Citation Context

...tions between a single source and a destination (Bhuyan et al., 2011). In this paper, we proposed an approach based on genetic algorithm (GA) to identify horizontal scan attacks within a flow-based IDS. This approach is highly effective in high-speed networks as compared to methods based on packets. Application of GA in IDS research has begun since 1995 (Crosbie and Spafford, 1995). GA is beneficial due to several reasons: (1) GA optimizes multiple members in each run, in another words it is highly parallel. This way, it avoids being trapped in local minimums and it extends its search domain. (2) GA is highly adaptive; Therefore it can adapt easily with changes in the network, such as changes in the extension and needs (Bankovic et al., 2009). In our approach we define two parameters: (i) number of destinations that each source visited, and (ii) number of scanned ports on that destination. GA is used to optimize weights of these parameters to achieve a performance close to optimum. Finally we compared our method with Snort. Next section reviews the previous studies on attacks detection methods based on scanning using GA. Methodology section gives a brief explanation of genetic algorit...

Citation Context

...o the administrator. Performance of these systems highly depends on the Threshold value (Moon et al., 2010). A frequently used parameter for scan attacks is number of connections between a single source and a destination (Bhuyan et al., 2011). In this paper, we proposed an approach based on genetic algorithm (GA) to identify horizontal scan attacks within a flow-based IDS. This approach is highly effective in high-speed networks as compared to methods based on packets. Application of GA in IDS research has begun since 1995 (Crosbie and Spafford, 1995). GA is beneficial due to several reasons: (1) GA optimizes multiple members in each run, in another words it is highly parallel. This way, it avoids being trapped in local minimums and it extends its search domain. (2) GA is highly adaptive; Therefore it can adapt easily with changes in the network, such as changes in the extension and needs (Bankovic et al., 2009). In our approach we define two parameters: (i) number of destinations that each source visited, and (ii) number of scanned ports on that destination. GA is used to optimize weights of these parameters to achieve a performance close to optimum. Finally we compared our method wi...