Intrusion detection and prevention system and method for generating detection rules and taking countermeasures

1. A detection rules generation engine, comprising one or more processors and/or servers, which alone or in combination, are configured to provide for execution of the following steps:

receiving filtered network traffic instances from a network tap and building an initial population of decision trees having nodes which are sorted based on an information gain of network features of the traffic instances;

selecting two individuals from the population based on a selection probability, wherein the selection probability is given by:

F ( I i )=α f 1 ( I i )+β f 2 ( I i )+γ f 3 ( I i ),

where:

f 1 (I i ) is the class-based selection function for the i th individual,

f 2 (I i ) is the actual fitness function for the i th individual,

f 3 (I i ) is the missing classes function of the best individual, and

α, β and γ are the weights of f 1 , f 2 and f 3 , respectively (where α+β+γ=1);

selecting a depth among the nodes of the decision trees;

applying a crossover operation on the selected individuals;

applying a mutation operation on the selected individuals; and

generating a next population.

2. The detection rules generation engine according to claim 1 , wherein the one or more processors and/or servers are further configured to provide for execution of the step of selecting a best individual of the next population.

3. The detection rules generation engine according to claim 2 , wherein the one or more processors and/or servers are further configured to provide for execution of the step of adding any missing classes to the best individual.

4. The detection rules generation engine according to claim 1 , wherein the one or more processors and/or servers are configured to provide for execution of the step of performing the crossover operation by swapping randomly chosen branches between the selected individuals so as to provide a synthesis to the selected depth.

5. The detection rules generation engine according to claim 1 , wherein the one or more processors and/or servers are configured to provide for execution of the step of performing the mutation operation by splitting the nodes of the selected individuals at the selected depth and at a splitting point which provides a highest information gain.

6. The detection rules generation engine according to claim 1 , further comprising a population database configured to store the next population.

7. A method for generating detection rules, comprising:

receiving filtered network traffic instances from a network tap;

building an initial population of decision trees having nodes which are sorted based on an information gain of network features of the traffic. instances;

selecting two individuals from the population based on a selection probability, wherein the selection probability is given by:

F ( I i )=α f 1 ( I i )+β f 2 ( I i )=γ f 3 ( I i ),

where:

f 1 (I i ) is the class-based selection function for the i th individual,

f 2 (I i ) is the actual fitness function for the i th individual,

f 3 (I i ) is the missing classes function of the best individual, and

α,β and γ are the weights of f 1 , 2 and 3 , respectively (where α+β+γ=1);

selecting a depth among the nodes of the decision trees;

applying a crossover operation on the selected individuals;

applying a mutation operation on the selected individuals; and

generating a next population.

8. The method according to claim 7 , further comprising selecting a best individual of the next population.

9. The method according to claim 8 , further comprising adding any missing classes to the best individual.

10. The method according to claim 7 , further comprising:

transforming the decision tree of the best individual into decision rules;

adding the decision rules into a decision rules database;

evaluating network traffic based on the decision rules in the decision rules database;

providing an alert based on the network traffic satisfying conditions of the decision rules; and

initiating countermeasures against a potential attack.

11. The method according to claim 7 , wherein the crossover operation is performed by swapping randomly chosen branches between the selected individuals so as to provide a synthesis to the selected depth.

12. The method according to claim 7 , wherein the mutation operation is performed by splitting the nodes of the selected individuals at the selected depth and at a splitting point which provides a highest information gain.

13. A tangible, non-transitory computer readable medium having instructions thereon, which, when executed on one or more processors cause execution of a method comprising:

building an initial population of decision trees having nodes which are sorted based on an information gain of network features of filtered traffic instances;

selecting two individuals from the population based on a selection probability, wherein the selection probability is given by:

F ( I i )=α f 1 ( I i )+β f 2 ( I i )+γ f 3 ( I i ),

where:

f 1 (I i ) is the class-based selection function for the i th individual,

f 2 (I i ) is the actual fitness function for the i th individual,

f 3 (I i ) is the missing classes function of the best individual, and

α,β and γ are the weights of f 1 , f 2 and f 3 , respectively (where α+β+γ=1);

selecting a depth among the nodes of the decision trees;

applying a crossover operation on the selected individuals;

applying a mutation operation on the selected individuals; and

generating a next population.