A Network Intrusions Detection System based on a Quantum Bio Inspired Algorithm

Transcription

1 A Network Itrusios Detectio System based o a Quatum Bio Ispired Algorithm Omar S. Solima 1, Aliaa Rassem 2 1,2 Faculty of Computers ad Iformatio, Cairo Uiversity Abstract: Network itrusio detectio systems (NIDSs) have a role of idetifyig malicious activities by moitorig the behavior of etworks. Due to the curretly high volume of etworks trafic i additio to the icreased umber of attacks ad their dyamic properties, NIDSs have the challege of improvig their classificatio performace. Bio-Ispired Optimizatio Algorithms (BIOs) are used to automatically extract the the discrimiatio rules of ormal or abormal behavior to improve the classificatio accuracy ad the detectio ability of NIDS. A quatum vaccied immue cloal algorithm with the estimatio of distributio algorithm (QVICA-with EDA) is proposed i this paper to build a ew NIDS. The proposed algorithm is used as classificatio algorithm of the ew NIDS where it is traied ad tested usig the KDD data set. Also, the ew NIDS is compared with aother detectio system based o particle swarm optimizatio (PSO). Results shows the ability of the proposed algorithm of achievig high itrusios classificatio accuracy where the highest obtaied accuracy is 94.8 %. Keywords: Estimatio of Distributio Algorithm (EDA), Network Itrusios Detectio System (NIDS), Quatum Vaccied Immue Cloal Algorithm (QVICA)., 1. Itroductio Itrusio Detectio Systems (IDSs) are the systems resposible of idetifyig malicious activities by moitorig the behavior of users or etworks. They detect the abormal behavior or uwated traffic ad take the appropriate respose agaist it [27]. There are two types of itrusio detectio approaches which are the misuse ad aomaly detectio approaches. Misuse detectio uses kow patters, sigatures, of uauthorized behavior to detect itrusios. It is quite strog to detect kow itrusios but it has low degree of accuracy i detectig ukow itrusios sice it relies o sigatures extracted by huma experts. Aomaly detectio establishes a baselie of ormal usage patters ad if it fids somethig that widely deviates from the baselie, the deviatio is agged as a possible itrusio. Although it is powerful to idetify ew types of itrusio as deviatios from ormal usage, a potetial drawback is the high false alarm rate, previously usee system behaviors may be recogized as aomalies, ad hece flagged as potetial itrusios [15]. IDSs ca also be categorized to host-based ad etwork-based depedig o the audit data which they will aalyze. Host based systems examie data of users like what files were accessed ad what applicatios were executed. Network-based IDS (NIDS) examies data as packets of iformatio exchage through the etworks. The goal of NIDSs is to quickly ad accurately recogize ad distiguish the ormal ad abormal etwork coectios. They seek to have a high itrusios detectio rate ad a low false alarms, detectig ormal coectios as itrusios, to esure high classificatio accuracy. There are some challeges facig these systems which make it difficult to achieve such a goal ad keep security of etworks. These challeges are the curret high volume of etworks traffic i additio to the icreased umber of attacks (itrusios) ad their complex ad dyamic properties. Artificial itelligece ad machie learig were used to build differet NIDSs but they have show limitatios to achievig high detectio accuracy ad fast processig times whe cofroted with these challeges. Computatioal Itelligece techiques, BIOs, kow for their ability to adapt ad to exhibit fault tolerace, high computatioal speed ad resiliece agaist oisy iformatio, compesate for the limitatios of these two approaches [30]. May BIOs have bee applied as classificatio techiques for NIDSs, like the artificial immue system (AIS), Artifical Neural Networks (ANNs), particle swarm optimizatio (PSO) ad may others. They were able to easily ad automatically extract the the discrimiatio rules of ormal or abormal behavior from the large etworks logs [7]. Also the Quatum Ispired Evolutioary Algorithms (QIEAs) have bee used to build NIDSs. QIEAs are some sort of hybrid algorithms appeared i 1990s. They hybridize the classical BIOs with quatum computig (QC) paradigm to improve the performace of these algorithms especially i complex large problems with high dimesios. The algorithms i this ew field proved have bee used i may applicatios icludig etworks security where they proved their ISSN: Page 371

2 effectiveess over the traditioal BIOs. New hybrid algorithms ca be itroduced to ehace the performace of QIEAs ad icrease the quality of obtaied solutios. The aim of this paper is to build a NIDS based o a ew proposed BIO amed Quatum Vaccied Immue Cloal Algorithm with Estimatio of Distributio Algorithm (QVICA-with EDA). This algorithm itroduces the vaccie operator ad the EDA samplig to be added to the classical Quatum Ispired Immue Cloal Algorithm (QICA). The algorithm is used to build a better NIDS with a higher itrusios classificatio accuracy. It is traied ad tested usig the audit data of the bechmark KDD dataset ad is compared with aother NIDS based o Particle Swarm Optimizatio (PSO). Results show the superiority of the proposed algorithm over the PSO. The rest of this paper is orgaized as follows: Sectio 2 itroduces related works i the field of IDS classificatio algorithms ad a backgroud of ecessary terms. Sectio 3 itroduces the proposed algorithm where experimetal results ad discussio are i sectio 4. The last sectio is devoted to coclusios ad further works. 2. Related Works ad Backgroud EAs ad QIEAs have bee used i past few years i may researches for itrusios classificatio to icrease the detectio accuracy of IDS. A sample of these researches is show i this sectio. The immue cloal algorithm was used i may etworkig applicatios like itrusio detectio for securig etworks ad the spam detectio. A Network Itrusio Detectio System (NIDS) based o the immuological approach was proposed where a adaptive samplig algorithm was applied durig the data collectio stage. This algorithm was used accordig to the dyamic characters of detectio data where it was able to improve the data-processig capabilities ad the fault tolerace of the system [8]. A collaborative itrusio detectio system was proposed to detect deial of service attacks by usig the artificial immue system due to its distributioal, collaborative, robust ad adaptive capabilities. This system was applied for peer to peer etworks where it was able to icrease the precisio of attack discovery ad decreases false positive rate [21]. Also, A IDS based o immue algorithm (IA) ad support vector machie (SVM) was itroduced. I this method, immue algorithm is used to preprocess the etwork data, SVM is adopted to classify the optimizatio data, ad recogize itruders. Results showed that the feasibility ad efficiecy of the system [5]. A hybrid itrusio detectio system based o rough set (RS )for feature selectio ad simplified swarm optimizatio for itrusio data classificatio was applied. RS is proposed to select the most relevat features ad the PSO with a ew weighted local search( WLS) strategy was used for classficatio. The WLS is added to discover the better solutio from the eighborhood of the curret solutio produced by PSO. The testig results showed that the proposed hybrid system ca achieve higher classificatio accuracy [6]. Particle Swarm Optimizatio ad its variats were combied with various Machie Learig techiques. They were used for Aomaly Detectio i Network Itrusio Detectio System to ehace the performace of system [22]. A improved egative selectio algorithm that itegrates a ovel further traiig strategy to reduce self-samples, to reduce computatioal cost i testig stage, was developed. The algorithm was able to get the highest detectio rate ad the lowest false alarm rate i most cases [9]. The Support Vector Machie (SVM) was itroduced as a classifier for a IDS where a wrapper based feature selectio approach usig Bees algorithm (BA) as a search strategy for subset geeratio. The result shows that these combied algorithms has yielded better quality IDS [2]. Also, A improved icremetal SVM algorithm (ISVM) combied with a kerel fuctio U-RBF was proposed ad applied ito etwork itrusio detectio. The simulatio results showed that the improved kerel fuctio U- RBF has played some role i savig traiig time ad test time [33]. A aomaly based etwork IDS usig GA approach was adopted where the proposed IDS used a adaptive GA for both learig ad detectio. The proposed method was efficiet with respect to good detectio rate with low false positives i additio to the lower executio time [24]. A IDS based o GA was proposed where GA uses evolutio theory to iformatio evolutio i order to filter the trafic data ad so reduce the complexity. It was implemeted o KDD99 bechmark dataset ad obtaied reasoable detectio rate [12]. A QIEA usig eigevectors ad ichig strategy was used to optimize the database of the sigature based detectio system, a ID system type that is kow with its poor detectio performace [29], ad the algorithm was able to improve the ID's ability i detectig the ukow attacks [34]. A QIEA was also used for optimizig the features selectio ad kerel parameters of the support vector machie used for aomaly detectio [31]. The QGA was also used to optimize the clusterig methodology ad get the optimal umber of clusters to be used for classifyig the data collected by the IDS [32]. A quatum eural etwork (NN) was applied for itrusio applicatio to ISSN: Page 372

3 overcome the weakess of the back propagatio NN which may fall ito local miimum [4]. The quatum particle swarm optimizatio (QPSO) was used as a traier for NN ad SVM to get better IDS performace. It was applied to trai the wavelet NN to improve the detectio rate for aomalies ad reduce the false detectio alarms i the etwork aomaly detectio [17]. It was also applied with the Gradiet Descet (GD) method to trai the Radial Basis Fuctio NN for etwork aomaly detectio [18]. It was used with SVM for etwork Itrusio feature selectio ad detectio where each particle was a selected subset of features ad its fitess was defied as the correct classificatio percetage by SVM [11]. It was used also for solvig the liear system of equatios of the least square SVM (LS- SVM )to overcome the LS-SVM weakess ad guaratee the sparsity ad robustess of the solutios [29] Quatum Ispired Immue Cloal Algorithm The artificial immue system algorithms (AIS) are a set of EAs ispirig their procedure from the huma immue system fuctioality. AIS iclude may differet algorithms where the two major used algorithms are the egative selectio algorithm ad the immue cloal algorithm (ICA). ICA is ispired from the huma immue systems cloal selectio process over the B cells where the evolutio process of the atibodies is a repeated cycle of matchig, cloig, mutatig ad replacig. The best B cells are allowed through this process to survive which icreases the attackig performace agaist the ukow atiges. Vacciatio is aother immuological cocept that ICA applies through the vaccie operator. This operator is used to itroduce some degree of diversity betwee solutios ad icrease their fitess values by usig artificial Vaccies. Quatum ispired evolutioary algorithms (QIEAs) were itroduced i the 1990s, they itegrate the quatum computig cocepts with evolutioary process of EAs. They are able to improve the quality of solutios ad ehace the algorithms performace as EAs suffer from bad performace i high dimesioal problems. EAs, icludig the ICA, have to do umerous evolutioary operatios ad fitess evaluatios i large problems which limit them from performig effectively. The hybridizatio betwee quatum properties ad traditioal ICA process ehaced its performace i complex problems. QICA combied quatum computig priciples, like quatum bits, quatum superpositio property ad quatum observatio process, with immue cloal selectio theory. These cocepts are described below i details where the quatum bit represetatio for atibodies ad vaccies i QICA has the advatage of represetig a liear superpositio of states (classical solutios) i search space probabilistically. Quatum represetatio ca guaratee less populatio size as a few umber of atibodies ad vaccies ca represet a large set of solutios through the space [23]. The quatum observatio process plays a great role i projectig the multi state quatum atibodies ito oe of its basic states to help i the idividuals evaluatio. -Quatum Bit: By usig quatum bit (q-bit) represetatio, a small populatio of atibodies ca be created where it represets a larger set of atibodies due to the quatum superpostiio property. The quatum atibody populatio is iitialized with quatum atibodies usig m q-bits for each oe. Ulike the classical bit, the q-bit does ot represet oly the value 0 or 1 but a superpositio of the two. Its state ca be give by: ψ = α 0 > + β 1 > (1) Where α ad β are complex umbers ad α 2 is the probability to have value 0 ad β 2 is the probability of havig value 1 ad α 2 + β 2 = 1. - Observatio Process: The quatum represeted idividuals are coverted ito biary represetatio by iteratig over each q-bit i the idividual ad chage it to a biary bit. The process is described i algorithm 1 Algorithm 1 Observatio Process 1: for i = 1 to m do 2: Geerate a radom umber r betwee 0 ad 1 3: if i α the 4: set the biary bit of i as 0 5: else 6: set the biary bit as 1 7: ed if 8: ed for 2.2. Estimatio of Distributio Algorithm The most of evolutioary algorithms (EA) use samplig durig their evolutio process for geeratig ew solutios. Some of these algorithms use it implicitly, like Geetic Algorithm (GA), as ew idividuals are sampled through the geetic operators of the cross over ad mutatio of the parets. Other algorithms apply a explicit samplig procedure through usig probabilistic models represetig the solutios characteristics. These ISSN: Page 373

4 algorithms are called the iterated desity estimatio evolutioary algorithms (IDEAs) where a iterated process of probabilistic model estimatio takes place to sample ew idividuals [10], [16]. Estimatio of Distributio Algorithms (EDAs), a example of the IDEA, are populatio based algorithms with a theoretical foudatio o probability theory. They ca extract the global statistical iformatio about the search space from the search so far ad builds a probability model of promisig solutios [25]. Ulike GAs, the ew idividuals i the ext populatio are geerated without crossover or mutatio operators. They are radomly reproduced by a probability distributio estimated from the selected idividuals i the previous geeratio [16]. EDA has some advatages, over other traditioal EAs, where it is able to capture the iterrelatios ad iter depedecies betwee the problem variables through the estimatio of their joit desity fuctio. EDA does't have the problem of fidig the appropriate values of may parameters as it oly relies o the probability estimatio with o other additioal parameters. The geeral EDA procedure is show i Algorithm 2. Algorithm 2 Estimatio of Distributio Algorithm 1: Iitialize the iitial populatio. 2: while termiatio coditio is ot satisfied do 3: Select a certai umber of excellet idividuals. 4: Costruct probabilistic model by aalyzig iformatio of the selected idividuals. 5: Create ew populatio by samplig ew idividuals from the costructed probabilistic model. 6: ed while The EDA relies o the costructio ad maiteace of a probability model that geerates satisfactory solutios for the problem solved. A estimated probabilistic model, to capture the joit probabilities betwee variables, is costructed from selectig the curret best solutios ad the it is simulated for producig samples to guide the search process ad update the iduced model. Estimatig the joit probability distributio associated with the data costitutes the bottleeck of EDA. Based o the complexity of the model used, EDAs are classified ito differet categories, without iterdepedecies, pair wise depedecies ad multiply depedecies algorithms as below [10], -Without Iterdepedecies EDAs: These models are used whe there is o depedecy assumed betwee the variables of the problem. The joit probability distributio is factorized to idepedet uivariate probability distributios p(xi). Uivariate Margial Distributio Algorithm (UMDA), a example for this category, estimates the p(xi) from the relative margial frequecies of the Xi of the selected data. Other examples of EDAs uder this category are the Populatio Based Icremetal Learig (PBIL) ad compact geetic algorithm (cga) [14]. UMDA, as a example, estimates the p(x ) from the relative margial frequecies of the X of the selected data. p(x) = x i i1 f N (x, μ, ) = f N (x i, μ i, i ) i1 (2) (3) -Pair-wise Depedecies EDAs: This type of EDAs assumes depedecy betwee pairs of the variables. The joit probability distributio of the variables is factorized as the product of a uivariate desity fuctio ad ( - 1) pair wise coditioal desity fuctios give a permutatio = (i,, i ) betwee variables. Examples are the Bivariate Margial Distributio Algorithm (BMDA), Mutual Iformatio Maximizatio for Iput Clusterig (MIMIC) ad Combiig Optimizers with Mutual Iformatio Trees (COMIT) algorithms. MIMIC, as a example, searches for the best permutatio π, of the variables, that will miimize theh (x), Kullback- Leibler divergece fuctio betwee the p (x) ad p(x) [10]. p(x) = p(x i1 ). p(x i2 x i1 ) p(x i x i1 ) (4) -Multiple Iterdepedecies EDAs: Depedecies are assumed betwee multiple variables where probabilistic graphical models based o either directed or udirected graphs are widely used. Structural ad parametric learig are doe to lear the topology of the etworks ad estimate the coditioal probabilities. Bayesia etwork algorithm (BOA), the Markov etwork EDA ad factorized Distributio Algorithm (FDA) are some examples. (For more details, see [14] ad [28]). p(x) = p(x i pa(x i ), θ i ) = θ ijk i1 f(x) = N(x i, μ i, v i ) i1 (6) (5) 3. Proposed Network Itrusios Detectio System This work builds a NIDS usig a ew classificatio algorithm to improve the detectio performace. It ISSN: Page 374

5 proposes a ew BIO amed Quatum Vaccied Immue Cloal Algorithm with Estimatio of Distributio Algorithm (QVICAwith EDA). It is based o the quatum computig cocepts, immue cloal selectio priciples ad the vaccie operator with EDA samplig. The NIDS is the compared with aother system base o PSO [6].A geeral schema of the proposed NIDS is show i figure 1. Figure 1 shows that the system has three mai stages. First stage is about data preprocessig; the secod is the traiig phase of the proposed classificatio algorithm ad the last oe is the testig phase where a detailed descriptio is show below. Fig 1: The ew NIDS based o the proposed algorithm (the QVICA-with EDA) 3.1. Data Preprocessig Phase This phase is cocered with the preprocessig of data represeted i the dataset records (etwork coectios). The data are divided ito two sets, the traiig set ad the test set. There is a class assiged to each record i the traiig set, to idicate either it is a ormal coectio or a attack oe, where test records are without class labels. Each record does ot have the total 41 features of the KDD, istead it has oly six selected features. These six features are those selected ad used i the PSO work which are the Service, src_bytes, dst_bytes, Rerror_rate, dst_host_srv_cout ad dst_host_diff _srv_rate. The proposed NIDS uses the same selected features for fair comparisos where the symbolic coversio of the symbolic features are doe followed by Equal frequecy discretizatio (EFD) for the cotiuous features. The processed data is the two outputs of this phase where the processed traiig set, called traiig Atiges (AGs), is used as a iput for the traiig phase. The processed testig set, called test Atiges, is used as the iput for the last phase of testig Traiig Phase I this phase, the QVICA-V with EDA is traied usig the traiig AGs to lear how to classify the data ito ormal ad itrusios. as metioed before, the algorithm itegrates the quatum computig, for represetatio, ad immue cloal selectio priciples with the vaccie operator for diversifyig solutios. The algorithm also utilizes the EDA probabilistic models ad samplig to improve the fitess of atibodies (solutios), icrease the degree of diversity ad shorte the executio time of the whole algorithm. The mai steps of the proposed algorithm are described i Algorithm 3 [23]. As show i algorithm 3, the algorithm starts by iitializig both the quatum atibody populatio Q(t) ad the quatum vaccie populatio V (t) followed by cloig ad mutataig atibodies to be the decoded for evaluatio. Additioal steps to the simple QICA, like vaccie decodig ad samplig will be described i details. The quatum vaccie populatio V (t) is iitialized i the same way with quatum vaccies where is the umber of grids that the decisio space is divided to ad = (D D D ) with d which is the umber of dimesios [23]. - Iitializatio: Quatum atibodies ad vaccies populatios are created where V (t) is iitialized with quatum vaccies where is the umber of grids that the decisio space is divided to ad = (D D D ) with d which is the umber of dimesios. Quatum atibodies Q(t) are cloed ad mutated to get Q (t) usig the cloal operator θ with C as umber of cloes that will produce the Q (t) where θ, C ad Q (t) are as follows, θ(q t ) = [θ(q 1 ), θ(q 2 ), θ(q m )] (7) C = N c (8) Q (t) = [Q t, q 1, q 2,, q m ] (9) Algorithm 3 The proposed Algorithm (QICA-V with EDA) 1: Iitialize the quatum atibody ad vaccie populatios, Q(t) ad V(t). 2: Iitialize t=1 as first iteratio 3: while termiatio coditio is ot satisfied do 4: Apply the cloal ad quatum mutatio operators over the Q(t) to get Q (t) 5: Produce B (t) by observig Q (t). 6: Decode V (t) to get V. 7: Divide V ito two subpopulatios, V ad V ISSN: Page 375

6 8: Select the farthest vaccies from V as the curret V. 9: Estimate probability distributio of the V. 10: Sample the distributio to get the ew V 11: Apply the geetic operators over the V to get the ew V 12: Build the ewv by mergig the ewv ad ewv 13: Apply vacciatio over B(t) usig the ewv to get BV (t). 14: Apply cloal selectio operator over BV (t) to get Q(t + 1). 15: ed while -Vaccie Decodig: Biary vaccies are coverted ito decimal represetatio betwee 0 ad 2 m - 1 to get V1 set. These decimal vaccies have to be ijected ito the decisio space so that they are decoded to be withi the decisio space domai ad get V2 set usig the followig formula, v 2 i = c i + width j v i m ad i = 1,.., (10) Where c is the coordiate of the grid (i) ad width j is the width of dimesio (j) ad j = 1,2,, d. The width ca be computed usig the maximum ad miimum values of each dimesio. -Vaccie Selectio ad vacciatio: Hammig distace is used to compute the distace betwee the vaccies ad atibodies to evaluate the farthest vaccies. The Hammig distace fuctio is performed as i algorithm 4. Vaccies with higher hammig distaces from all atibodies are selected (to ehace the exploratio) ito Vbest set. Vaccies i this set are used to apply the ijectio process over the mutated AB cloes where the ijectio i our proposed algorithm is doe i the real represetatio. Algorithm 4 Hammig distace Fuctio 1: for each bit a i vacciei ad bit b i atibodyj do 2: if a == b the 3: mismatchcouter = 0 4: else 5: mismatchcouter = 1 6: ed if 7: ed for 8: Hammig distace (i,j) = Mismatchcouter -Vaccie Samplig: EDA estimates the probability distributio of the ext iteratios best vaccies from the curret Vbest. It uses the mea ad stadard deviatio (sd), as show below where b is the legth of Vbest, of the vaccies i Vbest to costruct its model. μ = v i best b i1 b σ = [v i best μ] 2 b (11) (12) -Cloal selectio: The best atibodies from the vaccied atibodies populatio ad selected to form Q(t+1) ad coverted agai ito quatum represetatio to proceed to a ew iteratio Testig Phase I this phase, the QVICA-with EDA is tested to evaluate the traiig process. It is tested usig the test atiges, with o class label, produced by the first phase. The fial traied atibodies, from the traiig phase, are matched with the test atiges. Each test atige is matched with the whole set of these atibodies to be assiged to a class. The higher the umber of matched ABs with the atige, the more probability that this atige follows their class. At the ed of the phase, the class labels of all the test atiges are detected either as ormal or attack. 4. Experimets ad Results The proposed algorithm, QVICA- with EDA, is implemeted as the classificatio algorithm for a NIDS ad compared with aother classificatio algorithm based o PSO [6]. The experimets were implemeted over the The KDD-Cup 99 (Kowledge Discovery ad Data Miig Tools Coferece), a bechmark dataset for the etwrok itrusio detectio systems [1]. Each record i the KDD represets a TCP/IP coectio that is composed of 41 features that are both qualitative ad quatitative i ature. There are 39 types of distict attacks i KDD, grouped ito four classes of attack ad oe class of o attack (ormal coectios). The mai attack types are Deial of Service (DoS), Probe,Remote-to-Local (R2L) ad User-to-Root (U2R) where detailed descriptio of each ad its sub types is below [19], [13] ad [3]. -Deial of Service (DoS) attacks: where a attacker makes some computig or memory resource too busy or too full to hadle legitimate requests, thus deyig legitimate users access to a machie. Sub attacks of DoS are, Back,Lad,eptue,Pod,Smurf ad teardrop. -Probe attacks: where a attacker scas a etwork to gather iformatio or fid kow vulerabilities. ISSN: Page 376

7 Probe's sub attacks are Sata,ipsweep,Nmap ad portsweep. -Remote-to-Local (R2L) attacks: where a attacker seds packets to a machie over a etwork, the exploits machies vulerability to illegally gai local access as a user. Sub attacks of R2L that ca be foud i the sets' records are guess-passwd,ftpwrite,imap, Phf,multihop,warezmaster, warezcliet ad spy. -User-to-Root (U2R) attacks: where a attacker starts out with access to a ormal user accout o the system ad is able to exploit vulerability to gai root access to the system. U2R sub attacks are Bufieroverow,loadmodule,perl ad rootkit. Table 1: ACCURACY FOR DIFFERENT EXPERIMENTS USING QVICA-WITH EDA QVICA-with EDA Iteratios Pop Size The same parameters settigs of the PSO-WLS algorithm are used for our algorithm for fair compariso. A set of 4000 records is selected from the KDD based o the selected features of the PSO- WLS work to evaluate the performace of the QVICA- with EDA. The 10-fold cross validatio method is applied where the data are distributed as 10 for testig ad the remaiig 90 for traiig. Table 2: ACCURACY FOR DIFFERENT EXPERIMENTS USING PSO-WLS PSO-WLS Iteratios Pop Size Classificatio accuracy is the evaluatio measure used i this work. The atibodies populatio size, are set to differet values of 10,20,30,40 ad 50 where the umber of iteratios is set to 10,20,30 ad 40 with total of 20 idepedet rus. The best values of accuracy through differet experimets are captured ad compared with the results of the PSO-WLS algorithm as i tables 1 ad 2 where accuracy is as i equatio 13 [6], TP + TN accuracy = (13) TP + FP + FN + TN The tables show that our algorithm outperforms the PSO-WLS algorithm i some experimets where higher accuracy values are obtaied. The highest accuracy value was achieved with 50 atibodies ad 30 iteratios. A sample of the results are also visualized i figures 2, 3 ad 4 for more clarificatio. Usig 40 ad 50 as the values of the populatio size, the proposed algorithm is better tha the PSO-WLS classificatio i all differet experimets. Fig 2:Classificatio Accuracy at differt iteratios with populatio size of 30 Fig 3: Classificatio Accuracy at differt iteratios with populatio size of 40 Fig 4: Classificatio Accuracy at differt iteratios with populatio size of 50 For more ivestigatio, the accuracy of each fold i oe of the best experimets is recorded i table 3 ad compared with the folds results of the PSO-WLS ISSN: Page 377

8 algorithm where higher values are obtaied by our algorithm. The detailed accuracy values of the 20 rus of the best experimet is i table 4 ad are compared with the best experimet of the other algorithm. The proposed algorithm is able to get higher classificatio accuracy tha the best value of the PSO based algorithm usig the same parameters. Table 3: ACCURACY OF THE 10 FOLD CROSS VALIDATION OF ONE OF THE BEST RUNS Fold Accuracy Value QVICA-with PSO-WLS EDA Table 4: ACCURACY OF THE TWO ALGORITHMS OVER 20 RUNS (FOR THE BEST EXPERIMENT) Ru Accuracy Value QVICA-with PSO-WLS EDA Mea Coclusios A quatum vaccied immue cloal algorithm with the estimatio of distributio algorithm (QVICA-with EDA) was proposed i this paper as a classificatio algorithm for the NIDS. It was compared with aother classificatio algorithm based o particle swarm optimizatio (PSO) o the KDD data set. Classificatio accuracy values obtaied at the differet experimets showed the ability of the algorithm of achievig high classificatio accuracy. It outperforms the other algorithm i may experimets which proved its effectiveess. More experimets with differet parameters settigs will be doe i future work to esure that the algorithm is powerful for itrusio detectio. REFERENCES [1] [2] Osama Alomari ad Z Othma. Bees algorithm for feature selectio i etwork aomaly detectio. Joural of Applied Scieces Research, 8(3): , [3] Ver oica Bol o-caedo, Noelia S achez-maro o, ad Amparo Aloso-Betazos. Feature selectio ad classificatio i multiple class datasets: A applicatio to kdd cup 99 dataset. Expert Systems with Applicatios, 38(5): , [4] FENG Jia-li GONG Chag-qig. Study of a itrusio detectio based o quatum eural etworks techology [j]. Joural of Sheyag Istitute of Aeroautical Egieerig, 1:016, [5] Yu Sheg Che, Yu Sheg Qi, Yu Gui Xiag, Jig Xi Zhog, ad Xu Log Jiao. Itrusio detectio system based o immue algorithm ad support vector machie i wireless sesor etwork. I Iformatio ad Automatio, pages Spriger, [6] Yuk Yig Chug ad Noorhaiza Wahid. A hybrid etwork itrusio detectio system usig simplified swarm optimizatio (sso). Applied Soft Computig, [7] Tia Fag, Dogmei Fu, ad Yufeg Zhao. A hybrid artificial immue algorithm for feature selectio of ovaria cacer data. I Educatio Techology ad Traiig, ad 2008 Iteratioal Workshop o Geosciece ad Remote Sesig. ETT ad GRS Iteratioal Workshop o, volume 1, pages IEEE, [8] Qighua Zhag; Yuzhe Fu. Research of adaptive immue etwork itrusio detectio model. Iteratioal Joural of Systems, Cotrol ad Commuicatios, 3(3): , [9] Maoguo Gog, Jia Zhag, Jigjig Ma, ad Licheg Jiao. A efficiet egative selectio algorithm with further traiig for aomaly detectio. Kowledge-Based Systems, 30: , [10] Xiaojua He, Jiachao Zeg, Sogdog Xue, ad Lifag Wag. A ew estimatio of distributio algorithm based edge histogram model for flexible job-shop problem. I Computer Sciece for Evirometal Egieerig ad EcoIformatics, pages Spriger, ISSN: Page 378

9 [11] Zhag Hogmei, Gao Haihua, ad Wag Xigyu. Quatum particle swarm optimizatio based etwork itrusio feature selectio ad detectio [12] Mohammad Sazzadul Hoque, Md Mukit, Md Bikas, Abu Naser, et al. A implemetatio of itrusio detectio system usig geetic algorithm. arxiv preprit arxiv: , [13] Mohammad Sazzadul Hoque, Md Mukit, Md Bikas, Abu Naser, et al. A implemetatio of itrusio detectio system usig geetic algorithm. arxiv preprit arxiv: , [14] Pedro Larra aga, Ramo Etxeberria, Jos e A Lozao, ad Jos e M Pe a. Combiatorial optimizatio by learig ad simulatio of bayesia etworks. I Proceedigs of the Sixteeth coferece o Ucertaity i artificial itelligece, pages Morga Kaufma Publishers Ic., [15] Sag Mi Lee, Dog Seog Kim, ad Jog Sou Park. A survey ad taxoomy of lightweight itrusio detectio systems. Joural of Iteret Services ad Iformatio Security, 2(1/2): , [16] Feg Liu, Jua Liu, Jig Feg, ad Huaibei Zhou. Estimatio distributio of algorithm for fuzzy clusterig gee expressio data. I Advaces i Natural Computatio, pages Spriger, [17] Li-li Liu ad Yua Liu. Mqpso based o wavelet eural etwork for etwork aomaly detectio. I Wireless Commuicatios, Networkig ad Mobile Computig, WiCom 09. 5th Iteratioal Coferece o, pages 1 5. IEEE, [18] Yua Liu. Qpso-optimized rbf eural etwork for etwork aomaly detectio. Joural of Iformatio & Computatioal Sciece, 8(9): , [19] Adetumbi A Olusola, Adeola S Oladele, ad Daramola O Abosede. Aalysis of kdd99 itrusio detectio dataset for selectio of relevace features. I Proceedigs of the World Cogress o Egieerig ad Computer Sciece, volume 1, pages 20 22, [20] Chug-Mig Ou ad CR Ou. Immuity-ispired host-based itrusio detectio systems. I Geetic ad Evolutioary Computig (ICGEC), 2011 Fifth Iteratioal Coferece o, pages IEEE, [25] Jiayog Su, Qigfu Zhag, ad Edward PK Tsag. De/eda: A ew evolutioary algorithm for global optimizatio. Iformatio Scieces, 169(3): , [26] S.Yag ad L. Jiao. A quatum-vaccie-ispired immue cloal algorithm ad memory-ehaced learig. Electrical Egieerig, IEEE Trasactios o, [27] MM Wa el, Hamdy N Agiza, ad Elsayed Radwa. Itrusio detectio usig rough sets based parallel geetic algorithm hybrid model. I Proceedigs of the World Cogress o Egieerig ad Computer Sciece, volume 2, pages 20 22, [28] Hui WANG, Xiaoju BI, Liju YU, ad Liju ZHANG. A adjustable threshold immue egative selectio algorithm based o vaccie theory [j]. Joural of Harbi Egieerig Uiversity, 1:015, [29] Rui Wu, Chag Su, Kewe Xia, ad Yi Wu. A approach to wls-svm based o qpso algorithm i aomaly detectio. I Itelliget Cotrol ad Automatio, WCICA th World Cogress o, pages IEEE, [30] Shelly Xiaoa Wu ad Wolfgag Bazhaf. The use of computatioal itelligece i itrusio detectio systems: A review. Applied Soft Computig, 10(1):1 35, [31] Chu Yag, Haidog Yag, ad Feiqi Deg. Quatumispired immue evolutioary algorithm based parameter optimizatio for mixtures of kerels ad its applicatio to supervised aomaly idss. I Itelliget Cotrol ad Automatio, WCICA th World Cogress o, pages IEEE, [32] Qua-mi Zha, Rog-gui Wag, ad Wei He. Itrusio detectio algorithm based o quatum geetic clusterig. Applicatio Research of Computers, 1:073, [33] Haiyi Zhag, Yag Yi, ad Jiasheg Wu. Network itrusio detectio system based o icremetal support vector machie. I Cotemporary Challeges ad Solutios i Applied Artificial Itelligece, pages Spriger, [34] Zog-Fei Zhag. Quatum evolutioary algorithm for optimizig etwork itrusio sigature database. Jisuaji Yigyog/ Joural of Computer Applicatios, 30(8): , [21] Leila Rajbar ad Siavash Khorsadi. A collaborative itrusio detectio system agaist ddos attack i peer to peer etwork. I Software Egieerig ad Computer Systems, pages Spriger, [22] Khushboo Satpute, Shikha Agrawal, Jitedra Agrawal, ad Sajeev Sharma. A survey o aomaly detectio i etwork itrusio detectio system usig particle swarm optimizatio based machie learig techiques. I Proceedigs of the Iteratioal Coferece o Frotiers of Itelliget Computig: Theory ad Applicatios (FICTA), pages Spriger, [23] Omar S Solima ad Aliaa Rassem. A bio ispired cloal algorithm with estimatioof distributio algorithm for global optimizatio. I Iformatics ad Systems (INFOS), th Iteratioal Coferece o, pages BIO 166. IEEE, [24] KG Sriivasa. Applicatio of geetic algorithms for detectig aomaly i etwork itrusio detectio systems. I Advaces i Computer Sciece ad Iformatio Techology. Networks ad Commuicatios, pages Spriger, ISSN: Page 379