33 research outputs found
Adaptive rule-based malware detection employing learning classifier systems
Efficient and accurate malware detection is increasingly becoming a necessity for society to operate. Existing malware detection systems have excellent performance in identifying known malware for which signatures are available, but poor performance in anomaly detection for zero day exploits for which signatures have not yet been made available or targeted attacks against a specific entity. The primary goal of this thesis is to provide evidence for the potential of learning classier systems to improve the accuracy of malware detection.
A customized system based on a state-of-the-art learning classier system is presented for adaptive rule-based malware detection, which combines a rule-based expert system with evolutionary algorithm based reinforcement learning, thus creating a self-training adaptive malware detection system which dynamically evolves detection rules.
This system is analyzed on a benchmark of malicious and non-malicious files. Experimental results show that the system can outperform C4.5, a well-known non-adaptive machine learning algorithm, under certain conditions. The results demonstrate the system\u27s ability to learn effective rules from repeated presentations of a tagged training set and show the degree of generalization achieved on an independent test set.
This thesis is an extension and expansion of the work published in the Security, Trust, and Privacy for Software Applications workshop in COMPSAC 2011 - the 35th Annual IEEE Signature Conference on Computer Software and Applications --Abstract, page iii
A brief history of learning classifier systems: from CS-1 to XCS and its variants
© 2015, Springer-Verlag Berlin Heidelberg. The direction set by Wilson’s XCS is that modern Learning Classifier Systems can be characterized by their use of rule accuracy as the utility metric for the search algorithm(s) discovering useful rules. Such searching typically takes place within the restricted space of co-active rules for efficiency. This paper gives an overview of the evolution of Learning Classifier Systems up to XCS, and then of some of the subsequent developments of Wilson’s algorithm to different types of learning
XCS Classifier System with Experience Replay
XCS constitutes the most deeply investigated classifier system today. It
bears strong potentials and comes with inherent capabilities for mastering a
variety of different learning tasks. Besides outstanding successes in various
classification and regression tasks, XCS also proved very effective in certain
multi-step environments from the domain of reinforcement learning. Especially
in the latter domain, recent advances have been mainly driven by algorithms
which model their policies based on deep neural networks -- among which the
Deep-Q-Network (DQN) is a prominent representative. Experience Replay (ER)
constitutes one of the crucial factors for the DQN's successes, since it
facilitates stabilized training of the neural network-based Q-function
approximators. Surprisingly, XCS barely takes advantage of similar mechanisms
that leverage stored raw experiences encountered so far. To bridge this gap,
this paper investigates the benefits of extending XCS with ER. On the one hand,
we demonstrate that for single-step tasks ER bears massive potential for
improvements in terms of sample efficiency. On the shady side, however, we
reveal that the use of ER might further aggravate well-studied issues not yet
solved for XCS when applied to sequential decision problems demanding for
long-action-chains
Improving the Scalability of XCS-Based Learning Classifier Systems
Using evolutionary intelligence and machine learning techniques, a broad
range of intelligent machines have been designed to perform different
tasks. An intelligent machine learns by perceiving its environmental status
and taking an action that maximizes its chances of success.
Human beings have the ability to apply knowledge learned from a
smaller problem to more complex, large-scale problems of the same or a
related domain, but currently the vast majority of evolutionary machine
learning techniques lack this ability. This lack of ability to apply the already
learned knowledge of a domain results in consuming more than
the necessary resources and time to solve complex, large-scale problems
of the domain. As the problem increases in size, it becomes difficult and
even sometimes impractical (if not impossible) to solve due to the needed
resources and time. Therefore, in order to scale in a problem domain, a
systemis needed that has the ability to reuse the learned knowledge of the
domain and/or encapsulate the underlying patterns in the domain.
To extract and reuse building blocks of knowledge or to encapsulate
the underlying patterns in a problem domain, a rich encoding is needed,
but the search space could then expand undesirably and cause bloat, e.g.
as in some forms of genetic programming (GP). Learning classifier systems
(LCSs) are a well-structured evolutionary computation based learning
technique that have pressures to implicitly avoid bloat, such as fitness
sharing through niche based reproduction.
The proposed thesis is that an LCS can scale to complex problems in
a domain by reusing the learnt knowledge from simpler problems of the
domain and/or encapsulating the underlying patterns in the domain. Wilson’s
XCS is used to implement and test the proposed systems, which is a well-tested,
online learning and accuracy based LCS model. To extract the reusable building
blocks of knowledge, GP-tree like, code-fragments are introduced, which are more
than simply another representation (e.g. ternary or real-valued alphabets). This
thesis is extended to capture the underlying patterns in a problemusing a cyclic
representation. Hard problems are experimented to test the newly developed scalable
systems and compare them with benchmark techniques.
Specifically, this work develops four systems to improve the scalability
of XCS-based classifier systems. (1) Building blocks of knowledge are extracted
fromsmaller problems of a Boolean domain and reused in learning
more complex, large-scale problems in the domain, for the first time. By
utilizing the learnt knowledge from small-scale problems, the developed
XCSCFC (i.e. XCS with Code-Fragment Conditions) system readily solves
problems of a scale that existing LCS and GP approaches cannot, e.g. the
135-bitMUX problem. (2) The introduction of the code fragments in classifier
actions in XCSCFA (i.e. XCS with Code-Fragment Actions) enables the
rich representation of GP, which when couples with the divide and conquer
approach of LCS, to successfully solve various complex, overlapping
and niche imbalance Boolean problems that are difficult to solve using numeric
action based XCS. (3) The underlying patterns in a problem domain
are encapsulated in classifier rules encoded by a cyclic representation. The
developed XCSSMA system produces general solutions of any scale n for
a number of important Boolean problems, for the first time in the field of
LCS, e.g. parity problems. (4) Optimal solutions for various real-valued
problems are evolved by extending the existing real-valued XCSR system
with code-fragment actions to XCSRCFA. Exploiting the combined power
of GP and LCS techniques, XCSRCFA successfully learns various continuous
action and function approximation problems that are difficult to learn
using the base techniques.
This research work has shown that LCSs can scale to complex, largescale
problems through reusing learnt knowledge. The messy nature, disassociation of
message to condition order, masking, feature construction, and reuse of extracted
knowledge add additional abilities to the XCS family of LCSs. The ability to use
rich encoding in antecedent GP-like codefragments or consequent cyclic representation
leads to the evolution of accurate, maximally general and compact solutions in learning
various complex Boolean as well as real-valued problems. Effectively exploiting
the combined power of GP and LCS techniques, various continuous action
and function approximation problems are solved in a simple and straight
forward manner.
The analysis of the evolved rules reveals, for the first time in XCS, that
no matter how specific or general the initial classifiers are, all the optimal
classifiers are converged through the mechanism ‘be specific then generalize’
near the final stages of evolution. Also that standard XCS does not use
all available information or all available genetic operators to evolve optimal
rules, whereas the developed code-fragment action based systems effectively use figure
and ground information during the training process.
Thiswork has created a platformto explore the reuse of learnt functionality,
not just terminal knowledge as present, which is needed to replicate human capabilities
A path from broader to narrower grammars: the acquisition of argument structure in English and Hungarian
In recent years a growing number of theoretical and empirical studies of first language acquisition have cast doubt on the hypothesis that acquiring language is a
deterministic process in which the role of experience is restricted to triggering innate principles of grammatical content. The aim of this thesis is to explore areas of
language where input -based learning demonstrably plays a role and to find learning
mechanisms that account for the construction of observed overgeneral grammars
and the process of their restriction.The thesis is a comparative study of the acquisition of argument structure
in English and in Hungarian. The detailed analysis of spontaneous speech samples of two -- year -old children reveals that the omission of subjects, objects and
prepositions at the so- called telegraphic stage of English child language cannot be
explained either by limitations in processing capacity or by postulating an incomplete Universal Grammar. It is suggested that children's implicit arguments and
oblique noun phrases lacking case or prepositional marking need not be analysed as
syntactically ill- formed, since they conform to permissible abstract structural configurations. The errors may instead be attributed to overgeneral or indeterminate
rules of pragmatics, which are fuzzy and variable in the mature grammar.It is shown that the nature of the children's intake of the primary linguistic
data is a good predictor of the nature and extent of overgeneralisation or indeterminacy and of the speed with which the rules are fine -tuned to match the target
The Genitive Ratio and its Applications
The genitive ratio (GR) is a novel method of classifying nouns as animate, concrete or abstract. English has two genitive (possessive) constructions: possessive-s (the boy's head) and possessive-of (the head of the boy). There is compelling evidence that preference for possessive-s is strongly influenced by the possessor's animacy. A corpus analysis that counts each genitive construction in three conditions (definite, indefinite and no article) confirms that occurrences of possessive-s decline as the animacy hierarchy progresses from animate through concrete to abstract.
A computer program (Animyser) is developed to obtain results-counts from phrase-searches of Wikipedia that provide multiple genitive ratios for any target noun. Key ratios are identified and algorithms developed, with specific applications achieving classification accuracies of over 80%. The algorithms, based on logistic regression, produce a score of relative animacy that can be applied to individual nouns or to texts. The genitive ratio is a tool with potential applications in any research domain where the relative animacy of language might be significant. Three such applications exemplify that.
Combining GR analysis with other factors might enhance established co-reference (anaphora) resolution algorithms. In sentences formed from pairings of animate with concrete or abstract nouns, the animate noun is usually salient, more likely to be the grammatical subject or thematic agent, and to co-refer with a succeeding pronoun or noun-phrase. Two experiments, online sentence production and corpus-based, demonstrate that the GR algorithm reliably predicts the salient noun. Replication of the online experiment in Italian suggests that the GR might be applied to other languages by using English as a 'bridge'.
In a mental health context, studies have indicated that Alzheimer's patients' language becomes progressively more concrete; depressed patients' language more abstract. Analysis of sample texts suggests that the GR might monitor the prognosis of both illnesses, facilitating timely clinical interventions