Chuanhuan Yin

Sequence-similarity kernels for SVMs to detect anomalies in system calls

In intrusion detection systems (IDSs), short sequences of system calls executed by running programs can be used as evidence to detect anomalies. In this paper, one-class support vector machines (SVMs) using sequence-similarity kernels are adopted as the anomaly detectors. Edit distance-based kernel and common subsequence-based kernel are proposed to utilize the sequence information in the detection. Algorithms for efficient computation of the kernels are derived with the techniques of dynamic programming and bit-parallelism. The experimental results indicate that the proposed kernels can significantly outperform the standard RBF kernel.

Applying genetic programming to evolve learned rules for network anomaly detection

The DARPA/MIT Lincoln Laboratory off-line intrusion detection evaluation data set is the most widely used public benchmark for testing intrusion detection systems. But the presence of simulation artifacts attributes would cause many attacks in this dataset to be easily detected. In order to eliminate their influence on intrusion detection, we simply omit these attributes in the processes of both training and testing. We also present a GP-based rule learning approach for detecting attacks on network. GP is used to evolve new rules from the initial learned rules through genetic operations. Our results show that GP-based rule learning approach outperforms the original rule learning algorithm, detecting 84 of 148 attacks at 100 false alarms despite the absence of several simulation artifacts attributes.

High-order Markov kernels for intrusion detection

In intrusion detection systems, sequences of system calls executed by running programs can be used as evidence to detect anomalies. Markov chain is often adopted as the model in the detection systems, in which high-order Markov chain model is well suited for the detection, but as the order of the chain increases, the number of parameters of the model increases exponentially and rapidly becomes too large to be estimated efficiently. In this paper, one-class support vector machines (SVMs) using high-order Markov kernels are adopted as the anomaly detectors. This approach solves the problem of high-dimension parameter space. Furthermore, a rapid algorithm based on suffix tree is presented for the computation of Markov kernels in linear time. Experimental results show that the SVM with Markov kernels can produce good detection performance with low computational cost.

Using Cooperative Clustering to Solve Multiclass Problems

In this paper, we present a multiclass classification algorithm to address the multiclass problems with cooperative clustering. Using cooperative clustering, the cluster centers of all classes can be computed iteratively and simultaneously. In the process of clustering, we select a pair of adjacent class, and make their cluster center drawn towards the boundary. Therefore, the data set around a class is found and the data set plus the data in this class can be trained to form a classifier. With this algorithm, training efficiency and classification efficiency are improved with a slight impact on classification accuracy.

A Fast Multiclass Classification Algorithm Based on Cooperative Clustering

We present a fast multiclass classification algorithm to address the multiclass problems with a new clustering method, namely cooperative clustering. In the method of cooperative clustering, we iteratively compute the cluster centers of all classes simultaneously. For every cluster center in a class, a cluster center in an adjacent class is selected and the pair of cluster centers is drawn towards the boundary. In this way, the data set around a class is found and the data set plus the data in this class can be trained to form a classifier. With cooperative clustering, one binary classifier in the one-vs-all approach can be trained with far less samples. Furthermore, a kNN method is proposed to accelerate the classifying procedure. With this algorithm, both training and classification efficiency are improved with a slight impact on classification accuracy.

Local Support Vector Machine based on Cooperative Clustering for very large-scale dataset

Local support vector machine (LSVM) has been attracting more and more attention because of its consistency. In LSVM, the training of a standard SVM is transformed to the construction of a set of local model of SVM, each of which is obtained by the training on the neighborhood of a certain sample. This strategy reduces the number of samples in every turn of training for the construction of SVM, but increased the number of local model to be trained. Some methods had been proposed to reduce the number of local model which is needed to be trained. However, theses reduction is not enough for very large-scale dataset. In this paper, we present a new Local Support Vector Machine algorithm based on Cooperative Clustering, namely C2LSVM and do the description of the C2LSVM algorithm and experiment In C2LSVM, the data of training subset will be reduced from thousands down to tens. At the same time, the classification accuracy will be preserved even improved.

Kernel Polarization Based on Cooperative Clustering

In recent years, kernel methods are used in many applications, such as text classification and gene recognition. The parameters of kernels are empirically decided by the context of application. In order to select the appropriate kernel parameters, kernel polarization is presented as a universal kernel optimality criterion, which is independent of the classifier to be used. However, kernel polarization has several disadvantages, leading to the inconvenience of applying such method. In this paper, a clustering algorithm called Cooperative Clustering is integrated with kernel polarization. The experimental results showed the effectiveness of the approach.

Protocol anomaly detection based on string kernels

Kernels defined on vectors have been widely used in host-based intrusion detection. We propose a protocol anomaly detection model based on string kernels including high-order Markov kernel, all-length gap-weighted kernel, all-length-weighted kernel and its variation all-length-weighted once kernel. Experimental results show that these string kernels can hold state information of protocols well. Models proposed achieve a high detection rate.

A clustering based adaptive DAG for multiclass Support Vector Machine

This paper presents a method for multiclass Support Vector Machine(MCSVM), which we called CLustering Adaptive Directed Acyclic Graph(CLADAG). A previous approach, the Decision Directed Acyclic Graph(DDAG) is proposed to half randomly select a classifier from a set of classifier which is produced in the training phase. Using DDAG, the testing result of the unlabeled sample may be different if the label of some classes is swapped, leading to a unstable classification accuracy. In order to get definite testing result for the same sample, we use a heuristic method based on clustering to sort the order of classifier for all unlabeled samples. The experimental results demonstrated CLADAG is an effective method with definite results.

Increasing classification efficiency with multiple mirror classifiers

Reducing the computational load for training and classification procedures is a major problem in many pattern recognition approaches, such as artificial neural networks and support vector machines. Combining the multiple mirror classifiers is proven to be an efficient way to reduce the classification time. In this paper, we propose an approach that uses cooperative clustering method to construct mirror classifiers. With this procedure, the set of mirror point pairs with pre-determined size near the boundary of two classes is determined. Each mirror point pair constructs a small classifier. The minimum squared error based method and support vector machine based method are proposed to determine the weights for combining the multiple mirror classifiers. Experiments show that the training efficiency and classification efficiency are improved with a slight impact on generalization performance.