A Genetic Algorithm Approach for Doing Misuse Detection in Audit Trail Files

This paper focuses on the development of an intrusion detection system based on genetic algorithms. We present and justify a fitness function independent of variable parameters that addresses the problem of false positives. This fitness function is a generic one that can be used for either off-line or online intrusion detection systems or it allows us consider pseudo intrusions, which could be used to prevent the occurrence of actual intrusions. The paper also describes extending the system to account for the fact that intrusions may be mutually exclusive and defines the union operator which greatly speeds the search for intrusions