Intrusion detection using rough-fuzzy set and parallel quantum genetic algorithm

Abstract

An intrusion detection method using rough-fuzzy set and parallel quantum genetic algorithm (RFS-QGAID) is proposed in this paper. The RFS-QGAID is applied to solve the serious problems of determining the optimal antibodies subsets used to detect an anomaly. To obtain a simplified antibodies collection for high dimensional Log data sets, RFS is applied to delete the redundant antibody features and obtain the optimal antibodies features combination. Then, the optimal attitudes are entered into the QGA classifier for learning and training in the following stage. At last, the detected Log antigens are fed into RFS-QGAID, and we can classify the intrusion types. With RFS-QGAID, we give the simulations, the results on real Log data sets show that: the higher detection accuracy of RFS-QGAID is higher detection accuracy, but the false negative rate is lower for small samples sets, the adaptive performance is higher than other detection algorithms.

1. Introduction

As an effective network security defense tool, many Intrusion Detection Systems (IDS) based on artificial intelligence are proposed. The artificial intelligent algorithms include: deep learning (DL) [20], support vector machine (SVM) [2,11], fuzzy sets (FS) [23], outliers [18], random forest (RF) [9,10] and genetic algorithm (GA) [21]. Mohammed et al. designed an intelligent two-layer IDS for the new network Internet of Things (IoT) [14].

Alyaseen et al. designed an intrusion detection algorithm, they reduced the features with K-means and obtained higher classifying performance [2]. JooHwa et al. [10] designed an IDS, which was based on auto-encoder conditional algorithm, generatively adversarial networks and the RF algorithm (AE-CGAN-RF), auto-encoder conditional algorithm was adopted to obtain reduced features collection from high-dimensional data set.

Ren et al. applied the outliers method to calculate the attribute values and delete redundant features in a hybrid multilevel IDS [9]. These reduction algorithms can reduce partial redundant attributes, but they have shortcomings about the analysis of the characteristics of the relationship between attributes, so some redundant attributes are retained [24,25].

Because there are many redundant attributes in detected data of IDS [3,5,6,16,26], RS and FS are used in ID system. Pawlak put forward RS theory. Fortunately, RS is applied in the attributes reduction. RS has the ability to deal with incomplete and uncertain records set, get the best attributes by removing redundant. With RS and FS, we can get the memory antibodies [23].

For another, the ability of classifier directly decides the anomaly detection accuracy [12]. Yang improved the Clustering Algorithm with Modified Density Peak values (MDPCA) [23], and gave an IDS to improve the density of the peak to solve the problem of imbalance between detection rate and false detection rate. Song et al. [18] designed an anti-adversarial hidden markov model IDS (AA-HMM) to get higher classification ability. While those algorithms lack adaptivity. Orieb et al. proposed a pigeon-inspired optimization improved by a local search algorithm d (LS-PIO) [1] and applied it to an IoT network. Maya et al. gave a dual IDS with bagging and gradient boosting decision tree (GBDT) to decrease the false alarm rate [13]. Ankit and Ritika proposed an IDS based on deep neural network, they applied the fusion of statistical importance to select features [4].

The GA is applied to improve the self-adaptability in IDS. Zahra et al. gave an ID system with FS and GA, which are adopted to generate a reduced features collection, which included the fuzzy if-then antibodies classification rules, GA was applied to calculate the antibodies rule weights specification [21]. However, the initial population distribution of antibodies affect the detection performances of IDS greatly. For the fixing crossover probability values and mutation probability values of genetic operators, the global optimal solutions are unconducive to search.

In order to get higher intrusion detection performances, especially for the small samples sets, the Rough-Fuzzy Set method is proposed to delete the redundant attributes, obtain the optimum antibodies features sets and achieve effective compact features dataset after reducing all the unnecessary attributes. Then, synthesizing GA and the quantum computing, we design a MOP-AQGA algorithm. Finally, we propose an ID method based on RFS and QGA. Experiments are given on intrusion data which are collected from real network traffic records, and the results show that RFS-QGAID has better intrusion detection performances as it has higher detection, accuracy and lower false positive rate for small samples sets.

2. The RFS algorithm

2.1. Rough set

Combined the RS and AIS, the key definitions are given in following definitions [23].

Definition 1.

${\mathit{a}}_{\mathit{t}\mathit{g}}\in {\mathit{A}}_{\mathit{t}\mathit{g}}$ , ${\mathit{a}}_{\mathit{t}\mathit{g}}$ is an antige, ${\mathit{A}}_{\mathit{t}\mathit{g}}$ denotes an antigen collection, ${\mathit{A}}_{\mathit{t}\mathit{g}}\subset \mathit{S}$ , $\mathit{S}={\{0\mathrm{,}1\}}^{\mathit{m}}$ , ( $\mathit{m}\in \mathit{N}$ , $\mathit{m}\mathrm{>}0$ ), S is a binary string of m bits. N is the positive integers collection.

Definition 2.

${\mathit{a}}_{\mathit{t}\mathit{b}}\in {\mathit{A}}_{\mathit{t}\mathit{b}}$ , $\mathit{d}\in \mathit{S}$ , ${\mathit{a}}_{\mathit{g}\mathit{e}}\in \mathit{N}$ , ${\mathit{A}}_{\mathit{t}\mathit{b}}\{⟨{\mathit{a}}_{\mathit{t}\mathit{b}}\mathrm{,}{\mathit{a}}_{\mathit{s}}\mathrm{,}{\mathit{a}}_{\mathit{g}\mathit{e}}\mathrm{,}\mathit{c}⟩\}$ , ${\mathit{a}}_{\mathit{s}}\in \{00\mathrm{,}01\mathrm{,}10\}$ . ${\mathit{A}}_{\mathit{t}\mathit{b}}$ is an antibodies collection, ${\mathit{a}}_{\mathit{s}}$ denotes the status value of antibody, which includes three status: 00, 01 and 10, ${\mathit{a}}_{\mathit{g}\mathit{e}}$ presents the living time of antibody, c is the matching number of bits between antibodies and antigens. ${\mathit{A}}_{\mathit{t}\mathit{b}}$ contains three subsets ${\mathit{A}}_{\mathit{t}\mathit{b}\mathit{I}}$ , ${\mathit{A}}_{\mathit{t}\mathit{b}\mathit{T}}$ and ${\mathit{A}}_{\mathit{t}\mathit{b}\mathit{M}}$ , ${\mathit{A}}_{\mathit{t}\mathit{b}\mathit{I}}$ denotes the set which includes immature antibodies whose status are 00, ${\mathit{A}}_{\mathit{tbI}}=\{{\mathit{I}}_{\mathit{b}}|{\mathit{I}}_{\mathit{b}}\in {\mathit{A}}_{\mathit{tbI}}\mathrm{,}{\mathit{I}}_{\mathit{b}}.{\mathit{a}}_{\mathit{s}}=00\}$ , ${\mathit{A}}_{\mathit{t}\mathit{b}\mathit{T}}$ denotes the set which includes mature antibodies whose status are 01, ${\mathit{A}}_{\mathit{tbT}}=\{{\mathit{T}}_{\mathit{b}}|{\mathit{T}}_{\mathit{b}}\in {\mathit{A}}_{\mathit{tbT}}\mathrm{,}{\mathit{T}}_{\mathit{b}}.{\mathit{a}}_{\mathit{s}}=01\}$ ; ${\mathit{A}}_{\mathit{t}\mathit{b}\mathit{M}}$ the set which includes memory antibodies whose status are 10, ${\mathit{A}}_{\mathit{tbM}}=\{{\mathit{M}}_{\mathit{b}}|{\mathit{M}}_{\mathit{b}}\in {\mathit{A}}_{\mathit{tbM}}\mathrm{,}{\mathit{M}}_{\mathit{b}}.{\mathit{a}}_{\mathit{s}}=10\}$ .

Definition 3.

${\mathit{A}}_{\mathit{t}}={\mathit{S}}_{\mathit{f}}\cup {\mathit{N}}_{\mathit{f}}$ , all the antigens and antibodies form the collection ${\mathit{A}}_{\mathit{t}}$ . ${\mathit{S}}_{\mathit{f}}$ is on behalf of the normal behaviors collection, while ${\mathit{N}}_{\mathit{f}}$ stands for the attacks collection, the intersection between ${\mathit{S}}_{\mathit{f}}$ and ${\mathit{N}}_{\mathit{f}}$ is NULL.

The bonding strength is denoted as affinity between ${\mathit{a}}_{\mathit{t}\mathit{g}}$ and ${\mathit{a}}_{\mathit{t}\mathit{b}}$ . Definition 4.

The affinity between ${\mathit{a}}_{\mathit{t}\mathit{g}}$ and ${\mathit{a}}_{\mathit{t}\mathit{b}}$ is generated with formula (1): $$\begin{array}{}\text{(1)}& \mathit{D}=\sqrt{{\displaystyle \sum }_{\mathit{i}=1}^{\mathit{m}}{\mathrm{(}{\mathit{a}}_{\mathit{t}{\mathit{g}}^{\mathit{i}}}-{\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{i}}}\mathrm{)}}^2}\end{array}$$ ${\mathit{a}}_{\mathit{t}{\mathit{g}}^{\mathit{i}}}$ and ${\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{i}}}$ denote the values of ith bit of ${\mathit{a}}_{\mathit{t}\mathit{g}}$ and ${\mathit{a}}_{\mathit{t}\mathit{b}}$ respectively.

Definition 5.

The decision system with antibodies attributes is denoted $\mathit{AADT}=⟨\mathit{A}\mathrm{,}{\mathit{C}}_{\mathit{atb}}\cup {\mathit{D}}_{\mathit{atb}}\mathrm{,}{\mathit{V}}_{\mathit{atb}}\mathrm{,}\mathit{f}⟩$ .

${\mathit{A}}_{\mathit{t}}=\{{\mathit{a}}_{\mathit{t}{\mathit{b}}^1}\mathrm{,}{\mathit{a}}_{\mathit{t}{\mathit{b}}^2}\mathrm{,}\dots \mathrm{,}{\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{n}}}\}$ , ${\mathit{A}}_{\mathit{t}}\ne \mathit{\varphi }$ , ${\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{i}}}$ denotes an antibody, ${\mathit{A}}_{\mathit{t}}$ is given in Definition 3.

${\mathit{C}}_{\mathit{atb}}=\{{\mathit{a}}_{{\mathit{t}}^1}\mathrm{,}{\mathit{a}}_{{\mathit{t}}^2}\mathrm{,}\dots \mathrm{,}{\mathit{a}}_{{\mathit{t}}^{\mathit{m}}}\}$ , ${\mathit{C}}_{\mathit{atb}}$ contains m attributes of antibodies called conditional attributes collection.

${\mathit{D}}_{\mathit{atb}}$ denotes the antibodies category attributes collection, the union of ${\mathit{C}}_{\mathit{atb}}$ and ${\mathit{D}}_{\mathit{atb}}$ is ${\mathit{A}}_{\mathit{t}}$ , ${\mathit{C}}_{\mathit{atb}}\cap {\mathit{D}}_{\mathit{atb}}=\mathit{\varphi }$ .

${\mathit{V}}_{\mathit{a}\mathit{t}}={\bigcup }_{{\mathit{a}}_{\mathit{t}\mathit{b}}\in {\mathit{C}}_{\mathit{atb}}\cup {\mathit{D}}_{\mathit{atb}}}{\mathit{V}}_{\mathit{atb}}$ , ${\mathit{V}}_{\mathit{atb}}$ is named ${\mathit{a}}_{\mathit{t}\mathit{b}}$ ’s domain;

$\mathit{f}:{\mathit{A}}_{\mathit{t}}\times {\mathit{C}}_{\mathit{atb}}\to {\mathit{V}}_{\mathit{a}\mathit{t}}$ , f denote the function between attitudes and antibodies attribute.

Definition 6.

For the collection ${\mathit{B}}_{\mathit{t}}$ , ${\mathit{B}}_{\mathit{t}}\subset {\mathit{A}}_{\mathit{t}}$ decides an antibodies relation of equivalence $\mathit{IND}\mathrm{(}{\mathit{B}}_{\mathit{t}}\mathrm{)}$ : $\mathit{IND}\mathrm{(}{\mathit{B}}_{\mathit{t}}\mathrm{)}=\{\mathrm{(}{\mathit{a}}_{\mathit{t}\mathit{b}}\mathrm{,}{\mathit{a}}_{\mathit{t}\mathit{b}}^{\prime }\mathrm{)}\in {\mathit{A}}_{\mathit{t}}\times {\mathit{A}}_{\mathit{t}}|\forall {\mathit{a}}_{\mathit{t}\mathit{b}}^{″}\in {\mathit{B}}_{\mathit{t}}\mathrm{,}\mathit{f}\mathrm{(}{\mathit{a}}_{\mathit{t}\mathit{b}}\mathrm{,}{\mathit{a}}_{\mathit{t}\mathit{b}}^{″}\mathrm{)}=\mathit{f}\mathrm{(}{\mathit{a}}_{\mathit{t}\mathit{b}}^{\prime }\mathrm{,}{\mathit{a}}_{\mathit{t}\mathit{b}}^{″}\mathrm{)}$ . ${\mathit{A}}_{\mathit{t}}$ contains k types with $\mathit{IND}\mathrm{(}{\mathit{B}}_{\mathit{t}}\mathrm{)}$ , every subtype has a kind of antibodies: $$\begin{array}{}\text{(2)}& \mathit{IND}\mathrm{(}{\mathit{B}}_{\mathit{t}}\mathrm{)}={[{\mathit{A}}_{\mathit{t}\mathit{b}}]}_{\mathit{IND}\mathrm{(}{\mathit{B}}_{\mathit{t}}\mathrm{)}}=\{{\mathit{A}}_{\mathit{t}{\mathit{b}}^1}\mathrm{,}{\mathit{A}}_{\mathit{t}{\mathit{b}}^2}\mathrm{,}\dots \mathrm{,}{\mathit{A}}_{\mathit{t}{\mathit{b}}^{\mathit{k}}}\}\end{array}$$

Definition 7.

Antibody lower approximate collection $\mathit{B}\ast \mathrm{(}{\mathit{A}}_{\mathit{t}\mathit{b}}\mathrm{)}$ contains all the certain antibodies, but the upper approximation collection includes all possible antibodies.

Let a decision system with antibodies attributes is $\mathit{AADT}=⟨\mathit{A}\mathrm{,}{\mathit{C}}_{\mathit{atb}}\cup {\mathit{D}}_{\mathit{atb}}\mathrm{,}{\mathit{V}}_{\mathit{atb}}\mathrm{,}\mathit{f}⟩$ , $\forall {\mathit{A}}_{\mathit{t}\mathit{b}}$ and ${\mathit{A}}_{\mathit{t}\mathit{b}}\subseteq {\mathit{A}}_{\mathit{t}}$ , equivalence relations $\forall {\mathit{B}}_{\mathit{t}}\subseteq {\mathit{A}}_{\mathit{t}}$ , the lower approximation of ${\mathit{A}}_{\mathit{t}\mathit{b}}$ is defined with $\mathit{B}\ast \mathrm{(}{\mathit{A}}_{\mathit{t}\mathit{b}}\mathrm{)}=\bigcup \{{\mathit{A}}_{\mathit{t}\mathit{b}\mathit{i}}^{\prime }|{\mathit{A}}_{\mathit{t}\mathit{b}\mathit{i}}^{\prime }\in {\mathit{A}}_{\mathit{t}}\mathrm{/}\mathit{IND}\mathrm{(}{\mathit{B}}_{\mathit{t}}\mathrm{)}\wedge {\mathit{A}}_{\mathit{t}\mathit{b}\mathit{i}}^{\prime }\in {\mathit{A}}_{\mathit{t}\mathit{b}}\}$ .

Definition 8.

$\mathit{AADT}=⟨\mathit{A}\mathrm{,}{\mathit{C}}_{\mathit{atb}}\cup {\mathit{D}}_{\mathit{atb}}\mathrm{,}{\mathit{V}}_{\mathit{atb}}\mathrm{,}\mathit{f}⟩$ is a decision system with antibodies attributes, the positive domain of decision attribute is defined in formula (3): $$\begin{array}{}\text{(3)}& {\mathit{POS}}_{\mathit{B}}\mathrm{(}{\mathit{D}}_{\mathit{atb}}\mathrm{)}={\displaystyle \bigcup }_{{\mathit{A}}_{\mathit{t}\mathit{b}}\in {\mathit{A}}_{\mathit{t}}\mathrm{/}{\mathit{D}}_{\mathit{atb}}}\mathit{B}\ast \mathrm{(}{\mathit{A}}_{\mathit{t}\mathit{b}}\mathrm{)}\end{array}$$

Definition 9.

Antibody attribute dependency is shown as follows. $$\begin{array}{}\text{(4)}& \mathit{r}\mathrm{(}{\mathit{C}}_{\mathit{atb}}\mathrm{,}{\mathit{D}}_{\mathit{atb}}\mathrm{)}=|\mathit{POS}\mathrm{(}{\mathit{C}}_{\mathit{atb}}\mathrm{,}{\mathit{D}}_{\mathit{atb}}\mathrm{)}|\mathrm{/}|{\mathit{A}}_{\mathit{t}}|\end{array}$$ $|\mathit{POS}\mathrm{(}{\mathit{C}}_{\mathit{atb}}\mathrm{,}{\mathit{D}}_{\mathit{atb}}\mathrm{)}|$ and $|{\mathit{A}}_{\mathit{t}}|$ are the total number of antibodies in $|\mathit{POS}\mathrm{(}{\mathit{C}}_{\mathit{atb}}\mathrm{,}{\mathit{D}}_{\mathit{atb}}\mathrm{)}|$ and $\mathit{AADT}$ respectively.

Definition 10.

The significance degree of antibody attributes is given as: $$\begin{array}{}\text{(5)}& \mathit{SGF}\mathrm{(}{\mathit{a}}_{\mathit{t}\mathit{b}}\mathrm{,}{\mathit{C}}_{\mathit{atb}}\mathrm{,}{\mathit{D}}_{\mathit{atb}}\mathrm{)}=\mathit{r}\mathrm{(}{\mathit{C}}_{\mathit{atb}}\mathrm{,}{\mathit{D}}_{\mathit{atb}}\mathrm{)}-\mathit{r}\mathrm{\left(}\mathrm{\right(}{\mathit{C}}_{\mathit{atb}}-\{{\mathit{a}}_{\mathit{t}\mathit{b}}\}\mathrm{)}\mathrm{,}{\mathit{D}}_{\mathit{atb}}\mathrm{)}\end{array}$$

2.2. FS

The theory of FS is described that all the attributes of log data are applied to generate a fuzzy matrix, at the same time, the antibodies’ classified results are calculated after analyzing the relationship of antibodies. The total number of FS and the subfunction of each subclass decide the final results [23].

Definition 11.

We divide all the antibodies into k ( $2⩽\mathit{k}⩽\mathit{n}$ ) types of collections, ${\mathit{M}}_{\mathit{fc}}$ is: $$\begin{array}{}\text{(6)}& {\mathit{A}}_{\mathit{t}\mathit{c}}=\left\{{\mathit{A}}_{\mathit{t}\mathit{b}}\right|{\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{i}\mathit{k}}}\in [0\mathrm{,}1]\mathrm{,}{\displaystyle \sum }_{\mathit{i}=1}^{\mathit{c}}{\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{i}\mathit{k}}}=1;0\mathrm{<}{\displaystyle \sum }_{\mathit{k}=1}^{\mathit{n}}{\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{i}\mathit{k}}}\mathrm{<}\mathit{n}\}\end{array}$$ ${\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{i}\mathit{k}}}$ is the kth antibodies ${\mathit{x}}_{\mathit{k}}$ , that is from the subset ${\mathit{A}}_{\mathit{t}\mathit{b}}$ .

Definition 12.

For each type of fuzzy k-division, the antibody objective function ${\mathit{J}}_{\mathit{m}}$ is defined: $$\begin{array}{}\text{(7)}& {\mathit{J}}_{\mathit{m}}\mathrm{(}{\mathit{A}}_{\mathit{t}}\mathrm{,}\mathit{v}\mathrm{)}={\displaystyle \sum }_{\mathit{k}=1}^{\mathit{n}}{\displaystyle \sum }_{\mathit{i}=1}^{\mathit{c}}{\mathrm{(}{\mathit{a}}_{\mathit{t}{\mathit{b}}^{\mathit{i}\mathit{k}}}\mathrm{)}}^{\mathit{m}}{\mathrm{(}{\mathit{d}}_{\mathit{i}\mathit{k}}\mathrm{)}}^2\text{(8)}& {\mathit{d}}_{\mathit{i}\mathit{k}}=\mathit{d}\mathrm{(}{\mathit{x}}_{\mathit{k}}-{\mathit{v}}_{\mathit{i}}\mathrm{)}={\left[{\displaystyle \sum }_{\mathit{j}=1}^{\mathit{m}}{\mathrm{(}{\mathit{x}}_{\mathit{k}\mathit{j}}-{\mathit{v}}_{\mathit{i}\mathit{j}}\mathrm{)}}^2\right]}^{\frac{1}{2}}\end{array}$$

m ( $1⩽\mathit{m}\mathrm{<}\infty$ ) is the weight value of antibody, that is applied to change the fuzzy degree, and each category center coordinates are obtained with following formula: $$\begin{array}{}\text{(9)}& {\mathit{v}}_{\mathit{i}\mathit{j}}={\displaystyle \frac{{\sum }_{\mathit{k}=1}^{\mathit{n}}{\mathit{u}}_{\mathit{i}\mathit{k}}^{\mathit{m}}.{\mathit{x}}_{\mathit{k}\mathit{j}}}{{\sum }_{\mathit{k}=1}^{\mathit{n}}{\mathit{u}}_{\mathit{i}\mathit{k}}^{\mathit{m}}}}\mathrm{,}\mathit{j}=1\mathrm{,}2\mathrm{,}\dots \mathrm{,}\mathit{p}\end{array}$$

The final purpose of RFS is to generate the best classification ${\mathit{U}}^{\ast }$ , which is defined in formula (10): $$\begin{array}{}\text{(10)}& {\mathit{J}}_{\mathit{m}}^{\ast }\mathrm{(}{\mathit{A}}_{\mathit{t}}^{\ast }\mathrm{,}\mathit{v}\mathrm{)}=\underset{{\mathit{M}}_{\mathit{f}\mathit{c}}}{min}\mathit{J}\mathrm{(}{\mathit{A}}_{\mathit{t}}\mathrm{,}\mathit{v}\mathrm{)}\end{array}$$

2.3. The rough fuzzy set algorithm

The goals of RFS are: we can get the diversity of antibodies, avoid the RFS-MOP-AQGAID’s local convergence. Standardized steps of the RFS are shown as Table 1.

Table 1

Standardized process of the RFS

Standardized process of the RFS
1.	The training samples are converted as ${\mathit{A}}_{\mathit{t}\mathit{b}}$ with Definition 2;
2.	$\mathit{AADT}$ is generated with Definition 5;
3.	Calculate the $\mathit{IND}\mathrm{(}{\mathit{B}}_{\mathit{t}}\mathrm{)}$ with formula (2);
4.	Generate the positive domain of decision attribute with formula (3);
5.	Reduce the redundant attributes of $\mathit{AADT}$ by calculating all the significance of attributes;
6.	Give the value of parameter k ( $2⩽\mathit{k}⩽\mathit{n}$ ), ${\mathit{A}}_{\mathit{t}\mathrm{c}}^{\mathrm{(}0\mathrm{)}}={\mathit{A}}_{\mathit{t}\mathrm{c}}^{\prime }$ . Every step is labeled with r tags, $\mathit{r}=0\mathrm{,}1\mathrm{,}2\mathrm{,}\dots$  ;
7.	In every step, we calculate k centers values respectively $\{{\mathit{v}}_{\mathit{i}}^{\mathrm{(}\mathit{r}\mathrm{)}}\}$ , ${\mathit{v}}_{\mathit{i}}^{\mathrm{(}\mathit{r}\mathrm{)}}={\sum }_{\mathit{j}=1}^{\mathit{k}}{\mathit{v}}_{\mathit{i}\mathit{j}}$ ;
8.	In the rth step, the matrix ${\mathit{A}}_{\mathit{t}\mathit{c}}^{\mathrm{(}\mathit{r}\mathrm{)}}$ is generated by formula: ${\mathit{u}}_{\mathit{i}\mathit{k}}^{\mathrm{(}\mathit{r}+1\mathrm{)}}={[{\sum }_{\mathit{j}=1}^{\mathit{k}}{\mathrm{(}\frac{{\mathit{d}}_{\mathit{i}\mathit{k}}^{\mathrm{(}\mathit{r}\mathrm{)}}}{{\mathit{d}}_{\mathit{j}\mathit{k}}^{\mathrm{(}\mathit{r}\mathrm{)}}}\mathrm{)}}^{2\mathrm{/}\mathrm{(}\mathit{m}-1\mathrm{)}}]}^{-1}$ , When ${\mathit{I}}_{\mathit{k}}=\varnothing$ or ${\mathit{u}}_{\mathit{i}\mathit{k}}^{\mathrm{(}\mathit{r}+1\mathrm{)}}=0$ , $\mathit{i}\in {\tilde{\mathit{I}}}_{\mathit{k}}$ , ${\mathit{I}}_{\mathit{k}}=\{\mathit{i}|2⩽\mathit{k}\mathrm{<}\mathit{n}\mathrm{,}{\mathit{d}}_{\mathit{i}\mathit{k}}^{\mathrm{(}\mathit{r}\mathrm{)}}=0\}$ , so we can get: ${\tilde{\mathit{I}}}_{\mathit{j}}=\{1\mathrm{,}2\mathrm{,}\dots \mathrm{,}\mathit{k}\}-{\mathit{I}}_{\mathit{j}}$ , ${\sum }_{\mathit{i}\in {\mathit{I}}_{\mathit{j}}}{\mathit{u}}_{\mathit{i}\mathit{j}}^{\mathrm{(}\mathit{r}+1\mathrm{)}}=1$ .
9.	If $\Vert {\mathit{A}}_{\mathit{t}}^{\mathrm{(}\mathit{r}+1\mathrm{)}}-{\mathit{A}}_{\mathit{t}}^{\mathrm{(}\mathit{r}\mathrm{)}}\Vert ⩽{\mathit{\epsilon }}_{\mathit{L}}$ ( ${\mathit{\epsilon }}_{\mathit{L}}$ is a given accuracy), then stop, else $\mathit{r}=\mathit{r}+1$ , and go to step 3.
10.	Output the selected antibodies.

In RFS, rough set algorithm is used to obtain the reduction of antibodies, while there are some attributes which are uncertain values, which are easily neglected.

3. The QGAID algorithm

3.1. Evolution process of QGA

As GA has an adaptive mechanism, with GA we can calculate the individual antibodies’ fitness and allocate certain antibody quantum rotation angle values. With GA, the IDS’ convergence rate can be accelerated. This antibody quantum rotation angle value mechanism can easily achieve diversity of antibodies in their later evolution period, so the results of intrusion detection may be obviously affected. We adopted four operators to finish the antibodies’ cooperative evolution, which include antibodies similarity calculation operator, antibody fitness calculation operator, antibody population variation correction coefficient operator, and antibodies mutation operator. So we can calculate the dynamic mutation probability of different individuals in their evolution generations, the population diversity can be increase in the late period of population evolution. Hamming distance denotes similarity of individual antibodies. With the hamming distance value decreasing, the two individuals are more similar. The operators are shown as follows:

Definition 13.

Antibody similarity calculation operator ${\mathit{a}}_{\mathrm{similar}}$ : ${\mathit{a}}_{\mathrm{similar}}$ is applied to get the differences of individuals in the current antibodies population, which is demonstrated as equation (11) [28]. $$\begin{array}{}\text{(11)}& {\mathit{a}}_{\mathrm{similar}}=\left\{\begin{array}{cc}\frac{{\mathit{x}}_{\mathrm{avger}}-{\mathit{x}}_{\mathrm{mini}}}{{\mathit{x}}_{\mathrm{maxi}}-{\mathit{x}}_{\mathrm{mini}}}\mathrm{,}\hfill & {\mathit{x}}_{\mathrm{maxi}}\ne {\mathit{x}}_{\mathrm{mini}}\hfill \\ 0\mathrm{,}\hfill & {\mathit{x}}_{\mathrm{maxi}}={\mathit{x}}_{\mathrm{mini}}\hfill \end{array}\right.\end{array}$$

In (11), ${\mathit{x}}_{\mathrm{maxi}}$ denotes the individual with the maximal hamming distance in current population, ${\mathit{x}}_{\mathrm{mini}}$ denotes the individual with the maximal hamming distance, we calculate the average hamming distance value of all antibodies with the best antibodies in current population as ${\mathit{x}}_{\mathrm{avger}}$ . The less ${\mathit{a}}_{\mathrm{similar}}$ is, the more similar the individuals are, so we choose less mutation probability to maintain antibodies population steadily; in contrast, the larger ${\mathit{x}}_{\mathrm{sim}}$ represents that larger antibodies mutation probability should be adopted to increase the diversity of antibodies.

Definition 14.

Antibody fitness calculation operator ${\mathit{a}}_{\mathrm{fitni}}^{\prime }$ : ${\mathit{a}}_{\mathrm{fitni}}^{\prime }$ is to calculate the ith individuals’ fitness, which is demonstrated in the following equation: $$\begin{array}{}\text{(12)}& {\mathit{a}}_{\mathrm{fitni}}^{\prime }=\left\{\begin{array}{cc}\frac{{\mathit{f}}_{max}-{\mathit{f}}_{\mathit{i}}}{{\mathit{f}}_{max}-{\mathit{f}}_{min}}\mathrm{,}\hfill & {\mathit{f}}_{max}\ne {\mathit{f}}_{min}\hfill \\ 0\mathrm{,}\hfill & {\mathit{f}}_{max}={\mathit{f}}_{min}\hfill \end{array}\right.\end{array}$$

In equation (12), ${\mathit{f}}_{max}$ is behalf of the highest fitness value of all antibodies, ${\mathit{f}}_{min}$ presents the lowest fitness, ${\mathit{f}}_{\mathit{i}}$ denotes the ith antibody’s fitness value. The higher value of ${\mathit{y}}_{\mathrm{fit}}^{\prime }$ means that the ith antibody is farther to the best antibodies. Therefore, we should adjust higher mutation probability when the antibodies evolve.

Definition 15.

Antibody population variation correction coefficient operator ${\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}\mathrm{)}$ : ${\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}\mathrm{)}$ denotes the relation of the antibodies’ evolution algebra k. ${\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}\mathrm{)}$ is applied to change the antibody’s mutation probability for overcoming the antibodies population’s premature convergence. ${\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}\mathrm{)}$ is demonstrated in equation (13): $$\begin{array}{}\text{(13)}& {\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}\mathrm{)}=\left\{\begin{array}{cc}{\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}-1\mathrm{)}+\mathit{P}\times \frac{\mathit{s}-\mathit{k}}{\mathit{s}}\mathrm{,}\hfill & {\mathit{f}}_{max}\mathrm{(}\mathit{k}\mathrm{)}={\mathit{f}}_{max}\mathrm{(}\mathit{k}-\mathit{T}\mathrm{)}\wedge \mathit{k}\mathrm{>}\mathit{T}\hfill \\ {\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}-1\mathrm{)}\mathrm{,}\hfill & {\mathit{f}}_{max}\mathrm{(}\mathit{k}\mathrm{)}\ne {\mathit{f}}_{max}\mathrm{(}\mathit{k}-\mathit{T}\mathrm{)}\wedge \mathit{k}\mathrm{>}\mathit{T}\hfill \\ 0\mathrm{,}\hfill & \mathit{k}⩽\mathit{T}\hfill \end{array}\right.\end{array}$$

In (13), let’s suppose that n is behalf of the antibody’s current evolution algebra, s is the largest value of its evolutionary algebra, T is a constant, which is its iterations value, while the best antibodies are invariable any more. P ( $0\mathrm{<}\mathit{P}$ ) is a constant as well, which denotes the antibody’s adjusting coefficient, ${\mathit{f}}_{max}\mathrm{(}\mathit{k}\mathrm{)}$ is behalf of the optimized fitness value in the antibody’s kth generation populations. When the best fitness value of the antibodies populations are invariable for consecutive T generations, at the same time the evolution algebra do not achieve the maximum value. So we will use a larger mutation probability to modify the variation probability, the method is applied to calculated ${\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}\mathrm{)}$ with parameters s, k and C in equation (13).

Definition 16.

Antibodies mutation operator: ${\mathit{a}}_{\mathrm{similar}}$ , ${\mathit{a}}_{\mathrm{fitni}}^{\prime }$ and ${\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}\mathrm{)}$ are defined above, we apply them to obtain the antibodies’ current mutation probability, which is calculated with equation (14). $$\begin{array}{}\text{(14)}& {\mathit{p}}_{\mathit{n}}^{\prime }=\left\{\begin{array}{cc}{\mathit{p}}_0\times {\mathit{a}}_{\mathit{fit}}^{\mathit{n}}\times {\mathit{a}}_{\mathrm{similar}}+{\mathrm{F}}_{\mathrm{acc}}\mathrm{(}\mathit{k}\mathrm{)}\mathrm{,}\hfill & {\mathit{f}}_{max}\ne {\mathit{f}}_{min}\hfill \\ 0\mathrm{,}\hfill & {\mathit{f}}_{max}={\mathit{f}}_{min}\hfill \end{array}\right.\end{array}$$

In (14), ${\mathit{p}}_{\mathit{n}}^{\prime }$ denotes the ith antibody’s mutation probability in its kth generation population, ${\mathit{p}}_0$ is the initial mutation probability.

3.2. The QGA

There are three strategies in QGA, the first one is adaptive antibody correction of quantum rotation angle, which is adopted in antibody’s evolution; the second mechanism is the antibody cooperative evolution of multiple operators, with which we can obtain the optimized antibodies dynamically by modifying the mutation probability; the third one is multi-universe method, some optimal antibodies immigrant among different universes to increase the diversity the antibodies further. Therefore, antibodies quantum rotation angle is adopted to modify the antibody rotation angle step length dynamically with the antibody’s fitness. The antibody rotation angles are given in Table 2 [17].

Table 2

Antibody adaptive correction strategy

${\mathit{x}}_{\mathit{i}}^{\mathit{j}}$	${\mathit{b}}_{\mathit{i}}$	$\mathit{f}\mathrm{(}{\mathit{x}}^{\mathit{j}}\mathrm{)}⩾\mathit{f}\mathrm{(}{\mathit{x}}_{\mathrm{best}}^{\mathit{t}}\mathrm{)}$	$\mathrm{\Delta }{\mathit{\theta }}_{\mathit{i}}^{\mathit{j}}$	$\mathit{S}\mathrm{(}{\mathit{\alpha }}_{\mathit{i}}^{\mathit{j}}\mathrm{,}{\mathit{\beta }}_{\mathit{i}}^{\mathit{j}}\mathrm{)}$
				${\mathit{\alpha }}_{\mathit{i}}^{\mathit{j}}{\mathit{\beta }}_{\mathit{i}}^{\mathit{j}}\mathrm{>}0$	${\mathit{\alpha }}_{\mathit{i}}^{\mathit{j}}{\mathit{\beta }}_{\mathit{i}}^{\mathit{j}}\mathrm{<}0$	${\mathit{\alpha }}_{\mathit{i}}^{\mathit{j}}=0$	${\mathit{\beta }}_{\mathit{i}}^{\mathit{j}}=0$
0	0	False	${\mathit{\theta }}_1^{\mathit{j}}=0$	–	–	–	–
0	0	True	${\mathit{\theta }}_2^{\mathit{j}}=0$	–	–	–	–
0	1	False	${\mathit{\theta }}_3^{\mathit{j}}={\mathit{\theta }}^{\mathit{j}}$	+1	−1	0	$\pm 1$
0	1	True	${\mathit{\theta }}_4^{\mathit{j}}={\mathit{\theta }}^{\mathit{j}}$	−1	+1	$\pm 1$	0
1	0	False	${\mathit{\theta }}_5^{\mathit{j}}={\mathit{\theta }}^{\mathit{j}}$	−1	+1	$\pm 1$	0
1	0	True	${\mathit{\theta }}_6^{\mathit{j}}={\mathit{\theta }}^{\mathit{j}}$	+1	−1	0	$\pm 1$
1	1	False	${\mathit{\theta }}_7^{\mathit{j}}=0$	–	–	–	–
1	1	True	${\mathit{\theta }}_8^{\mathit{j}}=0$	–	–	–	–

Let us suppose that antibody x, $\mathit{f}\mathrm{(}\mathit{x}\mathrm{)}$ denotes its fitness value; ${\mathit{x}}_{\mathit{i}}^{\mathit{j}}$ represents the ith gene value of the jth antibody, which is 0 or 1; ${\mathit{b}}_{\mathit{i}}$ is behalf of the ith best antibody value; the antibody rotation angle direction in the corresponding polar coordinates is denoted as $\mathit{S}\mathrm{(}{\mathit{\alpha }}_{\mathit{i}}^{\mathit{j}}\mathrm{,}{\mathit{\beta }}_{\mathit{i}}^{\mathit{j}}\mathrm{)}$ ; ${\mathit{\theta }}^{\mathit{j}}$ denotes the step length value of the jth antibody, where ${\mathit{\theta }}^{\mathit{j}}$ is calculated with equation (15). $$\begin{array}{}\text{(15)}& {\mathit{\theta }}^{\mathit{j}}=\left\{\begin{array}{cc}\frac{{\mathit{f}}_{\mathit{j}}-{\mathit{f}}_{min}}{{\mathit{f}}_{max}-{\mathit{f}}_{min}}\mathrm{(}{\mathit{K}}_2-{\mathit{K}}_1\mathrm{)}+{\mathit{K}}_1\mathrm{,}\hfill & {\mathit{f}}_{max}\ne {\mathit{f}}_{min}\hfill \\ {\mathit{K}}_1\mathrm{,}\hfill & {\mathit{f}}_{max}={\mathit{f}}_{min}\hfill \end{array}\right.\end{array}$$

In (15), the antibody rotation angle step length is linearly to the antibody’s fitness, therefore, individuals with higher fitness will be allocated a larger antibody rotation angle step length for antibodies’ variety, on the contrary, antibodies that have lower fitness will be assigned a smaller one, so that the antibodies will vary more lowly.

In antibodies’ current population, we calculate the antibodies’ rotation angle step length of the ith evolution according to the antibodies rotation direction of the jth individuals, which is demonstrated as equation (16). $$\begin{array}{}\text{(16)}& \mathrm{\Delta }{\mathit{\theta }}_{\mathit{i}}^{\mathit{j}}={\mathit{\theta }}^{\mathit{j}}\times \mathit{S}\mathrm{(}{\mathit{\alpha }}_{\mathit{i}}^{\mathit{j}}\mathrm{,}{\mathit{\beta }}_{\mathit{i}}^{\mathit{j}}\mathrm{)}\end{array}$$

To decrease the extra calculation complexity, and improve the efficiency of IDS, we apply the model of 4 universes in QGA. In the 4 universes strategy, the main universe is the management center, it controls the other three auxiliary universes and translates the antibodies. In the auxiliary universe, antibodies evolve independently in their life cycles.

In some period, some part of excellent antibodies with high fitness are translated from the auxiliary universes to the main universe. In the main universe, we choose the optimal antibodies and send them to the three auxiliary universes respectively. Then certain worst antibodies with low fitness are weed out. The proposition of exchanging antibodies is 10 percent to 20 percent in all the antibodies population.

The QGA is presented in Table 3.

Table 3

QGA

The QGA
Set up the initial antibodies population: ( ${\mathit{t}}_{\mathit{s}}=0$ );
For ( $\mathit{i}=0$ ; $\mathit{i}\mathrm{<}3$ ; $\mathit{i}++$ )//in every universe, select the optimal antibodies collection:
Generate a new antibodies set $Q_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ ;
Observe each antibody in $Q_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ and get the antibody’s observed state ${\mathit{P}}_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ ;
With equation (12), generate the fitness ${\mathit{a}}_{\mathrm{fitni}}^{\prime }$ of each antibody in ${\mathit{P}}_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ ;
Choose the best antibodies with high fitness and put them into ${\mathit{B}}_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ ;
End
while (the antibodies algebra evolution value<= threshold value) do
For ( $\mathit{i}=0$ ; $\mathit{i}\mathrm{<}3$ ; $\mathit{i}++$ )//in every universe, optimize the antibodies:
${\mathit{t}}_{\mathit{s}}={\mathit{t}}_{\mathit{s}}+1$ ;
Observe each antibody in $Q_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ and get the antibody’s observed state ${\mathit{P}}_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ ;
With equation (12), generate the fitness ${\mathit{a}}_{\mathrm{fitni}}^{\prime }$ of each antibody in ${\mathit{P}}_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ ;
Obtain the antibody angle rotation step ${\mathit{\theta }}^{\mathit{j}}$ with equation (15);
Update $Q_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ with ${\mathit{\theta }}^{\mathit{j}}$ ;
Choose the best antibodies with high fitness and put them into ${\mathit{B}}_{\mathit{i}}\mathrm{(}{\mathit{t}}_{\mathit{s}}\mathrm{)}$ ;
Generate antibody similarity calculation operator with equation (11);
Obtain antibody fitness calculation operator with equation (12);
Calculate antibody population variation correction coefficient operator with equation (13);
Obtain the antibodies’ current mutation probability with equation (14);
Antibodies operate mutation with their current mutation probability above;
Choose the optimal antibodies and translate them to the main universe;
Select the best antibodies and update the worst ones in the other three auxiliary universes respectively.

3.3. The RFS-QGAID

The RFS-QGAID includes two main steps: training initial antibodies to get memory antibodies off-line, detect the intrusions on-line. The training phase is described in following steps:

The offline log records are as the initial input resources. We get the initial memory antibodies with RFS, the final decision table is $\mathit{AADT}$ ;

Execute the RFS, delete the redundant attributes from log records data sets with high-dimensional features. The significance between the features and different log records categories are calculated in the samples collection to generate the optimal antibodies combination.

Put the best antibodies above into the QGA classifier and generate the memory antibodies.

In the detection phase, the main two steps are as follows:

1. Sample from the received log records packets, get the flow log records details with the attributes in simplified $\mathit{AADT}$ .

2. Delete the unnecessary attributes and generate the d-dimensional significant attributes from the flow log records by the RFS submodule. Then, the flow log data are compared with the memory antibodies which are generated from the QGA classifier, at the same time, the accurate classified detection results are obtained, the records with results are the new antibodies which are input the QGA to update the antibodies set.

4. Simulations and results analysis

4.1. Data collection and parameters setup

To obtain the effective performances of the RFS-QGAID, we finish the experiments with the standard benchmark NS-KDD, which are offered by Lincoln laboratory for simulations of intrusion detection, the training samples collection KDDTrain+ has 125,973 records. Test sample collection contains 2 kind of sets: KDDTest−21 and KDDTest+, and each data set contains five categories of samples: Normal, Dos, the Probe, U2R and R2L.

When RFS-QGAID runs, all the log records in KDDTrain+ are used to train to obtain the initial antibodies, and KDDTest+ is used to test RFS-QGAID algorithm. The log records distribution is demonstrated in Table 4.

Table 4

Log records distribution of NSL-KDD [7]

No	Type	KDDTrain+	KDDTest+
1	Normal	67,343	9,710
2	DoS	45,927	7,458
3	Probe	11,656	2,422
4	U2R	52	67
5	R2L	995	2,887
Sum		125,973	22,544

Because there are a small amount of U2R attacks records, U2R set belongs to a small samples collection, all the 67 U2R records are applied as the simulation data. In equation (15), we set the minimum antibodies rotation angle step length value ${\mathit{K}}_1=0.001\mathit{\pi }$ , and the maximum one ${\mathit{K}}_2=0.05\mathit{\pi }$ , the initial antibodies mutation probability is set as ${\mathit{P}}_0=0.8$ , constant P of the antibodies variation operator adjustments is denoted as 0.08.

The RFS-QGAID is realized with C. The configuration RFS-QGAID examination environment: the type of CPU is the Intel Pentium 4, 3.20 GHz, memory is 16 GB, the OS is Windows 2016.

4.2. Records preprocessing and evaluation standard of ID

The detecting experiments contain 4 main steps: log records normalization, reducing the redundant attributes, training the log samples, and testing the flow log records. Some attributes may have smaller features value may be easily ignored, for the reason that there are large difference between various attributes. The log records should be transformed to a standard format, then RFS is adopted to delete the unnecessary attributes.

The log records collection includes n antibody samples, and faj[l] denotes the ith attribute value of the jth antibody. The mean value of antibody is demonstrated as equation (17), and the standard deviation value is shown as equation (18): $$\begin{array}{}\text{(17)}& \overline{\mathit{f}}{\mathit{a}}_{\mathit{k}}[\mathit{l}]={\displaystyle \frac{1}{\mathit{n}}}{\displaystyle \sum }_{\mathit{k}=1}^{\mathit{n}}\mathit{f}{\mathit{a}}_{\mathit{k}}[\mathit{l}]\text{(18)}& {\mathit{s}}_{\mathit{k}}[\mathit{l}]=\sqrt{{\displaystyle \frac{1}{\mathit{n}-1}}{\displaystyle \sum }_{\mathit{j}=\mathit{k}=1}^{\mathit{n}}{\mathrm{(}\mathit{f}{\mathit{a}}_{\mathit{k}}[\mathit{l}]-\overline{\mathit{f}}{\mathit{a}}_{\mathit{k}}[\mathit{l}]\mathrm{)}}^2}\end{array}$$

${\overline{\mathit{f}}}_{\mathit{k}}[\mathit{l}]$ denotes the mean value of the lth antibody attribute, ${\mathit{s}}_{\mathit{k}}[\mathit{l}]$ presents the standard deviation value of the ith antibody attribute. So all the antibody attributes can be normalized as equation (19) [8]: $$\begin{array}{}\text{(19)}& \hat{\mathit{f}}{\mathit{a}}_{\mathit{k}}[\mathit{l}]={\displaystyle \frac{\mathit{f}{\mathit{a}}_{\mathit{k}}[\mathit{l}]-\overline{\mathit{f}}{\mathit{a}}_{\mathit{k}}[\mathit{l}]}{{\mathit{s}}_{\mathit{k}}[\mathit{l}]}}\end{array}$$

The evaluation standards of the detecting results are shown in following formula [15]: $$\begin{array}{}\text{(20)}& \mathit{DR}={\displaystyle \frac{\mathit{TP}}{\mathit{TP}+\mathit{FN}}}\text{(21)}& \mathit{FAR}={\displaystyle \frac{\mathit{FP}}{\mathit{TN}+\mathit{FP}}}\text{(22)}& \mathit{Pre}={\displaystyle \frac{\mathit{TP}}{\mathit{TP}+\mathit{FP}}}\text{(23)}& \mathit{Acc}={\displaystyle \frac{\mathit{TP}+\mathit{TN}}{\mathit{TP}+\mathit{TN}+\mathit{FP}+\mathit{FN}}}\text{(24)}& \mathit{F}1\mathit{\text{-score}}={\displaystyle \frac{2\times \mathit{DR}\times \mathit{Pre}}{\mathit{DR}+\mathit{Pre}}}\end{array}$$

TP is the total number of flow log records that are attacks, and they are accurately identified; TN is the total number of flow log records that are normal behaviors, and they are accurately identified; FP presents the total number of flow log records that are attacks, and they are falsely identified as normal behaviors; FN presents the total number of records that are normal behaviors, and they are falsely identified as attacks [19,22].

4.3. The best attributes collection based on RFS

RFS algorithm is adopted to delete the unnecessary features and generate the optimal antibodies, the detecting classifier combines these attributes with calculating their significance.

We can conclude from the experiments that when there are total 19 attributes, the deviation value of the RFS’s DR and FAR is maximal, meanwhile the DR reaches 95%. When there are 25 features, the deviation value of the DR and FAR’s between the mRMR and FRS is maximal. Therefore, the top 19 significant attributes are selected as the features of antigens and antibodies with the RFS. Similarly, in the study by Zhang and Zhang [27], the same methods are used with NMIFS and IIFS-MC algorithms, we can get 20 features.

The conclusion demonstrates that RFS owns better attribute reduction ability than mRMR, NMIFS and IIFS-MC. Table 5 gives the final attribute subsets with the two algorithms above.

Table 5

The selected attributes subsets

Algorithm	Number of attributes	Selected attributes (label number)
RFS	19	2, 3, 4, 5, 6, 12, 23, 24, 15, 25, 29, 30, 32, 33, 35, 36, 37, 38, 39
NMIFS	20	12, 3, 6, 23, 2, 32, 5, 24, 36, 35, 33, 1, 30, 37, 4, 29, 39, 38, 25
IIFS-MC	20	2, 3, 17, 4, 5, 18, 12, 6, 15, 16, 8, 19, 11, 13, 14, 23, 28, 10, 22, 36
mRMR	25	32, 27, 23, 5, 3, 12, 13, 22, 11, 2, 9, 37, 28, 38, 1, 4, 6, 14, 29, 40, 39, 35, 33, 41, 30

From Table 5,we can conclude that the simper features collection is obtained, so the computation complexity of RFS can be used to decrease the detection time.

4.4. The intrusion detection performances compared with related works

The K-means [2], the AE-CGAN-RF [9], AA-HMM [18], MDPCA DBN [23], GPSO [25] and FRS-QGA algorithm proposed in Section 1 are used to execute the experimental log data set. The five kinds of samples collections ROC (Receiver Operating Characteristic) curves are shown in Fig. 1.

Fig. 1.

The ROC curves.

The results in Fig. 1 show that compared with the existing common detection methods, we apply FRS-QGA algorithm to detect the normal records, and the other four attacks (DOS, the Probe, R2L and U2R), and obtain a lower FAR, but a higher DR.

The RFS-QGAID algorithm is compared with the algorithms in Section 1, such as K-means [2], AE-CGAN-RF [10], AA-HMM [18], MDPCA-DBN [23], GPSO [25], LS-PIO [1], Dual-IDS [13] and DNN [4]. To execute the abnormal detection simulation, all the attacks records are settled as abnormal behaviors. In order to get the precise performance of RFS-QGAID algorithm, we run the algorithm with each records collection for 10 times to get the detection performances, such as DR, Acc, FAR, Pre and F1 score, finally calculate the average values respectively and compare them with other detection algorithms. The results are demonstrated in Table 6.

Table 6

The comparisons results (/ denotes the uncharted value)

Algorithm	DR	Acc	FAR	Pre	F1 score
K-means [2]	95.17	95.75	1.87	N/A	N/A
AE-CGAN-RF [10]	61.57	66.18	13.06	95.51	74.87
AA-HMM [18]	91.06	93.48	/	93.63	92.33
MDPCA-DBN [23]	93.55	94.36	2.34	/	/
LS-PIO [1]	97.5	97.95	11.2	/	87.19
Dual-IDS [13]	/	91.57	1.3	98.67	91.5
DNN [4]	/	99.84	1.1	99.94	99.37
GA+Fuzzy [21]	95.33	/	0.18	/	/
RFS-QGAID	98.24	98.87	0.29	97.69	97.83

The results demonstrated in Table 6 show that the RFS-QGAID has 0.11% higher false positives and 2.91% higher detection rate than GA + Fuzzy in the study by Varzaneh and Rafsanjani [21]; the other four performance indicators are almost more excellent than other intrusion methods, meanwhile the algorithm proposed in this paper has a better balance between detection rate and the rate of false positives.

To verify the classification ability of RFS-QGAID for different types of attacks, particularly the small data sets, the results are compared, which are demonstrated in Table 7.

Table 7

The first comparisons

Method	Norm	Dos	Prb	U2R	R2L
Mixed multilayer model [2]	98.13	99.54	87.22	21.93	31.39
MDPCA-DBN [23]	97.38	81.09	73.94	17.25	6.50
Outlier+RF [9]	97.66	97.32	95.34	21.05	31.96
RFS-QGAD	95.86	97.75	92.83	75.21	86.74

Table 7 shows that the RFS-MOP-AQGAID owns the highest DR among all the intrusion methods according to small sample data set: Probe, U2R and R2L attacks. RFS-MOP-AQGAID has higher DR, it can improve the adaptivity of the intrusion algorithm.

Literature [23] demonstrated the algorithm’s confusion matrix, with which we calculate the DR, Pre and F1 score, and compare them with the results in this paper (Table 8).

Table 8

The second comparison of different algorithms

Type	DR		Pre		F1 score
	MDPCA-DBN	RFS-QGAD	MDPCA-DBN	RFS-QGAD	MDPCA-DBN	RFS-QGAD
Morm	71.42	95.86	97.38	97.67	82.40	93.51
Dos	96.34	97.75	81.09	95.31	88.06	96.24
Probe	85.85	92.83	73.94	92.62	79.45	92.37
U2R	11.82	75.21	6.50	53.01	8.39	67.51
R2L	57.30	86.74	17.25	83.17	26.51	95.24
average	64.54	89.68	55.23	84.36	56.96	88.97

We can conclude from Table 8 that the proposed RFS-QGAID owns higher DR, Pre, and F1 score than MDPCA-DBN in the study by Yang et al. [23]. Particularly for Probe, U2R and R2L, the proposed algorithm’s detection abilities are better for small amount of records.

5. Conclusions

This paper apply the RFS algorithm to delete the unnecessary antibodies features and generate the optimal initial antibodies from flow log sample attributes collections. From the simulation results, we obtain an effective antibodies collection of the higher dimensional attributes.

In the meantime, we design a QGA to classify the behaviors. In QGA, antibody similarity calculation operator, antibody fitness calculation operator and antibody population variation correction coefficient operator and antibodies mutation operator are used to generate individual’ mutation probability dynamically, meanwhile, adaptive parallel quantum GA was applied to guarantee the variety of antibodies. Experiment results demonstrate that, the detection accuracy, false positive rate, and better adaptivity of RFS-QGAID are all better than current IDS, especial for small samples sets. However the flaw of RFS-QGAID is that the performances for new types of attacks need to be strong. The next research is to study the zero-day attacks deploy the RFS-QGAID in the new generation network.

Conflict of interest

None to report.