Building an Intrusion Detection System Based on Support Vector Machine and Genetic Algorithm

Host-based Intrusion Detection System (IDS) utilizes the log files as the data source and is limited by the content of the log files. If the log files were tampered, the IDS cannot accurately detect illegal behaviors. Therefore, the proposed IDS for this paper will create its own data source file. The system is controlled by the Client program and Server program. The client program is responsible for recording a user’s behavior in the data source file. The data source file is then transmitted to the server program, which will send it to SVM to be analyzed. The analyzed result will then be transmitted back to the client program. The client program will then decide on the course of actions to take based on the analyzed result. Also, the genetic algorithm is used to optimize information to extract from the data source file so that detection time can be optimized.