Data Mining - Concepts and Techniques.

Data Mining Practical Machine Learning Tools and Techniques

Swarm intelligence is a research branch that models the population of interacting agents or swarms that are able to self-organize. An ant colony, a flock of birds or an immune system is a typical example of a swarm system. Bees' swarming around their hive is another example of swarm intelligence. Artificial Bee Colony (ABC) Algorithm is an optimization algorithm based on the intelligent behaviour of honey bee swarm. In this work, ABC algorithm is used for optimizing multivariable functions and the results produced by ABC, Genetic Algorithm (GA), Particle Swarm Algorithm (PSO) and Particle Swarm Inspired Evolutionary Algorithm (PS-EA) have been compared. The results showed that ABC outperforms the other algorithms.

/pdf/a-powerful-and-efficient-algorithm-for-numerical-function-594pvbjq1k.pdf

A powerful and efficient algorithm for numerical function optimization: artificial bee colony (ABC) algorithm

Artificial bee colony (ABC) algorithm is an optimization algorithm based on a particular intelligent behaviour of honeybee swarms. This work compares the performance of ABC algorithm with that of differential evolution (DE), particle swarm optimization (PSO) and evolutionary algorithm (EA) for multi-dimensional numeric problems. The simulation results show that the performance of ABC algorithm is comparable to those of the mentioned algorithms and can be efficiently employed to solve engineering problems with high dimensionality.

/pdf/on-the-performance-of-artificial-bee-colony-abc-algorithm-5234goeamq.pdf

On the performance of artificial bee colony (ABC) algorithm

A comparative study of Artificial Bee Colony algorithm

Artificial Immune Systems (AIS) offer a relatively novel and promising paradigm to solve the problem of security in Mobile Adhoc Networks (MANETs). In this paper we address the issue of security in the challenging MANET environment by developing an AIS based security framework to detect misbehavior in a Bio/Nature inspired MANET routing protocol, BeeAdHoc. To the best of our knowledge, this is the first attempt to provide AIS based protection in the Bio/Nature inspired domain ofMANET routing. We designed and developed a security framework, BeeAIS, in the network simulator ns-2. We simulated a number of routing attacks to verify that the AIS based security system can counter all of them. These attacks, however, were successful in a MANET running the original BeeAdHoc protocol. We also compared our AIS based system with a cryptographic security system, BeeSec, developed earlier for BeeAdHoc. The results of our extensive experiments clearly indicate the effectiveness of the AIS to provide a similar security level as that of the cryptographic solution, but at significantly lower energy and communication cost. The efficient utilization of constrained bandwidth and battery is a key requirement in MANET routing.

BeeAIS: artificial immune system security for nature inspired, MANET routing protocol, BeeADHoc

The sophistication of computer malware is becoming a serious threat to the information technology infrastructure, which is the backbone of modern e-commerce systems. We, therefore, advocate the need for developing sophisticated, efficient, and accurate malware classification techniques that can detect a malware on the first day of its launch -- commonly known as "zero-day malware detection". To this end, we present a new technique, IMAD, that can not only identify zero-day malware without any apriori knowledge but can also detect a malicious process while it is executing (in-execution detection). The capability of in-execution malware detection empowers an operating system to immediately kill it before it can cause any significant damage. IMAD is a realtime, dynamic, efficient, in-execution zero-day malware detection scheme, which analyzes the system call sequence of a process to classify it as malicious or benign. We use Genetic Algorithm to optimize system parameters of our scheme. The evolutionary algorithm is evaluated on real world synthetic data extracted from a Linux system. The results of our experiments show that IMAD achieves more than 90% accuracy in classifying in-execution processes as benign or malicious. Moreover, our scheme can classify approximately 50% of malicious processes within first 20% of their system calls.

/pdf/imad-in-execution-malware-analysis-and-detection-17pkt1v1br.pdf

IMAD: in-execution malware analysis and detection

Ownership protection on relational databases--shared with collaborators (or intended recipients)-demands developing a watermarking scheme that must be able to meet four challenges: 1) it should be robust against different types of attacks that an intruder could launch to corrupt the embedded watermark; 2) it should be able to preserve the knowledge in the databases to make them an effective component of knowledge-aware decision support systems; 3) it should try to strike a balance between the conflicting requirements of database owners, who require soft usability constraints, and database recipients who want tight usability constraints that ensure minimum distortions in the data; and 4) last but not least, it should not require that a database owner defines usability constraints for each type of application and every recipient separately. The major contribution of this paper is a robust and efficient watermarking scheme for relational databases that is able to meet all above-mentioned four challenges. The results of our experiments prove that the proposed scheme achieves 100 percent decoding accuracy even if only one watermarked row is left in the database.

http://ww3.comsats.edu.pk/Faculty/Users/CS/sabah_suhail/TKDEP2.pdf

A Robust, Distortion Minimizing Technique for Watermarking Relational Databases Using Once-for-All Usability Constraints

The number of executable malware and the sophistication of their destructive ability has exponentially increased in past couple of years. Malware writers use sophisticated code obfuscation and encryption (a.k.a. packing) techniques to circumvent signatures ‐ derived from the code of the malware for detection ‐ stored in the signatures’ database of commercial off-the-shelf anti-virus software. In fact, it is claimed that more than half of new malware are created by simply re-packing the existing malware. Malware packing can undoubtedly be considered as the most challenging problem faced by anti-virus vendors nowadays. In this paper we present a novel scheme ‐ PE-Probe ‐ which has the ability to detect packed files and uses structural information of portable executables to detect zero-day (i.e. previously unseen) malicious executables. As a result, our proposed scheme is fully robust to code obfuscation and packing techniques. PE-Probe functions in two phases: (1) it classifies a given executable as packed or non-packed by employing well-studied heuristics, and (2) it invokes specialized structural models ‐ separately developed for packed and non-packed executables ‐ for malware detection on the basis of the outcome of the previous step. PE-Probe is real-time deployable as its scanning time is, on the average, less than quarter of a second per executable. We have carefully designed experiments ‐ keeping in view the stringent testing scenarios ‐ to analyze the reliability and robustness of our scheme to packing and obfuscation techniques. We report our experiments on a recently obtained malware dataset from OffensiveComputing.net, which contains more than half a million malicious executables.

/pdf/pe-probe-leveraging-packer-detection-and-structural-2ml8ypl4dt.pdf

PE-Probe: Leveraging Packer Detection and Structural Information to Detect Malicious Portable Executables

The concept of artificial evolution has been applied to numerous real world applications in different domains. In this paper, we use this concept in the domain of virology to evolve computer viruses. We call this domain as "Evolvable Malware". To this end, we propose an evolutionary framework that consists of three modules: (1) a code analyzer that generates a high-level genotype representation of a virus from its machine code, (2) a genetic algorithm that uses the standard selection, cross-over and mutation operators to evolve viruses, and (3) the code generator converts the genotype of a newly evolved virus to its machinelevel code. In this paper, we validate the notion of evolution in viruses on a well-known virus family, called Bagle. The results of our proof-of-concept study show that we have successfully evolved new viruses-previously unknown and known-variants of Bagle-starting from a random population of individuals. To the best of our knowledge, this is the first empirical work on evolution of computer viruses. In future, we want to improve this proof-of-concept framework into a full-blown virus evolution engine.

Muddassar Farooq

Papers

BeeAIS: artificial immune system security for nature inspired, MANET routing protocol, BeeADHoc

IMAD: in-execution malware analysis and detection

A Robust, Distortion Minimizing Technique for Watermarking Relational Databases Using Once-for-All Usability Constraints

PE-Probe: Leveraging Packer Detection and Structural Information to Detect Malicious Portable Executables

Evolvable malware