Kiran S. Balagani

Adaptive neural network clustering of Web users

The degree of personalization that a Web site offers in presenting its services to users is an important attribute contributing to the sites popularity. Web server access logs contain substantial data about user access patterns. One way to solve this problem is to group users on the basis of their Web interests and then organize the sites structure according to the needs of different groups. Two main difficulties inhibit this approach: the essentially infinite diversity of user interests and the change in these interests with time. We have developed a clustering algorithm that groups users according to their Web access patterns. The algorithm is based on the ART1 version of adaptive resonance theory. In our ART1-based algorithm, a prototype vector represents each user cluster by generalizing the URLs most frequently accessed by all cluster members. We have compared our algorithms performance with the traditional k-means clustering algorithm. Results showed that the ART1-based technique performed better in terms of intracluster distances. We also applied the technique in a prefetching scheme that predicts future user requests.

On the Feature Selection Criterion Based on an Approximation of Multidimensional Mutual Information

We derive the feature selection criterion presented in [1] and [2] from the multidimensional mutual information between features and the class. Our derivation: 1) specifies and validates the lower-order dependency assumptions of the criterion and 2) mathematically justifies the utility of the criterion by relating it to Bayes classification error.

A Weighted Metric Based Adaptive Algorithm for Web Server Load Balancing

We propose a load balancing algorithm that adapts its strategies for allocating Web requests based on the Web servers’ status. The system used in our experiment comprises of two components: (1) a Prober and (2) an Allocator. The Prober gathers the status information from the Web servers every 50 milliseconds. The status information consists of the load on each Web server and a check for a cache hit. Based on this status information, the Allocator calculates a weighted metric for each server. This metric has three components: (1) CPU load on the server, (2) server’s response rate, and (3) the number of requests served by the server. The Allocator chooses the Web server with the least value for this metric. Unique features of this approach are (1) consideration of both the global information (consisting of status at other Web servers) and local information at each Web server to choose the best server to allocate a request, and (2) the algorithm passes the IP address of the chosen Web server to the client that initiated the request and then allows the client to establish a connection with the server directly, thereby eliminating the participation overhead of the intermediate redirector. We compare our algorithm with three different methods: (1) random allocation scheme, (2) round robin allocation scheme, and (3) a recently reported scheme that uses neural networks. Our method is as good as or better (in most cases) in response time, than the other three approaches.

Making impostor pass rates meaningless: A case of snoop-forge-replay attack on continuous cyber-behavioral verification with keystrokes

Previous efforts in continuous cyber-behavioral verification have considered only zero-effort impostor attacks. Taking continuous verification with keystroke dynamics as a case in point, we demonstrate that forgery attempts created using snooped information (stolen keystroke timing information in our case) have alarmingly high success rates. In our experiments, with as little as 50 to 200 snooped keystrokes (roughly, less than two lines of text typed in a typical email), we were able to create forgeries that had as high as 87.75 percent success rates against verifier configurations that showed less than 11 percent “zero-effort” impostor pass rates. We performed experiments using keystroke data from 50 users who typed approximately 1300 to 2900 keystrokes of free text during three different periods. Our experiments consisted of two parts. In the first part, we conducted zero-effort verification experiments with two verifiers (“R” and “S”) and obtained EERs between 10 and 15 percent under various verifier configurations. In the second part, we replayed 10,000 forged impostor attempts per user and demonstrated how the zero-effort impostor pass rates became meaningless when impostor attempts were created using stolen keystroke timing information.

On Guo and Nixon's Criterion for Feature Subset Selection: Assumptions, Implications, and Alternative Options

Guo and Nixon proposed a feature selection method based on maximizing <i>I</i>( <b>x</b>;<i>Y</i>), the multidimensional mutual information between feature vector <b>x</b> and class variable <i>Y</i>. Because computing <i>I</i>(<b>x</b>;<i>Y</i>) can be difficult in practice, Guo and Nixon proposed an approximation of <i>I</i>(<b>x</b>;<i>Y</i>) as the criterion for feature selection. We show that Guo and Nixons criterion originates from approximating the joint probability distributions in <i>I</i>(<b>x</b>;<i>Y</i>) by second-order product distributions. We remark on the limitations of the approximation and discuss computationally attractive alternatives to compute <i>I</i>(<b>x</b>;<i>Y</i>) .

On the Relationship Between Dependence Tree Classification Error and Bayes Error Rate

Wong and Poon (1989) showed that Chow and Lius tree dependence approximation can be derived by minimizing an upper bound of the Bayes error rate. Wong and Poons result was obtained by expanding the conditional entropy H(omega|X). We derive the correct expansion of H(omega|X) and present its implication.