Using artificial anomalies to detect unknown and known network intrusions

Intrusion detection systems (IDSs) must be capable of detecting new and unknown attacks, or anomalies. We study the problem of building detection models for both pure anomaly detection and combined misuse and anomaly detection (i.e., detection of both known and unknown intrusions). We show the necessity of artificial anomalies by discussing the failure to use conventional inductive learning methods to detect anomalies. We propose an algorithm to generate artificial anomalies to coerce the inductive learner into discovering an accurate boundary between known classes (normal connections and known intrusions) and anomalies. Empirical studies show that our pure anomaly-detection model trained using normal and artificial anomalies is capable of detecting more than 77% of all unknown intrusion classes with more than 50% accuracy per intrusion class. The combined misuse and anomaly-detection models are as accurate as a pure misuse detection model in detecting known intrusions and are capable of detecting at least 50% of unknown intrusion classes with accuracy measurements between 75 and 100% per class.     

Using artificial neural networks to enhance CART

Accuracy is a critical factor in predictive modeling. A predictive model such as a decision tree must be accurate to draw conclusions about the system being modeled. This research aims at analyzing and improving the performance of classification and regression trees (CART), a decision tree algorithm, by evaluating and deriving a new methodology based on the performance of real-world data sets that were studied. This paper introduces a new approach to tree induction to improve the efficiency of the CART algorithm by combining the existing functionality of CART with the addition of artificial neural networks (ANNs). Trained ANNs are utilized by the tree induction algorithm by generating new, synthetic data, which have been shown to improve the overall accuracy of the decision tree model when actual training samples are limited. In this paper, traditional decision trees developed by the standard CART methodology are compared with the enhanced decision trees that utilize the ANN’s synthetic data generation, or CART+. This research demonstrates the improved accuracies that can be obtained with CART+, which can ultimately improve the knowledge that can be extracted by researchers about a system being modeled.     

Using neural networks to detect the bivariate process variance shifts pattern

Most of the research in statistical process control has been focused on monitoring the process mean. Typically, it is also important to detect variance changes as well. This paper presents a neural network-based approach for detecting bivariate process variance shifts. Some important implementation issues of neural networks are investigated, including analysis window size, number of training examples, sample size, training algorithm, etc. The performance of the neural network, in terms of the ARL and run length distribution, is compared with that of traditional multivariate control charts. Through rigorous evaluation and comparison, our research results show that the proposed neural network performs substantially better than the traditional generalized variance chart and might perform better than the adaptive sizes control charts in the case that the out-of-control covariance matrix is not known in advance.     

Using an artificial neural network to detect activations during ventricular fibrillation.

Ventricular fibrillation is a cardiac arrhythmia that can result in sudden death. Understanding and treatment of this disorder would be improved if patterns of electrical activation could be accurately identified and studied during fibrillation. A feedforward artificial neural network using backpropagation was trained with the Rule-Based Method and the Current Source Density Method to identify cardiac tissue activation during fibrillation. Another feedforward artificial neural network that used backpropagation was trained with data preprocessed by those methods and the Transmembrane Current Method. Staged training, a new method that uses different sets of training examples in different stages, was used to improve the ability of the artificial neural networks to detect activation. Both artificial neural networks were able to correctly classify more than 92% of new test examples. The performance of both artificial neural networks improved when staged training was used. Thus, artificial neural networks may beuseful for identifying activation during ventricular fibrillation.     

Using recurrent neural networks to detect changes in autocorrelated processes for quality monitoring

With the growing of automation in manufacturing, process quality characteristics are being measured at higher rates and data are more likely to be autocorrelated. A widely used approach for statistical process monitoring in the case of autocorrelated data is the residual chart. This chart requires that a suitable model has been identified for the time series of process observations before residuals can be obtained. In this work, a new neural-based procedure, which is alleviated from the need for building a time series model, is introduced for quality control in the case of serially correlated data. In particular, the Elman’s recurrent neural network is proposed for manufacturing process quality control. Performance comparisons between the neural-based algorithm and several control charts are also presented in the paper in order to validate the approach. Different magnitudes of the process mean shift, under the presence of various levels of autocorrelation, are considered. The simulation results indicate that the neural-based procedure may perform better than other control charting schemes in several instances for both small and large shifts. Given the simplicity of the proposed neural network and its adaptability, this approach is proved from simulation experiments to be a feasible alternative for quality monitoring in the case of autocorrelated process data.     

基于人工神经网络的主机安全量化评估研究

基于人工神经网络的方法对主机安全性能进行量化评估。分析了BP人工神经网络模型的网络结构及学习算法,分析了影响目标主机安全性能的可能因素,并应用BP神经网络模型对目标主机的安全性能进行样本训练及实际测试。基于人工神经网络的主机安全量化评估为评价目标主机的安全性能提供了可行的方法。     

Using hierarchical statistical analysis and deep neural networks to detect covert timing channels

Covert timing channels provide a mechanism to leak data across different entities. Manipulating the timing between packet arrivals is a well-known example of such approach. The time based property makes the detection of the hidden messages impossible by traditional security protecting mechanisms such as proxies and firewalls. This paper introduces a new generic hierarchical-based model to detect covert timing channels. The detection process consists of the analysis of a set of statistical metrics at consecutive hierarchical levels of the inter-arrival times flows. The statistical metrics considered are: mean, median, standard deviation, entropy, Root of Average Mean Error (RAME). A real statistical metrics timing channel dataset of covert and overt channel instances is created. The generated dataset is set to be either flat where the statistical metrics are calculated on all flows of data or hierarchal (5 levels of hierarchy were considered) where the statistical metrics are computed on sub parts of the flow as well. Following this method, 5 different datasets were generated, and used to train/test a deep neural network based model. Performance results about accuracy and model training time showed that the hierarchical approach outperforms the flat one by 4 to 10 percent (in terms of accuracy) and was able to achieve short model training time (in terms of seconds). When compared to the Support Vector Machine (SVM) classifier, the deep neural network achieved a better accuracy level (about 2.3% to 12% depends on the used kernel) and significantly shorter model training time (few seconds versus few 100’s of seconds). This paper also explores the importance of the used metrics in each level of the detection process.     

The use of an artificial neural network to detect automatically managed accounts in social networks

The problem of detection of automatically managed accounts (bots) in social networks has been considered. The method of their detection based on machine learning methods is proposed. The paper describes an example of a method based on artificial neural network learning. The parameters of a page in a social network used to detect bots have been presented. An experimental evaluation of the proposed system performance is given that demonstrates a high level of detection of bots in social networks.     

An artificial neural network approach for routing in distributed computer networks

This paper presents a new approach based on the Hopfield model of artificial neural networks to solve the routing problem in a context of computer network design. The computer networks considered are packet switching networks, modeled as non-oriented graphs where nodes represent servers, hosts or switches, while bi-directional and symmetric arcs represent full duplex communication links. The proposed method is based on a network representation enabling to match each network configuration with a Hopfield neural network in order to find the best path between any node pair by minimizing an energy function. The results show that the time delay derived from flow assignment carried out by this approach is, in most cases, better than those determined using conventional routing heuristics. Therefore, this neural-network approach is suitable to be integrated into an overall topological design process of moderate-speed and high-speed networks subject to quality of service constraints as well as to changes in configuration and link costs.     

Using artificial neural networks for classification of black-and-white images

This work is devoted to the problem of automatic classification of binary images. To solve this problem, neural networks are used. Experiments based on a database of faxgrams are performed with neural networks of different types. __________ Translated from Kibernetika i Sistemnyi Analiz, No. 2, pp. 184–187, March–April 2008.     

Using artificial neural networks to scale and infer vegetation media phase functions

Accurate vegetation models usually rely on experimental data obtained by means of measurement campaigns. Nowadays, RET and dRET models provide a realistic characterization of vegetation volumes, including not only in-excess attenuation, but also scattering, diffraction and depolarization. Nevertheless, both approaches imply the characterization of the forest media by means of a range of parameters, and thus, the construction of a simple parameter extraction method based on propagation measurements is required. Moreover, when dealing with experimental data, two common problems must be usually overcome: the scaling of the vegetation mass parameters into different dimensions, and the scarce number of frequencies available within the experimental data set. This paper proposes the use of Artificial Neural Networks as accurate and reliable tools able to scale vegetation parameters for varying physical dimensions and to predict them for new frequencies. This proposal provides a RMS error lower than 1 dB when compared to unbiased measured data, leading to an accurate parameter extracting method, while being simple enough for not to increase the computational cost of the model.

     

Rule-based artificial neural networks

Neural networks that are integrated with rule-based systems having a knowledge base offer more capabilities than networks not integrated with such systems.     

Knowledge-based artificial neural networks

Hybrid learning methods use theoretical knowledge of a domain and a set of classified examples to develop a method for accurately classifying examples not seen during training. The challenge of hybrid learning systems is to use the information provided by one source of information to offset information missing from the other source. By so doing, a hybrid learning system should learn more effectively than systems that use only one of the information sources. KBANN (Knowledge-Based Artificial Neural Networks) is a hybrid learning system built on top of connectionist learning techniques. It maps problem-specific “domain theories”, represented in propositional logic, into neural networks and then refines this reformulated knowledge using backpropagation. KBANN is evaluated by extensive empirical tests on two problems from molecular biology. Among other results, these tests show that the networks created by KBANN generalize better than a wide variety of learning systems, as well as several techniques proposed by biologists.     

A new approach to artificial neural networks

A novel approach to artificial neural networks is presented. The philosophy of this approach is based on two aspects: the design of task-specific networks, and a new neuron model with multiple synapses. The synapses' connective strengths are modified through selective and cumulative processes conducted by axo-axonic connections from a feedforward circuit. This new concept was applied to the position control of a planar two-link manipulator exhibiting excellent results on learning capability and generalization when compared with a conventional feedforward network. In the present paper, the example shows only a network developed from a neuronal reflexive circuit with some useful artifices, nevertheless without the intention of covering all possibilities devised.     

Using Bayesian neural networks with ARD input selection to detect malignant ovarian masses prior to surgery

In this paper, we applied Bayesian multi-layer perceptrons (MLP) using the evidence procedure to predict malignancy of ovarian masses in a large (n = 1,066) multi-centre data set. Automatic relevance determination (ARD) was used to select the most relevant inputs. Fivefold cross-validation (5CV) and repeated 5CV was used to select the optimal combination of input set and number of hidden neurons. Results indicate good performance of the models with area under the receiver operating characteristic curve values of 0.93–0.94 on independent data. Comparison with a linear benchmark model and a previously developed logistic regression model shows that the present problem is very well linearly separable. A resampling analysis further shows that the number of hidden neurons specified in the ARD analyses for input selection may influence model performance. This paper shows that Bayesian MLPs, although not frequently used, are a useful tool for detecting malignant ovarian tumours.     

Detection of unknown computer worms based on behavioral classification of the host

Machine learning techniques are widely used in many fields. One of the applications of machine learning in the field of information security is classification of a computer behavior into malicious and benign. Antiviruses consisting of signature-based methods are helpless against new (unknown) computer worms. This paper focuses on the feasibility of accurately detecting unknown worm activity in individual computers while minimizing the required set of features collected from the monitored computer. A comprehensive experiment for testing the feasibility of detecting unknown computer worms, employing several computer configurations, background applications, and user activity, was performed. During the experiments 323 computer features were monitored by an agent that was developed. Four feature selection methods were used to reduce the number of features and four learning algorithms were applied on the resulting feature subsets. The evaluation results suggest that by using classification algorithms applied on only 20 features the mean detection accuracy exceeded 90%, and for specific unknown worms accuracy reached above 99%, while maintaining a low level of false positive rate.     

Evolving artificial neural networks to combine financial forecasts

We conduct evolutionary programming experiments to evolve artificial neural networks for forecast combination. Using stock price volatility forecast data we find evolved networks compare favorably with a naive average combination, a least squares method, and a kernel method on out-of-sample forecasting ability-the best evolved network showed strong superiority in statistical tests of encompassing. Further, we find that the result is not sensitive to the nature of the randomness inherent in the evolutionary optimization process     

Using Boolean factors for the construction of an artificial neural networks

ABSTRACT

We propose a novel approach to define Artificial Neural Network(ANN) architecture from Boolean factors. ANNs are a subfield of machine learning applicable to several areas of life. However, defining its architecture for solving a given problem is not formalized and remains an open research problem. Since it is difficult to look into the network and figure out exactly what it has learnt, the complexity of such a technique makes its interpretation more tedious. We propose in this paper to build feedforward ANNs using the optimal factors obtained from the Boolean context representing a data. Since optimal factors completely cover the data and therefore give an explanation to these data, We could give an interpretation to the neurons activation and justify the presence of a neuron in our proposed neural network. We show through experiments and comparisons on the use data sets that this approach provides relatively better results for some key performance measures.     

基于Intel平台的Winograd快速卷积算法研究与优化

卷积作为深度学习中被频繁使用的关键部分,其并行算法的研究已成为高性能计算领域中的热门话题. 随着我国自主研发的申威26010众核处理器在人工智能领域的快速发展,对面向该处理器的高性能并行卷积算法提出了迫切的需求. 针对申威26010处理器的架构特征以及Winograd卷积算法的计算特性,提出了一种高性能并行卷积算法——融合Winograd卷积算法. 该算法不同于依赖官方GEMM（general matrix multiplication）库接口的传统Winograd卷积算法,定制的矩阵乘实现使得该算法的执行过程变得可见,且能够更好地适应现实中常见卷积运算. 整个算法由输入的Winograd变换、卷积核的Winograd变换、核心运算和输出的Winograd逆变换4部分构成,这4个部分并不是单独执行而是融合到一起执行. 通过实时地为核心运算提供需要的变换后数据,并将计算结果及时地逆变换得到最终的输出数据,提高了算法执行过程中的数据局部性,极大地降低了整体的访存开销. 同时,为该算法设计了合并的Winograd变换模式、DMA（direct memory access）双缓冲、片上存储的强化使用、输出数据块的弹性处理以及指令重排等优化方案. 最终的实验结果表明,在VGG网络模型的总体卷积测试中,该算法性能是传统Winograd卷积算法的7.8倍. 同时,抽取典型卷积神经网络模型中的卷积进行测试,融合Winograd卷积算法能够在所有的卷积场景中发挥明显高于传统Winograd卷积算法的性能. 其中,最大能够发挥申威26010处理器峰值性能的116.21%,平均能够发挥峰值性能的93.14%.

     

Using evolutionary artificial neural networks in monitoring binary and polytomous logistic profiles

A statistical profile is a relationship between a quality characteristic (a response) and one or more explanatory variables to characterize quality of a process or a product. Monitoring profiles or checking the stability of profiles over time, has been extensively studied under the normal response variable, but it has paid a little attention to the profile with the non-normal response variable denoted by generalized linear models (GLM). Whereas, some of the potential applications of profile monitoring are cases where the response can be modelled using logistic profiles entailing binary, nominal and ordinal models. Also, most of existing control charts in this field have been developed by statistical approach and employing machine learning techniques have been rarely addressed in the related literature. Hence, to implement on-line process monitoring of logistic profiles, a novel artificial neural network (ANN) as a control chart with a heuristic training procedure is proposed in this paper. Performance of the proposed approach is investigated and compared using simulation studies in binary and polytomous models based on average run length (ARL) criterion. Simulation results revealed a good performance of the proposed approach. Nevertheless, to enhance the detection ability of the proposed approach more, the idea of combining run-rule which is a supplementary tool for making more sensitive control chart with final statistic is also implemented in this paper. Furthermore, a diagnostic method with machine learning schemes is employed to identify the shifted parameters in the profile. Results indicate the superior performance of the proposed approaches in most of the simulations. Finally, an example is used to illustrate the implementation of the proposed charting scheme.