Fusion of Heterogeneous Intrusion Detection Systems for Network Attack Detection

Algorithm 3

The proposed system algorithm.

Algorithm: MIU

Input: Input traffic data record set of all features

Output: Return whether traffic data record is (ATTACK or NOT_A_ATTACK)

Process:

 () Find information gain for each feature in and store it in IG following Algorithm 1.

 () Using Algorithm 2 as the fitness function in the genetic algorithm, the features are selected.

 () Pass the input traffic data record with into classification algorithm (SVM), which returns the

    attack category for each input traffic data record.

 () Repeat Step () on other classification algorithms IBK, J48, RandomForest and BayesNet.

 () For each input traffic data record, now there are five local decision from five

    classification algorithms.

 () The local decision is labeled as or

    —stands for ATTACK

    —stands for NOT_A_ATTACK

    If ( == “DOS” ∥ == “PROBE” ∥ == “U2R” ∥ == “R2L”)

      Then

         =

      Else

         =

 () For each input traffic data record, decision from five IDS units is either or count

    the number of and

      If ( > 3)

          Final decision =

      Else

          Final decision =