An adaptive genetic-based signature learning system for intrusion detection

Rule-based intrusion detection systems generally rely on hand crafted signatures developed by domain experts. This could lead to a delay in updating the signature bases and potentially compromising the security of protected systems. In this paper, we present a biologically-inspired computational approach to dynamically and adaptively learn signatures for network intrusion detection using a supervised learning classifier system. The classifier is an online and incremental parallel production rule-based system.A signature extraction system is developed that adaptively extracts signatures to the knowledge base as they are discovered by the classifier. The signature extraction algorithm is augmented by introducing new generalisation operators that minimise overlap and conflict between signatures. Mechanisms are provided to adapt main algorithm parameters to deal with online noisy and imbalanced class data. Our approach is hybrid in that signatures for both intrusive and normal behaviours are learnt.The performance of the developed systems is evaluated with a publicly available intrusion detection dataset and results are presented that show the effectiveness of the proposed system.     

Generalized rules for combination and joint training of classifiers

Classifier combination has repeatedly been shown to provide significant improvements in performance for a wide range of classification tasks. In this paper, we focus on the problem of combining probability distributions generated by different classifiers. Specifically, we present a set of new combination rules that generalize the most commonly used combination functions, such as the mean, product, min, and max operations. These new rules have continuous and differentiable forms, and can thus not only be used for combination of independently trained classifiers, but also as objective functions in a joint classifier training scheme. We evaluate both of these schemes by applying them to the combination of phone classifiers in a speech recognition system. We find a significant performance improvement over previously used combination schemes when jointly training and combining multiple systems using a generalization of the product rule.     

基于遗传优化与模糊规则挖掘的异常入侵检测

提出一种基于智能体进化计算框架与遗传模糊规则挖掘的异常入侵检测方法.通过应用模糊集分布策略、解释性的控制策略和模糊规则生成策略,实现了Agent之间的模糊集信息交换,从而有效地从网络数据中抽取正确的、可解释的模糊IF-THEN分类规则,优化了模糊系统的可解释性,并提高了系统的紧凑性.采用KDD-Cup99数据集进行测试,并与现有方法进行了比较,结果表明该方法对R2L的攻击检测性能稍弱,对DoS、Probe和U2R的攻击均具有较高的分类精度与较低的误报率.     

量子多目标进化算法研究

本文首次将量子计算的理论用于多目标优化,提出量子多目标进化算法（QMOEA）,其采用量子位染色体表示法,利用量子门旋转策略和量子变异实现群体的进化,使用ε支配关系构造外部种群以此保持算法的较好分布性,提出基于快速排序的非劣最优解构造方法加快算法运行效率,实验表明,这种方法与经典的多目标进化算法SPEA2相比,其收敛性更好且分布更均匀     

Automated design of linear tree classifiers

An automated method is presented for the design of linear tree classifiers, i.e. tree classifiers in which a decision based on a linear sum of features is carried out at each node. The method exploits the discriminability of Tomek links joining opposed pairs of data points in multidimensional feature space to produce a hierarchically structured piecewise linear decision function. The corresponding decision surface is optimized by a gradient descent that maximizes the number of Tomek links cut by each linear segment of the decision surface, followed by training each node's linear decision segment on the data associated with that node. Experiments on real data obtained from ship images and character images suggest that the accuracy of the tree classifier designed by this scheme is comparable to that of the k-NN classifier while providing much greater decision speeds, and that the trade-off between the speed and the accuracy in pattern classification can be controlled by bounding the number of features to be used at each node of the tree. Further experiments comparing the classification errors of our tree classifier with the tree classifier produced by the Mui/Fu technique indicate that our tree classifier is no less accurate and often much faster than the Mui/Fu classifier.     

An improved decomposition-based multiobjective evolutionary algorithm with a better balance of convergence and diversity

In decomposition-based multiobjective evolutionary algorithms (MOEAs), a good balance between convergence and diversity is very important to the performance of an algorithm. However, only the aggregation functions enough to achieve a good balance, especially in high-dimensional objective space. So we considered using the value of related acute angle between a solution and a direction vector as an other consider index. This idea is implemented to enhance the famous decomposition-based algorithm, i.e., MOEA/D. The enhanced algorithm is compared to its predecessor and other state-of-the-art algorithms on a several well-known test suites. Our experimental results show that the proposed algorithm performs better than its predecessor in keeping a better balance between the convergence and diversity, and also as effective as other state-of-the-art algorithms.     

Mining Pareto-optimal rules with respect to support and confirmation or support and anti-support

In knowledge discovery and data mining many measures of interestingness have been proposed in order to measure the relevance and utility of the discovered patterns. Among these measures, an important role is played by Bayesian confirmation measures, which express in what degree a premise confirms a conclusion. In this paper, we are considering knowledge patterns in a form of “if…, then…” rules with a fixed conclusion. We investigate a monotone link between Bayesian confirmation measures, and classic dimensions being rule support and confidence. In particular, we formulate and prove conditions for monotone dependence of two confirmation measures enjoying some desirable properties on rule support and confidence. As the confidence measure is unable to identify and eliminate non-interesting rules, for which a premise does not confirm a conclusion, we propose to substitute the confidence for one of the considered confirmation measures in mining the Pareto-optimal rules. We also provide general conclusions for the monotone link between any confirmation measure enjoying the desirable properties and rule support and confidence. Finally, we propose to mine rules maximizing rule support and minimizing rule anti-support, which is the number of examples, which satisfy the premise of the rule but not its conclusion (called counter-examples of the considered rule). We prove that in this way we are able to mine all the rules maximizing any confirmation measure enjoying the desirable properties. We also prove that this Pareto-optimal set includes all the rules from the previously considered Pareto-optimal borders.     

A dominance tree and its application in evolutionary multi-objective optimization

Most contemporary multi-objective evolutionary algorithms (MOEAs) store and handle a population with a linear list, and this may impose high computational complexities on the comparisons of solutions and the fitness assignment processes. This paper presents a data structure for storing the whole population and their dominating information in MOEAs. This structure, called a Dominance Tree (DT), is a binary tree that can effectively and efficiently store three-valued relations (namely dominating, dominated or non-dominated) among vector values. This paper further demonstrates DT’s potential applications in evolutionary multi-objective optimization with two cases. The first case utilizes the DT to improve NSGA-II as a fitness assignment strategy. The second case demonstrates a DT-based MOEA (called a DTEA), which is designed by leveraging the favorable properties of the DT. The simulation results show that the DT-improved NSGA-II is significantly faster than NSGA-II. Meanwhile, DTEA is much faster than SPEA2, NSGA-II and an improved version of NSGA-II. On the other hand, in regard to converging to the Pareto optimal front and maintaining the diversity of solutions, DT-improved NSGA-II and DTEA are found to be competitive with NSGA-II and SPEA2.     

Design of fuzzy rule-based classifiers with semantic cointension

In computing with words (CWW), knowledge is linguistically represented and has an explicit semantics defined through fuzzy information granules. The linguistic representation, in turn, naturally bears an implicit semantics that belongs to users reading the knowledge base; hence a necessary condition for achieving interpretability requires that implicit and explicit semantics are cointensive. Interpretability is definitely stringent when knowledge must be acquired from data through inductive learning. Therefore, in this paper we propose a methodology for designing interpretable fuzzy models through semantic cointension. We focus our analysis on fuzzy rule-based classifiers (FRBCs), where we observe that rules resemble logical propositions, thus semantic cointension can be partially regarded as the fulfillment of the “logical view”, i.e. the set of basic logical laws that are required in any logical system. The proposed approach is grounded on the employment of a couple of tools: DCf, which extracts interpretable classification rules from data, and Espresso, that is capable of fast minimization of Boolean propositions. Our research demonstrates that it is possible to design models that exhibit good classification accuracy combined with high interpretability in the sense of semantic cointension. Also, structural parameters that quantify model complexity show that the derived models are also simple enough to be read and understood.     

动态多目标优化进化算法及性能分析

针对动态多目标优化问题提出了一种求解的新进化算法。首先,构建了一种近似估计新环境下动态多目标优化问题的Pareto核迁移估计模型。其次,当探测到问题环境发生改变时,算法利用以前环境搜索到的Pareto核的有效信息通过Pareto核迁移估计模型对新环境下的进化种群进行近似估计;当问题的环境未发生变化时,引入了带区间分割的变异算子和非劣解存档保优策略,以提高算法的搜索效率。最后计算机仿真表明新算法对动态多目标优化问题十分有效。     

Hierarchical classifiers based on neighbourhood criteria with adaptive computational cost

Classifiers based on neighbourhood concept require a high computational cost when the Reference Patterns Set is large. In this paper, we propose the use of hierarchical classifiers to reduce this computational cost, maintaining the hit rate in the recognition of handwritten digits. The hierarchical classifiers reach the hit rate of the best individual classifier. We have used NIST Database to carry out the experimentation, and we have worked with two test sets: in Test 1 (SD3, SD19) the hit rate is 99.54%, with a speed-up of 40.6, and in Test 2 (SD7), the hit rate is 97.51% with a speed-up of 15.7.     

Evolutionary robust optimization in production planning – interactions between number of objectives,sample size and choice of robustness measure

We aim to find robust solutions in optimization settings where there is uncertainty associated with the operating/environmental conditions, and the fitness of a solution is hence best described by a distribution of outcomes. In such settings, the nature of the fitness distribution (reflecting the performance of a particular solution across a set of operating scenarios) is of potential interest in deciding solution quality, and previous work has suggested the inclusion of robustness as an additional optimization objective. However, there has been limited investigation of different robustness criteria, and the impact this choice may have on the sample size needed to obtain reliable fitness estimates. Here, we investigate different single and multi-objective formulations for robust optimization, in the context of a real-world problem addressed via simulation-based optimization. For the (limited evaluation) setting considered, our results highlight the value of an explicit robustness criterion in steering an optimizer towards solutions that are not only robust (as may be expected), but also associated with a profit that is, on average, higher than that identified by standard single-objective approaches. We also observe significant interactions between the choice of robustness measure and the sample size employed during fitness evaluation, an effect that is more pronounced for our multi-objective models.     

PITAGORAS-PSP: Including domain knowledge in a multi-objective approach for protein structure prediction

Whenever evolutionary algorithms are used to solve certain classes of problems such as those that present a huge search space, the incorporation of problem-specific knowledge is required to achieve adequate levels of performance. In this paper, we propose a multi-objective optimization-based procedure that includes such a domain-specific knowledge to cope with a difficult problem, the protein structure prediction (PSP). This problem is considered to be an open problem as there is no recognized “best” procedure to find solutions. It presents a vast search space and the analysis of each protein conformation requires significant amount of computing time. In our procedure, we provide a reduction of the search space by using the dependent rotamer library and include new heuristics to improve a multi-objective approach to PSP based on the PAES algorithm. As it is shown in the paper, by using benchmark proteins from the CASP8 set, this hybrid PSP procedure provides competitive results when it is compared with some of the better proposals appeared up to now.     

Multi-objective PSO algorithm for mining numerical association rules without a priori discretization

In the domain of association rules mining (ARM) discovering the rules for numerical attributes is still a challenging issue. Most of the popular approaches for numerical ARM require a priori data discretization to handle the numerical attributes. Moreover, in the process of discovering relations among data, often more than one objective (quality measure) is required, and in most cases, such objectives include conflicting measures. In such a situation, it is recommended to obtain the optimal trade-off between objectives. This paper deals with the numerical ARM problem using a multi-objective perspective by proposing a multi-objective particle swarm optimization algorithm (i.e., MOPAR) for numerical ARM that discovers numerical association rules (ARs) in only one single step. To identify more efficient ARs, several objectives are defined in the proposed multi-objective optimization approach, including confidence, comprehensibility, and interestingness. Finally, by using the Pareto optimality the best ARs are extracted. To deal with numerical attributes, we use rough values containing lower and upper bounds to show the intervals of attributes. In the experimental section of the paper, we analyze the effect of operators used in this study, compare our method to the most popular evolutionary-based proposals for ARM and present an analysis of the mined ARs. The results show that MOPAR extracts reliable (with confidence values close to 95%), comprehensible, and interesting numerical ARs when attaining the optimal trade-off between confidence, comprehensibility and interestingness.