292034

A RULE LEARNING APPROACH FOR BUILDING AN EXPERT SYSTEM TO DETECT NETWORK INTRUSIONS

Article

Last updated: 03 Jan 2025

Subjects

-

Tags

-

Abstract

Network intrusion detection is the problem of detecting suspicious requests through networks. In recent years, many researchers focus on addressing this problem in the context of machine learning. Although machine learning algorithms are powerful, most of them lack the power of interpretability. Expert systems, on the other hand, are knowledge-based systems designed to simulate the problem-solving behavior of human experts. Expert systems possess the advantage of interpretability through an explanation mechanism that justifies its own line of reasoning, however, they need the availability of a domain expert. This paper proposes the use of rule learning approaches to gain the best of both fields, being interpretable as expert system and learnable through collected datasets without the need for explicit expertise. A separate and conquer rule learning approach is proposed for network intrusion detection. Our results show that the separate and conquer approach achieves a 0.99 weighted average F1-score on the test set which makes it very comparative to both decision trees and classical machine learning approaches. We also show that rules produced using separate and conquer are much simpler than decision trees and more interpretable.

DOI

10.21608/ijicis.2023.167424.1223

Keywords

Intrusion Detection, Expert Systems, Rule Learning, Separate and Conquer, Divide and Conquer

Authors

First Name

Omar

Last Name

Galal

MiddleName

-

Affiliation

Computer Engineering Department, Faculty of Engineering, Cairo University, Giza, Egypt

Email

omar.galal@eng.cu.edu.eg

City

-

Orcid

-

First Name

Ahmed

Last Name

Nasr

MiddleName

-

Affiliation

Computer Engineering Department, Faculty of Engineering, Cairo University, Giza, Egypt

Email

ahmed.nasr9677@gmail.com

City

-

Orcid

-

First Name

Lydia

Last Name

Rizkallah

MiddleName

Wahid

Affiliation

Computer Engineering Department, Faculty of Engineering, Cairo University, Giza, Egypt

Email

lydiawahid@outlook.com

City

Egypt

Orcid

0000-0002-8243-2135

Volume

23

Article Issue

1

Related Issue

40411

Issue Date

2023-03-01

Receive Date

2022-10-08

Publish Date

2023-03-01

Page Start

106

Page End

114

Print ISSN

1687-109X

Online ISSN

2535-1710

Link

https://ijicis.journals.ekb.eg/article_292034.html

Detail API

https://ijicis.journals.ekb.eg/service?article_code=292034

Order

292,034

Type

Original Article

Type Code

494

Publication Type

Journal

Publication Title

International Journal of Intelligent Computing and Information Sciences

Publication Link

https://ijicis.journals.ekb.eg/

MainTitle

A RULE LEARNING APPROACH FOR BUILDING AN EXPERT SYSTEM TO DETECT NETWORK INTRUSIONS

Details

Type

Article

Created At

23 Dec 2024