Modelling intrusion detection as an allocation problem

摘要

This paper proposes to reformulate the intrusion detection problem (IDP) as an allocation problem that allows the user to detect known attack patterns. Many methods and techniques were used for modeling the IDP, but some of them contribute little or not to resolve it. Indeed, some mathematical formulations of the IDP are NP-complete, and identified only two kinds of behaviours (normal and attack). This motivates some researchers to use genetic algorithms to solve these IDPs. The proposal developed in this paper aims to present a new mathematical formulation of the IDP that detects any known attack pattern without recourse to learning techniques like genetic algorithms. Our approach is based on the formulation of the IDP as an allocation problem, which can be rewritten in a polynomial form that makes it easy to solve. A Pascal code tool was developed to achieve some experiments. Our experiments show that our approach is very competitive with respect to some previous works.