Network traffic pattern recognition based on genetic algorithms

Network traffic pattern recognition is one of the main components of today’s network intrusion detection systems. In the present work, a genetic algorithm for learning a set of rules is presented. The learned rules are used for normal network traffic pattern recognition. This approach is different from previous works in which genetic algorithms were used to learn rules from anomalous network traffic instead. In this work adjustments to a canonical genetic algorithm are discussed, mainly covering fitness function related issues and niching techniques to get multiple solutions. Furthermore preliminaries results obtained against DARPA data set are presented.