Training genetic programming on half a million patterns: An example from anomaly detection

IEEE Transactions on Evolutionary Computation

Volumn 9, Issue 3, 2005, Pages 225-239

  Song, Dong ^a   Heywood, Malcolm I ^b   Zincir Heywood, A Nur ^b  

^a Quest Software Inc   (Canada)

^b DALHOUSIE UNIVERSITY   (Canada)

Author keywords

Dynamic subset selection (DSS); Genetic programming (GP); Hierarchical cost function; Intrusion detection; Large data sets

Indexed keywords

ALGORITHMS; DATA MINING; DATA STRUCTURES; NETWORK PROTOCOLS; PROBABILITY;

DYNAMICAL SUBSET SELECTION (DSS); GENETIC PROGRAMMING (GP); HIERARCHICAL COST FUNCTION; INTRUSION DETECTION; LARGE DATA SETS;

GENETIC ALGORITHMS;

EID: 21044433766     PISSN: 1089778X     EISSN: None     Source Type: Journal    
DOI: 10.1109/TEVC.2004.841683     Document Type: Article

References (32)

1. R. P. Lippmann, D. J. Fried, I. Graf, J. W. Haines, K. R. Kendall, D. McClung, D. Weber, S. E. Webster, D. Wyschogrod, R. K. Cunningham, and M. A. Zissman, "Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation," in Proc. DARPA Inf. Survivability Confer. Exposition (DISCEX), vol. 2, 2000, pp. 12-26.
2. J. McHugh, "Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory," ACM Trans. Inf. Syst. Security, vol. 3, no. 4, pp. 262-294, 2000.
3. C. Elkan, "Results of the KDD'99 classifier learning contest," SIGKDD Explorations. ACM SIGKDD, vol. 1, no. 2, pp. 63-64, 2000.
4. L. Wenke, S. J. Stolfo, and K. W. Mok, "A data mining framework for building intrusion detection models," in Proc. IEEE Symp. Security Privacy, 1999, pp. 120-132.
5. B. Pfahringer, "Winning the KDD99 classification cup: Bagged boosting," SIGKDD Explorations, vol. 1, no. 2, pp. 65-66, 2000.
6. I. Levin, "KDD-99 classifier learning contest LLSoft's results overview," SIGKDD Explorations, vol. 1, no. 2, pp. 67-75, 2000.
7. M. Vladimir, V. Alexei, and S. Ivan, "The MP13 approach to the KDD'99 classifier learning contest," SIGKDD Explorations, vol. 1, no. 2, pp. 76-77, 2000.
8. T. Bass, "Intrusion detection systems and multisensor data fusion," Commun. ACM, vol. 43, no. 4, pp. 99-105, April 2000.
9. F. H. Bennett III, J. R. Koza, J. Shipman, and O. Stiffelman, "Building a parallel computer system for $18000 that performs a half pets-flop per day," in Proc. Genetic Evol. Comput. Conf., 1999, pp. 1484-1490.
10. H. Juillé and J. B. Pollack, "Massively parallel genetic programming," in Advances in Genetic Programming: Volume 2, P. J. Angeline and K. E. Kinnear, Eds. Cambridge, MA: MIT Press, 1996, ch. 17, pp. 339-358.
11. J. R. Koza, F. H. Bennett, B. J. L. Bennett, S. L. Bade, M. A. Keane, and D. Andre, "Evolving computer programs using rapidly reconfigurable field programmable gate arrays and genetic programming," in Proc. ACM 6th Int. Symp. Field Program. Gate Arrays, 1998, pp. 209-219.
12. P. Nordin, "A compiling genetic programming system that directly manipulates the machine code," in Advances in Genetic Programming, K. E. Kinnear, Ed. Cambridge, MA: MIT Press, 1994, ch. 14, pp. 311-334.
13. C. Gathercole and P. Ross, "Dynamic training subset selection for supervised learning in genetic programming," in Lecture Notes in Computer Science. New York: Springer-Verlag, 1994, vol. 866, Parallel Problem Solving From Nature III, pp. 312-321.
14. J. L. Hennessy and D. A. Patterson, Computer Architecture: A Quantitative Approach, 3rd ed. San Mateo, CA: Morgan Kaufmann, 2003. ISBN 1-55860-596-7.
15. D. Song, M. I. Heywood, and A. N. Zincir-Heywood, "A linear genetic programming approach to intrusion detection," in Lecture Notes in Computer Science, vol. 2724, Proc. Genetic Evol. Comput. Conf., E. Cantú-Paz et al., Eds., 2003, pp. 2325-2336.
16. W. Lee and S. J. Stolfo, "A framework for constructing features and models for intrusion detection systems," ACM Trans. Inf. Syst. Security, vol. 3, no. 4, pp. 227-261, Nov. 2000.
17. P. Lichodzijewski, A. N. Zincir-Heywood, and M. I. Heywood, "Host-based intrusion detection using self-organizing maps," in Proc. IEEE Int. Joint Conf. Neural Netw., 2002, pp. 1714-1719.
18. L. Huelsbergen, "Finding general solutions to the parity problem by evolving machine-language representations," in Proc. 3rd Conf. Genetic Programm., 1998, pp. 158-166.
19. S. Luke and L. Panait, "Lexicographic parsimony pressure," in Proc. Genetic Evol. Comput. Conf., W. B. Langdon et al., Eds., 2002, pp. 829-836.
20. R. M. Friedberg, "A learning machine: Part I, " IBM J. Res. Develop., vol. 2, no. 1, pp. 2-13, 1958.
21. N. L. Cramer, "A representation for the adaptive generation of simple sequential programs," in Proc. Int. Conf. Genetic Algorithms and Their Applicat., 1985, pp. 183-187.
22. M. I. Heywood and A. N. Zincir-Heywood, "Dynamic page-based linear genetic programming," IEEE Trans. Syst., Man, Cybern. B. Cybern., vol. 32, no. 3, pp. 380-388, 2002.
23. L. Brieman, "The heuristics of instability in model selection," Annu. Statistics, vol. 24, pp. 2350-2383, 1996.
24. Y. Freund and R. E. Schapire, "A decision-theoretic generalization of on-line learning and an application to boosting," J. Comput. Syst. Sci., vol. 55, pp. 119-139, 1997.
25. H. Iba, "Bagging, boosting and bloating in genetic programming," in Proc. Genetic Evol. Comput. Conf., W. Banzhaf et al., Eds., 1999, pp. 1053-1060.
26. G. Paris, D. Robilliard, and C. Ronlupt, "Applying boosting techniques to genetic programming," in Lecture Notes in Computer Science, vol. 2310, Proc. 5th Int. Conf. Artif. Evol., P. Collet et al., Eds., 2001, pp. 267-278.
27. J. Eggermont, A. E. Eiben, and J. I. van Hemert, "Adapting the fitness function in GP for data mining," in Lecture Notes in Computer Science, vol. 1598, Proc. Eur. Workshop on Genetic Program., R. Poli, P. Nordin, and W. B. Langdon, Eds., 1999, pp. 193-202.
28. W. D. Hillis, "Coevolving parasites improve simulation evolution as an optimization procedure," Physica D, vol. 42, pp. 228-234, 1990.
29. J. Cartlidge and S. Bullock, "Learning lessons from the common cold: How reducing parasite virulence improves coevolutionary optimization," in Proc. IEEE Congr. Evol. Comput. World Congr. Comput. Intell., vol. 2, 2002, pp. 1420-1425.
30. J. B. D. Caberera, B. Ravichandran, and R. K. Mehra, "Statistical traffic modeling for network intrusion detection," in Proc. 8th Int. Symp. Modeling, Anal., Simulation Comput., Telecommun. Syst., 2000, pp. 466-473.
31. K. Kendall, "A database of computer attacks for the evaluation of intrusion detection systems," M.S. thesis, Massachusetts Inst. Technol., Cambridge, MA, 1998.
32. Cisco IOS Firewall Intrusion Detection System Documentation (2004, Oct.). [Online]. Available: http://www.cisco.com/univered/cc/td/doc/ product/software/ios120/120newft/120t/120t5/iosfw2/ios_ids.htm