Un système de vérification et de validation de la sécurité et l’intégration évolutive adaptative de la protection dans les systèmes d’informations avancés

Abstract

The Internet and new technologies of computer networks require to the company a high degree of the security and protection at the level of the systems. Security has become an impor-tant necessity, for that different tools are integrated as intrusion detection systems (IDS). IDS is very important components of the security infrastructure in any security policy. Moreover, the main purpose of IDS is to detect the different attacks and ensure the ability to discover the novel one for accompanying the attack's evolution. Regarding to the huge number of connections and the large flow of data on the Internet, IDS has a difficulty to detect attacks. Moreover, irrelevant and redundant features influence on the quality of IDS precisely on the detection rate and processing cost. Feature Selection (FS) is the important technique, which gives the issue for enhancing the performance of detection. The dissertation proposes two main contributions. In the first contri-bution, we propose a new taxonomy for feature selection algorithms in intrusion detection sys-tems. We provide a classification with a comparative study between different contribution ac-cording to their techniques and results. The second contribution proposes a distributed multi-objective algorithm of the feature selec-tion for intrusion detection systems. In fact, we propose a new multi-objective algorithm for feature selection called 'MOEDAFS' (Multi-Objective Estimation of Distribution Algorithms (EDA) for Feature Selection). MOEDAFS is based on EDA and Mutual Information (MI). EDA is used to explore the search space and MI is integrated as a probabilistic model to guide research by modelling re-dundancy and relevancy relationships between attributes. Therefore, we propose four probabil-istic models for MOEDAFS. MOEDAFS selects the best feature subsets that have better detec-tion accuracy with fewer selected features. MOEDAFS uses two objective functions: the mini-mization of the classification error rate (ER) and the number of selected features (NF). In order to demonstrate the performance of MOEDAFS, we used two comparisons: an internal comparison and an external comparison on NSL-KDD intrusion detection data. The internal comparison is performed between the four versions of MOEDAFS. The external com-parison is made against well-known feature selection algorithms: Deterministic, Metaheuristic, Multi-objective algorithms. Experimental results demonstrate that MOEDAFS outperforms other feature selection algorithms either in terms of classification accuracy or in terms of re-duction rates.