A PSO-Based approach to rule learning in network intrusion detection

The update of rules is the key to success for rule-based network intrusion detection system because of the endless appearance of new attacks. To efficiently extract classification rules from the vast network traffic data, this paper gives a new approach based on Particle Swarm Optimization (PSO) and introduces a new coding scheme called "indexical coding" in accord with the feature of the network traffic data. PSO is a novel optimization technique and has been shown high performance in numeric problems, but few researches have been reported in rule learning for IDS that requires a high level representation of the individual, this paper makes a study and demonstrates the performance on the 1999 KDD cup data. The results show the feasibility and effectiveness of it.