OCPAD: One class Naive Bayes classifier for payload based anomaly detection

Application specific attack detection requires packet payload analysis. Current payload analysis techniques suffer from failed detection as they use only the presence or absence of short sequences of a packet in a knowledge-base created out of non-malicious packets. In this paper, we describe OCPAD a content anomaly detection method to identify network packets with suspicious payload content. Proposed method combines the benefits of one class classification and frequency information of short sequences.We adapt one class Multinomial Naive Bayes classifier as anomaly detector for detecting HTTP attacks. OCPAD uses likelihood of each short sequence’s occurrence in a payload of known non-malicious packets as a measure to derive the degree of maliciousness of a packet. In the training phase, OCPAD generates the likelihood range of each sequence’s occurrence from every packet. In order to store the likelihood range of these sequences, we propose a novel and efficient data structure called Probability Tree. In the testing phase, it treats a short sequence as anomalous if it is not found in the database or its likelihood of occurrence in a packet is not in the range found in training phase. Using the likelihood of anomalous short sequences, it generates a class label for a test packet. Our experiments with a large dataset of 1 million HTTP packets collected from an academic network revealed OCPAD has a high Detection Rate (up to 100%) compared to previous methods and acceptable rate of False Positives (less than 0.6%).     

Application of genetic algorithm for fuzzy rules optimization on semi expert judgment automation using Pittsburg approach

Genetic algorithm is well-known of its best heuristic search method. Fuzzy logic unveils the advantage of interpretability. Genetic fuzzy system exploits potential of optimization with ease of understanding that facilitates rules optimization. This paper presents the optimization of fourteen fuzzy rules for semi expert judgment automation of early activity based duration estimation in software project management. The goal of the optimization is to reduce linguistic terms complexity and improve estimation accuracy of the fuzzy rule set while at the same time maintaining a similar degree of interpretability. The optimized numbers of linguistic terms in fuzzy rules by 27.76% using simplistic binary encoding mechanism managed to improve accuracy by 14.29% and reduce optimization execution time by 6.95% without compromising on interpretability in addition to promote improvement of knowledge base in fuzzy rule based systems.     

Anorexic contribution to increased linoleate mobilization and oxidation in lymphoma-bearing mice

To test for a regulatory defect in adipose triacylglycerol (essential) fatty acid mobilization in lymphoma-bearing mice, free [1-¹⁴C]linoleic acid/mouse serum albumin was injectediv into lymphoma-bearing and control mice, adapted to a reversed light cycle, and studied in three dietary states in the dark period. Mean daily food intake decreased in mice with small and large tumor burdens. Plasma free fatty acid (FFA) oxidation rates, which approximate FFA mobilization rates, were estimated by multicompartmental analysis (CONSAM). Oxidation of linoleate to CO₂ was reduced significantly (85%) inad libitum fed as compared to briefly fasted control mice but not in fedvs. fasted mice with large or small tumor burdens. However, plasma FFA oxidation rates to CO₂ did not differ in briefly fasted tumor-bearing and pairfed control mice. When re-fed a 250-mg test meal, briefly fasted mice with small tumors suppressed plasma free linoleic acid oxidation, as did controls. During simulated night, mildly anorexic, tumor-bearing mice with small tumor burdens mobilized essential fatty acids much faster than controls. This could explain body fat loss. The abnormally rapid rates of FFA (free linoleic acid) mobilization at night probably result from anorexia rather than from inability of food to suppress fat mobilization.