Ant colony induced decision trees for intrusion detection

Abstract

In the ashes of Moore’s Law, companies have to acclimatise to the vast increase of data flowing through their networks. Reports on information breaches and hackers claiming ransom for company data are rampant. We live in a world where data requirements have become dynamic, where things are constantly changing. The field of intrusion detection however have not changed much, traditional detection methods are still the norm for commercial products promoting a rigid, manual and static detection platform. Intrusion Detection Systems (IDS) analyse network traffic to identify suspicious patterns with the intention to compromise the system. Practitioners train classifiers to classify the data within different categories e.g. malicious or normal network traffic. Machine learning has great potential when applied in the intrusion detection domain: decision trees (DT), random forests (RF) and ant colony optimization (ACO) are all popular research topics. This paper focuses on the recent advances within machine learning, specifically the Ant Tree Miner (ATM) classifier. The ATM classifier proposed by Otero, Freitas & Johnson (2012) builds decision trees using ant colony optimization instead of traditional C4.5 or CART techniques. Our experimental process ensures reliability, comparability and reproducibility, which are lacking in some previous research within the field. This approach is intended to improve on previous studies combining both domains. The ATM classifier has not been tested in the intrusion detection domain.