Genetic programming for prevention of cyberterrorism through dynamic and evolving intrusion detection

  • Authors:
  • James V. Hansen;Paul Benjamin Lowry;Rayman D. Meservy;Daniel M. McDonald

  • Affiliations:
  • Information Systems Department, Kevin and Debra Rollins Center for e-Business, Marriott School of Management, Brigham Young University, United States;Information Systems Department, Kevin and Debra Rollins Center for e-Business, Marriott School of Management, Brigham Young University, United States;Information Systems Department, Kevin and Debra Rollins Center for e-Business, Marriott School of Management, Brigham Young University, United States;Artificial Intelligence Lab, Department of Management Information Systems, University of Arizona, United States

  • Venue:
  • Decision Support Systems
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Because malicious intrusions into critical information infrastructures are essential to the success of cyberterrorists, effective intrusion detection is also essential for defending such infrastructures. Cyberterrorism thrives on the development of new technologies; and, in response, intrusion detection methods must be robust and adaptive, as well as efficient. We hypothesize that genetic programming algorithms can aid in this endeavor. To investigate this proposition, we conducted an experiment using a very large dataset from the 1999 Knowledge Discovery in Database (KDD) Cup data, supplied by the Defense Advanced Research Projects Agency (DARPA) and MIT's Lincoln Laboratories. Using machine-coded linear genomes and a homologous crossover operator in genetic programming, promising results were achieved in detecting malicious intrusions. The resulting programs execute in real time, and high levels of accuracy were realized in identifying both positive and negative instances.