Kamran Shafi

An adaptive genetic-based signature learning system for intrusion detection

Rule-based intrusion detection systems generally rely on hand crafted signatures developed by domain experts. This could lead to a delay in updating the signature bases and potentially compromising the security of protected systems. In this paper, we present a biologically-inspired computational approach to dynamically and adaptively learn signatures for network intrusion detection using a supervised learning classifier system. The classifier is an online and incremental parallel production rule-based system. A signature extraction system is developed that adaptively extracts signatures to the knowledge base as they are discovered by the classifier. The signature extraction algorithm is augmented by introducing new generalisation operators that minimise overlap and conflict between signatures. Mechanisms are provided to adapt main algorithm parameters to deal with online noisy and imbalanced class data. Our approach is hybrid in that signatures for both intrusive and normal behaviours are learnt. The performance of the developed systems is evaluated with a publicly available intrusion detection dataset and results are presented that show the effectiveness of the proposed system.

Intrusion detection with evolutionary learning classifier systems

Evolutionary Learning Classifier Systems (LCSs) combine reinforcement learning or supervised learning with effective genetics-based search techniques. Together these two mechanisms enable LCSs to evolve solutions to decision problems in the form of easy to interpret rules called classifiers. Although LCSs have shown excellent performance on some data mining tasks, many enhancements are still needed to tackle features like high dimensionality, huge data sizes, non-uniform distribution of classes, etc. Intrusion detection is a real world problem where such challenges exist and to which LCSs have not previously been applied. An intrusion detection problem is characterised by huge network traffic volumes, difficult to realize decision boundaries between attacks and normal activities and highly imbalanced attack class distribution. Moreover, it demands high accuracy, fast processing times and adaptability to a changing environment. We present the results and analysis of two classifier systems (XCS and UCS) on a subset of a publicly available benchmark intrusion detection dataset which features serious class imbalances and two very rare classes. We introduce a better approach for handling the situation when no rules match an input on the test set and recommend this be adopted as a standard part of XCS and UCS. We detect little sign of overfitting in XCS but somewhat more in UCS. However, both systems tend to reach near-best performance in very few passes over the training data. We improve the accuracy of these systems with several modifications and point out aspects that can further enhance their performance. We also compare their performance with other machine learning algorithms and conclude that LCSs are a competitive approach to intrusion detection.

Achievement, affiliation, and power: Motive profiles for artificial agents

Computational models of motivation are tools that artificial agents can use to identify, prioritize, select and adapt the goals they will pursue autonomously. Previous research has focused on developing computational models of motivation that permit artificial agents to exhibit characteristics such as adaptive exploration, problem-finding behavior, competence-seeking behavior, and creativity. This permits self-motivated agents to identify novel or interesting goals not specifically programmed by system engineers, or adapt in complex or uncertain environments where it is difficult for system engineers to identify all possible goals in advance. However, existing computational models of motivation cover only a small subset of psychological motivation theories. There remains potential to draw on other psychological motivation theories to create artificial agents with new behavioral characteristics. This includes agents that can strive for standards of excellence, both internal and external; agents that can proactively socialize and build relationships with others; and agents that can exert their influence to gain control of resources. With these objectives in mind, this article expands our ‘‘motivation toolbox’’ with three new computational models of motivation for achievement, affiliation, and power motivation. The models are designed such that they can be used in isolation or together, embedded in an artificial ‘‘motive profile.’’ To validate the new models of motivation, three experiments are presented that compare the goal-selecting behavior of artificial agents with different motive profiles with that of humans with corresponding motive profiles. Results show that agents with different motive profiles exhibit different goal-selection characteristics, and that these various characteristics are statistically similar to behavioral trends observed experimentally in humans. The article concludes by discussing areas for the future development of each motivation model and the future roles and applications of agents with different motive profiles.

Biologically-inspired Complex Adaptive Systems approaches to Network Intrusion Detection

The pervasiveness of the computing power has made it an inevitable commodity of the modern time. The inexorable technological advances clearly predict the continually increasing reliance of human life on the computing systems in the future. Intelligent portable devices are commonplace these days and information accessibility is ubiquitous. There is a network underlying any computer infrastructure. Complex Adaptive Systems (CAS) are a relatively new field with techniques inspired by Biology, Sociology and other fields. The field of CAS studies systems as a network of interdependent components. There has been a major breakthrough in the field of Network Intrusion Detection Systems (NIDS) in computer security through the adoption of a CAS perspective. This paper surveys some key work in this area with the primary focus being placed on biologically-inspired CAS approaches to NIDS.

Evaluation of an adaptive genetic-based signature extraction system for network intrusion detection

Machine learning techniques are frequently applied to intrusion detection problems in various ways such as to classify normal and intrusive activities or to mine interesting intrusion patterns. Self-learning rule-based systems can relieve domain experts from the difficult task of hand crafting signatures, in addition to providing intrusion classification capabilities. To this end, a genetic-based signature learning system has been developed that can adaptively and dynamically learn signatures of both normal and intrusive activities from the network traffic. In this paper, we extend the evaluation of our systems to real time network traffic which is captured from a university departmental server. A methodology is developed to build fully labelled intrusion detection data set by mixing real background traffic with attacks simulated in a controlled environment. Tools are developed to pre-process the raw network data into feature vector format suitable for a supervised learning classifier system and other related machine learning systems. The signature extraction system is then applied to this data set and the results are discussed. We show that even simple feature sets can help detecting payload-based attacks.

The role of early stopping and population size in XCS for intrusion detection

Evolutionary Learning Classifier Systems (LCSs) are rule based systems that have been used effectively in concept learning. XCS is a prominent LCS that uses genetic algorithms and reinforcement learning techniques. In traditional machine learning (ML), early stopping has been investigated extensively to the extent that it is now a default mechanism in many systems. However, there has been a belief that EC methods are more resilient to overfitting. Therefore, this topic is under-investigated in the evolutionary computation literature and has not been investigated in LCS. In this paper, we show that it is necessary to stop evolution in LCS using a stopping criteria other than a maximum number of generations and that evolution may suffer from overfitting similar to other ML methods.

Prediction of dynamical systems by symbolic regression

We study the modeling and prediction of dynamical systems based on conventional models derived from measurements. Such algorithms are highly desirable in situations where the underlying dynamics are hard to model from physical principles or simplified models need to be found. We focus on symbolic regression methods as a part of machine learning. These algorithms are capable of learning an analytically tractable model from data, a highly valuable property. Symbolic regression methods can be considered as generalized regression methods. We investigate two particular algorithms, the so-called fast function extraction which is a generalized linear regression algorithm, and genetic programming which is a very general method. Both are able to combine functions in a certain way such that a good model for the prediction of the temporal evolution of a dynamical system can be identified. We illustrate the algorithms by finding a prediction for the evolution of a harmonic oscillator based on measurements, by detecting an arriving front in an excitable system, and as a real-world application, the prediction of solar power production based on energy production observations at a given site together with the weather forecast.

Real time signature extraction from a supervised classifier system

Recently some algorithms have been proposed to clean post-training rule populations evolved by XCS, a state of the art Learning Classifier System (LCS). We present an algorithm to extract optimal rules, which we refer to as signatures, during the operation of UCS, a recent variant of XCS. In a benchmark binary valued dataset our method seconds the generalization and optimality hypotheses for UCS and provide mechanisms for retrieving all maximally general rules in real time. In real valued problems, where precise realization of decision boundaries is often not possible, our algorithm is able to retrieve near optimal representations with the help of a modified subsumption operator. The algorithm is able to reduce the processing time asymptotically and provides a mechanism for early stopping of the learning process.

Performance analysis of rough set ensemble of learning classifier systems with differential evolution based rule discovery

Data mining, and specifically supervised data classification, is a key application area for Learning Classifier Systems (LCS). Scaling to larger classification problems, especially to higher dimensional problems, is a key challenge. Ensemble based approaches can be applied to LCS to address scalability issues. To this end a rough set based ensemble of LCS is proposed, which relies on a pre-processed feature partitioning step to train multiple LCS on feature subspaces. Each base classifier in the ensemble is a Michigan style supervised LCS. The traditional genetic algorithm based rule evolution is replaced by a differential evolution based rule discovery, to improve generalisation capabilities of LCS. A voting mechanism is then used to generate output for test instances. This paper describes the proposed ensemble algorithm in detail, and compares its performance with different versions of base LCS on a number of benchmark classification tasks. Analysis of computational time and model accuracy show the relative merits of the ensemble algorithm and base classifiers on the tested data sets. The rough set based ensemble learning approach and differential evolution based rule searching out-perform the base LCS on classification accuracy over the data sets considered. Results also show that small ensemble size is sufficient to obtain good performance.

Reduct based ensemble of learning classifier system for real-valued classification problems

Rough set theory has proved efficient for many applications, including finding hidden patterns in data, data reduction, evaluating significance of data, and generating sets of decision rules from data. Recently, it has shown to be effective approach for constructing ensemble learning systems as well. Learning classifier systems are genetics-based machine learning techniques that have recently shown a high degree of competence on a variety of data mining problems. Attempts to improve its generalization capabilities in the literature using ensemble learning lack a systematic and robust techniques for partitioning the problem at hand. It is well known that ensemble performance depends on the problem decomposition technique being used. Rough set based learning classifier system ensemble is proposed in this paper. In this approach, rough set attribute reduction is used to generate a set of reducts, and then a diverse subset of these reducts is selected to train an ensemble of base classifiers. The experiments show that classification accuracy of reduct-based ensemble systems outperforms a single learning classifier system model. It has also shown better performance than either an ensemble of classifiers with all attributes being used or a single classifier trained by a single reduct. It has also shown competitive performance to the random subspace ensemble strategy on the set of real data sets used in the experiments.