Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory Konstantinos Demertzis – Lazaros Iliadis ESADM ECISMD Hybrid Artificial Intelligence System for Cyber Security

2  Agenda –Introduction –Hybrid Artificial Intelligence System for Cyber Security (HAISCS) –Evolving Spiking Anomaly Detection Model (ESADM) –Evolving Computational Intelligence System for Malware Detection (ECISMD) –ESADM –Spiking Neural Network Classification –Spiking Neural Network Pattern Recognition –ECISMD –Spiking Neural Network Classification –Evolving Classification Function (ECF) –Genetic Algorithm for Offline ECF Optimization –Results –Future Directions –Conclusions Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

3  Introduction –Artificial Intelligence (AI) –is the intelligence exhibited by machines or software, and the branch of computer science that develops machines and software with intelligence. –Machine Learning –a branch of artificial intelligence, concerns the construction and study of systems that can learn from data. Hybrid Artificial Intelligence System for Cyber Security –Pattern Recognition –in machine learning aims to classify data (patterns) based on either priori knowledge extracted from the patterns. –Classification –is the problem of identifying to which of a set of categories (sub-populations) a new observation belongs, on the basis of a training set of data containing observations (or instances) whose category membership is known (Supervised Learning). Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

4  Hybrid Artificial Intelligence System for Cyber Security (HAISCS) Hybrid Evolving Spiking Anomaly Detection Model (HESADM) Hybrid Artificial Intelligence System for Cyber Security ESADM ECISMD Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

5  Evolving Spiking Anomaly Detection Model (ESADM) Hybrid Artificial Intelligence System for Cyber Security ESADM Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

6  Evolving Spiking Anomaly Detection Model (ESADM) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

7  Evolving Spiking Anomaly Detection Model (ESADM) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

8  Evolving Spiking Anomaly Detection Model (ESADM) –Evolving Spiking Neural Network (eSNN) Classification –Gaussian Receptive Fields –Rank Order Population Encoding –One-Pass Learning Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

9  Evolving Spiking Anomaly Detection Model (ESADM) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

10  Evolving Spiking Anomaly Detection Model (ESADM) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

11  Evolving Spiking Anomaly Detection Model (ESADM) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

12  Evolving Spiking Anomaly Detection Model (ESADM) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

13  Evolving Spiking Anomaly Detection Model (ESADM) Hybrid Artificial Intelligence System for Cyber Security Traf_Red_Full Dataset Classifier Train Accuracy Test Accuracy NaiveBayes96.387% % RBFNetwork % % MLP % % LibSVM % % k-NN % % J % % RandomForest97.57% % LogisticRegression % % BayesNet % % AdaBoost %95.947% eSNN98,9%97,7% normalFull Dataset Classifier Train Accuracy Test Accuracy NaiveBayes %98.895% RBFNetwork % % MLP % % LibSVM99.673% % k-NN % % J %99.719% RandomForest % % LogisticRegression98.998% % BayesNet % % AdaBoost % % eSNN99.999%99.9% Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

14  Evolving Computational Intelligence System for Malware Detection (ECISMD) Hybrid Artificial Intelligence System for Cyber Security ESADM ECISMD Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

15  Evolving Computational Intelligence System for Malware Detection (ECISMD) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

16  Evolving Computational Intelligence System for Malware Detection (ECISMD) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

17  Evolving Computational Intelligence System for Malware Detection (ECISMD) –Evolving Classification Function (ECF) –used for pattern classification, generates rule nodes in an N dimensional input space and associate them with classes. Each rule node is defined with its centre, radius (influence field) and the class it belongs to. A learning mechanism is designed in such a way that the nodes can be generated. Hybrid Artificial Intelligence System for Cyber Security Rule 1:if X1 is ( 2: 0.50 ) X2 is ( 1: 0.69 ) X3 is ( 1: 0.95 ) X4 is ( 1: 0.95 ) X5 is ( 1: 0.94 ) X6 is ( 1: 0.52 ) X7 is ( 1: 0.95 ) X8 is ( 2: 0.87 ) X9 is ( 2: 0.82 ) then Class is [1] Radius = , 20 in node Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

18  Evolving Computational Intelligence System for Malware Detection (ECISMD) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

19  Evolving Computational Intelligence System for Malware Detection (ECISMD). Hybrid Artificial Intelligence System for Cyber Security –Genetic Algorithm for Offline ECF Optimization –A Genetic Algorithm is an evolutionary algorithm in which the principles of the Darwin's theory of evolution are applied to a population of solutions to a problem in order to "breed" better solutions. –Solutions, in this case the parameters of the ECF network, are encoded in a binary string and each solution is given a score depending on how well it performs. –Good solutions are selected more frequently for breeding, and are subjected to crossover and mutation (loosely analogous to those operations found in biological systems). –After several generations, the population of solutions should converge on a "good" solution. Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

20  Evolving Computational Intelligence System for Malware Detection (ECISMD) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

21  Evolving Computational Intelligence System for Malware Detection (ECISMD) Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

22  Evolving Computational Intelligence System for Malware Detection (ECISMD) Hybrid Artificial Intelligence System for Cyber Security Packed Dataset Classifier Train Accuracy Test Accuracy RBFNetwork % % NaiveBayes % % MLP % % LibSVM % % k-NN % % eSNN99.8%99.2% Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

23  Evolving Computational Intelligence System for Malware Detection (ECISMD) Hybrid Artificial Intelligence System for Cyber Security Malware Dataset Classifier Train Accuracy Test Accuracy RBFNetwork % % NaiveBayes % % MLP %97.289% LibSVM % % k-NN % % ECF99.05%95.561% Optimized ECF 99.87%97.992% Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

24  Evolving Computational Intelligence System for Malware Detection (ECISMD) –Future Directions Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

25  [1] Delorme A., Perrinet L. & Thorpe S. J., (2000), «Networks of Integrate-and-Fire Neurons using Rank Order Coding B: Spike Timing Dependant Plasticity and Emergence of Orientation Selectivity», Published in Neurocomputing, 38-40(1-4), ,  [2] Garcıa P. - Teodoro, Dıaz-Verdejo J., Macia-Fernandez G., Vazquez E., (2009), «Anomaly-based network intrusion detection: Techniques, systems and challenges», Elsevier computers & security 28 (2009) 18–28.  [3] Kasabov Nikola, (2006), «Evolving Connectionist Systems: The Knowledge Engineering Approach», Springer-Verlag New York, Inc., NJ, USA.  [4] Wysoski Simei Gomes, Benuskova Lubica, Kasabov Nikola K., (2006), «Adaptive learning procedure for a network of spiking neurons and visual pattern recognition. In Advanced Concepts for Intelligent Vision Systems», pages 1133–1142, Berlin/Heidelberg, Springer.  [5] Thorpe Simon J. and Jacques Gautrais, (1998), «Rank order coding», In CNS ’97: Proceedings of the 6th annual conference on Computational neuroscience: trends in research, pages 113–118, New York, NY, USA, 1998, Plenum Pressity.  [6] Stolfo Salvatore J., Fan Wei, Wenke Lee, Prodromidis Andreas, and Philip K. Chan, (2000), «Cost-based Modeling and Evaluation for Data Mining With Application to Fraud and Intrusion Detection: Results from the JAM Project», DARPA Information Survivability Conference and Exposition, DISCEX '00.  [7] Thorpe Simon J., Delorme Arnaud, and Rufin van Rullen, (2001), «Spike-based strategies for rapid processing», Neural Networks, 14(6-7):715–725.  [8] Schliebs S., Defoin-Platel M., Kasabov N, (2009), «Integrated feature and parameter optimization for an evolving spiking neural network», 15 th ICONIP 2008, Auckland, New Zealand. Hybrid Artificial Intelligence System for Cyber Security Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

26 Hybrid Artificial Intelligence System for Cyber Security  Forest Informatics Laboratory  Director of the Lab Professor Lazaros S. Iliadis  Research Areas –Fuzzy Logic –Computational Intelligence –Soft Computing –Machine Learning –Pattern Recognition –Neural Networks –Support Vector Machines –Genetic Algorithms –Adaptive Fuzzy Clustering –Heuristic Models –Intelligent Agents – multiAgent Systems –Expert Systems - Knowledge Systems - Fuzzy Inference Systems –Intelligent Information Systems and Applications in Risk Management Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory

27 | Hybrid Artificial Intelligence System for Cyber Security  Conclusion Democritus University of Thrace Dep. of Forestry & Management of the Environment & Natural Resources Forest Informatics Laboratory