Research On Good-Point-Set Covering Algorithm And Its Applications In Intrusion Detection

Based on deeply analyzing the mechanism of artificial neural networks (ANN), Zhang Ling and Zhang Bo proposed the theory and method of constructive machine learning which has been successfully used in many aspects. By using sphere projection, they converted neurons in ANN to a set of classifiers which are utilized for partitioning limited space. In other words, this method transforms problems in infinite space to finite space. Therefore, the learning problem of ANN can be converted to covering problem and the complexity can be reduced simultaneously.With the fast development of computer and network technique, the computer system has become more and more complex and open. Even it shares a lot of convenient properties, some negative influence being brought such as easy to be intruded. Therefore, active protecting technologies come into being and can be used to tackle this problem.This dissertation proposes a learning algorithm GCA (Good-Point-Set Covering Algorithm) which is combined with covering algorithm and the theory of Good-Point-Set. This algorithm is effective by validated on UCI data. In addition, GCA will be further introduced into intrusion detection. By selecting dataset in different granularity and combining with ensemble learning, we construct a new intrusion detection model based on ensemble Good-Point-Set Covering Algorithm.The content of this dissertation is detailed as follows:1. The background knowledge and significance of covering algorithm and intrusion detection are explained. We review some related works include classical classification algorithms, geometrical representation of McCulloch-Pitts neuron, Constructive method (or covering algorithm) and several methods make improvement on it. By comparing with single classifier, we summarize the properties of ensemble classifier and related approaches. Then the performance of the algorithm proposed here can be enhanced by adopting Bagging ensemble method.2. Introduce the theory of Good-Point-Set and its advantage on selecting weight of neurons. As a constructive machine learning method, the essential problem of covering algorithm is to find the weight and threshold of neurons, in which weight and threshold refer to the center of covering domain and radius of covering domain respectively. Usually the approaches of constructing the weight of neuron or selecting a sample as the center of new covering domain are by randomly selecting or pre-setting the selection order. However, these methods did not take the data distributions into accord. In contrast, the theory of Good-Point-Set can effectively achieve better covering order and improve the performance significantly.3. We propose two intrusion detection models based on GCA (Good-Point-Set Covering Algorithm) and ensemble learning algorithm of GCA. In the process of sample construction, a single optimal combination of feature selection approach is used to decrease the high feature dimension of samples. Additionally, Select several subsets of features under different granularities and establish a GCA intrusion detection model. Then we adopt ensemble learning approach to improve the performance of GCA intrusion detection model. In the ensemble learning framework, several single-classifiers identify samples from different angles and simulate the human behavior that observes object from different aspects, which are useful for resolving the multi-attributes problem. Therefore, our proposed ensemble learning based GCA intrusion detection model can further improve the detection accuracy.