With exponential growth in the size of computer networks and developed applications, the significant increasing of the potential damage that can be caused by launching attacks is becoming obvious. Meanwhile, Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs) are one of the most important defense tools against the sophisticated and ever-growing network attacks. Due to the lack of adequate dataset, anomaly-based approaches in intrusion detection systems are suffering from accurate deployment, analysis and evaluation. There exist a number of such datasets such as DARPA98, KDD99, ISC2012, and ADFA13 that have been used by the researchers to evaluate the performance of their proposed intrusion detection and intrusion prevention approaches. Based on our study over eleven available datasets since 1998, many such datasets are out of date and unreliable to use. Some of these datasets suffer from lack of traffic diversity and volumes, some of them do not cover the variety of attacks, while others anonymized packet information and payload which cannot reflect the current trends, or they lack feature set and metadata. This paper produces a reliable dataset that contains benign and seven common attack network flows, which meets real world criteria and is publicly avaliable. Consequently, the paper evaluates the performance of a comprehensive set of network traffic features and machine learning algorithms to indicate the best set of features for detecting the certain attack categories.

Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization

Genetic programming (GP) is a systematic, domain-independent method for getting computers to solve problems automatically starting from a high-level statement of what needs to be done. Using ideas from natural evolution, GP starts from an ooze of random computer programs, and progressively refines them through processes of mutation and sexual recombination, until high-fitness solutions emerge. All this without the user having to know or specify the form or structure of solutions in advance. GP has generated a plethora of human-competitive results and applications, including novel scientific discoveries and patentable inventions. This unique overview of this exciting technique is written by three of the most active scientists in GP. See www.gp-field-guide.org.uk for more information on the book.

/pdf/a-field-guide-to-genetic-programming-3wkkmsw81n.pdf

A Field Guide to Genetic Programming

C4.5: Programs for Machine Learning (書評)

Handbook of logic in computer science.

This paper surveys knowledge management (KM) development using a literature review and classification of articles from 1995 to 2002 with keyword index in order to explore how KM technologies and applications have developed in this period. Based on the scope of 234 articles of knowledge management applications, this paper surveys and classifies KM technologies using the seven categories as: KM framework, knowledge-based systems, data mining, information and communication technology, artificial intelligence/expert systems, database technology, and modeling, together with their applications for different research and problem domains. Some discussion is presented, indicating future development for knowledge management technologies and applications as the followings: (1) KM technologies tend to develop towards expert orientation, and KM applications development is a problem-oriented domain. (2) Different social studies methodologies, such as statistical method, are suggested to implement in KM as another kind of technology. (3) Integration of qualitative and quantitative methods, and integration of KM technologies studies may broaden our horizon on this subject. (4) The ability to continually change and obtain new understanding is the power of KM technologies and will be the application of future works.

https://blog.ub.ac.id/izuaf/files/2013/11/KM-Technologies-and-Applications-Expert-Systems-with-Applications-25-2003-17-07-2007.pdf

Knowledge management technologies and applications—literature review from 1995 to 2002

In this article, we discuss the need to evaluate the performance of data mining procedures and argue that tests done with real data sets cannot provide all the information needed for a thorough assessment of their performance characteristics. We argue that artificial data sets are therefore essential. After a discussion of the desirable characteristics of such artificial data, we describe two pseudo-random generators. The first is based on the multi-variate normal distribution and gives the investigator full control of the degree of correlation between the variables in the artificial data sets. The second is inspired by fractal techniques for synthesizing artificial landscapes and can produce data whose classification complexity can be controlled by a single parameter. We conclude with a discussion of the additional work necessary to achieve the ultimate goal of a method of matching data sets to the most appropriate data mining technique.

Evaluating data mining procedures: techniques for generating artificial data sets

The efficient mining of large, commercially credible, databases requires a solution to at least two problems: (a) better integration between existing Knowledge Discovery algorithms and popular DBMS; (b) ability to exploit opportunities for computational speedup such as data parallelism. Both problems need to be addressed in a generic manner, since the stated requirements of end-users cover a range of data mining paradigms, DBMS, and (parallel) platforms. In this paper we present a family of generic, set-based, primitive operations for Knowledge Discovery in Databases (KDD). We show how a number of well-known KDD classification metrics, drawn from paradigms such as Bayesian classifiers, Rule-Induction/Decision Tree algorithms, Instance-Based Learning methods, and Genetic Programming, can all be computed via our generic primitives. We then show how these primitives may be mapped into SQL and, where appropriate, optimised for good performance in respect of practical factors such as client–server communication overheads. We demonstrate how our primitives can support C4.5, a widely-used rule induction system. Performance evaluation figures are presented for commercially available parallel platforms, such as the IBM SP/2.

Interfacing knowledge discovery algorithms to large database management systems

This paper describes a formal framework for uncertain reasoning in the possible worlds semantic theory. It shows that the model theory of belief functions is simpler than the model theory of lower order monotonic capacities. We concentrate on finding a generalization of belief functions with the same simple model theory, which also admits a conjunction operator. We identify collections of belief functions that have a full propositional logic and present our generalization based on this result. We do not completely solve the problem of finding a conjunction operator. We describe a possible application of this research in data mining, namely the combination of evidence from multiple sources.

/pdf/belief-functions-and-the-possible-worlds-paradigm-3yxa0lifnv.pdf

Elwood Wilkins

Papers

Evaluating data mining procedures: techniques for generating artificial data sets

Interfacing knowledge discovery algorithms to large database management systems

Belief Functions and the Possible Worlds Paradigm