Search

This paper is devoted to the problem of class imbalance in machine learning, focusing on the intrusion detection of rare classes in computer networks. The problem of class imbalance occurs when one class heavily outnumbers examples from the other classes. In this paper, we are particularly interested in classifiers, as pattern recognition and anomaly detection could be solved as a classification problem. As still a major part of data network traffic of any organization network is benign, and malignant traffic is rare, researchers therefore have to deal with a class imbalance problem. Substantial research has been undertaken in order to identify these methods or data features that allow to accurately identify these attacks. But the usual tactic to deal with the imbalance class problem is to label all malignant traffic as one class and then solve the binary classification problem. In this paper, however, we choose not to group or to drop rare classes but instead investigate what could be done in order to achieve good multi-class classification efficiency. Rare class records were up-sampled using SMOTE method (Chawla et al., 2002) to a preset ratio targets. Experiments with the 3 network traffic datasets, namely CIC-IDS2017, CSE-CIC-IDS2018 (Sharafaldin et al., 2018) and LITNET-2020 (Damasevicius et al., 2020) were performed aiming to achieve reliable recognition of rare malignant classes available in these datasets. Popular machine learning algorithms were chosen for comparison of their readiness to support rare class detection. Related algorithm hyper parameters were tuned within a wide range of values, different data feature selection methods were used and tests were executed with and without over-sampling to test the multiple class problem classification performance of rare classes. Machine learning algorithms ranking based on Precision, Balanced Accuracy Score, G ¯ , and prediction error Bias and Variance decomposition, show that decision tree ensembles (Adaboost, Random Forest Trees and Gradient Boosting Classifier) performed best on the network intrusion datasets used in this research. [ABSTRACT FROM AUTHOR]

Compared with the traditional negative selection algorithms produce detectors randomly in whole state space, the boundary-fixed negative selection algorithm (FB-NSA) non-randomly produces a layer of detectors closely surrounding the self space. However, the false alarm rate of FB-NSA is higher than many anomaly detection methods. Its detection rate is very low when normal data close to the boundary of state space. This paper proposed an improved FB-NSA (IFB-NSA) to solve these problems. IFB-NSA enlarges the state space and adds auxiliary detectors in appropriate places to improve the detection rate, and uses variable-sized training samples to reduce the false alarm rate. We present experiments on synthetic datasets and the UCI Iris dataset to demonstrate the effectiveness of this approach. The results show that IFB-NSA outperforms FB-NSA and the other anomaly detection methods in most of the cases. [ABSTRACT FROM AUTHOR]

Multigranulation rough set (MGRS) theory provides an effective manner for the problem solving by making use of multiple equivalence relations. As the information systems always dynamically change over time due to the addition or deletion of multiple objects, how to efficiently update the approximations in multigranulation spaces by making fully utilize the previous results becomes a crucial challenge. Incremental learning provides an efficient manner because of the incorporation of both the current information and previously obtained knowledge. In spite of the success of incremental learning, well-studied findings performed to update approximations in multigranulation spaces have relatively been scarce. To address this issue, in this paper, we propose matrix-based incremental approaches for updating approximations from the perspective of multigranulation when multiple objects vary over time. Based on the matrix characterization of multigranulation approximations, the incremental mechanisms for relevant matrices are systematically investigated while adding or deleting multiple objects. Subsequently, in accordance with the incremental mechanisms, the corresponding incremental algorithms for maintaining multigranulation approximations are developed to reduce the redundant computations. Finally, extensive experiments on eight datasets available from the University of California at Irvine (UCI) are conducted to verify the effectiveness and efficiency of the proposed incremental algorithms in comparison with the existing non-incremental algorithm. [ABSTRACT FROM AUTHOR]

Multi-objective particle swarm optimization (MOPSO) algorithms are shown to have enormous potential in solving multi-objective optimization problems (MOPs). However, most MOPSO is difficult to balance the exploration and exploitation, which may cause some problems to find true Pareto fronts when tackling some complex MOPs. A multi-objective decomposition particle swarm optimization based on completion-checking (C-DMOPSO) is improved in this paper. The updating mode of velocity is changed dynamically according to the algorithm's evolutionary process, which balances the exploration and exploitation effectively. In addition, simulated binary crossover and opposition-based learning are adopted to improve the diversity, and the archive set strategy is added to store the optimal solutions. Furthermore, polynomial mutation is performed in archive. The effectiveness of the proposed algorithm is tested by nineteen standard functions, including ZDT, DTLZ and UF, and the experimental results show that C-DMOPSO performs better on most of test problems. [ABSTRACT FROM AUTHOR]

In the microblog network, users' forwarding behavior is widespread and the propagation range is difficult to predict quantitatively. To solve this problem, machine learning algorithms are used to quantitatively predict propagation breadth and depth of microblog users' forwarding behavior. The dataset is preprocessed, and the extracted features are divided into three types: user features, microblog features and social features. Then the dataset is analyzed in detail; machine learning algorithms are used to predict the propagation breadth and depth of users' forwarding behavior; and the influence of the three types of features on prediction precision is studied. The experimental results show that the prediction precision of the improved random forest algorithm has less fluctuations, and it is not sensitive to the changes of various features. The improved random forest algorithm has higher precision and better generalization ability than the other algorithms, which shows that the prediction results have high reference value. Social features have the greatest influence on the prediction precision for each prediction algorithm. User features have the similar influence as microblog features on the prediction precision. [ABSTRACT FROM AUTHOR]

In recent years, electricity stealing has been repeatedly prohibited, and as the methods of stealing electricity have become more intelligent and concealed, it is growing increasingly difficult to extract high-dimensional data features of power consumption. In order to solve this problem, a correlation model of power-consumption data based on convolutional neural networks (CNN) is established. First, the original user signal is preprocessed to remove the noise. The user signal with a fixed signal length is then intercepted and the parallel class labelled. The segmented user signals and corresponding labels are input into the convolutional neural network for training, and the trained convolutional neural network is then used to detect and classify the test user signals. Finally, the actual steal leak dataset is used to verify the effectiveness of this algorithm, which proves that the algorithm can effectively carry out anti–-electricity stealing by warning of abnormal power consumption behavior. There are lots of line traces on the surface of the broken ends which left in the cable cutting case crime scene along the high-speed railway in China. The line traces usually present nonlinear morphological features and has strong randomness. It is not very effective when using existing image-processing and three-dimensional scanning methods to do the trace comparison, therefore, a fast algorithm based on wavelet domain feature aiming at the nonlinear line traces is put forward to make fast trace analysis and infer the criminal tools. The proposed algorithm first applies wavelet decomposition to the 1-D signals which picked up by single point laser displacement sensor to partially reduce noises. After that, the dynamic time warping is employed to do trace feature similarity matching. Finally, using linear regression machine learning algorithm based on gradient descent method to do constant iteration. The experiment results of cutting line traces sample data comparison demonstrate the accuracy and reliability of the proposed algorithm. [ABSTRACT FROM AUTHOR]