Intrusion Detection In Mobile Ad Hoc Networks Using GA Based Feature Selection

TL;DR

This paper explores the use of genetic algorithms and Markov blanket discovery for feature selection in intrusion detection systems for mobile ad hoc networks, aiming to improve detection accuracy and reduce false alarms.

Contribution

It introduces and compares two feature selection methods, genetic algorithm and Markov blanket discovery, for enhancing intrusion detection in MANETs.

Findings

Genetic algorithm achieved higher detection rate.

Markov blanket method resulted in lower false alarm rate.

Both methods improved intrusion detection performance.

Abstract

Mobile ad hoc networking (MANET) has become an exciting and important technology in recent years because of the rapid proliferation of wireless devices. MANETs are highly vulnerable to attacks due to the open medium, dynamically changing network topology and lack of centralized monitoring point. It is important to search new architecture and mechanisms to protect the wireless networks and mobile computing application. IDS analyze the network activities by means of audit data and use patterns of well-known attacks or normal profile to detect potential attacks. There are two methods to analyze: misuse detection and anomaly detection. Misuse detection is not effective against unknown attacks and therefore, anomaly detection method is used. In this approach, the audit data is collected from each mobile node after simulating the attack and compared with the normal behavior of the system. If there is any deviation from normal behavior then the event is considered as an attack. Some of the features of collected audit data may be redundant or contribute little to the detection process. So it is essential to select the important features to increase the detection rate. This paper focuses on implementing two feature selection methods namely, markov blanket discovery and genetic algorithm. In genetic algorithm, bayesian network is constructed over the collected features and fitness function is calculated. Based on the fitness value the features are selected. Markov blanket discovery also uses bayesian network and the features are selected depending on the minimum description length. During the evaluation phase, the performances of both approaches are compared based on detection rate and false alarm rate.