V. Rao Vemuri

Use of K-Nearest Neighbor classifier for intrusion detection11An earlier version of this paper is to appear in the Proceedings of the 11th USENIX Security Symposium, San Francisco, CA, August 2002

A new approach, based on the k-Nearest Neighbor (kNN) classifier, is used to classify program behavior as normal or intrusive. Program behavior, in turn, is represented by frequencies of system calls. Each system call is treated as a word and the collection of system calls over each program execution as a document. These documents are then classified using kNN classifier, a popular method in text categorization. This method seems to offer some computational advantages over those that seek to characterize program behavior with short sequences of system calls and generate individual program profiles. Preliminary experiments with 1998 DARPA BSM audit data show that the kNN classifier can effectively detect intrusive attacks and achieve a low false positive rate.

Improved approaches for cost-effective traffic grooming in WDM ring networks: ILP formulations and single-hop and multihop connections

Traffic grooming is the term used to describe how different traffic streams are packed into higher speed streams. In a synchronous optical network-wavelength division multiplexing (SONET-WDM) ring network, each wavelength can carry several lower-rate traffic streams in time division (TDM) fashion. The traffic demand, which is an integer multiple of the timeslot capacity, between any two nodes is established on several TDM virtual connections. A virtual connection needs to be added and dropped only at the two end nodes of the connection; as a result, the electronic add-drop multiplexers (ADMs) at intermediate nodes (if there are any) will electronically bypass this timeslot. Instead of having an ADM on every wavelength at every node, it may be possible to have some nodes on some wavelength where no add-drop is needed on any timeslot; thus, the total number of ADMs in the network (and, hence, the network cost) can be reduced. Under the static traffic pattern, the savings can be maximized by carefully packing the virtual connections into wavelengths. In this work, we allow arbitrary (nonuniform) traffic and we present a formal mathematical definition of the problem, which turns out to be an integer linear program (ILP). Then, we propose a simulated-annealing-based heuristic algorithm for the case where all the traffic is carried on directly connected virtual connections (referred to as the single-hop case). Next, we study the case where a hub node is used to bridge traffic from different wavelengths (referred to as the multihop case). We find the following main results. The simulated-annealing-based approach has been found to achieve the best results, so far, in most cases, relative to other comparable approaches proposed in the literature. In general, a multihop approach can achieve better equipment savings when the traffic-grooming ratio is large, but it consumes more bandwidth.

Adaptive anomaly detection with evolving connectionist systems

Anomaly detection holds great potential for detecting previously unknown attacks. In order to be effective in a practical environment, anomaly detection systems have to be capable of online learning and handling concept drift. In this paper, a new adaptive anomaly detection framework, based on the use of unsupervised evolving connectionist systems, is proposed to address these issues. It is designed to adapt to normal behavior changes while still recognizing anomalies. The evolving connectionist systems learn a subjects behavior in an online, adaptive fashion through efficient local element tuning. Experiments with the KDD Cup 1999 network data and the Windows NT user profiling data show that our adaptive anomaly detection systems, based on Fuzzy Adaptive Resonance Theory (ART) and Evolving Fuzzy Neural Networks (EFuNN), can significantly reduce the false alarm rate while the attack detection rate remains high.

Information filtering via hill climbing, WordNet and index patterns

The recent growth of the Internet has left many users awash in a sea of information. This development has spawned the need for intelligent filtering systems. This paper describes work implemented in the INFOS (Intelligent News Filtering Organizational System) project that is designed to reduce the users search burden by automatically categorizing data as relevant or irrelevant based upon user interests. These predictions are learned automatically based upon features taken from input articles and collaborative features derived from other users. The filtering is performed by a hybrid technique that combines elements of a keyword-based hill climbing method, knowledge-based conceptual representation via WordNet, and partial parsing via index patterns. The hybrid system integrating all these approaches combines the benefits of each while maintaining robustness and scalability.

An application of principal component analysis to the detection and visualization of computer network attacks

Network traffic data collected for intrusion analysis is typically high-dimensional making it difficult to both analyze and visualize. Principal Component Analysis is used to reduce the dimensionality of the feature vectors extracted from the data to enable simpler analysis and visualization of the traffic. Principal Component Analysis is applied to selected network attacks from theDarpa 1998 intrusion detection data sets namely: Denial-of-Service and Network Probe attacks. A method for identifying an attack based on the generated statistics is proposed. Visualization of network activity and possible intrusions is achieved using Bi-plots, which provides a summary of the statistics.RésuméLes données de trafic que l’on collecte lors d’intrusions dans des réseaux se caractérisent par leur côté multidimensionnel, ce qui les rend difficiles à analyser et à visualiser. L’analyse en composantes principales est ici utilisée pour réduire le nombre de dimensions des vecteurs extraits de ces données, ce qui rend plus simple l’analyse et la visualisation du trafic. Elle est appliquée à des attaques de réseaux prises dans les jeux de données de détection d’intrusion du DARPA 1998 à savoir : attaques par saturation (déni de service) et attaques par sonde. Une méthode d’identification de l’attaque basée sur des statistiques générales est proposée. La visualisation de l’activité du réseau et d’éventuelles intrusions est réalisée en utilisant des « bi-plots », qui fournissent un condensé de ces statistiques.

Improved approaches for cost-effective traffic grooming in WDM ring networks: nonuniform traffic and bidirectional ring

The SONET ring is the most widely used optical network infrastructure today. While deploying the WDM/SONET ring, traffic grooming is an important network-design problem. SONET allows each wavelength to carry several lower-rate independent traffic channels in TDM fashion. For each logical connection that is established on one TDM time slot of a wavelength, traffic needs to be added and dropped only at the two end nodes of the connection. It is possible to have some nodes on some wavelength where no add/drop is needed on any time slot, thus resulting in savings of electronic equipment cost. By carefully arranging the connections on the network, the savings can be maximized. In the WDM/SONET ring, the equipment cost is predominantly high, so efficient traffic grooming can greatly reduce the network cost. In this paper, we first present a comprehensive mathematical definition of the problem, which turns out to be an integer linear program (ILP). Then, we propose a simulated-annealing-based heuristic algorithm for traffic grooming. A simple heuristic is also provided for the case where a hub node is used to bridge traffic from different wavelengths (called the multihop approach). We find the following main results. The simulated-annealing approach provides very good results in most cases. In general, multihop approaches can achieve better equipment savings when the grooming ratio is large but it consumes more bandwidth. Single-hop approaches will do better in all aspects when the grooming ratio is small. This paper focuses on nonuniform traffic and both unidirectional and bidirectional rings.

An artificial immune system approach to document clustering

It has recently been shown that artificial immune systems (AIS) can be successfully used in many machine learning tasks. The aiNet, one such AIS algorithm exploiting the biologically-inspired features of the immune system, performs well on elementary clustering tasks. This paper proposes the use of the aiNet to more complex tasks of document clustering. Based on the immune network and affinity maturation principles, the aiNet performs an evolutionary process on the raw data, which removes data redundancy and retrieves good clustering results. Also, Principal Component Analysis is integrated into this method to reduce the time complexity. The results are compared with some classical document clustering methods - Hierachical Agglomerative Clustering and K-means.

How do image statistics impact lossy coding performance

It has been observed (Saha and Vemuri, 1999) that when we compress a variety of images of different types using a fixed wavelet filter, the peak signal-to-noise ratio (PSNR) values vary widely from image to image. This large variation in PSNR by as much as 30 dB, can only be attributed to the nature and inherent characteristics of the image, since everything else is fixed. In this paper, we analyze the set of test images to determine the features in the images that may cause the coding performance variations. It is shown that most of the gray-level image features do not have any direct effect on the coding performance, and image activity measure is the only feature that has a correlation with the PSNR value.

Web-Based Knowledge Acquisition to Impute Missing Values for Classification

Machine learning is the science of building predictors from data while accounting for the predictors accuracy on future data. Many machine learning classifiers can make accurate predictions when the data is complete. In the presence of insufficient data, statistical methods can be applied to fill in a few missing items. But these methods rely only on the available data to calculate the missing values and perform poorly if the percentage of missing values exceeds a threshold. An alternative is to fill in the missing data by an automated knowledge discovery process via mining the WWW. This novel procedure is applied by first restoring missing information and next learning the parameters of the classifier from the restored data. Using a Bayesian network as a classifier, the parameters, i.e., the probabilities associated with the causal relationships in the network, are deduced using the knowledge mined from the WWW in conjunction with the data available on hand. The method, when tested with heart disease data sets from the UC Irvine Machine Learning Repository [UCI repository of machine learning databases], gave satisfactory results.

Effect of image activity on lossy and lossless coding performance

Summary form only given. When we compress a variety of multimedia images using a fixed wavelet filter, the PSNR values vary widely. Similarly in lossless image compression using a fixed integer wavelet transform, the bit rates can vary sharply. These large variations can be attributed to the image activity measure (IAM). We define and use a number of IAM from image variance, edges, wavelet coefficients and gradients, and analyse various images to see the effect of such image activity on the coding performance. It is observed that for both textures and images, a gradient-based activity measure is found to be the most effective measure in capturing the activities and solely determines the compressibility of an image.