Using a Particle Swarm Optimization Approach for Evolutionary Fuzzy Rule Learning: A Case Study of Intrusion Detection

Transcription

1 Using a Particle Swarm Optimization pproach for Evolutionary Fuzzy Rule Learning: Case Study of Intrusion Detection Mohammad Saniee badeh saniee@ce.sharif.edu Jafar Habibi habibi@sharif.edu Department of Computer Engineering Sharif University of Technology zadi ve., Tehran, Iran Saman liari aliari@ce.sharif.edu bstract n evolutionary fuzzy rule-learning algorithm is proposed in this paper. This algorithm utilizes a Particle Swarm Optimization (PSO) approach to search the neighborhood of each indivual in the problem search space. The evolutionary algorithm is based on the Michigan approach, which means that each indivual in the population represents a fuzzy if-then rule. The proposed learning approach is performed on intrusion detection that is a complex classification problem. Results show that the final classification system is capable of detecting known intrusive behaviors in a computer network with an acceptable performance. Keywords: Evolutionary Computation, Fuzzy Rule Learning, Particle Swarm Optimization, Intrusion Detection. 1 Introduction With the growing number of intrusions into networked computers has grows and raises concerns about computer security. Intrusion Detection Systems are important security tools, placing inse a protected network and looking for known or potential threats in network traffic and/or audit data recorded by hosts. Basically, an IDS analyzes information about users behaviors from various sources such as audit trail, system table, and network usage data. The problem of intrusion detection has been studied extensively in computer security [1, 2], and has recently received a lot of attention in machine learning and data mining [3, 4]. The intrusion detection techniques can be dived into two groups according to the type of information they use: misuse detection and anomaly detection. Signature or misuse detection is based on patterns of known intrusions. In this case, the intrusion detection problem is a classification problem. This approach allows the detection of intrusions which the system has learned their signatures perfectly. To remedy the problem of detecting novel attacks, anomaly detection attempts to construct a model according to the statistical knowledge about the normal activity of the computer system. In this case, intrusions correspond to anomalous network activity, i.e., to traffic whose statistical profile deviates significantly from the normal. In this paper, we exploit a genetic fuzzy system to develop a novel IDS based on misuse detection. The goal of our algorithm is to find high quality fuzzy if-then rules to predict the class of input patterns correctly. Traditionally, fuzzy if-then rules were gained from human experts. Recently various methods have been suggested for automatically generating and adusting fuzzy if-then rules without using the a of human experts [5]. Genetic algorithms have been used as rule generation and optimization tools in the design of fuzzy rulebased systems. Those G-based studies on the design of fuzzy rule based systems are usually referred to as fuzzy genetics-based machine

2 learning methods. These methods are classified into Pittsburgh or Michigan approaches. [6, 7] The Pittsburgh approach [6] is similar to the traditional G where every indivual in the population is a set of rule, representing a complete solution to the learning problem. Crossover and mutation are then applied in the usual way to create new generations of such populations. The Michigan approach [7], however, has generally used a different partial solution to the overall learning task. Each indivual represents a single rule, and through cooperation with the other rules in the population, the overall problem is being solved. The proposed algorithm is a new model based on the Michigan approach. In this algorithm, the global population is dived into some subpopulations. The number of subpopulations is equal to the number of classes in the classification problem. For each subpopulation, all of the indivuals represent rules with the same class in the prediction part of the rule according to the fact that each indivual in the presented algorithm represents a rule which has the form if condition then prediction. We have empowered our algorithm using a heuristic local search procedure, which is based on Particle Swarm Optimization (PSO). This procedure aims to improve the quality of derived fuzzy rules by searching their neighborhoods according to some restrictions. Section 3 will discuss about the details of this procedure clearly. This paper is organized as follows: In section 2 we propose the structure of Michigan based genetic fuzzy rule learning algorithm. Section 3 presents the PSO-based heuristic local search procedure. The following section will discuss about the experimental results, which we have obtained. t the last section of the paper we derive some conclusions. 2 Evolutionary Fuzzy Rule Learning First, let us explain about the method of coding fuzzy rules, which is used in this paper. Each fuzzy if-then rule is coded as a string. The following symbols are used for denoting the five linguistic values (Figure 1): small ( 1 ), medium small ( 2 ), medium ( 3 ), medium large ( 4 ) and large ( 5 ). For example, the following fuzzy if-then rule is coded as ( 3, 2, 5, 1 ) : If x 1 is medium and x 2 is medium small and x 3 is large and x 4 is small then Class CF = CF. C with Figure 1: Membership functions of five linguistic values (S: small, MS: medium small, M: medium, ML: medium large, L: large). Outline of the proposed Michigan approach based IDS algorithm is as follows: Step 1: Generate an initial population of fuzzy if then rules. (Initialization) Step 2: Generate new fuzzy if then rules by genetic operations. (Generation) Step 3: Each indivual can live according to its age number. The procedure that accomplishes this lifetime is based on a PSO heuristic algorithm. (PSO-Based Local Search) Step 3: Replace a part of the current population with the newly generated rules. (Replacement) Step 4: Terminate the algorithm if a stopping condition is satisfied, otherwise return to Step 2. (Internal termination test) Step 5: Save the best indivuals of the resulted population. Terminate the whole algorithm if a maximum number of iterations is satisfied. Otherwise, go to step 1. Each step of this fuzzy classifier system is described as follows: 2.1 Initialization Let us denote the number of fuzzy if-then rules in the population by N pop. To produce an initial population, N pop fuzzy if-then rules are generated according to a random pattern in the train dataset [7]. The evolutionary fuzzy system (Figure 2) is consered for each of the classes of the

3 classification problem separately. One of the important benefits of this separation is that the learning system can focus on each of the classes of the classification problem. ccording to this fact, the mentioned random pattern is extracted according to the patterns of the training dataset, which their consequent class is the same as the class that the algorithm works on. Next, for this random pattern, we determine the most compatible combination of antecedent fuzzy sets using only the five linguistic values (Figure. 1). The compatibility of antecedent fuzzy rules with the random pattern is calculated by equation (1). µ R ( x p ) = µ ( x p1 )... µ p = 1,2,...,m ( x 1 n pn ), (1) where µ i (.) is the membership function of i. fter generating each fuzzy if-then rule, the consequent class of this rule is determined according to (2). β R ) = max{ β ( R ),..., β ( R )}. (2) ( Classhˆ Class1 where, β Class h h = 1,2,...,c Class c ( R ) = µ ( x p ) NClass h, xp Class h (3) where β Class h ( R ) is the sum of the compatibility grades of the training patterns in Class h with the fuzzy if then rule R and N Class h is the number of training patterns which their corresponding class is Class h. Each of the fuzzy rules in the final classification has a certainty grade, which denotes the strength of that fuzzy rule. This number is calculated according to (4). CF where, B = h = β ˆ ( R ) β Class h β ˆ h β Class h ( R ) c h= 1 ( c 1) Class h ( R ) (4) (5) When a rule set S is given, an input pattern x p = ( xp1, xp2,..., xpn) is classified by a single winner rule R in S, which is determined as follows: [7] { ( x ). CF R S} µ ˆ ( x ). CF = max µ. (6) p That is, the winner rule has the maximum product of the compatibility and the certainty grade CF. The classification is reected if no fuzzy if then rule is compatible with the input pattern x p (i.e., µ ( x p ) = 0 for R S). The generation of each fuzzy rule is accepted only if its consequent class is the same as its corresponding random pattern class. Otherwise, the generated fuzzy rule is reected and the rule generation process is repeated. fter generation of N pop fuzzy if-then rules, the fitness value of each rule is evaluated by classifying all the given training patterns using the set of fuzzy if then rules in the current population. The fitness value of the fuzzy if then rule is evaluated by the following fitness function: fitness R ) = NCP( R ) (7) ( where, NCP ( R ) denotes the number of correctly classified training patterns by rule R. 2.2 Generation pair of fuzzy if-then rules is selected from the current population to generate new fuzzy if-then rules for the next population. Each fuzzy if-then rule in the current population is selected by the tournament selection procedure. crossover operation is applied to a selected random pair of fuzzy if then rules with a prespecified crossover probability. Note that the selected indivuals for crossover operation should be different. In computer simulations of this paper, we used the one-point crossover. fter performing the crossover operation, consequent classes of the generated indivuals are determined. If these classes are the same as their parent classes then the generated indivuals are accepted, otherwise the crossover operation is repeated until a prespecified iteration number for each indivual p

4 that its consequent class is not the same as its parents. We call this number X. repeat With a pre-specified mutation probability, each antecedent fuzzy set of fuzzy if then rules is randomly replaced with a different antecedent fuzzy set after the crossover operation. fter performing the mutation operation, consequent class of the mutated indivual is determined. If the result class is the same as the class of the indivual before the mutation operation, the mutated indivual is accepted; otherwise, the mutation operation is repeated until a prespecified iteration number. We call this number M. repeat The above procedure is iterated until a prespecified number of pairs of fuzzy if-then rules are generated. 2.3 Local Search In order to improve the classification rate of the population, we conser a lifetime for each indivual of the current population. We simulate this lifetime using a local search algorithm, which is based on a Particle Swarm Optimization heuristic. Before describing the details of the PSO-based local search procedure, which will be done in section 3, it is essential to introduce the concept of age for each indivual. n indivual can search its neighborhood (or can live) according to its age. The age of each indivual depends on its fitness. In other words, fitter indivuals have greater age or opportunity to live. This rule is based on the concept of survival of the fittest as Darwin mentioned [6]. To accomplish this ea we determine the age of each indivual using equation (8). fitness( R ) ge( R ) = wage (8) N Class h where, wage denotes a weight which depends on the CPU speed of the computer that the algorithm runs on (The faster the CPU the lower the w age ). Note that the division in the equation is for normalizing the fitness of R. ccording to equation (13), each indivual can live and improves its quality (fitness) as much as its age number determines. The unit of age number is in milliseconds. 2.4 Replacement pre-specified number of fuzzy if then rules in the current population are replaced with the newly generated rules. In our fuzzy classifier system, P repr percent of the worst rules with the smallest fitness values are removed from the current population and (100 - P repr ) percent of the newly generated fuzzy if then rules are added. 2.5 Termination Tests We can use any stopping condition for terminating the internal cycle of the Michigan based fuzzy classification algorithm. In computer simulations of this paper, we used the total number of generations as a stopping condition. Fuzzy rules of the final population that their fitness is not zero are stored in the Fuzzy Rule Pool (FRP). This pool is updated until a prespecified number of iterations for the external cycle of the evolutionary PSO-Based algorithm. 3 PSO Heuristic for Local Search PSO was developed by Kennedy and Eberhart [8]. The PSO is inspired by the social behavior of a flock of migrating birds trying to reach an unknown destination. In PSO, each solution is a bird in the flock and is referred to as a particle. particle is analogous to a chromosome (population member) in Gs. s opposed to Gs, the evolutionary process in the PSO does not create new birds from parent ones. Rather, the birds in the population only evolve their social behavior and accordingly their movement towards a destination. Physically, this mimics a flock of birds that communicate together as they fly. Each bird looks in a specific direction, and then when communicating together, they entify the bird that is in the best location. ccordingly, each bird speeds towards the best bird using a velocity that depends on its current position. Each bird, then, investigates the search space from its new local position, and the process repeats until the flock reaches a desired destination. It is important to note that the process involves both intelligence and social

5 interaction so that birds learn from their own experience (local search) and also from the experience of others around them (global search). PSO is similar to the other evolutionary algorithms in that the system is initialized with a population of random solutions. Each potential solution, call particles, flies in the D- dimensional problem space with a velocity, which is dynamically adusted according to the flying experience of its own and its colleagues. The location of the ith particle is represented as X. The best previous position ( which giving the best fitness value) of the ith particle is recorded and represented as P. which is also called pbest. The index of the best pbest among all the particles is represented by symbol g. The location P gd is also called gbest. The velocity for ith particle is represented as V. PSO is initialized with a population of random solutions of the obective function. The position of each particle is updated by a new velocity calculated through (9) and (10): V w V + c * η *( P X * * 2 *( P gd X ) + c η ) (9) X X + V (10) This section will present the PSO algorithm, which is used in the structure of the main evolutionary fuzzy system as a local search procedure. 3.1 RM Concept Before presenting the PSO-Based Local Search algorithm, let us introduce the RM concept, which we have used in this algorithm. Conser a fuzzy rule of the population with n antecedents, R = ( ai ), i = 1,2,..., n (11) Here we define Rule ntecedent Modification (RM) Operator, RM ( i, ) as replacing the current linguistic value of the rule i th precondition with th linguistic value. Then we define a new fuzzy rule by using the RM- Operator according to (12). R = R + RM i, ) (12) ( Therefore, the plus sign + in (12) has its new meaning. It can be given a concrete example: Suppose there is a classification problem with five inputs, equation (13) shows a sample fuzzy rule for this problem: R = ( S, ML, L, MS, L) (13) The RM-Operator is RM ( 5, 2 ). The result is demonstrated in equation (14). R = R + RM ( 5, 2 ) = ( S, ML, L, MS, MS) (14) Rule ntecedent Modification Sequence (RMS) is made up of one or more RM Operators: RMS = RM, RM,..., RM ) (15) ( 1 2 n where RM 1, RM 2,..., RM n are RM operators, here the order of the RM Operators in RMS is important. RM Sequence acting on a solution means all the RM Operators of the RM Sequence act on the solution in order. This can be described by the following formula: R = R + RMS = R + ( RM 1, RM 2,..., RM n ) = (...(( R + RM ) + RM 2 ) RM ) (16) 1 n Different RM Sequences acting on the same solution may produce the same new solution. ll these RM Sequences are named the equivalent set of RM Sequences. In the equivalent set, the sequence which has the least RM Operator is called Basic RM Sequence of the set or Basic RM Sequence (BRMS) in short. Several RM Sequences can be merged into a new RM Sequence; we define the operator as merging two RM Sequences into a new RM Sequence. Suppose there are two RM Sequences, RMS 1 and RMS 2, RMS 1 and RMS 2 act on solution R in order, namely RMs1 first, RMS2 second, we get a new solution R, and there is another RM Sequence RM S acting on the same solution

6 R, then get the Same solution R, described as follows: RMS = RMS1 RMS 2 (17) RM S and RMS1 RMS2 are in the same equivalent set. Suppose there are two solutions, R and R B, and our task is to construct a Basic RM Sequence BRMS B which can act on RB to get solution R, we define: B BRMS = R R (18) B Here the sign - also has its new meaning. We can modify the nodes in R B according to R from left to right to get BRMS B. So there must be an equation R = R + BRMS. B B For example, two solutions are presented in (19) and (20) R = ( L, MS, L, S, S) (19) R B = ( L, L, ML, S, MS) (20) The BRMS BRMS B B = is calculated as follows: ( RM (2, 2 ), RM (3, 5 ), RM (5, 1 )) (21) 3.2 PSO-Based Local Search Formula (9) has already no longer been suitable for our task, which is rule extraction for a classification problem. We update it as follows: V V α ( P X ) β *( P X ) (22) * gd where α and β are random numbers between 0 and 1. α *( P X ) means all RM Operators in Basic RM Sequence P X should be maintained with the probability of α, it is the same as β ( P X ). * From here we can see that the bigger the value of α the greater the influence of P is (more RM Operators in P X will be maintained). It is also the same as β ( P X ). * Outline of the PSO-Based Local Search is presented in figure 2. Step 1 Initialization: each of the particles positioned according to the current rule. The initial velocity of each particle is determined randomly (a random RM operator). Step 2 Step 3 Step 4 If the lifetime of the current rule is finished, go to Step 5. For all the particles in position the next position X as follows: X 3.1 Calculate difference between P, according to the method which is X, calculate and proposed, BRMS = P X. BRMS is a basic sequence. 3.2 Calculate BRMSB = Pgd X which BRMS B is also a basic sequence. 3.3 Calculate the velocity V according to equation (22), and then transform RM Sequence V to a Basic RM Sequence. 3.4 Calculate the new solution using equation (16). 3.5 Update P if the new solution is superior to P. Update Pgd if there is new best solution which is superior to P gd. GOTO Step 2. Step 5 Sketch the global best rule as the result of local search procedure. Figure 2: Outline of the PSO-Based Local Search Procedure.

7 4 Experimental Results Experiments were carried out using the 1998 DRP intrusion detection evaluation data set prepared and managed by MIT Lincoln Labs. We used the subset of this dataset that was preprocessed by the Columbia University and distributed as part of the UCI KDD rchive [9]. The available database is made up of a large number of network connections related to normal and malicious traffic. Each connection is represented with a 41-dimensional feature vector. Connections are also labeled as belonging to one out of five classes, i.e., normal traffic, Denial of Service (DOS) attacks, Remote to Local (R2L) attacks, User to Root (U2R) attacks, and Probing attacks (PRB). Features were linearly normalized so that they took values within the range [0, 1]. The training data set contains 650 randomly generated points from the five classes, with the number of data from each class proportional to its size, except that the smallest class (U2R) is completely included. different randomly selected set of 9600 points is used for testing the proposed fuzzy classifier system. This section will compare the performance of the proposed PSO-Based Evolutionary Fuzzy System with other approaches for the intrusion detection problem. Table I presents parameter settings for the PSO- Based Evolutionary Fuzzy System, which is used in this paper. TBLE I Parameters specification in computer simulations Parameter Value population size ( N pop ) 20 crossover probability ( P c ) 90 mutation probability ( P m ) 10 age weight parameter ( w age ) number of particles ( N particle ) 20 replacement percentage ( P rep ) 20 stopping condition of the internal algorithm cycle 100 stopping condition of the external algorithm cycle 4 The effect of PSO-Based Local Search procedure can be investigated according to figures 3 and 4. ccording to these figures, we can comprehend that our proposed local search procedure is capable of improving the performance of fuzzy classifier system when it is applied on strong enough rules. However, performing this procedure only on very strong rules will reduce the procedure efficiency. The classification accuracy of our hybr algorithm is shown in Table II along with the performance achieved by a simple evolutionary fuzzy system (without local search step) and some of the other algorithms (EFRID [3], Winner entry [10]). s it is clear, the Evolutionary Fuzzy Systems (with or without local search procedure) are completely competitive to other approaches for intrusion detection. Furthermore, by comparing the classification accuracies of the first two rows of Table II, the hybr evolutionary fuzzy system with PSO-Based local search outperforms the simple evolutionary system. Thus Table III compares the performance of proposed evolutionary algorithms against other methods (EFRID [3] and RIPPER [11]). Our approach resulted in both high detection rate and low false alarm rate. ccording to Table III we can conclude that using evolutionary fuzzy systems resulted in a more reliable intrusion detection system. 5 Conclusions In this paper, a novel PSO-Based Local Search procedure is introduced. The proposed local search procedure is used in the structure of a Michigan based evolutionary fuzzy system. The capability of the resulted hybr fuzzy system is investigated according to the intrusion detection classification problem. Computer simulations on DRP datasets demonstrate high performance of PSO-Based evolutionary fuzzy system for intrusion detection. Our future work is to conser the comprehensibility of the final detection system as another obective for our classification problem. To accomplish this obective we should minimize number of antecedents of each fuzzy rule while maximizing the classification rate of it.

8 Classification Rate NORML U2R R2L DOS PRB Classification Rate NORML U2R R2L DOS PRB Generation Figure 3: Evolution without the local search step TBLE II COMPRISON OF SOME LGORITHMS CLSS lgorithm NORML U2R R2L DOS PRB PSO+EFS Simple EFS EFRID Winner Entry Generation Figure 4: Evolution with the Local Search step TBLE III PERFORMNCE COMPRISON lgorithm Detection Rate False larm Rate PSO+EFS Simple EFS EFRID RIPPER-rtificial nomalies References [1] J. llen,. Christie, W. Fithen, J. McHugh, J. Pickel, and E. Stoner. (1999). State of the practice of intrusion detection technologies. Technical Report CMU/SEI99 -TR-028. ESC , Carnegie Mellon, Software Engineering Institute, Pittsburgh Pennsylvania, [2] S. xelsson (2000). Intrusion detection systems: survey and taxonomy. Technical Report No 99-15, Dept. of Computer Engineering, Chalmers University of Technology, Sweden, March [3] J. Gomez, and D. Dasgupta, "Evolving Fuzzy Classifies for Intrusion Detection," Proceedings of the 2002 IEEE Information ssurance Workshop, Jun [4] M. Saniee badeh, J. Habibi, and C. Lucas, Intrusion Detection Using a Fuzzy Genetics- Based Learning lgorithm, Journal of Network and Computer pplications, In Press, [5] C. L. Karr, and E. J. Gentry, Fuzzy control of ph using genetic algorithms, IEEE Trans. on Fuzzy Systems, vol. 1, pp , February, [6] B. Carse, T.C. Fogarty, and. Muntro, Evolving fuzzy rule based controllers using genetic algorithms, Fuzzy Sets and Systems, vol. 80, no. 3, 3, pp , June, [7] H. Ishibuchi, and T. Nakashima, "Improving the Performance of Fuzzy Classifier Systems for Pattern Classification Problems with Continuous ttributes", IEEE Transactions on Industrial Electronics, vol. 46, no. 6, December 1999 [8] Kennedy J, Eberhart R. Particle swarm optimization. Proceedings of the IEEE international conference on neural networks (Perth, ustralia), Piscataway, NJ: IEEE Service Center; [9] KDD-cup data set: kddcup99.html. [10] C. Elkan, Results of the KDD_99 classifier learning, CM SIGKDD Explorations 1, pp , [11] W. Fan, W. Lee, M. Miller, S. J. Stolfo, and P. K. Chan, Using artificial anomalies to detect unknown and know network intrusions, Proceedings of the First IEEE International Conference on Data Mining, 2001.