Dynamic fuzzy rule interpolation and its application to intrusion detection

Fuzzy rule interpolation (FRI) offers an effective approach for making inference possible in sparse rule-based systems (and also for reducing the complexity of fuzzy models). However, requirements of fuzzy systems may change over time and hence, the use of a static rule base may affect the accuracy of FRI applications. Fortunately, an FRI system in action will produce interpolated rules in abundance during the interpolative reasoning process. While such interpolated results are discarded in existing FRI systems, they can be utilized to facilitate the development of a dynamic rule base in supporting subsequent inference. This is because the otherwise relinquished interpolated rules may contain possibly valuable information, covering regions that were uncovered by the original sparse rule base. This paper presents a dynamic fuzzy rule interpolation (D-FRI) approach by exploiting such interpolated rules in order to improve the overall system's coverage and efficacy. The resulting D-FRI system is able to select, combine, and generalize informative, frequently used interpolated rules for merging with the existing rule base while performing interpolative reasoning. Systematic experimental investigations demonstrate that D-FRI outperforms conventional FRI techniques, with increased accuracy and robustness. Furthermore, D-FRI is herein applied for network security analysis, in devising a dynamic intrusion detection system (IDS) through integration with the Snort software, one of the most popular open source IDSs. This integration, denoted as D-FRI-Snort hereafter, delivers an extra amount of intelligence to predict the level of potential threats. Experimental results show that with the inclusion of a dynamic rule base, by generalising newly interpolated rules based on the current network traffic conditions, D-FRI-Snort helps reduce both false positives and false negatives in intrusion detection

Dynamic QoS Solution for Enterprise Networks Using TSK Fuzzy Interpolation

The Quality of Services (QoS) is the measure of data transmission quality and service availability of a network, aiming to maintain the data, especially delay-sensitive data such as VoIP, to be transmitted over the network with the required quality. Major network device manufacturers have each developed their own smart dynamic QoS solutions, such as AutoQoS supported by Cisco, CoS (Class of Service) by Netgear devices, and QoS Maps on SROS (Secure Router Operating System) provided by HP, to maintain the service level of network traffic. Such smart QoS solutions usually only work for manufacture qualified devices and otherwise only a pre-defined static policy mapping can be applied. This paper presents a dynamic QoS solution based on the differentiated services (DiffServ) approach for enterprise networks, which is able to modify the priority level of a packet in real time by adjusting the value of Differentiated Services Code Point (DSCP) in Internet Protocol (IP) header of network packets. This is implemented by a 0-order TSK fuzzy model with a sparse rule base which is developed by considering the current network delay, application desired priority level and user current priority group. DSCP values are dynamically generated by the TSK fuzzy model and updated in real time. The proposed system has been evaluated in a real network environment with promising results generated

Generalized Adaptive Fuzzy Rule Interpolation

As a substantial extension to fuzzy rule interpolation that works based on two neighbouring rules flanking an observation, adaptive fuzzy rule interpolation is able to restore system consistency when contradictory results are reached during interpolation. The approach first identifies the exhaustive sets of candidates, with each candidate consisting of a set of interpolation procedures which may jointly be responsible for the system inconsistency. Then, individual candidates are modified such that all contradictions are removed and thus interpolation consistency is restored. It has been developed on the assumption that contradictions may only be resulted from the underlying interpolation mechanism, and that all the identified candidates are not distinguishable in terms of their likelihood to be the real culprit. However, this assumption may not hold for real world situations. This paper therefore further develops the adaptive method by taking into account observations, rules and interpolation procedures, all as diagnosable and modifiable system components. Also, given the common practice in fuzzy systems that observations and rules are often associated with certainty degrees, the identified candidates are ranked by examining the certainty degrees of its components and their derivatives. From this, the candidate modification is carried out based on such ranking. This work significantly improves the efficacy of the existing adaptive system by exploiting more information during both the diagnosis and modification processes

User centered neuro-fuzzy energy management through semantic-based optimization

This paper presents a cloud-based building energy management system, underpinned by semantic middleware, that integrates an enhanced sensor network with advanced analytics, accessible through an intuitive Web-based user interface. The proposed solution is described in terms of its three key layers: 1) user interface; 2) intelligence; and 3) interoperability. The system’s intelligence is derived from simulation-based optimized rules, historical sensor data mining, and a fuzzy reasoner. The solution enables interoperability through a semantic knowledge base, which also contributes intelligence through reasoning and inference abilities, and which are enhanced through intelligent rules. Finally, building energy performance monitoring is delivered alongside optimized rule suggestions and a negotiation process in a 3-D Web-based interface using WebGL. The solution has been validated in a real pilot building to illustrate the strength of the approach, where it has shown over 25% energy savings. The relevance of this paper in the field is discussed, and it is argued that the proposed solution is mature enough for testing across further buildings