INTRUSION DETECTION AND PREVENTION SYSTEM AND METHOD FOR GENERATING DETECTION RULES AND TAKING COUNTERMEASURES

摘要

A detection rules generation engine includes an initial population creation subsystem configured to receive filtered network traffic instances from a network tap and to build an initial population of decision trees having nodes which are sorted based on an information gain of network features of the traffic instances. A parents selection subsystem is configured to select two individuals from the population based on a selection probability. A depth selection subsystem is configured to select a depth among the nodes of the decision trees. A parents crossover subsystem is configured to apply a crossover operation on the selected individuals. A parents mutation subsystem is configured to apply a mutation operation on the selected individuals. A population replacement subsystem is configured to generate a next population.