A COMPARATIVE STUDY OF "FUZZY LOGIC, GENETIC ALGORITHM & NEURAL NETWORK" IN
WIRELESS NETWORK SECURITY (WNS)
ABSTRACT
The more widespread use of networks meaning increased the risk of being attacked. In this study illustration to compares three AI techniques. Using for solving wireless network security problem (WNSP) in Intrusion Detection Systems in network security field. I will show the methods used in these systems, giving brief points of the design principles and the major trends. Artificial intelligence techniques are widely used in this area such as fuzzy logic, neural network and Genetic algorithms. In this paper, I will focus on the fuzzy logic, neural network and Genetic algorithm technique and how it could be used in Intrusion Detection Systems giving some examples of systems and experiments proposed in this field. The purpose of this paper is comparative analysis between three AI techniques in network security domain.

1 INTRODUCTION
This paper shows a general overview of Intrusion Detection Systems (IDS) and the methods used in these systems, giving brief points of the design principles and the major trends. Hacking, Viruses, Worms and Trojan horses are various of the main attacks that fear any network systems. However, the increasing dependency on networks has increased in order to make safe the information that might be to arrive by them. As we know artificial intelligence has many techniques are widely used in this area such as fuzzy logic, neural network and Genetic algorithms etc... In this paper, In this study, I will focus on the three algorithms mentioned above by giving some examples of systems and experiments proposed that used in Intrusion Detection Systems in this area. The purpose of this paper is comparative analysis between three AI techniques in terms of performance, accuracy of decision making.

1-1 Genetic Algorithms
“A Genetic Algorithm (GA) is a programming procedure that imitates natural development as a problem-solving tactic.”[2] It is based on Darwinian’s rule of development and survival of fittest to optimize a inhabitants of candidate solutions towards a predefined suitability. [16][18] GA uses an development and ordinary collection that uses a chromosome-like data structure and develop the chromosomes using collection, Reassemble, and change operators. The procedure habitually start with randomly generated population of chromosomes, which represent all probable result of a problem that are measured candidate results. Dissimilar positions of each chromosome are encoded as bits, numbers or characters. These positions might referred to as genes. According to the requested answers, an estimation task is used to evaluate the quality of each chromosome , this task is called “Fitness Function”. Through estimation, two essential operators, intersect and change, are used to emulate the natural reproduction and change of types. The collection of chromosomes for staying and combination is partial to wards the fittest chromosomes. At first by a casual creation of initial population, then estimate and develop during collection, recombination, and change. Finally, the best personality (chromosome) is chosen out as the last result once the optimization meet its goal (Pohlheim, 2001). With the appearance of information jump in the industry world and the quick speed of communication, network systems and technologies has been of a main fear to stay up with the fast stream of information spread and communication in everywhere around the world. Enlarge of network degree, growth of complex information technologies, and other factors increase the number of probable targets for attacks versus computer networks. Hacking, Viruses, Worms and Trojan horses are several of the main attacks that fear any network systems. However, the increasing need on computer networks has increased in order to safe the information that might arrive by them. alongside with the typically used security tools like firewalls, intrusion detection systems (IDS) are appropriate of highest importance. Intrusion Detections Systems (IDS) is a new way of security systems, which provides capable path to safe computer networks. Artificial Intelligence paths have been used enormously to produce a lot of IDS. Some of these paths dependency on Genetic Algorithms to give the network with an capable classifier to know and sense intrusions events. In the next paragraph , IDS systems are briefly clear and clarified, the next stage goes briefly on AIS to provide an foreword of the next stage which clarifies the apply of genetic algorithms in ID. finally, put all jointly by presenting a brief on two diverse system case studies that uses paths by GA for IDS.

Generate
Initial
population
Ovulate Objective function Are optimization
Criteria met?
Best
Individuals
S
T
A
R
T

YesA
R
E
S
U
L
T

l t NO

Selection
Recompilation
Mutation
Generate new population

Generate
Initial
population
Ovulate Objective function Are optimization
Criteria met?
Best
Individuals
S
T
A
R
T

YesA
R
E
S
U
L
T

l t NO

Selection
Recompilation
Mutation
Generate new population

figure 1 : Structure of Simple GA [16]

Initialization
Selection
Initiation population
New population
Old population
End
Quit?
Crossover
Mutation
No
Yes
Initialization
Selection
Initiation population
New population
Old population
End
Quit?
Crossover
Mutation
No
Yes

Figure 2 : The operation of GA [8]

Figure 3 : Algorithm [8]

Figure 4 : Results of Experiment [28].

1.2 ANN (Artificial Neural Networks) Approach
Neural Networks (NN) are mathematical techniques designed to simulate the way in which the human brain a specific task, and consists of simple processing units, these units are only the elements of calculation, called neurons or nodes (Nodes, Neurons), which have a characteristic neurological. Neurons are joined with communication channels, and information flows, in the structure of arithmetical information among nodes.” [2] The capability of interconnection among nodes is during weights that are changing elements which make a dynamic ANN environment. alike to the human’s neural systems, a lot of inputs could inter a confident nerve in a similar style; the inputs are collected with the weight to be used in a transport Function which gives the last output. ANN learning techniques are mostly divided into supervised or unsupervised according to the knowledge technique used. Supervised technique must reach a desired production, if not; the numerical algorithms built in ANN will make some adjustments until it reaches the probable production. The unsupervised knowledge is the reverse technique of the previous technique, i.e. it is given a some elements for inputs and no right output. In state of IDS these knowledge techniques are used to add to the system intelligence in distinctive among normal and interloper behaviors. unlike expert systems, which can present the user with a best result if the distinctiveness, which are surveyed precisely, match those, which have been coded in the rule base, a neural network conducts an analysis of the information and provides expectedly estimation that the data matches the distinctiveness, which it has been trained on recognition of. While the probability of a match definition by a neural network can be 100%, the correctness of its decisions dependence absolutely on the experience the system gains in analyzing examples of the current problem. The Neural Network gains the experience principally by exercise the system to properly identify pre-selected examples of the problem. The echo of the Neural Network is explained and the setting of the system is polished until the neural network’s analysis of the exercising data reaches a pleasurable level. In addition to the main exercise period, the neural network also gains knowledge over time as it conducts analyses on data related to the problem.

1.3 Fuzzy Logic
Fuzzy Logic was presented as a means to the model of doubt of natural language. And due to the doubt nature of intrusions fuzzy sets are powerfully used in discovering attack actions and reducing the average of false alarms at the same time. Essentially, intrusion detection systems discriminate among two discrete types of behaviors, normal and abnormal, which create two discrete sets of system and information. Fuzzy logic could create sets that have among values where the differences among the two sets are not good defined. In this case the logic depends on linguistics by taking the minimum of set of events or maximum instead of stating OR, AND or NOT operation in the if-then-else situation. This attribute powerfully participates in reducing the false positive alarm rates in the system. [12][24].
NeGPAIM-W2 has two low-level processing units counting the fuzzy engine, which it will process the input data. This engine is liable for execute the abuse Detection methodology.
The fuzzy engine will calculate a pattern firstly, and the user action graph will be mapped versus it to decide how-ever or not a user (intruder) has been, or is performing an intrusion attack. The overall intrusion probability for the network sensors is divided into two weighted parts: one weighting for the wireless attack probability and the other for the wired network intrusion attack probability. The fuzzy engine’s network detection rules have been updated with the new NeGPAIMW 2 Model to provide a better detection rate. The rules have been updated to detect attacks at layers 2 and 3 of the OSI model, where the previous fuzzy engine specifically targeted layer 3 only. The modern model allows for improved performance by divided the network exposure into wired and wireless one by one, and weighting the outputs to form a final fuzzy intrusion attack probability as seen in Fig.2. This also give a permission to the engine to get into account the variation in broadcast of data over the unlike network mediums. The fuzzy engine will pass its intrusion probability value to the central analysis engine. This is a continuous process.

Figure 1: General Representation of NeGPAIM-W2.

Figure 2: Comparison between Traditional and Alternative
Misuse Detection.

Figure 3: High Level Detection Model.

2 COMPARATIVE ANALYSIS
Comparative analysis of chosen techniques in terms of performance accuracy of decision making.

2.1 Neural Network
When we used the neural networks in the task of alarm for the purpose of detecting intruders for 10 users. Was accurate to the degree of 96% for strangers and other activities not normal with 7% of alarms wrong.

2.2 GENETIC ALGORITHM
Chittur [26] achieved for genetic algorithm detection for the purpose of spy and actives strange success rate of 97% This is demonstrated by the low rate of false alarms.

2.3 FUZZY LOGIC
The fuzzy engine was set to this study this as an action of abuse as every scheduling wireless hardware have their MAC addresses registered. The result of the fuzzy engine at this point was set at 15% possibility of attack due to the excited common presented. The result was once again forwarded to the CAE. The CAE, at this point, still only received intrusion possibility from the fuzzy engine and, after performing the statistical calculations, the CAE output is 7.5% possibility of attack. This is still too low to apply any active or passive request. Step 3 Results At Step 3 of his/her attack, Intruder1 had broken the WEP key for AP1, from the data gathered during Step 2. The intruder then proceeded to ports can Host1, the DHCP and FTP server, which excited off one more two wireless common presented. The fuzzy engine's result at this point was set at forty percent possibility of attack. This information was then reported to the CAE as was finish before. The CAE has still only received intrusion possibility from the fuzzy engine at this point. After the stage the statistical calculations, the CAE output is 20% possibility of attack.

3 DISCUSSION
Expert Systems used in Intrusion Detection techniques as a significant objective in the increase of effective detection-based information security systems. But "expert". unluckily, Expert Systems necessitate frequent updates by a System Administrator to stay present. The require of repairs or update will degrade the security of the entire system while the system's users think that the system is safe, even if one of the key components becomes unsuccessful over time.

Advantages of Neural Network-based Intrusion Detection Systems
The primary benefit in the using of a neural network in the detection would be the litheness that the network would supply. (A N N) would be able of analyzing the data from the network, even if the data is unfinished or indistinct.
Also, the network ability to non-linear analysis of the data, because it can be exposed to several networks, coordinated attacks, has a special ability to handle data from multiple sources in a non-linear. The advantage inherent speed of neural networks. Help to detect or predict the speed of the various attacks. A Neural Network-based abuse detection system would identify the possibility that a particular event, or series of actions, was indicative of an attack against the system. As the Neural Network gains practice it will improve its capability to determine where these actions are likely to occur in the attack process. This information could then be used to produce a series of events that should happen if this is in actuality an intrusion effort. By tracking occurs following these procedures will be able to perfect the system analysis procedures, to carry out security measures and successful preventive.

Disadvantages of Neural Network-based Intrusion Detection Systems
In the past, neural networks is able to detect the infiltration methods for two main reasons. First one they are not trained good on detection methods, data and training necessary for accurate intrusion detection, secondly; black box

4 CONCLUSION in this paper, Intrusion Detection System summary was presented, giving the dissimilar trends and technologies that might be used Artificial Intelligence methods are in advance the most attention presently concerning its ability to study and develop, which makes them more exact and usefully in facing the huge number of unpredictable attacks. Three main techniques were highlighted, were the use of Genetic Algorithms, fuzzy logic and neural network providing system classifiers with extra intelligence.

References
1 “Intrusion Detection Systems using Genetic Algorithms”By: LameesAlhazzaa
ID: 426221091
Proposed to: Dr. Hassan Mathkour
2 Bobor, V. "Efficient Intrusion Detection System Architecture Based on Neural
Networks and Genetic Algorithms.", Department of Computer and Systems Sciences,
Stockholm University / Royal Institute of Technology, KTH/DSV, 2006.
3 Faraoun, K M., and A. Boukelif. "Genetic Programming Approach for Multi-Category
Pattern Classification Applied to Network Intrusions Detection.", INTERNATIONAL
JOURNAL OF COMPUTATIONAL INTELLIGENCE, Vol. 3, No. 1, 2006 pp. 79-90.
4 SHAHBAZ PERVEZ, IFTIKHAR AHMAD, ADEEL AKRAM, SAMI ULLAH
SWATI University of Engineering and Technology, Taxila, Pakistan
{Shahbaz, adeel}@uettaxila.edu.pk
5 Page, J., Heaney, J., Adkins, M. &Dolsen, G. (1989). Evaluation of Security Model Rule
Bases.Technical Report.Planning Research Corporation.

6 Lunt, T.F. (1989).Real-Time Intrusion Detection.Proceedings from IEEE COMPCON.
7 Mukherjee, B., Heberlein, L.T. & Levitt, K.N. (May/June, 1994). Network Intrusion
Detection. IEEE Network. pp. 26-41.
8 Gong, R.H. , M. Zulkernine, P. Abolmaesumi, "A Software Implementation of a
Genetic Algorithm Based Approach to Network Intrusion Detection," Proceedings of
Sixth IEEE ACIS International Conference on Software Engineering, Artificial
Intelligence, Networking, and Parallel/Distributed Computing (SNPD),May 2005,
Maryland,USA.
9 Utilizing Fuzzy Logic and Neural Networks for Effective,
Preventative Intrusion Detection in a Wireless Environment
Robert Goss. Nelson Mandela Metropolitan. University Port Elizabeth(6001) rossouw.vonsolms@nmmu.ac.za 10 Wilhelm, A. (2000).The State of the Digital Divide in USA. Retrieved May 25, 2005, from 34 http://www.digitalechancen. de/transfer/downloads/MD43.pdf 11 Miniwatts Marketing Group.(2007). Internet World Stats. Retrieved from http://www.internetworldstats.com/ 12 Yao, J. T., S.L. Zhao, and L.V. Saxton, “ A study on fuzzy intrusion detection ”,
Proceedings of SPIE Vol. 5812, Data Mining, Intrusion Detection, Information
Assurance, And
Data Networks Security, 28 March - 1 April 2005, Orlando, Florida, USA.
13 Ryan, J., Lin, M., and Miikkulainen, R. (1997). Intrusion Detection with Neural
Networks. AI Approaches to Fraud Detection and Risk Management: Papers from the 1997 AAAI
Workshop (Providence, Rhode Island), pp. 72-79. Menlo Park, CA: AAAI.
14 Rhodes, B., Mahaffey, J., &Cannady, J. (2000, October). Multiple Self-Organizing
Maps for Intrusion Detection. Proceedings of the 23rd National Information Systems
Security Conference.
15 Cannady, J. (2000, October). Next Generation Intrusion Detection: Autonomous
Reinforcement
Intrusion Detection. Proceedings of the 23rd National Information Systems Security
Conference.

16 Li, W., "Using Genetic Algorithm for Network Intrusion Detection," Proceedings of the
United States Department of Energy Cyber Security Group 2004 Training Conference,
May
24-27, 2004, Kansas City, Kansas, USA.
18 Marczyk, A. "Genetic Algorithms and Evolutionary Computation.", The Talk, Origins
Archive. 23 Apr. 2004. 7 Oct. 2006 <http://www.talkorigins.org/faqs/genalg/genalg.html>.
24 Gomez, J., and D. Dasgupta. "Evolving Fuzzy Classifiers for Intrusion Detection.",
Proceedings of the 2002 IEEE, Workshop on Information Assurance, United States
Military Academy, June 2001,West Point, NY .
26 Chittur, A., "Model Generation for an Intrusion Detection System Using Genetic
Algorithms.”, High School Honors Thesis, Ossining High School,Ossining, NY., 27
Nov, 2001.
27 Fox, Kevin L., Henning, Rhonda R., and Reed, Jonathan H. (1990). A Neural Network
Approach Towards Intrusion
Detection.In Proceedings of the 13th National Computer Security Conference.
28 Hammerstrom, Dan. (June, 1993). Neural Networks At Work. IEEE Spectrum. pp.
26-53.