35632142
Adaptive real-time anomaly detection using inductively generated sequential patterns
A time-based inductive learning approach to the problem of real-time anomaly detection is described. This approach uses sequential rules that characterize a user's behavior over time. A rulebase is used to store patterns of user activities, and anomalies are reported whenever a user's activity deviates significantly from those specified in the rules. The rules in the rulebase characterize either the sequential relationships between security audit records or the temporal properties of the records. The rules are created in two ways: they are either dynamically generated and modified by a time-based inductive engine in order to adapt to changes in a user's behavior, or they are specified by the security management to implement a site security policy. This approach allows the correlation between adjacent security events to be exploited for the purpose of greater sensitivity in anomaly detection against seemingly intractable (or erratic) activities using statistical approaches. Real-time detection of anomaly activities is possible.<<ETX>>
6309018
Knowledge-based learning integrating acquisition and learning
Empirical learning algorithms are hampered by their inability to use domain knowledge to guide the induction of new rules. This paper describes knowledge-based learning, an approach to learning that selects the examples and relevant attributes for an empirical algorithm. Knowledge-based learning can be used for developing rules for engineering expert systems. Engineers often have some rules for problem solving, but also many experiences (examples) that facilitate solving problems. Knowledge-based learning systems are able to use both forms of knowledge.
5343942
Knowledge-Based Equation Discovery in Engineering Domains
Machine learning techniques that can compress datasets into relationships that underlie the data have great utility for engineers. Most model discovery systems are not well suited to discovering comprehensible models in engineering domains. In this paper we present KEDS, a Knowledge-based Equation Discovery System, which uses a model-driven approach to discover equations and thereby build models from engineering data.
35812356
A Study of How Domain Knowledge Improves Knowledge-Based Learning Systems
Abstract A knowledge-based learning system is developed to demonstrate that intelligently selecting a subset of examples based on domain knowledge for rule induction can be more productive than using all provided examples. Knowledge-based learning uses an incomplete domain theory and examples to induce knowledge missing in the theory. Knowledge-based learning systems determine where knowledge is missing in a domain theory, select a relevant subset of examples to use in induction, and induce new rules or modify existing rules.
12858200
Building Robust Learning Systems by Combining Induction and Optimization
Each concept description language and search strategy has an inherent inductive bias, a preference for some hypotheses over others. No single inductive bias performs optimally on all problems. This paper describes a system that couples induction with optimization to carry out an efficient search of large regions of inductive bias space. Experimental results are reported demonstrating the system's capacity to choose optimal biases even for complex and noisy problems.
37627056
SWIFT: system workbench for integrating and facilitating teams
There have been many R&D efforts in recent years to develop computer environments that directly enhance group problem-solving productivity. An example of such efforts is the computer-based virtual teaming technology (VTT) developed at the knowledge-based Engineering Sytems Research Laboratory (KESRL). The core software environment for KESRL's VTT is called SWIFT and is based on the knowledge processing technology (KPT) previously developed at KESRL to support various engineering design tasks. SWIFT is a flexible environment which enables the rapid development of collaborative applications, linking workers in distributed environments, of many domains. The paper presents the overall system architecture of SWIFT, and introduces the current and future R&D efforts at KESRL in realizing SWIFT for significant industrial applications.<<ETX>>
8443328
Correct execution of transactions at different isolation levels
Many transaction processing applications execute at isolation levels lower than SERIALIZABLE in order to increase throughput and reduce response time. However, the resulting schedules might not be serializable and, hence, not necessarily correct. The semantics of a particular application determines whether that application will run correctly at a lower level and, in practice, it appears that many applications do. The decision to choose an isolation level at which to run an application and the analysis of the correctness of the resulting execution is usually done informally. We develop a formal technique to analyze and reason about the correctness of the execution of an application at isolation levels other than SERIALIZABLE. We use a new notion of correctness, semantic correctness, a criterion weaker than serializability, to investigate correctness. In particular, for each isolation level, we prove a condition under which the execution of transactions at that level will be semantically correct. In addition to the ANSI/ISO isolation levels of READ UNCOMMITTED, READ COMMITTED, and REPEATABLE READ, we also prove a condition for correct execution at the READ-COMMITTED with first-committer-wins and at SNAPSHOT isolation. We assume that different transactions in the same application can be executing at different levels, but that each transaction is executing at least at READ UNCOMMITTED.
527997
Statistical en-route filtering of injected false data in sensor networks
In a large-scale sensor network individual sensors are subject to security compromises. A compromised node can inject into the network large quantities of bogus sensing reports which, if undetected, would be forwarded to the data collection point (i.e. the sink). Such attacks by compromised sensors can cause not only false alarms but also the depletion of the finite amount of energy in a battery powered network. We present a statistical en-route filtering (SEF) mechanism that can detect and drop such false reports. SEF requires that each sensing report be validated by multiple keyed message authentication codes (MACs), each generated by a node that detects the same event. As the report is forwarded, each node along the way verifies the correctness of the MACs probabilistically and drops those with invalid MACs at earliest points. The sink further filters out remaining false reports that escape the en-route filtering. SEF exploits the network scale to determine the truthfulness of each report through collective decision-making by multiple detecting nodes and collective false-report-detection by multiple forwarding nodes. Our analysis and simulations show that, with an overhead of 14 bytes per report, SEF is able to drop 80/spl sim/90% injected false reports by a compromised node within 10 forwarding hops, and reduce energy consumption by 50% or more in many cases.
17835959
Toward resilient security in wireless sensor networks
Node compromise poses severe security threats in wireless sensor networks. Unfortunately, existing security designs can address only a small, fixed threshold number of compromised nodes; the security protection completely breaks down when the threshold is exceeded. In this paper, we seek to overcome the threshold limitation and achieve resiliency against an increasing number of compromised nodes. To this end, we propose a novel location-based approach in which the secret keys are bound to geographic locations, and each node stores a few keys based on its own location. The location-binding property constrains the scope for which individual keys can be (mis)used, thus limiting the damages caused by a collection of compromised nodes. We illustrate this approach through the problem of report fabrication attacks, in which the compromised nodes forge non-existent events. We evaluate our design through extensive analysis, implementation and simulations, and demonstrate its graceful performance degradation in the presence of an increasing number of compromised nodes.
14349319
Querying XML Documents from a Relational Database in the Presence of DTDs
Many researchers have investigated the problem of storing and querying XML documents using an RDBMS Two situations are considered in this approach based on whether or not an XML schema is available In a schema-oblivious relational approach, an XML schema is not available, or it is available but is not used The advantage of schema-oblivious relational approach is that no XML schema is required, and the fixed generic schema can be used to store XML documents with arbitrary structure However, since XML schema is not exploited, this approach usually implies a query engine where join operations dominate the query time and performance might suffer significantly On the other hand, rare work on the problem of schema-based XML-to-SQL query mapping has been published in the literature In this paper, we present an algorithm to address this problem.
12609380
A topology-independent fair queueing model in ad hoc wireless networks
Fair queueing of rate and delay-sensitive packet flows in a shared-medium, multihop wireless network remains largely unaddressed because of the unique design issues such as location-dependent contention, spatial channel reuse, conflicts between ensuring fairness and maximizing channel utilization, and distributed fair scheduling. In this paper we propose a new topology-independent fair queueing model for a shared-medium ad hoc network. Our model ensures coordinated fair channel access among spatially contending flows while seeking to maximize spatial channel reuse. We describe packetized algorithms that realize the fluid fairness model with analytically provable performance bounds. We further design distributed implementations that approximate the ideal centralized algorithm. We evaluate our design through both simulations and analysis.