An efficient class association rule‐pruning method for unified intrusion detection system using genetic algorithm

Genetic network programming (GNP)‐based class association rule mining has been demonstrated to be efficient for misuse and anomaly detection. However, misuse detection is weak in detecting brand new attacks, while anomaly detection has a defect of high positive false rate. In this paper, a unified detection method is proposed to integrate misuse detection and anomaly detection to overcome their disadvantages. In addition, GNP‐based class association rule mining method extracts an overwhelming number of rules which contain much redundant and irrelevant information. Therefore, in this paper, an efficient class association rule‐pruning method is proposed based on matching degree and genetic algorithm (GA). In the first stage, a matching degree‐based method is applied to preprune the rules in order to improve the efficiency of the GA. In the second stage, the GA is implemented to pick up the effective rules among the rules remaining in the first stage. Simulations on KDDCup99 show the high performance of the proposed method. © 2012 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.     

Association Rule Mining for Continuous Attributes using Genetic Network Programming

Most of the existing association rule mining algorithms are able to extract knowledge from databases with attributes of binary values. However, in real‐world applications, databases are usually composed of continuous values such as height, length or weight. If the attributes are continuous, the algorithms are commonly integrated with a discretization method that transforms them into discrete attributes. Discretization is a process of transforming a continuous attribute value into a finite number of intervals and assigning each interval into a discrete numerical value. However, the user most often must specify the number of intervals, or provide some heuristic rules to be used while discretization, and then it is difficult to get the highest attribute interdependency and at the same time get the lowest number of intervals. In this paper we present an association rule mining algorithm that is suited for continuous valued attributes commonly found in scientific and statistical databases. We propose a method using a new graph‐based evolutionary algorithm named ‘genetic network programming (GNP)’ that can deal with continuous values directly, that is, without using any discretization method as a preprocessing step. GNP represents its individuals using graph structures and evolves them in order to find a solution; this feature contributes to creating very compact programs and implicitly memorizing past action sequences. In the proposed method using GNP, the significance of the extracted association rules is measured by the use of χ² test, and only important association rules are stored in a pool all together through generations. Results of experiments conducted on a real‐life database suggest that the proposed method provides an effective technique for handling continuous attributes. Copyright © 2008 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.     

Acquisition of optimal attribute subset through genetic algorithm using GNP‐based class association rule mining

Attribute selection is a technique to prune less relevant information and discover high‐quality knowledge. It is especially useful for the classification of a large database, because the preprocessing of data increases the possibility that predictor attributes given to the mining algorithm become more relevant to the class attribute. In this paper, a method to acquire the optimal attribute subset for the genetic network programming (GNP) based class association rule mining has been proposed, and this attribute selection process using genetic algorithm (GA) leads to a higher accuracy for classification. Class association rule mining through GNP is conducted with a small subset of data rather than the original large number of attributes; thus simple but important rules are obtained for classification while the local optimal problem is avoided. Simulation results with educational data show that the classification accuracy is largely improved from 52.73 to 74.54%, when classification is made using the optimal attribute subset. © 2014 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.     

Rule pool updating through Sarsa‐learning to improve adaptability in changing environments

Genetic network programming (GNP) is a new evolutionary algorithm using the directed graph as its chromosome. A GNP‐based rule accumulation (GNP‐RA) method was proposed previously for multiagent control. However, in changing environments where new situations appear frequently, the old rules in the rule pool become incompetent for guiding the agent's actions, and therefore updating them becomes necessary. This paper proposes a more robust rule‐based model which can adapt to the environment changes. In order to realize this, Sarsa‐learning is used as a tool to update the rules to cope with the unexperienced situations in new environments. Furthermore, Sarsa‐learning helps to generate better rules by selecting really important judgments and actions during training. In addition, the ε‐greedy policy of Sarsa enables GNP‐RA to explore the solutions space sufficiently, generating more rules. Simulations on the tile world problem show that the proposed method outperforms the previous ones, namely GP and reinforcement learning. © 2014 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.     

基于关联规则挖掘的气象观测设备一致性检测算法

为了保证气象观测设备采集数据的稳定性,从而需要对观测设备进行一致性检测。提出了一种基于兴趣度的关联规则的算法。并将该兴趣度关联规则挖掘算法应用于气象观测设备一致性检测上,可以形成关联规则气象观测设备一致性的模型。通过真实数据验证表明,该算法不仅能够挖掘出所有相关性很强的规则,同时与同类非Apriori类的算法相比,在时间性能上更加优越。通过该关联规则算法挖掘出所有关联项对形成范例库,利用规则匹配的方法对设备之间进行一致性检测,对算法实验优化,得到最优参数解,从而判定设备一致性。     

一个不需要候选集的挖掘关联规则算法的研究

挖掘关联规则是数据挖掘中的一个重要课题。针对挖掘关联规则典型算法中的某种不足，介绍了一个不需要产生候选集的挖掘关联规则的算法FP－tree。经过深入研究，对它进行了分析和评价。     

EvoCMAR: A New Evolutionary Method to Directly Mine Association Rules for Classification

In this paper, we propose an evolutionary method with a three‐layer structure to directly mine association rules for classification. The association rules have been demonstrated to be useful for classification, such as classification based on association rule (CBA) and classification method based on multiple association rule (CMAR), and they are found to be more accurate than some traditional methods, such as C4.5. Generally speaking, there are two phases in an associative classification method: (i) association rules mining; (ii) classification by association rules. However, the two phases are almost separated, viz, during the first phase, the mining of association rules does not focus on classification. Moreover, when building the classifier in the second phase, most of the association rues will be pruned. As a result, if we are able to directly mine the classification association rules, we can save time. Meanwhile, we can expect even better accuracy because the mining procedure itself considers the classification. In this paper, we build a novel evolutionary method, named evolutionary classification method based on multiple association rule (EvoCMAR), to tackle these problems, and the simulation results show that it performs well in both accuracy and speed. © 2010 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.     

Evolutionary selection of interesting class association rules using genetic relation algorithm

During the last years, several association rule‐based classification methods have been proposed, these algorithms may quickly generate accurate rules. However, the generated rules are often very large in terms of the number of rules and usually complex and hardly understandable for users. Among all the rules generated by the algorithms, only some of them are likely to be of any interest to the domain expert analyzing the data. Most of the rules are either redundant, irrelevant or obvious. In this paper, a new method for selecting the interesting class association rules is proposed by an evolutionary method named genetic relation algorithm. The algorithm evaluates the relevance and interestingness of the discovered association rules by the relationships between the rules in each generation using a specific measure of distance among them giving a reduced set of rules as the result in the final generation. This small rule set has the following properties: (i) accurate as it has at least the same classification accuracy as the complete association rule set, (ii) interesting because of the diversity of rules and (iii) comprehensible because it is more understandable for the users as the number of attributes involved in the rules is also small. The efficiency of the proposed method is compared with other conventional methods including genetic network programming‐based mining using ten databases and the experimental results show that it outperforms others keeping a good balance between the classification accuracy and the comprehensibility of the rules. © 2011 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.     

基于FP-network关联规则挖掘算法的配电网薄弱点分析研究

针对配电网运行时经常发生故障的情况,如何快速高效地寻找出配电网中的薄弱点成为了当下配电网安全运行的一大难题.文中采用频繁模式网络(FP-network)模型,建立事务-项目的关联矩阵,并且将所需要进行关联规则挖掘的数据储存在关联矩阵中,从而进行关联规则的数据挖掘.通过算例分析证实了FP-network关联规则挖掘算法可...     

基于模糊多目标遗传优化算法的节假日电力负荷预测

多目标遗传优化算法的一个优点就是可在一次迭代计算中寻找到问题的多个非劣最优解。该文应用多目标遗传算法和关联规则算法提出一个基于模糊规则的电力负荷模式分类系统。在此分类系统中采用多目标遗传优化算法从众多模糊分类规则中自动挑选出具有较好识别性能和可解释性的模糊规则，并利用模糊关联规则挖掘通过启发式规则选择改善遗传算法的搜索性能。经仿真试验表明此分类系统具有较好的分类性能，可为节假日负荷预测提供更为充分的历史数据，从而改善其负荷预测性能。     

变压器故障特征量可信度的关联规则分析

变压器在线监测得到的多个特征量对于不同故障类别的潜在信息量不一样,量化各特征量与特定故障类型之间的关联度将对变压器的潜在故障诊断和预测都有着很重要的作用。为此,利用布尔型离散化方法和基于ChiMerge算法的多值离散化方法分别对变压器在线监测的连续数据进行离散化,再利用改进的Apriori关联规则数据挖掘算法计算多个变压器在线监测特征量与各个故障类型之间的可信度。最后在实例中进行了多个特征量与多个故障类型的可信度的计算,结果表明特定特征量与故障类型之间确实存在不同的关联程度,量化关联程度能有效提高故障诊断算法的效率;另外还在实例中进行了多值的关联规则挖掘,结果表明关联规则可以应用在对故障类型划分较细的变压器故障诊断。     

Fuzzy intertransaction class association rule mining using Genetic Network Programming for stock market prediction

Intertransaction class association rule (interCAR) has the ability to find the relationships among attributes from different transactions, which has shown its effectiveness for stock market prediction. A crisp interCAR mining method based on Genetic Network Programming (GNP) has been studied in our previous work. But, the crisp method loses much useful information in the discretization and it has many unstable factors influencing the prediction results, so more information is desired in order to make the prediction safer and more efficient. In this paper, a fuzzy interCAR mining method is proposed to keep as much information as possible in the data transformation. Besides, the proposed method has ability that the trading actions bring large profits. The proposed method is applied to Tokyo Stock Exchange, where we compared it with the crisp method as well as some other methods. © 2011 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.     

基于关联规则挖掘的电力生产安全事故事件关键诱因筛选

随着智能电网、通信网络及电力生产安全事故事件分析水平的提高和发展,电力生产安全事故事件数据量快速增长、复杂性不断增大,逐步构成了电力生产安全事故事件大数据。为在先验事故事件大数据的基础上高效、可靠地对事故诱因进行分类和识别,基于关联规则挖掘进行电力生产安全事故事件关键诱因筛选。根据事故事件的特点,建立电力生产安全事故诱因分析体系,对不同类型的事故进行布尔离散化,并基于关联规则挖掘提出事故诱因的诱发度计算方法,运用Apriori算法进行深度关联规则挖掘,并根据强关联规则对关键诱因进行筛选和分析。以某区域近5年的事故实例分析验证了该方法的有效性。     

基于配用电数据关联的中压配电网断线故障诊断方法

基于配用电信息系统数据和关联规则算法,提出一种诊断中压配电网分支线断线不接地故障的方法。通过分析相互关联的配用电信息系统数据,提出基于数据特征选择的关联规则挖掘方法,并通过卡方分裂算法将连续型特征量转换为布尔型特征量,同时采用MSApriori算法解决故障信息中的稀有项问题,然后在此基础上应用kulc准则消除冗余规则以形成约简的代表规则家族。以华东某地区配用电信息系统中的历史数据为依据进行实际算例分析,结果说明所提出的方法能够大量减少无效挖掘,显著提高效率和准确度,适用于中压配电网断线故障的在线诊断。     

Network Intrusion Detection Using Class Association Rule Mining Based on Genetic Network Programming

Because of the expansion of the Internet in recent years, computer systems are exposed to an increasing number and type of security threats. How to detect network intrusions effectively becomes an important technique. This paper proposes a class association rule mining approach based on genetic network programming (GNP) for detecting network intrusions. This approach can deal with both discrete and continuous attributes in network‐related data. And it can be flexibly applied to both misuse detection and anomaly detection. Experimental results with KDD99Cup and DARPA98 database from MIT Lincoln Laboratory shows that the proposed method provides a competitive high detection rate (DR) compared to other machine learning techniques. © 2010 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.     

基于改进PSO-Apriori算法的恐怖组织关联特征分析

通过分析和挖掘出恐怖组织内在的关联特征,得出恐怖主义袭击事件组织者的时空活动规律,为针对特定组织者的全球反恐战略部署提供理论依据和指导。利用20年的全球恐怖主义数据库(GTD)作为数据源,以全球恐怖组织为主体研究对象,通过改进的多值属性Apriori算法对提取出的恐怖组织时间、空间及其相关特征进行关联分析,并以粒子群算法(PSO)优化Apriori算法的支持度和置信度两个重要参数。研究结果表明,改进算法规则提取时间有所缩短,冗余规则数量大大减少,特定恐怖组织在时空分布上具有很强的内在关联特征。由此得出结论,通过对多值属性Apriori算法的剪枝步和连接步设定规则限制能够提高关联算法的运行效率并提取出更加有效的规则。同时,经过粒子群算法的优化能够避免人为主观意识对算法结果产生的影响,从而验证了改进算法的有效性和准确性,挖掘出恐怖组织的基本时空活动规律。     

电力信息网络入侵检测研究

分析了电力信息网络安全结构及存在的入侵问题,提出将数据挖掘算法应用于电力信息网络的入侵检测。在入侵检测中使用关联规则分析算法,挖掘网络数据流中特征之间的关联关系。提出了一种针对网络入侵检测规则生成方法的AR_Tree算法,该算法解决了传统关联规则算法存在的多次扫描和无效规则问题。实验证明,此算法在规则生成和对网络入侵检测方面应用效果比传统算法优越,可以有效检测电力信息网络中的入侵行为。     

基于关联规则挖掘的输电线路缺陷状态预测

对输电线路缺陷状态进行关联因素的分析和预测工作,可以为输电线路的巡维工作提供重要的技术支持。在现有输电线路状态分析和影响因素研究的基础上,提出了基于关联规则挖掘的输电线路缺陷状态预测方法。首先根据历史缺陷数据评价得到输电线路缺陷状态。结合各种影响因素,构建线路缺陷状态与相关因素的特征库。然后引入FP-Growth算法挖掘各因素与缺陷状态间的关联规则,并将得到的规则用于预测线路的缺陷状态。最后以某地区架空输电线路为例,通过历史缺陷等数据评价得到缺陷状态样本,提取相关条件特征作为输入特征,并用于预测线路的缺陷状态。结果验证了该方法的有效性,对输电线路的巡维检修有一定的参考价值。     

考虑换流站海量事件的关联规则挖掘分析方法

为提高换流站运维人员面对海量生成事件的分析能力,提出一种考虑换流站海量事件的关联规则挖掘分析方法。首先,利用原始事件元组特性进行记录事件与响应日志的实体特征筛选,并进行换流站实体特征的布尔映射与关联挖掘建模。然后,利用互信息(MI)原理与对称不确定性(SU)理论改进FP-Growth算法。最后,基于改进算法进行换流站事件关联分析,进而基于关联规则结果进行换流站异常反馈。通过挖掘昆柳龙直流换流站调试期间海量生成事件,表明所提出的方法可以有效地从海量事件中提取判断特征与结果特征的强关联规则,及时发现换流站的设备异常动作,并为运维分析提供决策支撑。     

融合粗糙集和模糊聚类的连续数据知识发现

知识自动获取是困扰基于知识的系统普遍推广应用的瓶颈，粗糙集理论是一种从历史数据中发现规则知识的数学工具。该文针对粗糙集方法应用于电厂与电力系统数据挖掘中存在的连续属性离散化问题，提出了基于模糊聚类的离散化方法。采用模糊C平均(FCM)算法离散连续属性，获得各类的聚类中心以及属性值隶属于各聚类中心的隶属度矩阵，得到离散化的数据。将粗糙集方法应用于离散化后的数据挖掘隐含在历史数据中的知识。最后进一步讨论了置信度、支持度等指标对规则的评价方法。给出的汽轮机轴系振动故障诊断规则获取算例验证了整个知识发现方案的可行性。