Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Probabilistic Independence Networks for Hidden Markov Probability Models

Graphical techniques for modeling the dependencies of randomvariables have been explored in a variety of different areas includingstatistics, statistical physics, artificial intelligence, speech recognition, image processing, and genetics.Formalisms for manipulating these models have been developedrelatively independently in these research communities. In this paper weexplore hidden Markov models (HMMs) and related structures within the general framework of probabilistic independencenetworks (PINs). The paper contains a self-contained review of the basic principles of PINs.It is shown that the well-known forward-backward (F-B) and Viterbialgorithms for HMMs are special cases of more general inference algorithms forarbitrary PINs. Furthermore, the existence of inference and estimationalgorithms for more general graphical models provides a set of analysistools for HMM practitioners who wish to explore a richer class of HMMstructures.Examples of relatively complex models to handle sensorfusion and coarticulationin speech recognitionare introduced and treated within the graphical model framework toillustrate the advantages of the general approach.

Learning how (not) to fire a gun: combatant training and civilian victimization

What is the relationship between the type of training combatants receive upon recruitment into an armed group and their propensity to abuse civilians in civil war? Does military training or political training prevent or exacerbate the victimization of civilians by armed non-state actors? While the literature on civilian victimization has expanded rapidly, few studies have examined the correlation between abuse of civilians and the modes of training that illegal armed actors receive. Using a simple formal model, we develop hypotheses regarding this connection and argue that while military training should not decrease the probability that a combatant engages in civilian abuse, political training should. We test these hypotheses using a new survey consisting of a representative sample of approximately 1,500 demobilized combatants from the Colombian conflict, which we match with department-level data on civilian casualties. The empirical analysis confirms our hypotheses about the connection between training and civilian abuse and the results are robust to adding a full set of controls both at the department and at the individual level

Distributional semantics and machine learning for statistical machine translation

[EU]Lan honetan semantika distribuzionalaren eta ikasketa automatikoaren erabilera aztertzen dugu itzulpen automatiko estatistikoa hobetzeko. Bide horretan, erregresio logistikoan oinarritutako ikasketa automatikoko eredu bat proposatzen dugu hitz-segiden itzulpen- probabilitatea modu dinamikoan modelatzeko. Proposatutako eredua itzulpen automatiko estatistikoko ohiko itzulpen-probabilitateen orokortze bat dela frogatzen dugu, eta testuinguruko nahiz semantika distribuzionaleko informazioa barneratzeko baliatu ezaugarri lexiko, hitz-cluster eta hitzen errepresentazio bektorialen bidez. Horretaz gain, semantika distribuzionaleko ezagutza itzulpen automatiko estatistikoan txertatzeko beste hurbilpen bat lantzen dugu: hitzen errepresentazio bektorial elebidunak erabiltzea hitz-segiden itzulpenen antzekotasuna modelatzeko. Gure esperimentuek proposatutako ereduen baliagarritasuna erakusten dute, emaitza itxaropentsuak eskuratuz oinarrizko sistema sendo baten gainean. Era berean, gure lanak ekarpen garrantzitsuak egiten ditu errepresentazio bektorialen mapaketa elebidunei eta hitzen errepresentazio bektorialetan oinarritutako hitz-segiden antzekotasun neurriei dagokienean, itzulpen automatikoaz haratago balio propio bat dutenak semantika distribuzionalaren arloan.

Probability distributions or point predictions? Survey forecasts of US output growth and inflation

We consider whether survey respondents’ probability distributions, reported as histograms, provide reliable and coherent point predictions, when viewed through the lens of a Bayesian learning model. We argue that a role remains for eliciting directly-reported point predictions in surveys of professional forecasters.

A comment on "Rational learning lead to nash equilibrium" by professors Ehud Kalai and Ehud Lehrer

Kalai and Lebrer (93a, b) have recently show that for the case of infinitely repeated games, a coordination assumption on beliefs and optimal strategies ensures convergence to Nash equilibrium. In this paper, we show that for the case of repeated games with long (but finite) horizon, their condition does not imply approximate Nash equilibrium play. Recently Kalai and Lehrer (93a, b) proved that a coordination assumption on beliefs and optimal strategies, ensures that pIayers of an infinitely repeated game eventually pIay 'E-close" to an E-Nash equilibrium. Their coordination assumption requires that if players believes that certain set of outcomes have positive probability then it must be the case that this set of outcomes have, in fact, positive probability. This coordination assumption is called absolute continuity. For the case of finitely repeated games, the absolute continuity assumption is a quite innocuous assumption that just ensures that pIayers' can revise their priors by Bayes' Law. However, for the case of infinitely repeated games, the absolute continuity assumption is a stronger requirement because it also refers to events that can never be observed in finite time.

A note on learning chaotic sunspot equilibrium

In this paper we prove convergence to chaotic sunspot equilibrium through two learning rules used in the bounded rationality literature. The rst one shows the convergence of the actual dynamics generated by simple adaptive learning rules to a probability distribution that is close to the stationary measure of the sunspot equilibrium; since this stationary measure is absolutely continuous it results in a robust convergence to the stochastic equilibrium. The second one is based on the E-stability criterion for testing stability of rational expectations equilibrium, we show that the conditional probability distribution de ned by the sunspot equilibrium is expectational stable under a reasonable updating rule of this parameter. We also report some numerical simulations of the processes proposed.

A new implementation of population based incremental learning method for optimizations in electromagnetics

To enhance the global search ability of population based incremental learning (PBIL) methods, it is proposed that multiple probability vectors are to be included on available PBIL algorithms. The strategy for updating those probability vectors and the negative learning and mutation operators are thus re-defined correspondingly. Moreover, to strike the best tradeoff between exploration and exploitation searches, an adaptive updating strategy for the learning rate is designed. Numerical examples are reported to demonstrate the pros and cons of the newly implemented algorithm.

A new implementation of Population Based Incremental Learning method for optimization studies in electromagnetics

To enhance the global search ability of Population Based Incremental Learning (PBIL) methods, It Is proposed that multiple probability vectors are to be Included on available PBIL algorithms. As a result, the strategy for updating those probability vectors and the negative learning and mutation operators are redefined as reported. Numerical examples are reported to demonstrate the pros and cons of the newly Implemented algorithm. ©2006 IEEE.

Active Learning to Maximize Area Under the ROC Curve

In active learning, a machine learning algorithmis given an unlabeled set of examples U, and is allowed to request labels for a relatively small subset of U to use for training. The goal is then to judiciously choose which examples in U to have labeled in order to optimize some performance criterion, e.g. classification accuracy. We study how active learning affects AUC. We examine two existing algorithms from the literature and present our own active learning algorithms designed to maximize the AUC of the hypothesis. One of our algorithms was consistently the top performer, and Closest Sampling from the literature often came in second behind it. When good posterior probability estimates were available, our heuristics were by far the best.

Balancing Exploration and Exploitation: A New Algorithm for Active Machine Learning

Active machine learning algorithms are used when large numbers of unlabeled examples are available and getting labels for them is costly (e.g. requiring consulting a human expert). Many conventional active learning algorithms focus on refining the decision boundary, at the expense of exploring new regions that the current hypothesis misclassifies. We propose a new active learning algorithm that balances such exploration with refining of the decision boundary by dynamically adjusting the probability to explore at each step. Our experimental results demonstrate improved performance on data sets that require extensive exploration while remaining competitive on data sets that do not. Our algorithm also shows significant tolerance of noise.

Critical behavior in a cross-situational lexicon learning scenario

The associationist account for early word learning is based on the co-occurrence between referents and words. Here we introduce a noisy cross-situational learning scenario in which the referent of the uttered word is eliminated from the context with probability gamma, thus modeling the noise produced by out-of-context words. We examine the performance of a simple associative learning algorithm and find a critical value of the noise parameter gamma(c) above which learning is impossible. We use finite-size scaling to show that the sharpness of the transition persists across a region of order tau(-1/2) about gamma(c), where tau is the number of learning trials, as well as to obtain the learning error (scaling function) in the critical region. In addition, we show that the distribution of durations of periods when the learning error is zero is a power law with exponent -3/2 at the critical point. Copyright (C) EPLA, 2012

Machine Learning applicato al Web Semantico: Statistical Relational Learning vs Tensor Factorization

Obiettivo della tesi è analizzare e testare i principali approcci di Machine Learning applicabili in contesti semantici, partendo da algoritmi di Statistical Relational Learning, quali Relational Probability Trees, Relational Bayesian Classifiers e Relational Dependency Networks, per poi passare ad approcci basati su fattorizzazione tensori, in particolare CANDECOMP/PARAFAC, Tucker e RESCAL.

Learning Paradigms Exemplified by Virtual Experiments with Honey Bees

Learning is based on rules that can be elucidated by behavioural experiments. This article focuses on virtual experiments, in which non-associative learning (habituation, sensitization) and principles of associative learning (contiguity, inhibitory learning, generalization, overshadowing, positive and negative patterning) can be examined using 'virtual' honey bees in PER (Proboscis Reaction Extension) conditioning experiments. Users can develop experimental designs, simulate and document the experiments and find explanations and suggestions for the analysis of the learning experiments. The virtual experiments are based on video sequences and data from actual learning experiments. The bees' responses are determined by probability-based learning profiles.

Implicit probabilistic sequence learning: Correlated streams and sequence length matter

We investigated whether a pure perceptual stream is sufficient for probabilistic sequence learning to occur within a single session or whether correlated streams are necessary, whether learning is affected by the transition probability between sequence elements, and how the sequence length influences learning. In each of three experiments, we used six horizontally arranged stimulus displays which consisted of randomly ordered bigrams xo and ox. The probability of the next possible target location out of two was either .50/.50 or .75/.25 and was marked by an underline. In Experiment 1, a left vs. right key response was required for the x of a marked bigram in the pure perceptual learning condition and a response key press corresponding to the marked bigram location (out of 6) was required in the correlated streams condition (i.e., the ring, middle, or index finger of the left and right hand, respectively). The same probabilistic 3-element sequence was used in both conditions. Learning occurred only in the correlated streams condition. In Experiment 2, we investigated whether sequence length affected learning correlated sequences by contrasting the 3-elements sequence with a 6-elements sequence. Significant sequence learning occurred in all conditions. In Experiment 3, we removed a potential confound, that is, the sequence of hand changes. Under these conditions, learning occurred for the 3-element sequence only and transition probability did not affect the amount of learning. Together, these results indicate that correlated streams are necessary for probabilistic sequence learning within a single session and that sequence length can reduce the chances for learning to occur.