Dual representation of samples for negative selection issues

• Autorzy: Chmielewski A. , Wierzchoń S. T.
• Języki publikacji: EN

Abstrakty

EN

This paper presents a new dual model combining binary and real-valued representations of samples for negative selection algorithms. Recent research show that the two types of encoding can produce quite good results for some types of datasets when they are applied separately in such algorithms. Besides a number of efficient algorithms, various affinity (or similarity) functions fitted to particular implementation was investigated. Basing on a series of experiments, we propose a dual representation enabling overcome some of the existing drawbacks of these algorithms, and allowing significant speed up the classification process. This new model was designed mainly for detecting anomalies in real-time applications, were the time of classification is crucial, e.g. intrusion detection systems.

Słowa kluczowe

EN

anomaly detection; negative selection; binary receptors; intrusion detection; real-valued receptors

PL

detekcja; receptor

• Wydawca: Instytut Podstawowych Problemów Techniki PAN
• Czasopismo: Computer Assisted Mechanics and Engineering Sciences
• Rocznik: 2007
• Tom: Vol. 14, No. 4
• Strony: 579--590
• Opis fizyczny: Bibliogr. 30 poz., rys., tab.

Twórcy

autor

Chmielewski A.

autor

Wierzchoń S. T.

• Białystok Technical University [Politechnika Białostocka], Wiejska 45A, 15-331 Białystok

Bibliografia

• [1] C. Aggarwal, A. Hinneburg, D.A. Keim. On the surprising behavior of distance metrics in high dimensional spaces. In: Proceedings of 8th International Conference on Database Theory, pp. 420-434, 2001.
• [2] U. Aickelin, J. Greensmith, J. Twycross. Immune system approaches to intrusion detection — a review. In: Proceedings of 3rd International Conference on Artificial Immune Systems, LNCS Vol. 3239, pp. 316-329. Springer, 2004.
• [3] U. Aickelin, J. Twycross, T. Hesketh-Roberts. Rule generalisation in intrusion detection systems using SNORT. In: International Journal of Electronic Security and Digital Forensics, 1(1): 101-116, 2007.
• [4] J. Balthrop, F. Esponda, S. Forrest, M. Glickman. Coverage and generalization in an artificial immune system. In: Proceedings of the Genetic and Evolutionary Computation Conference (GECCO 2002), New York, July 9-13, 2002, pp. 3-10.
• [5] K. Beyer, J. Goldstein, R. Ramakrishnan, U. Shaft. When is "nearest neighbor" meaningful. LNCS Vol. 1540, pp. 217-235, Springer-Verlag, 1999.
• [6] A. Chmielewski, S.T. Wierzchoń. Badanie przydatności algorytmu generującego V-Detectory do klasyfikacji wybranych zbiorow. VI Krajowa Konferencja Inżynieria Wiedzy i Systemy Ekspertowe, Wrocław, 2006, pp. 13- 22.
• [7] A. Chmielewski, S.T. Wierzchoń. Comparing real-valued negative selection algorithms for intrusion detection applications. In: Proceedings of 13th International Multi-Conference on Advanced Computer Systems (ACS 2006), Międzyzdroje (Poland), October 18-20, 2006, Vol. I, pp. 387-395.
• [8] A. Chmielewski, S.T. Wierzchoń Experiments with the V-Detector algorithm. System Science Journal, 2007 (in print).
• [9] A. Chmielewski, S.T. Wierzchoń On the distance norms for multidimensional dataset in the case of real-valued negative selection application. In: Zeszyty Naukowe Politechniki Białostockiej, 2007 (in print).
• [10] A. Chmielewski, S.T. Wierzchoń. Simple method of increasing the coverage of nonself region for negative selection algorithms. In: Proceedings of the 6th Computer Information Systems and Industrial Management Applications (CISIM), Elk (Poland), 2007, pp. 155-160.
• [11] P. D'haeseleer, S. Forrest, P. Helman. An immunological approach to change detection: Algorithm, analysis and implications. In: Proceedings of 1996 Computer Security and Privacy, Los Alamitos, 1996, pp. 110-119.
• [12] S. Forrest, A. Perelson, L. Allen, R. Cherukuri. Self-nonself discrimination in a computer. In: Proceedings of the IEEE Symposium on Research in Security and Privacy, Los Alamitos, 1994, pp. 202-212.
• [13] P.K. Harmer, P.D. Wiliams, G.H. Gunsch, G.B. Lamont. Artificial immune system architecture for computer security applications. IEEE Transactions on Evolutionary Computation, 6: 252-280, 2002.
• [14] S. Hettich, S.D. Bay. KDD Cup 1999 Data, http://kdd.ics.uci.edu
• [15] S.A. Hofmeyr, S. Forrest. Architecture for an artificial immune systems. Evolutionary Computation, 8(4): 443-473, 2000.
• [16] Z. Ji, D. Dasgupta. Real-valued negative selection algorithm with variable-sized detectors. Genetic and Evolutionary Computation GECCO-2004, Part I, LNCS Vol. 3102, pp. 287-298. Seattle, WA, USA, Springer-Verlag, 2004.
• [17] Z. Ji, D. Dasgupta. Applicability issues of the real-valued negative selection algorithms. Genetic and Evolutionary Computation GECCO-2006, pp. 111-118. Seattle, WA, USA, 2006.
• [18] Y. LeCun. The MNIST database of handwritten digits,http://yann.lecun.com/exdb/mnist, 1998.
• [19] J.K. Percus, O.E. Percus, A.S. Perelson. Predicting the size of the T-cell receptor and antibody combining region from consideration of efficient self-nonself discrimination. In: Proceedings of National Academy of Sciences USA (90), pp. 1691-1695, 1993.
• [20] A. Perelson, D. Weisbuch. Immunology for physicists. Reviews of Modern Physics, 69: 1219-1265, 1977.
• [21] SNORT, Intrusion Detection System, http://www.snort.org
• [22] T. Stibor. On the Appropriateness of Negative Selection for Anomaly Detection and Network Intrusion Detection, PhD thesis. Technical University Darmstadt, 2006.
• [23] T. Stibor, K.M. Bayarou, C. Eckert. An investigation of r-chunk detector generation on higher alphabets. In: Proceedings of Genetic and Evolutionary Computation Conference (GECCO 2004), LNSC Vol. 3102, pp. 299-307. Springer-Verlag, 2004.
• [24] T. Stibor, P. Mohr, J. Timmis, C. Eckert. Is Negative Selection Appropriate for Anomaly Detection? In: Proceedings of the ACM SIGEVO Genetic and Evolutionary Computation Conference (GECCO 2005), Washington, D.C., June 25-29, 2005, pp. 321-328.
• [25] T. Stibor, J. Timmis. Comments on real-valued negative selection vs. real-valued positive selection and one-class SVM. In: Proceedings of the Congress on Evolutionary Computation (CEC-2007), Singapore, September 2007. IEEE Press (accepted for publication).
• [26] T. Stibor, J. Timmis, C. Eckert. A comparative study of real-valued negative selection to statistical anomaly detection techniques. In: Proceedings of the 4th International Conference on Artificial Immune Systems (ICARIS- 2005), LNCS Vol. 3627, pp. 262-275. Springer-Verlag, 2005.
• [27] T. Stibor, J. Timmis, C. Eckert. On the use of hyperspheres in artificial immune systems as antibody recognition regions. In: Proceedings of the 5th International Conference on Artificial Immune Systems (ICARIS-2006), LNCS Vol. 4163, pp. 215-228. Springer-Verlag, 2006.
• [28] S.T. Wierzchoń. Generating optimal repertoire of antibody strings in an artificial immune system. Intelligent Information Systems, pp. 119-133. Springer-Verlag, 2000.
• [29] S.T. Wierzchoń. Deriving concise description of non-self patterns in an artificial immune system. In: L.C. Jain, J. Kacprzyk, eds., New Learning Paradigms in Soft Computing, pp. 438-458. Physica-Verlag 2001.
• [30] S.T. Wierzchoń. Sztuczne systemy immunologiczne. Teoria i zastosowania. Akademicka Oficyna Wydawnicza EXIT, Warszawa, 2001.