1. Networks, Lie Monoids, & Generalized Entropy Metrics Networks, Lie Monoids, & Generalized Entropy Metrics St. Petersburg Russia September 25, 2005 Joseph E. Johnson PhD Professor, Department of Physics University of South Carolina

2. I. Introduction

3. The Problem Networks, such as the Internet, are of extraordinary complexity for which there is currently no complete mathematical foundation. Networks, such as the Internet, are of extraordinary complexity for which there is currently no complete mathematical foundation. With only 1,000 nodes there are 1,000,000 real numbers representing the data transfer weights for that topology (using C ij as an ‘information connection matrix’). With only 1,000 nodes there are 1,000,000 real numbers representing the data transfer weights for that topology (using C ij as an ‘information connection matrix’). Furthermore these values change every fraction of a second. Thus every hour one must usefully monitor a trillion (10 12 ) values to ‘track’ the network. Furthermore these values change every fraction of a second. Thus every hour one must usefully monitor a trillion (10 12 ) values to ‘track’ the network.

5. Analogy to Thermodynamics This is similar to knowing the positions and momenta of billions of molecules and trying to understand what a system is doing. The information is voluminous & useless. This is similar to knowing the positions and momenta of billions of molecules and trying to understand what a system is doing. The information is voluminous & useless. Thermodynamic concepts like pressure, temperature, heat, volume, etc suggest themselves as ‘macro’ variables. Thermodynamic concepts like pressure, temperature, heat, volume, etc suggest themselves as ‘macro’ variables. But networks lack a measure of ‘nearness’ and ‘energy’ making these useless. But networks lack a measure of ‘nearness’ and ‘energy’ making these useless. Entropy is suggestive as a measure but is meaningful only on probability distributions which also are not overtly apparent in networks. Entropy is suggestive as a measure but is meaningful only on probability distributions which also are not overtly apparent in networks.

6. Additional Problems Yet things are much worse: Yet things are much worse: Although the C ij connection matrix captures the network topology and information flows, there are n! different C matrices that describe the same network. Although the C ij connection matrix captures the network topology and information flows, there are n! different C matrices that describe the same network. This is due to the random numbering of the network nodes necessary to specify the C matrix. This is due to the random numbering of the network nodes necessary to specify the C matrix.

7. Critical Remark The connection matrix C ij has off-diagonal elements that are exactly defined by the information transfers or weights between node i and node j. The connection matrix C ij has off-diagonal elements that are exactly defined by the information transfers or weights between node i and node j. However, the diagonal elements of C are totally arbitrary and can be set to any value for a given network. However, the diagonal elements of C are totally arbitrary and can be set to any value for a given network.

8. II. Proposed Theoretical Foundation

9. Previous Work In 1985, the author found a new way to decompose all continuous general linear transformations (GL(n,R)) into a Markov-type Lie group (that conserves the sum of the components of a vector) and another Abelian Lie group that scales or stretches the axes. In 1985, the author found a new way to decompose all continuous general linear transformations (GL(n,R)) into a Markov-type Lie group (that conserves the sum of the components of a vector) and another Abelian Lie group that scales or stretches the axes. This Markov type Lie group was shown to give all continuous Markov transformations (a Lie monoid, M) when the parameter space of the Lie algebra, L, is restricted to non-negative values  thus M( )=e L This Markov type Lie group was shown to give all continuous Markov transformations (a Lie monoid, M) when the parameter space of the Lie algebra, L, is restricted to non-negative values  thus M( )=e L

10. Nature of Markov Transformation A Markov transformation (Markov 1905), transforms a vector of non-negative reals into another vector of non-negative reals (such as probability distributions). A Markov transformation (Markov 1905), transforms a vector of non-negative reals into another vector of non-negative reals (such as probability distributions). Every column of a Markov transformation is itself a vector of non-negative reals that sum to unity and thus is a probability distribution. Every column of a Markov transformation is itself a vector of non-negative reals that sum to unity and thus is a probability distribution.

11. Recent Advance The author has recently observed (DARPA internal report) that if the ambiguous diagonal values of the C matrix are chosen to be the negatives of the sum of the other values in that column, then the resulting C matrix is a unique element of the Markov Lie monoid, L, and thus generates a well defined Markov matrix. The author has recently observed (DARPA internal report) that if the ambiguous diagonal values of the C matrix are chosen to be the negatives of the sum of the other values in that column, then the resulting C matrix is a unique element of the Markov Lie monoid, L, and thus generates a well defined Markov matrix. In essence this means that the L matrices that generate Markov transformations are in 1-1 correspondence to possible networks (ignoring the ambiguity of nodal numbering). In essence this means that the L matrices that generate Markov transformations are in 1-1 correspondence to possible networks (ignoring the ambiguity of nodal numbering).

12. Conclusion 1 Conclusion 1 Both the topology and information flow rates of any given network (as specified by the connection matrix C) exactly correspond to a unique (infinitesimal) Markov transformation. Both the topology and information flow rates of any given network (as specified by the connection matrix C) exactly correspond to a unique (infinitesimal) Markov transformation. Thus network theory and Markov transformations and Lie group theory are now intimately connected allowing the tools and techniques in one to be used in the others. Thus network theory and Markov transformations and Lie group theory are now intimately connected allowing the tools and techniques in one to be used in the others.

13. Conclusion 2 Conclusion 2 Any of the (  ) generalized (Renyi’) entropies are now well defined on the columns of the resulting Markov matrix (for a given value of ). Any of the (  ) generalized (Renyi’) entropies are now well defined on the columns of the resulting Markov matrix (for a given value of ). Thus one can distill the ‘information’ of each column, (and thus each node (i)) to an entropy value E(i,  For each node there is now an associated entropy. Thus one can distill the ‘information’ of each column, (and thus each node (i)) to an entropy value E(i,  For each node there is now an associated entropy. The value of is related to the extent of ‘connectivity connection’ that one wishes to characterize for that node. The value of is related to the extent of ‘connectivity connection’ that one wishes to characterize for that node.

14. Interpretation of M The Markov transformation that results from a given connection matrix is the infinitesimal set of flows, of a conserved probability’, away from a given node, in proportion to the C values. The Markov transformation that results from a given connection matrix is the infinitesimal set of flows, of a conserved probability’, away from a given node, in proportion to the C values.

15. Ambiguity of Node Numbering Each time the entropy is computed for the N different nodes, the set of values can be sorted by (largest to smallest) value as the order of the nodes is unimportant. Each time the entropy is computed for the N different nodes, the set of values can be sorted by (largest to smallest) value as the order of the nodes is unimportant. This results in a curve or function that is monotonically non-increasing. This results in a curve or function that is monotonically non-increasing. The next time the entropies are computed the nodes are again resorted and will end up in a different order but that is unimportant as only the functional form is essential i.e. some node does the same thing. The next time the entropies are computed the nodes are again resorted and will end up in a different order but that is unimportant as only the functional form is essential i.e. some node does the same thing.

16. Conclusion 3 The functional curve of entropy values ‘distills’ the ‘order’ associated with the nodes and removes the ambiguity of nodal ordering. The functional curve of entropy values ‘distills’ the ‘order’ associated with the nodes and removes the ambiguity of nodal ordering.

17. Asymmetrical Row Computation The C matrix diagonals can also be set to the negative of the sum of row values so that the resulting M matrix reflects the asymmetry of the C matrix and associated row entropies. The C matrix diagonals can also be set to the negative of the sum of row values so that the resulting M matrix reflects the asymmetry of the C matrix and associated row entropies. Using the ordering of the column entropies (as above) defines an ordering of the nodes so that the associated row entropies define a function. Using the ordering of the column entropies (as above) defines an ordering of the nodes so that the associated row entropies define a function. This function, when displayed, can also indicate anomalies when it assumes abnormal values. This function, when displayed, can also indicate anomalies when it assumes abnormal values.

18. Conclusion 4 The ordered column entropy values form one function and the same ordering for row entropies forms a second function both of which can be continuously monitored for abnormal behavior. The ordered column entropy values form one function and the same ordering for row entropies forms a second function both of which can be continuously monitored for abnormal behavior. The abnormalities in these functions indicate exactly which nodes have such behavior and the probability of the abnormality being that devient The abnormalities in these functions indicate exactly which nodes have such behavior and the probability of the abnormality being that devient

19. III. Application to Intrusion Detection

20. Column Entropy - Order 1

21. Column Entropy - Order 2

22. Column Entropy - Order 3

23. Order 1 – Order 2 Difference Plot

24. Order 2 – Order 3 Difference Plot

25. Column/Row Ratio Plot (Symmetry Plot) – Order 2

26. Further Insights Normalization of c matrix relative to size Normalization of c matrix relative to size Time window size versus entropy Time window size versus entropy Type and severity of intrusion anomalies in terms of column and row entropy signatures Type and severity of intrusion anomalies in terms of column and row entropy signatures