Table 3 Performance of GP and GE techniques on intrusion detection
Related Figures (10)
Table 1: The Features Table 2: BNF grammar used for the problem Figure 1: Route Request Packets on Simulated Networks Table 4: Performance of Manual Detection on Simulated Networks Figure 2: Classification Accuracy and Energy Consumption of the Optimal Evolved Programs Furthermore, since the size of the programs can affect their energy consumption, we conduct experiments to evolve pro- grams with different tree depths (17, 5). Tree depth defines the maximum size of the individuals (trees) evolved in GP. The effect of program size on evolved program’s detection ability and energy consumption can be seen in Figure 2. It would ap- pear that route discuption attacks can be detected by small pro- grams. Constraining the sizes of program that can be evolved forces the technique to search for small programs in that re- duced space. The approach manages to find effective ones. The results are more dramatic for ad hoc flooding detection. We can see how small-sized programs can exhibit good detection ca- pability. Nevertheless programs with bigger program size and accordingly higher energy consumption show a slightly better performance on the detection ability. The conceptual schema of the experiments is demonstrated in Figrure 3. Figure 3: Simplified Schema of Experiments the trade-offs falling in the second biggest energy consumption interval (the chart in the top-middle) could be more optimal and acceptable, since it include points which achieve the high clas- sification accuracy with less energy consumption (than the pro- grams consume in the interval f). Figure 4: Coplots for Programs Evolved for Detection of Ad Hoc Flooding Attack with Three Objectives Figure 5: Coplots for Programs Evolved for Detection of Both Attacks Together with Three Objectives Table 5: Performance of Some Programs for Detection of Both Attacks To- gether These experiments show that different trade-offs could be made between classification accuracy and energy consumption. It is shown how in some circumstances a multiple objective ap- proach provides a more effective means of searching the trade- off space. It is likely that for some types of networks (e.g. sen- sor networks) the ability to make good trade-offs will be partic- ularly important. Programs with almost the same classification accuracy (as obtained by GP) but with lower energy consump- tion are evolved by using MOEC techniques. More importantly a set of solutions showing different trade-offs is obtained. So programs showing different trade-offs could be distributed to nodes based on their energy level. A final choice between solu- tions making different trade-offs rests with the designer. Table 8: Performance of Some Cooperative Programs Evolved by MOEC
