Intrusion detection systems (IDS) by exploiting Machine learning techniques are able to diagnose attack traffics behaviors. Because of relatively large numbers of features in IDS standard benchmark dataset, like KDD CUP 99 and NSL_KDD, features selection methods play an important role. Optimization algorithms like Genetic algorithms (GA) are capable of finding near-optimum combination of the features intended for construction of the final model. This paper proposes an innovative method called chain method, for evaluation of the given test record. The main intuition of our method is to concentrate merely on one attack type at every stage. In the beginning, datasets with the proposed features by GA based on different labels will be assembled. Based on a specific sequence– which is found on different permutation of four existed labels- the test record will be entered the chain module. If the first stage –which is correlated to the input sequence-, is able to diagnose the first label, the final output has been indicated. If is not, the records will pass through the next stage until the final output be obtained. Simulations on proposed chain method, illustrate this technique is able to outperform other conventional methods especially in R2L and U2R detection with the accuracy of 98.83% and 98.88% respectively.
