John Burge

Learning DFA representations of HTTP for protecting web applications

Intrusion detection is a key technology for self-healing systems designed to prevent or manage damage caused by security threats. Protecting web server-based applications using intrusion detection is challenging, especially when autonomy is required (i.e., without signature updates or extensive administrative overhead). Web applications are difficult to protect because they are large, complex, highly customized, and often created by programmers with little security background. Anomaly-based intrusion detection has been proposed as a strategy to meet these requirements. This paper describes how DFA (Deterministic Finite Automata) induction can be used to detect malicious web requests. The method is used in combination with rules for reducing variability among requests and heuristics for filtering and grouping anomalies. With this setup a wide variety of attacks is detectable with few false-positives, even when the system is trained on data containing benign attacks (e.g., attacks that fail against properly patched servers).

Discrete dynamic Bayesian network analysis of fMRI data

We examine the efficacy of using discrete Dynamic Bayesian Networks (dDBNs), a data‐driven modeling technique employed in machine learning, to identify functional correlations among neuroanatomical regions of interest. Unlike many neuroimaging analysis techniques, this method is not limited by linear and/or Gaussian noise assumptions. It achieves this by modeling the time series of neuroanatomical regions as discrete, as opposed to continuous, random variables with multinomial distributions. We demonstrated this method using an fMRI dataset collected from healthy and demented elderly subjects (Buckner, et al., 2000 : J Cogn Neurosci 12:24‐34) and identify correlates based on a diagnosis of dementia. The results are validated in three ways. First, the elicited correlates are shown to be robust over leave‐one‐out cross‐validation and, via a Fourier bootstrapping method, that they were not likely due to random chance. Second, the dDBNs identified correlates that would be expected given the experimental paradigm. Third, the dDBNs ability to predict dementia is competitive with two commonly employed machine‐learning classifiers: the support vector machine and the Gaussian naïve Bayesian network. We also verify that the dDBN selects correlates based on non‐linear criteria. Finally, we provide a brief analysis of the correlates elicited from Buckner et al.s data that suggests that demented elderly subjects have reduced involvement of entorhinal and occipital cortex and greater involvement of the parietal lobe and amygdala in brain activity compared with healthy elderly (as measured via functional correlations among BOLD measurements). Limitations and extensions to the dDBN method are discussed. Hum Brain Mapp, 2009.

V-Lab-a virtual laboratory for autonomous agents-SLA-based learning controllers

In this paper, we present the use of stochastic learning automata (SLA) in multiagent robotics. In order to fully utilize and implement learning control algorithms in the control of multiagent robotics, an environment for simulation has to be first created. A virtual laboratory for simulation of autonomous agents, called V-Lab is described. The V-Lab architecture can incorporate various models of the environment as well as the agent being trained. A case study to demonstrate the use of SLA is presented.

Learning class-discriminative dynamic Bayesian networks

In many domains, a Bayesian networks topological structure is not known a priori and must be inferred from data. This requires a scoring function to measure how well a proposed network topology describes a set of data. Many commonly used scores such as BD, BDE, BDEU, etc., are not well suited for class discrimination. Instead, scores such as the class-conditional likelihood (CCL) should be employed. Unfortunately, CCL does not decompose and its application to large domains is not feasible. We introduce a decomposable score, approximate conditional likelihood (ACL) that is capable of identifying class discriminative structures. We show that dynamic Bayesian networks (DBNs) trained with ACL have classification efficacies competitive to those trained with CCL on a set of simulated data experiments. We also show that ACL-trained DBNs outperform BDE-trained DBNs, Gaussian naïve Bayes networks and support vector machines within a neuroscience domain too large for CCL.

Improving bayesian network structure search with random variable aggregation hierarchies

Bayesian network structure identification is known to be NP-Hard in the general case. We demonstrate a heuristic search for structure identification based on aggregationhierarchies. The basic idea is to perform initial exhaustive searches on composite “high-level” random variables (RVs) that are created via aggregations of atomic RVs. The results of the high-level searches then constrain a refined search on the atomic RVs. We demonstrate our methods on a challenging real-world neuroimaging domain and show that they consistently yield higher scoring networks when compared to traditional searches, provided sufficient topological complexity is permitted. On simulated data, where ground truth is known and controllable, our methods yield improved classification accuracy and structural precision, but can also result in reduced structural recall on particularly noisy datasets.

Shrinkage Estimator for Bayesian Network Parameters

Maximum likelihood estimates (MLEs) are commonly used to parameterize Bayesian networks. Unfortunately, these estimates frequently have unacceptably high variance and often overfit the training data. Laplacian correction can be used to smooth the MLEs towards a uniform distribution. However, the uniform distribution may represent an unrealistic relationships in the domain being modeled and can add an unreasonable bias. We present a shrinkage estimator for domains with hierarchically related random variables that smoothes MLEs towards other distributions found in the training data. Our methods are quick enough to be performed during Bayesian network structure searches. On both a simulated and a real-world neuroimaging domain, we empirically demonstrate that our estimator yields superior parameters in the presence of noise and greater likelihoods on left-out data.