Giorgio Giacinto

Design of effective neural network ensembles for image classification purposes

Abstract In the field of pattern recognition, the combination of an ensemble of neural networks has been proposed as an approach to the development of high performance image classification systems. However, previous work clearly showed that such image classification systems are effective only if the neural networks forming them make different errors. Therefore, the fundamental need for methods aimed to design ensembles of ‘error-independent’ networks is currently acknowledged. In this paper, an approach to the automatic design of effective neural network ensembles is proposed. Given an initial large set of neural networks, our approach is aimed to select the subset formed by the most error-independent nets. Reported results on the classification of multisensor remote-sensing images show that this approach allows one to design effective neural network ensembles.

Intrusion detection in computer networks by a modular ensemble of one-class classifiers

Since the early days of research on intrusion detection, anomaly-based approaches have been proposed to detect intrusion attempts. Attacks are detected as anomalies when compared to a model of normal (legitimate) events. Anomaly-based approaches typically produce a relatively large number of false alarms compared to signature-based IDS. However, anomaly-based IDS are able to detect never-before-seen attacks. As new types of attacks are generated at an increasing pace and the process of signature generation is slow, it turns out that signature-based IDS can be easily evaded by new attacks. The ability of anomaly-based IDS to detect attacks never observed in the wild has stirred up a renewed interest in anomaly detection. In particular, recent work focused on unsupervised or unlabeled anomaly detection, due to the fact that it is very hard and expensive to obtain a labeled dataset containing only pure normal events. The unlabeled approaches proposed so far for network IDS focused on modeling the normal network traffic considered as a whole. As network traffic related to different protocols or services exhibits different characteristics, this paper proposes an unlabeled Network Anomaly IDS based on a modular Multiple Classifier System (MCS). Each module is designed to model a particular group of similar protocols or network services. The use of a modular MCS allows the designer to choose a different model and decision threshold for different (groups of) network services. This also allows the designer to tune the false alarm rate and detection rate produced by each module to optimize the overall performance of the ensemble. Experimental results on the KDD-Cup 1999 dataset show that the proposed anomaly IDS achieves high attack detection rate and low false alarm rate at the same time.

An approach to the automatic design of multiple classifier systems

Abstract Multiple classifier systems (MCSs) based on the combination of outputs of a set of different classifiers have been proposed in the field of pattern recognition as a method for the development of high performance classification systems. Previous work clearly showed that multiple classifier systems are effective only if the classifiers forming them are accurate and make different errors. Therefore, the fundamental need for methods aimed to design “accurate and diverse” classifiers is currently acknowledged. In this paper, an approach to the automatic design of multiple classifier systems is proposed. Given an initial large set of classifiers, our approach is aimed at selecting the subset made up of the most accurate and diverse classifiers. A proof of the optimality of the proposed design approach is given. Reported results on the classification of multisensor remote sensing images show that this approach allows the design of effective multiple classifier systems.

Reject option with multiple thresholds

can be obtained using the so-called “reject” option. Namely, the patterns that are the most likely to be misclassified are rejected (i.e., they are not classified); they are then handled by more sophisticated procedures (e.g., a manual classification is performed). However, handling high reject rates is usually too time-consuming for application purposes. Therefore, a trade-off between error and reject is mandatory. The formulation of the best error-reject trade-off and the related optimal reject rule was given by Chow [1]. According to Chow’s rule, a pattern x is rejected if: max P P T k N k i = ( ) = ( ) < 1, , | | K ω ω x x (3)

Combination of neural and statistical algorithms for supervised classification of remote-sensing images

Abstract Various experimental comparisons of algorithms for supervised classification of remote-sensing images have been reported in the literature. Among others, a comparison of neural and statistical classifiers has previously been made by the authors in (Serpico, S.B., Bruzzone, L., Roli, F., 1996. Pattern Recognition Letters 17, 1331–1341). Results of reported experiments have clearly shown that the superiority of one algorithm over another cannot be claimed. In addition, they have pointed out that statistical and neural algorithms often require expensive design phases to attain high classification accuracy. In this paper, the combination of neural and statistical algorithms is proposed as a method to obtain high accuracy values after much shorter design phases and to improve the accuracy–rejection tradeoff over those allowed by single algorithms.

Rapid and brief communication: A study on the performances of dynamic classifier selection based on local accuracy estimation

Dynamic classifier selection (DCS) plays a strategic role in the field of multiple classifier systems (MCS). This paper proposes a study on the performances of DCS by Local Accuracy estimation (DCS-LA). To this end, upper bounds against which the performances can be evaluated are proposed. The experimental results on five datasets clearly show the effectiveness of the selection methods based on local accuracy estimates.

Alarm clustering for intrusion detection systems in computer networks

Until recently, network administrators manually arranged alarms produced by intrusion detection systems (IDS) to attain a high-level description of cyberattacks. As the number of alarms is increasingly growing, automatic tools for alarm clustering have been proposed to provide such a high-level description of the attack scenarios. In addition, it has been shown that effective threat analysis requires the fusion of different sources of information, such as different IDS. This paper proposes a new strategy to perform alarm clustering which produces unified descriptions of attacks from alarms produced by multiple IDS. In order to be effective, the proposed alarm clustering system takes into account two characteristics of IDS: (i) for a given attack, different sensors may produce a number of alarms reporting different attack descriptions; and (ii) a certain attack description may be produced by the IDS in response to different types of attack. Experimental results show that the high-level alarms produced by the alarm clustering module effectively summarize the attacks, drastically reducing the volume of alarms presented to the administrator. In addition, these high-level alarms can be used as the base to perform further higher-level threat analysis.

Bayesian relevance feedback for content-based image retrieval

Despite the efforts to reduce the so-called semantic gap between the users perception of image similarity and the feature-based representation of images, the interaction with the user remains fundamental to improve performances of content-based image retrieval systems. To this end, relevance feedback mechanisms are adopted to refine image-based queries by asking users to mark the set of images retrieved in a neighbourhood of the query as being relevant or not. In this paper, the Bayesian decision theory is used to estimate the boundary between relevant and non-relevant images. Then, a new query is computed whose neighbourhood is likely to fall in a region of the feature space containing relevant images. The performances of the proposed query shifting method have been compared with those of other relevance feedback mechanisms described in the literature. Reported results show the superiority of the proposed method.

Information fusion for computer security: State of the art and open issues

In this paper, we critically review the issue of information fusion for computer security, both in terms of problem formulation and in terms of state-of-the-art solutions. We also analyze main strengths and weaknesses of currently used approaches and propose some research issues that should be investigated in the future.

Adaptive Selection of Image Classifiers

Recently, the concept of “Multiple Classifier Systems” was proposed as a new approach to the development of high performance image classification systems. Multiple Classifier Systems can be used to improve classification accuracy by combining the outputs of classifiers making “uncorrelated” errors. Unfortunately, in real image recognition problems, it may be very difficult to design an ensemble of classifiers that satisfies this assumption. In this paper, we propose a different approach based on the concept of “adaptive selection” of multiple classifiers in order to select the most appropriate classifier for each input pattern. We point out that adaptive selection does not require the assumption of uncorrelated errors, thus simplifying the choice of classifiers forming a Multiple Classifier System. Reported results on the classification of remote-sensing images show that adaptive selection can be used to obtain substantial improvements in classification accuracy.