Features selection for ids in encrypted traffic using genetic algorithm

• Main Authors: Barati, Mehdi, Abdullah, Azizol, Mahmod, Ramlan, Mustapha, Norwati, Udzir, Nur Izura
• Format: Conference or Workshop Item
• Language: English
• Published: UUM College of Arts and Sciences, Universiti Utara Malaysia 2013
• Online Access: http://psasir.upm.edu.my/id/eprint/41307/1/41307.pdf; http://psasir.upm.edu.my/id/eprint/41307/; http://www.icoci.cms.net.my/proceedings/2013/PDF/PID38.pdf

Intrusion Detection System (IDS) is one method to detect unauthorized intrusions into computer systems and networks. On the other hand, encrypted exchanges between users are widely used to ensure data security. Traditional IDSs are not able to reactive efficiently in encrypted and tunneled traffic due to inability to analyze packet content. An encrypted malicious traffic is able to evade the detection by IDS. Feature selection for IDS is a fundamental step in detection procedure and aims to eliminate some irrelevant and unneeded features from the dataset. This paper presents a hybrid feature selection using Genetic Algorithm and Bayesian Network to improve Brute Force attack detection in Secure Shell (SSH) traffic. Brute Force attack traffic collected in a client-server model is implemented in proposed method. Our results prove that the most efficient features were selected by proposed method.