A Cooperative Differential Evolution Based Intrusion Detection System for Unknown Cyberattacks

The evolving unknown cyberattacks have rapidly increased the cyber threat surface. However, since only known cyberattack samples are usually available, most existing intrusion detection systems (IDSs) are only effective in detecting known cyberattacks. In this poster, we propose a cooperative differential evolution based IDS, coined CoDE-IDS, to detect unknown cyberattacks. Specifically, we first design a dual DE algorithm for known nonself antigens (abnormal data), which considers dual evolutionary objectives and creates unknown nonself antigens characterized by similar features to known ones. Second, a hierarchical DE algorithm is designed to transfer known self antigens with hierarchical distances and create unknown non-self antigens deviating from normal patterns. Last, the newly-evolved antigens are employed to generate cyberattack detectors. Extensive experiments demonstrate that the CoDE-IDS achieves outperformed effectiveness in recognizing both unknown and known cyberattacks compared to the state-of-the-art studies.