Search

This paper is devoted to the problem of class imbalance in machine learning, focusing on the intrusion detection of rare classes in computer networks. The problem of class imbalance occurs when one class heavily outnumbers examples from the other classes. In this paper, we are particularly interested in classifiers, as pattern recognition and anomaly detection could be solved as a classification problem. As still a major part of data network traffic of any organization network is benign, and malignant traffic is rare, researchers therefore have to deal with a class imbalance problem. Substantial research has been undertaken in order to identify these methods or data features that allow to accurately identify these attacks. But the usual tactic to deal with the imbalance class problem is to label all malignant traffic as one class and then solve the binary classification problem. In this paper, however, we choose not to group or to drop rare classes but instead investigate what could be done in order to achieve good multi-class classification efficiency. Rare class records were up-sampled using SMOTE method (Chawla et al., 2002) to a preset ratio targets. Experiments with the 3 network traffic datasets, namely CIC-IDS2017, CSE-CIC-IDS2018 (Sharafaldin et al., 2018) and LITNET-2020 (Damasevicius et al., 2020) were performed aiming to achieve reliable recognition of rare malignant classes available in these datasets. Popular machine learning algorithms were chosen for comparison of their readiness to support rare class detection. Related algorithm hyper parameters were tuned within a wide range of values, different data feature selection methods were used and tests were executed with and without over-sampling to test the multiple class problem classification performance of rare classes. Machine learning algorithms ranking based on Precision, Balanced Accuracy Score, G ¯ , and prediction error Bias and Variance decomposition, show that decision tree ensembles (Adaboost, Random Forest Trees and Gradient Boosting Classifier) performed best on the network intrusion datasets used in this research. [ABSTRACT FROM AUTHOR]

Compared with the traditional negative selection algorithms produce detectors randomly in whole state space, the boundary-fixed negative selection algorithm (FB-NSA) non-randomly produces a layer of detectors closely surrounding the self space. However, the false alarm rate of FB-NSA is higher than many anomaly detection methods. Its detection rate is very low when normal data close to the boundary of state space. This paper proposed an improved FB-NSA (IFB-NSA) to solve these problems. IFB-NSA enlarges the state space and adds auxiliary detectors in appropriate places to improve the detection rate, and uses variable-sized training samples to reduce the false alarm rate. We present experiments on synthetic datasets and the UCI Iris dataset to demonstrate the effectiveness of this approach. The results show that IFB-NSA outperforms FB-NSA and the other anomaly detection methods in most of the cases. [ABSTRACT FROM AUTHOR]

Multigranulation rough set (MGRS) theory provides an effective manner for the problem solving by making use of multiple equivalence relations. As the information systems always dynamically change over time due to the addition or deletion of multiple objects, how to efficiently update the approximations in multigranulation spaces by making fully utilize the previous results becomes a crucial challenge. Incremental learning provides an efficient manner because of the incorporation of both the current information and previously obtained knowledge. In spite of the success of incremental learning, well-studied findings performed to update approximations in multigranulation spaces have relatively been scarce. To address this issue, in this paper, we propose matrix-based incremental approaches for updating approximations from the perspective of multigranulation when multiple objects vary over time. Based on the matrix characterization of multigranulation approximations, the incremental mechanisms for relevant matrices are systematically investigated while adding or deleting multiple objects. Subsequently, in accordance with the incremental mechanisms, the corresponding incremental algorithms for maintaining multigranulation approximations are developed to reduce the redundant computations. Finally, extensive experiments on eight datasets available from the University of California at Irvine (UCI) are conducted to verify the effectiveness and efficiency of the proposed incremental algorithms in comparison with the existing non-incremental algorithm. [ABSTRACT FROM AUTHOR]

Multi-objective particle swarm optimization (MOPSO) algorithms are shown to have enormous potential in solving multi-objective optimization problems (MOPs). However, most MOPSO is difficult to balance the exploration and exploitation, which may cause some problems to find true Pareto fronts when tackling some complex MOPs. A multi-objective decomposition particle swarm optimization based on completion-checking (C-DMOPSO) is improved in this paper. The updating mode of velocity is changed dynamically according to the algorithm's evolutionary process, which balances the exploration and exploitation effectively. In addition, simulated binary crossover and opposition-based learning are adopted to improve the diversity, and the archive set strategy is added to store the optimal solutions. Furthermore, polynomial mutation is performed in archive. The effectiveness of the proposed algorithm is tested by nineteen standard functions, including ZDT, DTLZ and UF, and the experimental results show that C-DMOPSO performs better on most of test problems. [ABSTRACT FROM AUTHOR]