Fig. 4
From: Hybrid intrusion detection system using blockchain framework
BC-HyIDS phase 2: anomaly based detection architecture. Detailed architecture of phase 2 that is anomaly based detection for system. Input will be taken from phase 1, the packets which are considered as normal. Rule dataset is used to train classifiers. Rule based dataset is generated using genetic algorithm. It consists of rules describing normal behavior of packets entering in the network. Ensemble approach with majority voting algorithm is used to find final prediction as attack or normal packet