An Evolutionary Ensemble Approach for Distributed Intrusion Detection

An architecture for a distributed intrusion detection system is proposed, and a genetic programming algorithm, extended with the ensemble paradigm, to classify malicious or unauthorized network activity is presented. The architecture is based on a distributed hybrid multiisland model that combines the two well known approaches adopted to parallelize genetic programming: the cellular and the island models. Each island contains a subpopulation and a cellular genetic program enhanced with the boosting technique, that generates a decision-tree predictor trained on the local data stored in the island, and cooperates with the others by exchanging the outermost individuals of the population. After the classifiers are computed, they are collected to form the GP ensemble. Experiments on the KDD Cup 1999 Data shows the proposed method obtains accuracy comparable to other approaches proposed for this kind of problem.