9. Evolutionary Computation in Intelligent Network Management

Data mining is an iterative and interactive process concerned with discovering patterns, associations and periodicity in real world data. This chapter presents two real world applications where evolutionary computation has been used to solve network management problems. First, we investigate the suitability of linear genetic programming (LGP) technique to model fast and efficient intrusion detection systems, while comparing its performance with artificial neural networks and classification and regression trees. Second, we use evolutionary algorithms for a Web usage-mining problem. Web usage mining attempts to discover useful knowledge from the secondary data obtained from the interactions of the users with the Web. Evolutionary algorithm is used to optimize the concurrent architecture of a fuzzy clustering algorithm (to discover data clusters) and a fuzzy inference system to analyze the trends. Empirical results clearly shows that evolutionary algorithm could play a major rule for the problems considered and hence an important data mining tool. 9.1 Intrusion Detection Systems Security of computers and the networks that connect them is increasingly becoming of great significance. Computer security is defined as the protection of computing systems against threats to confidentiality, integrity, and availability. There are two types of intruders: the external intruders who are unauthorized users of the machines they attack, and internal intruders, who have permission to access the system with some restrictions. The traditional prevention techniques such as user authentication, data encryption, avoiding programming errors and firewalls are used as the first line of defense for computer security. If a password is weak and is compromised, user authentication cannot prevent unauthorized use, firewalls are vulnerable to errors in configuration and ambiguous or undefined security policies. They are generally unable to protect against malicious mobile code, insider attacks and unsecured modems. Programming errors cannot be avoided as the complexity of the system and application software is changing rapidly leaving behind some exploitable weaknesses. Intrusion detection is therefore required as an additional wall for protecting systems [9.10, 9.151. Intrusion detection is use-