Rule Generalisation in Intrusion Detection Systems using Snort

Intrusion Detection Systems (IDSs) provide an important layer of security for computer systems and networks, and are becoming more and more necessary as reliance on Internet services increases and systems with sensitive data are more commonly open to Internet access. An IDS’s responsibility is to detect suspicious or unacceptable system and network activity and to alert a systems administrator to this activity. The majority of IDSs use a set of signatures that define what suspicious traffic is, and Snort is one popular and actively developing open-source IDS that uses such a set of signatures known as Snort rules. Our aim is to identify a way in which Snort could be developed further by generalising rules to identify novel attacks. In particular, we attempted to relax and vary the conditions and parameters of current Snort rules, using a similar approach to classic rule learning operators such as generalisation and specialisation. We demonstrate the effectiveness of our approach through experiments with standard datasets and show that we are able to detect previously undetected variants of various attacks. We conclude by discussing the general effectiveness and appropriateness of generalisation in Snort based IDS rule processing. Keywords: anomaly detection, intrusion detection, Snort, Snort rules

'The application of Bayesian Optimization and Classifier Systems in Nurse Scheduling'

Abstract. Two ideas taken from Bayesian optimization and classifier systems are presented for personnel scheduling based on choosing a suitable scheduling rule from a set for each person's assignment. Unlike our previous work of using genetic algorithms whose learning is implicit, the learning in both approaches is explicit, i.e. we are able to identify building blocks directly. To achieve this target, the Bayesian optimization algorithm builds a Bayesian network of the joint probability distribution of the rules used to construct solutions, while the adapted classifier system assigns each rule a strength value that is constantly updated according to its usefulness in the current situation. Computational results from 52 real data instances of nurse scheduling demonstrate the success of both approaches. It is also suggested that the learning mechanism in the proposed approaches might be suitable for other scheduling problems.

Learning from the lagoon: Research in development in Solomon Islands

A major challenge for international agricultural research is to find ways to improve the nutrition and incomes of people left behind by the Green Revolution. To better address the needs of the most marginal and vulnerable people, the CGIAR Research Program on Aquatic Agricultural Systems (AAS) developed the research-in-development (RinD) approach. In 2012, WorldFish started to implement RinD in Solomon Islands. By building people’s capacity to analyze and address development problems, actively engaging relevant stakeholders, and linking research to these processes, RinD aims to develop an alternative approach to addressing hunger and poverty. This report describes the key principles and implementation process, and assesses the emergent outcomes of this participatory, systems-oriented and transformative research approach in Solomon Islands.

'Explicit Learning: an Effort towards Human Scheduling Algorithms'

Abstract Scheduling problems are generally NP-hard combinatorial problems, and a lot of research has been done to solve these problems heuristically. However, most of the previous approaches are problem-specific and research into the development of a general scheduling algorithm is still in its infancy. Mimicking the natural evolutionary process of the survival of the fittest, Genetic Algorithms (GAs) have attracted much attention in solving difficult scheduling problems in recent years. Some obstacles exist when using GAs: there is no canonical mechanism to deal with constraints, which are commonly met in most real-world scheduling problems, and small changes to a solution are difficult. To overcome both difficulties, indirect approaches have been presented (in [1] and [2]) for nurse scheduling and driver scheduling, where GAs are used by mapping the solution space, and separate decoding routines then build solutions to the original problem. In our previous indirect GAs, learning is implicit and is restricted to the efficient adjustment of weights for a set of rules that are used to construct schedules. The major limitation of those approaches is that they learn in a non-human way: like most existing construction algorithms, once the best weight combination is found, the rules used in the construction process are fixed at each iteration. However, normally a long sequence of moves is needed to construct a schedule and using fixed rules at each move is thus unreasonable and not coherent with human learning processes. When a human scheduler is working, he normally builds a schedule step by step following a set of rules. After much practice, the scheduler gradually masters the knowledge of which solution parts go well with others. He can identify good parts and is aware of the solution quality even if the scheduling process is not completed yet, thus having the ability to finish a schedule by using flexible, rather than fixed, rules. In this research we intend to design more human-like scheduling algorithms, by using ideas derived from Bayesian Optimization Algorithms (BOA) and Learning Classifier Systems (LCS) to implement explicit learning from past solutions. BOA can be applied to learn to identify good partial solutions and to complete them by building a Bayesian network of the joint distribution of solutions [3]. A Bayesian network is a directed acyclic graph with each node corresponding to one variable, and each variable corresponding to individual rule by which a schedule will be constructed step by step. The conditional probabilities are computed according to an initial set of promising solutions. Subsequently, each new instance for each node is generated by using the corresponding conditional probabilities, until values for all nodes have been generated. Another set of rule strings will be generated in this way, some of which will replace previous strings based on fitness selection. If stopping conditions are not met, the Bayesian network is updated again using the current set of good rule strings. The algorithm thereby tries to explicitly identify and mix promising building blocks. It should be noted that for most scheduling problems the structure of the network model is known and all the variables are fully observed. In this case, the goal of learning is to find the rule values that maximize the likelihood of the training data. Thus learning can amount to 'counting' in the case of multinomial distributions. In the LCS approach, each rule has its strength showing its current usefulness in the system, and this strength is constantly assessed [4]. To implement sophisticated learning based on previous solutions, an improved LCS-based algorithm is designed, which consists of the following three steps. The initialization step is to assign each rule at each stage a constant initial strength. Then rules are selected by using the Roulette Wheel strategy. The next step is to reinforce the strengths of the rules used in the previous solution, keeping the strength of unused rules unchanged. The selection step is to select fitter rules for the next generation. It is envisaged that the LCS part of the algorithm will be used as a hill climber to the BOA algorithm. This is exciting and ambitious research, which might provide the stepping-stone for a new class of scheduling algorithms. Data sets from nurse scheduling and mall problems will be used as test-beds. It is envisaged that once the concept has been proven successful, it will be implemented into general scheduling algorithms. It is also hoped that this research will give some preliminary answers about how to include human-like learning into scheduling algorithms and may therefore be of interest to researchers and practitioners in areas of scheduling and evolutionary computation. References 1. Aickelin, U. and Dowsland, K. (2003) 'Indirect Genetic Algorithm for a Nurse Scheduling Problem', Computer & Operational Research (in print). 2. Li, J. and Kwan, R.S.K. (2003), 'Fuzzy Genetic Algorithm for Driver Scheduling', European Journal of Operational Research 147(2): 334-344. 3. Pelikan, M., Goldberg, D. and Cantu-Paz, E. (1999) 'BOA: The Bayesian Optimization Algorithm', IlliGAL Report No 99003, University of Illinois. 4. Wilson, S. (1994) 'ZCS: A Zeroth-level Classifier System', Evolutionary Computation 2(1), pp 1-18.

Students' perceptions about assessment using an e-learning platform.

SCAP’s Information Systems Department is composed of about twenty teachers who have, for several years, been using an e-learning environment (Moodle) combined with traditional assessment. A new e-assessment strategy was implemented recently in order to evaluate a practical topic, the use of spreadsheets to solve management problems. This topic is common to several courses of different undergraduate degree programs. Being e-assessment an outstanding task regarding theoretical topics, it becomes even more challenging when the topics under evaluation are practical. In order to understand the implications of this new type of assessment from the viewpoint of the students, questionnaires and interviews were undertaken. In this paper the analysis of the questionnaires are presented and discussed.

Learning Sustainability with EPS@ISEP – Development of an Insectarium

8th International Symposium on Project Approaches in Engineering Education (PAEE)

Learning Sustainability with EPS@ISEP – Development of a Water Disinfection System

Proceedings of the 8th International Symposium on Project Approaches in Engineering Education (PAEE), Guimarães, 2016

Rule Generalisation in Intrusion Detection Systems using Snort

Intrusion Detection Systems (IDSs) provide an important layer of security for computer systems and networks, and are becoming more and more necessary as reliance on Internet services increases and systems with sensitive data are more commonly open to Internet access. An IDS’s responsibility is to detect suspicious or unacceptable system and network activity and to alert a systems administrator to this activity. The majority of IDSs use a set of signatures that define what suspicious traffic is, and Snort is one popular and actively developing open-source IDS that uses such a set of signatures known as Snort rules. Our aim is to identify a way in which Snort could be developed further by generalising rules to identify novel attacks. In particular, we attempted to relax and vary the conditions and parameters of current Snort rules, using a similar approach to classic rule learning operators such as generalisation and specialisation. We demonstrate the effectiveness of our approach through experiments with standard datasets and show that we are able to detect previously undetected variants of various attacks. We conclude by discussing the general effectiveness and appropriateness of generalisation in Snort based IDS rule processing. Keywords: anomaly detection, intrusion detection, Snort, Snort rules

Qualidade, formação e ensino à distância: uma aplicação da NP 4512 numa unidade de E-learning

A implementação de sistemas de gestão da qualidade na área da educação e formação permite reforçar e consolidar as organizações que atuam num mercado cada vez mais competitivo, permitindo-lhes satisfazer, numa base permanente e sistemática, as expetativas dos clientes através do fornecimento de produtos de formação de melhor qualidade. Neste contexto, o objetivo deste estudo é explorar a temática dos sistemas de gestão da qualidade ao nível do setor de educação. Em específico pretende-se efetuar uma revisão de literatura sobre qualidade, formação e ensino à distância;analisar normas, projetos e iniciativas em matéria de ensino à distância e implementar um Sistema de Gestão da Formação, de acordo com a NP 4512, numa unidade de e-learning. A metodologia adotada foi investigação–ação e centrou-se no levantamento bibliográfico e na aplicação dos conceitos num contexto específico de um organização de ensino. Foi escolhida a unidade de e-learning do IPP (e-IPP) como contexto do estudo por ser uma unidade de ensino superior. Os principais resultados obtidos são: (1) maior conhecimento das normas projetos e iniciativas em matéria de ensino à distância a nível nacional e europeu; (2) análise detalhada da recente norma portuguesa NP 4512; (3) elaboração da documentação associada ao Sistema de Gestão da Formação (SGF) na unidade e-IPP, em específico, identificação e monitorização dos processos, descrição dos procedimentos obrigatórios e elaboração do manual do SGF. Como principal limitação deste estudo destaca-se a implementação parcial do sistema de gestão da formação na unidade e-IPP, devido à falta de tempo e à falta de maturidade da unidade e-IPP.

A Soft Computing Approach to Quality Evaluation of General Chemistry Learning in Higher Education

In contemporary societies higher education must shape individuals able to solve problems in a workable and simpler manner and, therefore, a multidisciplinary view of the problems, with insights in disciplines like psychology, mathematics or computer science becomes mandatory. Undeniably, the great challenge for teachers is to provide a comprehensive training in General Chemistry with high standards of quality, and aiming not only at the promotion of the student’s academic success, but also at the understanding of the competences/skills required to their future doings. Thus, this work will be focused on the development of an intelligent system to assess the Quality-of-General-Chemistry-Learning, based on factors related with subject, teachers and students.

An idiotypic immune network as a short-term learning architecture for mobile robots

A combined Short-Term Learning (STL) and Long-Term Learning (LTL) approach to solving mobile robot navigation problems is presented and tested in both real and simulated environments. The LTL consists of rapid simulations that use a Genetic Algorithm to derive diverse sets of behaviours. These sets are then transferred to an idiotypic Artificial Immune System (AIS), which forms the STL phase, and the system is said to be seeded. The combined LTL-STL approach is compared with using STL only, and with using a handdesigned controller. In addition, the STL phase is tested when the idiotypic mechanism is turned off. The results provide substantial evidence that the best option is the seeded idiotypic system, i.e. the architecture that merges LTL with an idiotypic AIS for the STL. They also show that structurally different environments can be used for the two phases without compromising transferability.

Effective Learning-Based Hybrid Search for Bandwidth Coloring

International audience

Action and perception: Neural indices of learning in infants

Early human development offers a unique perspective in investigating the potential cognitive and social implications of action and perception. Specifically, during infancy, action production and action perception undergo foundational developments. One essential component to examine developments in action processing is the analysis of others’ actions as meaningful and goal-directed. Little research, however, has examined the underlying neural systems that may be associated with emerging action and perception abilities, and infants’ learning of goal-directed actions. The current study examines the mu rhythm—a brain oscillation found in the electroencephalogram (EEG)—that has been associated with action and perception. Specifically, the present work investigates whether the mu signal is related to 9-month-olds’ learning of a novel goal-directed means-end task. The findings of this study demonstrate a relation between variations in mu rhythm activity and infants’ ability to learn a novel goal-directed means-end action task (compared to a visual pattern learning task used as a comparison task). Additionally, we examined the relations between standardized assessments of early motor competence, infants’ ability to learn a novel goal-directed task, and mu rhythm activity. We found that: 1a) mu rhythm activity during observation of a grasp uniquely predicted infants’ learning on the cane training task, 1b) mu rhythm activity during observation and execution of a grasp did not uniquely predict infants’ learning on the visual pattern learning task (comparison learning task), 2) infants’ motor competence did not predict infants’ learning on the cane training task, 3) mu rhythm activity during observation and execution was not related to infants’ measure of motor competence, and 4) mu rhythm activity did not predict infants’ learning on the cane task above and beyond infants’ motor competence. The results from this study demonstrate that mu rhythm activity is a sensitive measure to detect individual differences in infants’ action and perception abilities, specifically their learning of a novel goal-directed action.

Virtual Learning Factory on VR-Supported Factory Planning

Part 13: Virtual Reality and Simulation

Mimicking the behaviour of idiotypic AIS robot controllers using probabilistic systems

Previous work has shown that robot navigation systems that employ an architecture based upon the idiotypic network theory of the immune system have an advantage over control techniques that rely on reinforcement learning only. This is thought to be a result of intelligent behaviour selection on the part of the idiotypic robot. In this paper an attempt is made to imitate idiotypic dynamics by creating controllers that use reinforcement with a number of different probabilistic schemes to select robot behaviour. The aims are to show that the idiotypic system is not merely performing some kind of periodic random behaviour selection, and to try to gain further insight into the processes that govern the idiotypic mechanism. Trials are carried out using simulated Pioneer robots that undertake navigation exercises. Results show that a scheme that boosts the probability of selecting highly-ranked alternative behaviours to 50% during stall conditions comes closest to achieving the properties of the idiotypic system, but remains unable to match it in terms of all round performance.