{"title":"Data analytics on network traffic flows for botnet behaviour detection","authors":"Duc C. Le, A. N. Zincir-Heywood, M. Heywood","doi":"10.1109/SSCI.2016.7850078","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7850078","url":null,"abstract":"Botnets represent one of the most destructive cybersecurity threats. Given the evolution of the structures and protocols botnets use, many machine learning approaches have been proposed for botnet analysis and detection. In the literature, intrusion and anomaly detection systems based on unsupervised learning techniques showed promising performances. In this paper, we investigate the capability of employing the Self-Organizing Map (SOM), an unsupervised learning technique as a data analytics system. In doing so, our aim is to understand how far such an approach could be pushed to analyze unknown traffic to detect botnets. To this end, we employed three different unsupervised training schemes using publicly available botnet data sets. Our results show that SOMs possess high potential as a data analytics tool on unknown traffic. They can identify the botnet and normal flows with high confidence approximately 99% of the time on the data sets employed in this work.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"390 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133354505","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An investigation into the effect of unlabeled neurons on Self-Organizing Maps","authors":"Willem S. van Heerden, A. Engelbrecht","doi":"10.1109/SSCI.2016.7849938","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7849938","url":null,"abstract":"Self-Organizing Maps (SOMs) are unsupervised neural networks that build data models. Neuron labeling attaches descriptive textual labels to the neurons making up a SOM, and is an important component of SOM-based exploratory data analysis (EDA) and data mining (DM). Several neuron labeling approaches tend to leave some neurons unlabeled. The interaction between unlabeled neurons and SOM model accuracy affect the choice of labeling algorithm for SOM-based EDA and DM, but has not been previously investigated. This paper applies the widely used example-centric neuron labeling algorithm to several classification problems, and empirically investigates the relationship between the percentage of neurons left unlabeled and classification accuracy. Practical recommendations are also presented, which address the treatment of unlabeled neurons and the selection of an appropriate neuron labeling algorithm.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133455668","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Particle swarm optimizer: The impact of unstable particles on performance","authors":"C. Cleghorn, A. Engelbrecht","doi":"10.1109/SSCI.2016.7850265","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7850265","url":null,"abstract":"There exists a wealth of theoretical analysis on particle swarm optimization (PSO), specifically the conditions needed for stable particle behavior are well studied. This paper investigates the effect that the stability of the particle has on the PSO's actually ability to optimize. It is shown empirically that a majority of PSO parameters that are theoretically unstable perform worse than a trivial random search across 28 objective functions, and across various dimensionalities. It is also noted that there exists a number of parameter configurations just outside the stable-2 region which did not exhibit poor performance, implying that a minor violation of the conditions for order-2 stability is still acceptable in terms of overall performance of the PSO.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131869988","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Comparison of Multi-objective Evolutionary Algorithms for prototype selection in nearest neighbor classification","authors":"G. Acampora, G. Tortora, A. Vitiello","doi":"10.1109/SSCI.2016.7849936","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7849936","url":null,"abstract":"The nearest neighbor classifiers are popular supervised classifiers due to their ease of use and good performance. However, in spite of their success, they suffer from some defects such as high storage requirements, high computational complexity, and low noise tolerance. In order to address these drawbacks, prototype selection has been studied as a technique to reduce the size of training datasets without deprecating the classification accuracy. Due to the need of achieving a trade-off between accuracy and reduction, Multi-Objective Evolutionary Algorithms (MOEAs) are emerging as methods efficient in solving the prototype selection problem. The goal of this paper is to perform a systematic comparison among well-known MOEAs in order to study their effects in solving this problem. The comparison involves the study of MOEAs' performance in terms of the well-known measures such as hypervolume, Δ index and coverage of two sets. The empirical analysis of the experimental results is validated through a statistical multiple comparison procedure.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134389929","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A fuzzy logic approach for dynamic adaptation of parameters in galactic swarm optimization","authors":"Emer Bernal, O. Castillo, J. Soria","doi":"10.1109/SSCI.2016.7850266","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7850266","url":null,"abstract":"In this article we propose the use of fuzzy systems for dynamic adjustment of parameters in the galactic swarm optimization (GSO) method. This algorithm is inspired by the movement of stars, galaxies and superclusters of galaxies under the force of gravity. GSO uses various cycles of exploration and exploitation phases to achieve a trade-off between the exploration of new solutions and exploitation of existing solutions. In this paper we proposed distinct fuzzy systems for the dynamic adaptation of the c3 and c4 parameters to measure the performance of the algorithm with 17 benchmark functions with different number of dimensions. In this paper a comparison was made between different variants to prove the efficacy of the method in optimization problems.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134547347","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Johannes Ponge, D. D. S. Braga, D. Horstkemper, B. Hellingrath, Stephan E. Ludwig, Fernando Buarque de Lima-Neto
{"title":"Automated scalable modeling for population microsimulations","authors":"Johannes Ponge, D. D. S. Braga, D. Horstkemper, B. Hellingrath, Stephan E. Ludwig, Fernando Buarque de Lima-Neto","doi":"10.1109/SSCI.2016.7850160","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7850160","url":null,"abstract":"The propagation of diseases within the population is an ever-reappearing hot topic in news stories. Mutations of known diseases repeatedly infected large portions of the population. In order to support the select appropriate mechanisms to help taming the spread of an epidemic, several simulation approaches have been developed to forecast the propagation behavior of diseases. Agent-based micro simulations promise to create the most detailed and accurate forecasts, but require a high modeling effort. In this paper we propose an approach to lessen this modeling effort by introducing a method that automatically creates agents for representing groups within the population based on multiple data sources (e.g. census data, vaccinations records, etc.). Our approach also facilitates combining these heterogeneous data with geographic information systems as well as dealing with incomplete data for enabling automatic and scalable creation of epidemics models for different simulation purposes in epidemiology. Two test cases were used to assess the proposition.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122431862","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Multi-objective optimization of base classifiers in StackingC by NSGA-II for intrusion detection","authors":"Michael Milliken, Y. Bi, L. Galway, G. Hawe","doi":"10.1109/SSCI.2016.7849977","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7849977","url":null,"abstract":"Multiple Classifier Systems are often found to improve results of intrusion detection by combining a set of classifier decisions where single classifiers may not achieve the same level of detection. However not every set of classifiers is more able, therefore selection of more capable sets is required. A misclassification is a false positive or negative instance; a set of classifiers may produce one more than the other. An optimal set of classifiers is required to reduce both, thus treating them as individual objectives allows a balance to be found. The aim of this work is the selection of optimal sets of base level classifies using an evolutionary computation approach. A comparative analysis is made of the performance of the generated ensembles against the individual base level classifiers, it is shown that optimal ensembles can be found to perform better than a majority of individuals.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"71 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122608516","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Bayesian model for anomaly detection in SQL databases for security systems","authors":"Mădălina M. Drugan","doi":"10.1109/SSCI.2016.7849905","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7849905","url":null,"abstract":"We focus on automatic anomaly detection in SQL databases for security systems. Many logs of database systems, here the Townhall database, contain detailed information about users, like the SQL queries and the response of the database. A database is a list of log instances, where each log instance is a Cartesian product of feature values with an attached anomaly score. All log instances with the anomaly score in the top percentile are identified as anomalous. Our contribution is multi-folded. We define a model for anomaly detection of SQL databases that learns the structure of Bayesian networks from data. Our method for automatic feature extraction generates the maximal spanning tree to detect the strongest similarities between features. Novel anomaly scores based on the joint probability distribution of the database features and the log-likelihood of the maximal spanning tree detect both point and contextual anomalies. Multiple anomaly scores are combined within a robust anomaly analysis algorithm. We validate our method on the Townhall database showing the performance of our anomaly detection algorithm.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121050168","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Hybridising Ant Colony Optimisation with a upper confidence bound algorithm for routing and wavelength assignment in an optical burst switching network","authors":"Andrew S. Gravett, M. D. Plessis, T. Gibbon","doi":"10.1109/SSCI.2016.7849900","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7849900","url":null,"abstract":"Ant Colony Optimisation (ACO) has been extensively applied to the network routing problem. Simulated ants are used to explore the network while recording information regarding their success by means of pheromones that are deposited on the route. A balance must be found between exploration of new routes and exploitation of established routes. Modern Monte Carlo game play algorithms, like Upper Confidence Bound applied to Trees (UCT), also have to decide which game branches to explore and which solutions should be exploited. The Upper Confidence Bound 1 (UCB1) formula is used to choose move branches, thus creating a balance between exploration and exploitation. This paper investigates the use of the UCB1 formula in an ACO algorithm to determine which routes should be selected. UCB1 was incorporated into an ACO algorithm that allocates a path (from source to destination) and an appropriate wavelength to packets to be routed in a network, which employs Optical Burst Switching (OBS). The new algorithm was evaluated against an existing ant-based algorithm on three network topologies in order to determine its effectiveness. Results obtained indicated that the proposed algorithm outperformed the existing algorithm in most scenarios.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128986854","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"From quantum cognition to quantum agents: An agent model integrating the superposition state property","authors":"A. Fougères","doi":"10.1109/SSCI.2016.7850161","DOIUrl":"https://doi.org/10.1109/SSCI.2016.7850161","url":null,"abstract":"To model intelligent complex systems engineers use the techniques of distributed artificial intelligence and the agent paradigm increasingly However, the problem of decision making by components of a complex system with local, incomplete, uncertain, exchanged or observed in asynchronous manner is often present in agent models. To provide a solution to this problem, studies on quantum cognition introduce quantum properties such as superposition state and entanglement in the decision process. So how to propose quantum agents models that are capable of implementing both quantum properties of superposition state and entanglement? A case study simulating the Takuzu game illustrates our proposed quantum agent model.","PeriodicalId":120288,"journal":{"name":"2016 IEEE Symposium Series on Computational Intelligence (SSCI)","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128542954","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}