found that they tended to use inconsistent definitions. This formulates the need for a standard consistent definition to have comparable results. The researchers proposed a new categorisation of two types of unknown attacks, namely Type-A, which represents a completely new category of unknown attacks, and Type-B, which represents unknown attacks within already known categories of attacks. The researchers conducted several experiments and evaluated modern intrusion detection systems based on shallow and deep artificial neural network models and their ability to detect Type-A and Type-B attacks using two well-known benchmark datasets for network intrusion detection. The research problem was studied as both a binary and multi-class classification problem. The results showed that the evaluated models had poor overall generalisation error measures, where the classification error rate in detecting several types of unknown attacks from 92 experiments was 50.09%, which highlights the need for new approaches and techniques to address this problem.

An effect of chaos grasshopper optimization algorithm for protection of network infrastructure

Due to the proliferation of sophisticated cyber extortion with exponentially critical effects, intrusion detection system is being evolved systematically their revealing, understanding, attribution and mitigation capabilities. Unfortunately, most of the modern Intrusion Detection System (IDS) technique does not provide sufficient defense services in the wireless environment while maintaining operational continuity and the stability of the defense objective in the presence of intruders and modern attacks. To resolve this problem, we propose a new feature selection technique by combining Ensemble of Feature Selection (EFS) and Chaotic Adaptive Grasshopper Optimization Algorithm (CAGOA) method, called ECAGOA. The proposed method has the capability of preventing stagnation issue and is particularly credited to the following three aspects. Firstly, EFS method is applied for selecting the high ranked subset of attributes. Then, we have employed chaos concept in Grasshopper Optimization Algorithm (GOA) which generates a uniformly distributed population to enhance the quality of the initial populations and has the capability to manage two different issues such as the ability to search for new space termed as exploration and the ability to use existing space termed as exploitation in the optimization process. In order to avoid local optima and premature convergence, lastly, an adaptive grasshopper optimization algorithm is developed by using organized parameter adaptation method. Furthermore, the adaptive behavior of GOA is applied to decide whether a record signifies an anomaly or not, differing from some approaches acquainted in the literature. Support vector machine (SVM) is used as a fitness function in the proposed method to choose the relevant features that can help classify the attacks accurately. In addition, it is also applied to optimize the penalty factor (C), kernel parameter (σ), and tube size (ϵ) of SVM method. The proposed algorithm is evaluated using three popular datasets: ISCX 2012, NSL-KDD and CIC-IDS2017. The evaluation results show that the proposed method outperformed several feature selection techniques from state-of-the-art methods in terms of detection rate, accuracy, and false alarm rate.

Siam-IDS: Handling class imbalance problem in Intrusion Detection Systems using Siamese Neural Network

Abstract To tackle new and complex attacks, modern Intrusion Detection Systems (IDSs) are developed using Deep Learning (DL) techniques and are trained on intrusion detection datasets such as KDD and NSL-KDD. These two datasets have a large number of samples in Denial of Service and Probe attack classes besides the Normal class, but the number of samples in Remote to Local (R2L) and User to Root (U2R) attack classes is very less. R2L and U2R attacks represent the minority classes of these two datasets and due to lack of training samples in these minority classes, DL based IDSs are unable to detect them accurately. This leads to class imbalance problem and increases the chances of the network being compromised due to undetected intrusions. To handle this class imbalance problem in IDSs, this paper proposes Siam-IDS which is a novel IDS based on Siamese Neural Network (Siamese-NN). The proposed Siam-IDS is able to detect R2L and U2R attacks without using traditional class balancing techniques such as oversampling and random undersampling. The performance of Siam-IDS was compared with existing IDSs developed using DL techniques namely Deep Neural Network (DNN) and Convolutional Neural Network (CNN). Siam-IDS was able to achieve higher recall values for both R2L and U2R attack classes when compared to its counterparts.

A classification model based on svm and fuzzy rough set for network intrusion detection

Intrusion Detection Systems (IDS) are designed to provide security into computer networks. Different classification models such as Support Vector Machine (SVM) has been successfully applied on the network data. Meanwhile, the extension or improvement of the current models using prototype selection simultaneous with their training phase is crucial due to the serious inefficacies during training (i.e. learning overhead). This paper introduces an improved model for prototype selection. Applying proposed prototype selection along with SVM classification model increases attack discovery rate. In this article, we use fuzzy rough sets theory (FRST) for prototype selection to enhance SVM in intrusion detection. Testing and evaluation of the proposed IDS have been mainly performed on NSL-KDD dataset as a refined version of KDD-CUP99. Experimentations indicate that the proposed IDS outperforms the basic and simple IDSs and modern IDSs in terms of precision, recall, and accuracy rate.

Association Rule Mining for Intrusion Detection System: A Survey

Many modern intrusion detection systems are based on data mining and database-centric architecture, where a number of data mining techniques have been found. Among the most popular techniques, association rule mining is one of the important topics in data mining research. This approach determines interesting relationships between large sets of data items. This technique was initially applied to the so-called market basket analysis, which aims at finding regularities in shopping behaviour of customers of supermarkets. In contrast to dataset for market basket analysis, which takes usually hundreds of attributes, network audit databases face tens of attributes. So the typical Apriori algorithm of association rule mining, which needs so many database scans, can be improved, dealing with such characteristics of transaction database. In this paper, a literature survey on the Association Rule Mining has carried out.

Multilayered Echo-State Machine: A Novel Architecture for Efficient Intrusion Detection

Computers and other smart gadgets have become of a paramount importance in today’s transactions. Connected to the Internet, those devices offer the possibility to benefit from a myriad of electronic services, including social networking, banking, trade marketing, education and so on. Such activities are producing huge volume of information transiting with high velocity each day. Parallel to that, we have witnessed an epidemic increase in the number and the sophistication of cyberattacks, as they became more persistent and highly structured. In this context, modern intrusion detection systems are to be modeled so as to issue high detection rates in a tiny period of time in order to mitigate the risks. This paper is built on recurrent neural network with multilayered echo-state machine (ML-ESM) to model an intrusion detection. We assess our model on three publicly available data sets, namely, the DARPA KDD’99, NSL-KDD a reformed version of the latter, and UNSW NB 15. Performance metrics for both binary classification and multilabel classification are calculated and compared with those of some existing machine learning techniques and the recent state-of-the-art intrusion detection systems. Results indicate that the ML-ESM wins the challenge in both achieving a higher accuracy and considerably optimizing the processing time.

DFA-AD: a distributed framework architecture for the detection of advanced persistent threats

Advanced persistent threats (APTs) are target-oriented and advanced cyber-attacks which often leverage the bot control and customized malware techniques in order to control and remotely access valuable information. APTs generally use various attack techniques to gain access to the unauthorized system and then progressively spread throughout the network. The prime objectives of APT attacks are to steal intellectual property, legal documents, sensitive internal business and other data. If an attack is successfully launched on a system, the timely detection of attack is extremely important to stop APTs from further spreading and for mitigating its impact. On the other hand, internet of things (IoT) devices quickly become ubiquitous while IoT services become pervasive. Their prosperity has not gone unnoticed, and the number of attacks and threats against IoT devices and services are also increasing. Cyber-attacks are not new to IoT, but as the IoT will be deeply intertwined in our societies and lives, it becomes essential to take cyber defense seriously. In this paper, we propose a novel distributed framework architecture for the detection of APTs named as distributed framework architecture for APTs detection (DFA-AD), which is a promising basis for modern intrusion detection systems. In contrast to other approaches, the DFA-AD technique for detecting APT attack is based on multiple parallel classifiers, which classify the events in a distributed environment and event correlation among those events. Each classifier method is focused on detecting the APT's attack technique independently. The evaluation results show that the proposed approach achieves greater effectiveness and accuracy.

A Multi-resolution Port Scan Detection Technique for High-speed Networks

In this paper, we present a novel failed flow dispersion estimation technique, called multi-window state map (MWSM), which requires a small amount of memory and a constant number of memory accesses for implementing the multi-resolution concept (e.g., MRDS). We then extended the proposed MWSM scheme into a complete port scan detector. The simulation results with real-world traffic traces indicate that the proposed estimation technique manages the expected relative error and average standard error of less than 0.8% and 9%, respectively, while limiting the memory consumption to less than 60% of MRDS. In addition, the number of false positives decreases by 61% compared to a scan detector based on MRDS when it is extended to a complete scan detector. Owing to its simple mechanism and architecture, the proposed technique is well suited to hardware implementation. Therefore, we believe that the proposed technique is practically viable in modern high-speed intrusion detection systems.

Combating advanced persistent threats: From network event correlation to incident detection

An advanced persistent threat (also known as APT) is a deliberately slow-moving cyberattack that is applied to quietly compromise interconnected information systems without revealing itself. APTs often use a variety of attack methods to get unauthorized system access initially and then gradually spread throughout the network. In contrast to traditional attacks, they are not used to interrupt services but primarily to steal intellectual property, sensitive internal business and legal documents and other data. If an attack on a system is successful, timely detection is of paramount importance to mitigate its impact and prohibit APTs from further spreading. However, recent security incidents, such as Operation Shady Rat, Operation Red October or the discovery of MiniDuke – just to name a few – have impressively demonstrated that current security mechanisms are mostly insufficient to prohibit targeted and customized attacks. This paper therefore proposes a novel anomaly detection approach which is a promising basis for modern intrusion detection systems. In contrast to other common approaches, which apply a kind of black-list approach and consider only actions and behaviour that match to well-known attack patterns and signatures of malware traces, our system works with a white-list approach. Our anomaly detection technique keeps track of system events, their dependencies and occurrences, and thus learns the normal system behaviour over time and reports all actions that differ from the created system model. In this work, we describe this system in theory and show evaluation results from a pilot study under real-world conditions.

Feasible Study on Pattern Matching Algorithms based on Intrusion Detection Systems

With the increasing popularity of web services, attackers are paying more attention to hack the web services and the servers on which they run. Thus the need of effective modern intrusion detection system has taken prime importance for any system. At present intrusion detection system (IDS) analysis module uses the pattern matching technology, which is applied in various problems in the field of information security, genetic algorithms and evolutionary algorithm. As one of the solution to intrusion detection problems, pattern matching algorithms shown their advantages. This paper presents a feasibility study on a pattern matching algorithm General Terms Intrusion Detection System (IDS), Pattern matching algorithm.

CompactDFA: Scalable Pattern Matching Using Longest Prefix Match Solutions

A central component in all contemporary intrusion detection systems (IDSs) is their pattern matching algorithms, which are often based on constructing and traversing a deterministic finite automaton (DFA) that represents the patterns. While this approach ensures deterministic time guarantees, modern IDSs need to deal with hundreds of patterns, thus requiring to store very large DFAs, which usually do not fit in fast memory. This results in a major bottleneck on the throughput of the IDS, as well as its power consumption and cost. We propose a novel method to compress DFAs by observing that the name used by common DFA encoding is meaningless. While regular DFAs store separately each transition between two states, we use this degree of freedom and encode states in such a way that all transitions to a specific state are represented by a single prefix that defines a set of current states. Our technique applies to a large class of automata, which can be categorized by simple properties. Then, the problem of pattern matching is reduced to the well-studied problem of Longest Prefix Match (LPM), which can be solved either in ternary content-addressable memory (TCAM), in commercially available IP-lookup chips, or in software. Specifically, we show that with a TCAM our scheme can reach a throughput of 10 Gb/s with low power consumption.

Intrusion Detection System using Genetic Algorithm and Data Mining: An Overview

Network security is of primary concerned now days for large organizations. Various types of Intrusion Detection Systems (IDS) are available in the market like Host based, Network based or Hybrid depending upon the detection technology used by them. Modern IDS have complex requirements. With data integrity, confidentiality and availability, they must be reliable, easy to manage and with low maintenance cost. Various modifications are being applied to IDS regularly to detect new attacks and handle them. In this paper, we are focusing on genetic algorithm (GA) and data mining based Intrusion Detection System.