Dynamic fuzzy rule interpolation and its application to intrusion detection

Fuzzy rule interpolation (FRI) offers an effective approach for making inference possible in sparse rule-based systems (and also for reducing the complexity of fuzzy models). However, requirements of fuzzy systems may change over time and hence, the use of a static rule base may affect the accuracy of FRI applications. Fortunately, an FRI system in action will produce interpolated rules in abundance during the interpolative reasoning process. While such interpolated results are discarded in existing FRI systems, they can be utilized to facilitate the development of a dynamic rule base in supporting subsequent inference. This is because the otherwise relinquished interpolated rules may contain possibly valuable information, covering regions that were uncovered by the original sparse rule base. This paper presents a dynamic fuzzy rule interpolation (D-FRI) approach by exploiting such interpolated rules in order to improve the overall system's coverage and efficacy. The resulting D-FRI system is able to select, combine, and generalize informative, frequently used interpolated rules for merging with the existing rule base while performing interpolative reasoning. Systematic experimental investigations demonstrate that D-FRI outperforms conventional FRI techniques, with increased accuracy and robustness. Furthermore, D-FRI is herein applied for network security analysis, in devising a dynamic intrusion detection system (IDS) through integration with the Snort software, one of the most popular open source IDSs. This integration, denoted as D-FRI-Snort hereafter, delivers an extra amount of intelligence to predict the level of potential threats. Experimental results show that with the inclusion of a dynamic rule base, by generalising newly interpolated rules based on the current network traffic conditions, D-FRI-Snort helps reduce both false positives and false negatives in intrusion detection

Transformation-Based Fuzzy Rule Interpolation Using Interval Type-2 Fuzzy Sets

In support of reasoning with sparse rule bases, fuzzy rule interpolation (FRI) offers a helpful inference mechanism for deriving an approximate conclusion when a given observation has no overlap with any rule in the existing rule base. One of the recent and popular FRI approaches is the scale and move transformation-based rule interpolation, known as T-FRI in the literature. It supports both interpolation and extrapolation with multiple multi-antecedent rules. However, the difficult problem of defining the precise-valued membership functions required in the representation of fuzzy rules, or of the observations, restricts its applications. Fortunately, this problem can be alleviated through the use of type-2 fuzzy sets, owing to the fact that the membership functions of such fuzzy sets are themselves fuzzy, providing a more flexible means of modelling. This paper therefore, extends the existing T-FRI approach using interval type-2 fuzzy sets, which covers the original T-FRI as its specific instance. The effectiveness of this extension is demonstrated by experimental investigations and, also, by a practical application in comparison to the state-of-the-art alternative approach developed using rough-fuzzy setspublishersversionPeer reviewe

Fuzzy Rule Based Interpolative Reasoning Supported by Attribute Ranking

Using fuzzy rule interpolation (FRI) interpolative reasoning can be effectively performed with a sparse rule base where a given system observation does not match any fuzzy rules. Whilst offering a potentially powerful inference mechanism, in the current literature, typical representation of fuzzy rules in FRI assumes that all attributes in the rules are of equal significance in deriving the consequents. This is a strong assumption in practical applications, thereby often leading to less accurate interpolated results. To address this challenging problem, this work employs feature selection (FS) techniques to adjudge the relative significance of individual attributes and therefore, to differentiate the contributions of the rule antecedents and their impact upon FRI. This is feasible because FS provides a readily adaptable mechanism for evaluating and ranking attributes, being capable of selecting more informative features. Without requiring any acquisition of real observations, based on the originally given sparse rule base, the individual scores are computed using a set of training samples that are artificially created from the rule base through an innovative reverse engineering procedure. The attribute scores are integrated within the popular scale and move transformation-based FRI algorithm (while other FRI approaches may be similarly extended following the same idea), forming a novel method for attribute ranking-supported fuzzy interpolative reasoning. The efficacy and robustness of the proposed approach is verified through systematic experimental examinations in comparison with the original FRI technique, over a range of benchmark classification problems while utilising different FS methods. A specific and important outcome is that supported by attribute ranking, only two (i.e., the least number of) nearest adjacent rules are required to perform accurate interpolative reasoning, avoiding the need of searching for and computing with multiple rules beyond the immediate neighbourhood of a given observationpublishersversionPeer reviewe