A RULE LEARNING APPROACH FOR BUILDING AN EXPERT SYSTEM TO DETECT NETWORK INTRUSIONS
Galal, O., Nasr, A., Rizkallah, L. (2023). A RULE LEARNING APPROACH FOR BUILDING AN EXPERT SYSTEM TO DETECT NETWORK INTRUSIONS. EKB Journal Management System, 23(1), 106-114. doi: 10.21608/ijicis.2023.167424.1223
Omar Galal; Ahmed Nasr; Lydia Wahid Rizkallah. "A RULE LEARNING APPROACH FOR BUILDING AN EXPERT SYSTEM TO DETECT NETWORK INTRUSIONS". EKB Journal Management System, 23, 1, 2023, 106-114. doi: 10.21608/ijicis.2023.167424.1223
Galal, O., Nasr, A., Rizkallah, L. (2023). 'A RULE LEARNING APPROACH FOR BUILDING AN EXPERT SYSTEM TO DETECT NETWORK INTRUSIONS', EKB Journal Management System, 23(1), pp. 106-114. doi: 10.21608/ijicis.2023.167424.1223
Galal, O., Nasr, A., Rizkallah, L. A RULE LEARNING APPROACH FOR BUILDING AN EXPERT SYSTEM TO DETECT NETWORK INTRUSIONS. EKB Journal Management System, 2023; 23(1): 106-114. doi: 10.21608/ijicis.2023.167424.1223

A RULE LEARNING APPROACH FOR BUILDING AN EXPERT SYSTEM TO DETECT NETWORK INTRUSIONS

International Journal of Intelligent Computing and Information Sciences
Volume 23, Issue 1, March 2023, Page 106-114  XML PDF (344.66 K)
Document Type: Original Article
DOI: 10.21608/ijicis.2023.167424.1223
View on SCiNiTO View on SCiNiTO
Authors
Omar Galal1; Ahmed Nasr2; Lydia Wahid Rizkallah email orcid 3
1Computer Engineering Department, Faculty of Engineering, Cairo University, Giza, Egypt
2Computer Engineering Department, Faculty of Engineering, Cairo University, Giza, Egypt
3Computer Engineering Department, Faculty of Engineering, Cairo University, Giza, Egypt
Abstract
Network intrusion detection is the problem of detecting suspicious requests through networks. In recent years, many researchers focus on addressing this problem in the context of machine learning. Although machine learning algorithms are powerful, most of them lack the power of interpretability. Expert systems, on the other hand, are knowledge-based systems designed to simulate the problem-solving behavior of human experts. Expert systems possess the advantage of interpretability through an explanation mechanism that justifies its own line of reasoning, however, they need the availability of a domain expert. This paper proposes the use of rule learning approaches to gain the best of both fields, being interpretable as expert system and learnable through collected datasets without the need for explicit expertise. A separate and conquer rule learning approach is proposed for network intrusion detection. Our results show that the separate and conquer approach achieves a 0.99 weighted average F1-score on the test set which makes it very comparative to both decision trees and classical machine learning approaches. We also show that rules produced using separate and conquer are much simpler than decision trees and more interpretable.
Keywords
Intrusion Detection; Expert Systems; Rule Learning; Separate and Conquer; Divide and Conquer
Statistics
Article View: 348
PDF Download: 261