Shaomin Mu

Sequence-similarity kernels for SVMs to detect anomalies in system calls

In intrusion detection systems (IDSs), short sequences of system calls executed by running programs can be used as evidence to detect anomalies. In this paper, one-class support vector machines (SVMs) using sequence-similarity kernels are adopted as the anomaly detectors. Edit distance-based kernel and common subsequence-based kernel are proposed to utilize the sequence information in the detection. Algorithms for efficient computation of the kernels are derived with the techniques of dynamic programming and bit-parallelism. The experimental results indicate that the proposed kernels can significantly outperform the standard RBF kernel.

Cooperative clustering for training SVMs

Support vector machines are currently very popular approaches to supervised learning. Unfortunately, the computational load for training and classification procedures increases drastically with size of the training data set. In this paper, a method called cooperative clustering is proposed. With this procedure, the set of data points with pre-determined size near the border of two classes is determined. This small set of data points is taken as the set of support vectors. The training of support vector machine is performed on this set of data points. With this approach, training efficiency and classification efficiency are achieved with small effects on generalization performance. This approach can also be used to reduce the number of support vectors in regression problems.

Local Support Vector Machine based on Cooperative Clustering for very large-scale dataset

Local support vector machine (LSVM) has been attracting more and more attention because of its consistency. In LSVM, the training of a standard SVM is transformed to the construction of a set of local model of SVM, each of which is obtained by the training on the neighborhood of a certain sample. This strategy reduces the number of samples in every turn of training for the construction of SVM, but increased the number of local model to be trained. Some methods had been proposed to reduce the number of local model which is needed to be trained. However, theses reduction is not enough for very large-scale dataset. In this paper, we present a new Local Support Vector Machine algorithm based on Cooperative Clustering, namely C2LSVM and do the description of the C2LSVM algorithm and experiment In C2LSVM, the data of training subset will be reduced from thousands down to tens. At the same time, the classification accuracy will be preserved even improved.

The Training of Radial Basis Function Network Classifier with Cooperative Clustering

The selection of centers and widths parameter has a strong influence on the performance of radial basis function neural network. In this paper, we present a novel approach of clustering, which we called cooperative clustering, and use it for selection of centers of radial basis function neural network. The experimental results are given to show that the approach could not only effectively improve the training speed, but also keep classification accuracies.

High-order markov kernels for network intrusion detection

In intrusion detection systems, sequences of system calls executed by running programs can be used as evidence to detect anomalies. Markov chain is often adopted as the model in the detection systems, in which high-order Markov chain model is well suited for the detection, but as the order of the chain increases, the number of parameters of the model increases exponentially and rapidly becomes too large to be estimated efficiently. In this paper, oneclass support vector machines (SVMs) using high-order Markov kernel are adopted as the anomaly detectors. This approach solves the problem of high dimension parameter space. Experiments show that this system can produce good detection performance with low computational overhead.

Length-weighted string kernels for sequence data classification

Various sequence-similarity kernels, the string kernels, have been introduced for use with support vector machines (SVMs) in a discriminative approach to the sequence data classification problems. In these applications, string kernels are asked to be similarity measures between strings. In this paper, we present a new string kernel and its variants suitable to sequence data classification, which are determined by (possibly non-contiguous) matching subsequences with all possible lengths shared by two strings. In these kernels, gaps in subsequences are allowed and the longer subsequences contribute more to the value of kernels. Efficient algorithms of computing the kernels are derived with the techniques of dynamic programming and bit-parallelism. In some cases, the computation of the kernel is linear in the length of the strings.

Increasing classification efficiency with multiple mirror classifiers

Reducing the computational load for training and classification procedures is a major problem in many pattern recognition approaches, such as artificial neural networks and support vector machines. Combining the multiple mirror classifiers is proven to be an efficient way to reduce the classification time. In this paper, we propose an approach that uses cooperative clustering method to construct mirror classifiers. With this procedure, the set of mirror point pairs with pre-determined size near the boundary of two classes is determined. Each mirror point pair constructs a small classifier. The minimum squared error based method and support vector machine based method are proposed to determine the weights for combining the multiple mirror classifiers. Experiments show that the training efficiency and classification efficiency are improved with a slight impact on generalization performance.

Using Length-weighted Once Kernel to Detect Anomalous Process

In this paper, we present a new string kernel, called length-weighted once kernel, and propose an efficient algorithm to compute this kernel. The algorithm is based on dynamic programming and suffix kernel. Moreover, we intend to distinguish anomalous process from normal processes using a one-class support vector machine classifier with certain kernel function. In the experiments, gap-weighted kernels, length-weighted once kernel, and RBF kernel are tested with an SVM classifier on the UNM datasets. The experimental results reveal that the length- weighted once kernel outperforms the others.

A fast bit-parallel algorithm for gapped string kernels

In this paper, we present a new kind of gapped string kernel, named length-weighted kernels, including p-length-weighted and all-length-weighted kernels. Moreover, we propose a dynamic programming algorithm based on suffix kernel to compute the length-weighted kernels. Given strings s and t, and a gap penalty λ, all-length-weighted kernel can be calculated in time O(|s||t|) using our algorithms. Based on the relationship between all-length and p-length kernels, the p-length-weighted can be computed in O(p|s||t|) time. Furthermore, a bit-parallel technique is used to reduce the complexity from O(p|s||t|) to O(⌈pk/w⌉|s||t|), where w is the word size of the machine (e.g. 32 or 64 in practice) and k is determined by the longest matching subsequence of two strings s and t. The empirical results suggest that this bit-parallel technique algorithm combined with dynamic programming and suffix kernel technique outperforms the other approaches in some cases where the necessary condition of using bit-parallel technique can be satisfied.