Albert Fornells

Large-Scale Experimental Evaluation of Cluster Representations for Multiobjective Evolutionary Clustering

Multiobjective evolutionary clustering algorithms are based on the optimization of several objective functions that guide the search following a cycle based on evolutionary algorithms. Their capabilities allow them to find better solutions than with conventional clustering algorithms if the suitable individual representation is selected. This paper provides a detailed analysis of the three most relevant and useful representations-prototype-based, label-based, and graph-based-through a wide set of synthetic data sets. Moreover, they are also compared to relevant conventional clustering algorithms. Experiments show that multiobjective evolutionary clustering is competitive with regard to other clustering algorithms. Furthermore, the best scenario for each representation is also presented.

Explanations of unsupervised learning clustering applied to data security analysis

Network security tests should be periodically conducted to detect vulnerabilities before they are exploited. However, analysis of testing results is resource intensive with many data and requires expertise because it is an unsupervised domain. This paper presents how to automate and improve this analysis through the identification and explanation of device groups with similar vulnerabilities. Clustering is used for discovering hidden patterns and abnormal behaviors. Self-organizing maps are preferred due to their soft computing capabilities. Explanations based on anti-unification give comprehensive descriptions of clustering results to analysts. This approach is integrated in Consensus, a computer-aided system to detect network vulnerabilities.

A Methodology for Analyzing Case Retrieval from a Clustered Case Memory

Case retrieval from a clustered case memory consists in finding out the clusters most similar to the new input case, and then retrieving the cases from them. Although the computational time is improved, the accuracy rate may be degraded if the clusters are not representative enough due to data geometry. This paper proposes a methodology for allowing the expert to analyze the case retrieval strategies from a clustered case memory according to the required computational time improvement and the maximum accuracy reduction accepted. The mechanisms used to assess the data geometry are the complexity measures. This methodology is successfully tested on a case memory organized by a Self-Organization Map.

Data classification through an evolutionary approach based on multiple criteria

Real-world problems usually present a huge volume of imprecise data. These types of problems may challenge case-based reasoning systems because the knowledge extracted from data is used to identify analogies and solve new problems. Many authors have focused on organizing case memory in patterns to minimize the computational burden and deal with uncertainty. The organization is usually determined by a single criterion, but in some problems, a single criterion can be insufficient to find accurate clusters. This work describes an approach to organize the case memory in patterns based on multiple criteria. This new approach uses the searching capabilities of multiobjective evolutionary algorithms to build a Pareto set of solutions, where each one is a possible organization based on the relevance of objectives. The system shows promising capabilities when it is compared with a successful system based on self-organizing maps. Due to the data set geometry influences, the clustering building process results are analyzed taking into account it. For this reason, some complexity measures are used to categorize data sets according to their topology.

Analysis of vulnerability assessment results based on CAOS

Abstract: Information system security must battle regularly with new threats that jeopardize the protection of those systems. Security tests have to be run periodically not only to identify vulnerabilities but also to control information systems, network devices, services and communications. Vulnerability assessments gather large amounts of data to be further analyzed by security experts, who recently have started using data analysis techniques to extract useful knowledge from these data. With the aim of assisting this process, this work presents CAOS, an evolutionary multiobjective approach to be used to cluster information of security tests. The process enables the clustering of the tested devices with similar vulnerabilities to detect hidden patterns, rogue or risky devices. Two different types of metrics have been selected to guide the discovery process in order to get the best clustering solution: general-purpose and specific-domain objectives. The results of both approaches are compared with the state-of-the-art single-objective clustering techniques to corroborate the benefits of the clustering results to security analysts.

Integration of a Methodology for Cluster-Based Retrieval in jColibri

One of the key issues in Case-Based Reasoning (CBR) systems is the efficient retrieval of cases when the case base is huge and/or it contains uncertainty and partial knowledge. Although many authors have focused on proposing case memory organizations for improving the retrieval performance, there is not any free open source framework which offers this kind of capabilities. This work presents a plug-in called Thunder for the j colibri framework. Thunder provides a methodology integrated in a graphical environment for managing the case retrieval from cluster based organizations. A case study based on tackling a Textual CBR problem using Self-Organizing Maps as case memory organizing technique is successfully tested.

Experiences Using Clustering and Generalizations for Knowledge Discovery in Melanomas Domain

One of the main goals in prevention of cutaneous melanoma is early diagnosis and surgical excision. Dermatologists work in order to define the different skin lesion types based on dermatoscopic features to improve early detection. We propose a method called SOMEX with the aim of helping experts to improve the characterization of dermatoscopic melanoma types. SOMEX combines clustering and generalization to perform knowledge discovery. First, SOMEX uses Self-Organizing Maps to identify groups of similar melanoma. Second, SOMEX builds general descriptions of clusters applying the anti-unification concept. These descriptions can be interpreted as explanations of groups of melanomas. Experiments prove that explanations are very useful for experts to reconsider the characterization of melanoma classes.

Data Security Analysis Using Unsupervised Learning and Explanations

Vulnerability assessment is an effective security mechanism to identify vulnerabilities in systems or networks before they are exploited. However manual analysis of network test and vulnerability assessment results is time consuming and demands expertise. This paper presents an improvement of Analia, which is a security system to process results obtained after a vulnerability assessment using artificial intelligence techniques. The system applies unsupervised clustering techniques to discover hidden patterns and extract abnormal device behaviour by clustering devices in groups that share similar vulnerabilities. The proposed improvement consists in extracting a symbolic explanation for each cluster in order to help security analysts to understand the clustering solution using network security lexicon.

Multiobjective Evolutionary Clustering Approach to Security Vulnerability Assesments

Network vulnerability assessments collect large amounts of data to be further analyzed by security experts. Data mining and, particularly, unsupervised learning can help experts analyze these data and extract several conclusions. This paper presents a contribution to mine data in this security domain. We have implemented an evolutionary multiobjective approach to cluster data of security assessments. Clusters hold groups of tested devices with similar vulnerabilities to detect hidden patterns. Two different metrics have been selected as objectives to guide the discovery process. The results of this contribution are compared with other single-objective clustering approaches to confirm the value of the obtained clustering structures.

Multi-label classification based on analog reasoning

Some of the real-world problems are represented with just one label but many of todays issues are currently being defined with multiple labels. This second group is important because multi-label classes provide a more global picture of the problem. From the study of the characteristics of the most influential systems in this area, MlKnn and RAkEL, we can observe that the main drawback of these specific systems is the time required. Therefore, the aim of the current paper is to develop a more efficient system in terms of computation without incurring accuracy loss. To meet this objective we propose MlCBR, a system for multi-label classification based on Case-Based Reasoning. The results obtained highlight the strong performance of our algorithm in comparison with previous benchmark methods in terms of accuracy rates and computational time reduction.