%%\documentstyle[12pt,eclepsf]{article}
\documentstyle[eclepsf]{article}
\textheight 260mm
\topmargin 5mm
\textwidth 180mm
\oddsidemargin -7mm

\newtheorem{algorithm}{Algorithm}

\pagestyle{myheadings}
\markright{(ICNNAI'2006 -- at Brest, Belarus )}
\thispagestyle{empty}

\begin{document}
\begin{huge}

%% --- (title) ---
\begin{center}
{\bf How Many Parachutists will be Needed to Find \\ a Needle in a Pastoral?} \\
\hspace*{1in}\\
\hspace*{1in}\\
\hspace*{1in}\\ 
Akira Imada  \\
\hspace*{1in}\\
Brest State Technical University \\ 
Belarus
\end{center}


\clearpage
\begin{center}
{\bf Intrusion Detection by Soft-computing}\\
\end{center}
\noindent
{\LARGE CONTENTS:}
\begin{itemize} 
%%\setlength{\itemsep}{0pt}
\item Supervised Learning
   \begin{itemize}
   \item[$\star$] Samples for {\it Training} and {\it Testing}
      \begin{itemize}
      \item[$\cdot$] {\it Iris-flower} \& {\it KDD-cup-99} dataset
      \item[$\cdot$] A challenge using Iris-flower
      \end{itemize}
   \end{itemize}
\item Conjecture 1\\
      \hspace*{.4in} ``Intrusion is like a needle in hay not like an iris family''
   \begin{itemize}
   \item[$\star$] How to search for needles in hay? -- 4 experiments
   \end{itemize}
\end{itemize}


\clearpage
\noindent
{\LARGE CONTENTS:} \hfill(cont'd)
\hspace*{1in}\\
\begin{itemize}
\item Conjecture 2 \\
      \hspace*{.4in} ``No efficient such algorithm'' 
   \begin{itemize}
   \item[$\star$] Hoping to be a good debate
   \item[$\star$] Yet other two challanges
   \end{itemize}
\item Concluding Remarks
\end{itemize}

\clearpage
\begin{center}
{\bf  How to design an Intrusion Detection System \\ intelligently, if any?}\\
\end{center}
\begin{itemize}
\setlength{\itemsep}{0pt}
\item Two categories of detection
   \begin{itemize}
   \setlength{\itemsep}{0pt} 
   \item[$\star$] Detection of {\it known attack}.
   \item[$\star$] Detection of {\it unknown no-normal}.
   \end{itemize}
\end{itemize}
\bigskip
\begin{center}
Detecting known-attacks meaningful? \\
$\Downarrow$ \\
A lookup-table enough? \\
$\Downarrow$\\
Our interst is in detecting {\it unknown no-normal}.
\end{center}


\clearpage
\begin{center}
{\bf  General assumption:}\\
\end{center}

\begin{itemize} 
\item TCP/IP connection to a network
   \begin{itemize}
   \item[] $\Rightarrow$ can be represented by a $n$-dimensional vector
   \end{itemize}
\end{itemize}

\clearpage
\begin{center}
{\bf  Our Goal}\\
\end{center}

\noindent
$\bullet$ Is a vector input to our system a {\it Normal} or an {\it Attack}?

\begin{figure}[hb]
 \begin{center}
 \epsfile{file=b-box.eps,width=10cm,height=3.5cm}
 \end{center}
\end{figure}

\noindent
\begin{itemize}
\item A successful result in the literaturs seems to be
   \begin{itemize}
   \item[] {\it Accurate Detection Rate} $>$ 90\%
   \item[]{\it False Alarm Rate} $<$ 10 \%
   \end{itemize}
\end{itemize}


\clearpage
\begin{center}
{\bf  Training \& Testing}\\
\end{center}

\bigskip
\noindent
We need a testset when we want a supervised methods

\bigskip
\begin{itemize}
\item Frequantly used two public domain datasets.
   \begin{itemize}
   \item[$\star$] Iris-flower dataset.
   \item[$\star$] KDD-cup-1999 dataset
   \end{itemize}
\end{itemize}


%% --- (iris dataset) ---
\clearpage
\begin{center}
{\bf What is iris flower dataset}
\end{center}

\begin{LARGE}
\begin{itemize}
\item 3 families of iris flower $\Rightarrow$ 150 samples in total;
\item Each family $\Rightarrow$ 50 samples; Each sample $\Rightarrow$ 4 features.
\end{itemize}
\end{LARGE}

\begin{figure}[hb]
 \begin{center}
 \epsfile{file=iris-family.eps,width=12cm,height=4cm}
 \end{center}
\end{figure}


\clearpage
\noindent
\begin{center}
{\bf A reported success}\\
\hspace*{1in}\\
Castellano et al. (2000) \\
assumed one to be normal while the other two abnormal.

$\Downarrow$\\
$\bullet$ abnormal detection rate = 96\%  \\ 
$\bullet$ false alarm rate = 0.6\%\\

$\Downarrow$\\
But can we be so optimistic?\\
When a family of iris is normal then are others abnormal?\\


\end{center}


\clearpage
\begin{center}
{\bf Let's visualize iris families --- Sammon mapping} \\
\hspace*{1in}\\
Sammon mapping maps points in a high-D space to 2-D \\
\hspace*{1in}\\
by\\
\hspace*{1in}\\
keeping distance relation preserved as much as possible
\hspace*{1in}\\
or \\
distances in the $n$-D space are approximated 
by distances in 2-D space with a minimal error.\\
\end{center}

\clearpage
\begin{center} 
{\bf A Sammon mapping of iris families}
\end{center}
\begin{figure}[h]\label{fig:iris}
\begin{center}
     \epsfile{file=iris.eps,width=16cm,height=8cm}
\end{center}
\end{figure}


\clearpage
\begin{center} 
{\bf Where do outliers lie?}\\
\hspace*{1in}\\
Not in the domain for the other families!!\\
$\Downarrow$\\
Not at the point at random, either.\\
$\Downarrow$\\
But outlier usually hides behind Normal.
\end{center}


\clearpage
\begin{center}
{\bf Attacks by Mutant} \\
\end{center}
\hspace*{1in}\\
{\bf $\Box$  Charrange 1}
{\it
\begin{itemize}
\item[(1)] Assume one family as Normal
\item[(2)] Mutate the Normal samples and take them as Attack.
\item[(3)] Train your system with half of the \{Normal + Mutant\}
\item[(4)] Test the system with remaining \{Normal + Mutant\}
\end{itemize}
}

\begin{center}
\hspace*{1in}\\
$\Downarrow$\\
Will a successful result be possible? 
\end{center}


%% --- (KDD-cup-99 dataset) ---
\clearpage
\begin{center}
{\bf What is the KDD-cup-1999 Dataset?} 
\end{center}
\begin{itemize}
\setlength{\itemsep}{0pt}
\item {\it Attack} $\Rightarrow$ {\LARGE 32 attack types of the 4 categories:}
   \begin{itemize}
      \item[$\star$] {\it Probing}
         \begin{itemize}
            \item[] {\LARGE by proving a vulnerability of the network;}
         \end{itemize}
      \item[$\star$] {\it Denial-of-Service (DoS)}
         \begin{itemize}
            \item[] {\LARGE by denying legitimate requests to a system;}
         \end{itemize}
      \item[$\star$] {\it User-to-Root (U2R)} 
         \begin{itemize}
            \item[] {\LARGE an unauthorized access to local super-user or root;}
         \end{itemize}
      \item[$\star$] {\it Remote-to-Local (R2L)}
         \begin{itemize}
            \item[] {\LARGE an unauthorized local access from a remote machine.}
         \end{itemize}
   \end{itemize}
\item {\it Normal}
\end{itemize}


\clearpage
\begin{center}
{\bf How big is the KDD-cup-1999 dataset?}\\
\hspace*{1in}\\
Labeled 4,898,430 records $\Rightarrow$ {\it Training}\\
Un-labeled 311,029 records $\Rightarrow$ {\it Testing}\\
and\\
Each record is 41-dimensional vector\\
\hspace*{1in}\\
$\Downarrow$
\hspace*{1in}\\
Sammon Mapping wouldn't work any more!
\end{center}

\clearpage
\begin{center}
{\bf Can dimension be reduced?}
\end{center}
\begin{itemize}
\item Kuchimanchi et al.~(2004)
   \begin{itemize}
   \item[$\star$] 41-D to 19-D (by Principal Component Analysis)
      \begin{itemize}
      \item[$\cdot$] (detection accuracy, false positive) = (99.92\%, 0.26\%)
      \end{itemize}
   \item[$\star$] while the original being
      \begin{itemize}
      \item[$\cdot$] (detection accuracy, false positive) = (99.94\%, 0.23\%)
      \end{itemize}
   \end{itemize}
\item Joshi et al.~(2005)
   \begin{itemize}
   \item[$\star$] 41-D to 5-D
      \begin{itemize}
      \item[$\cdot$] (detection accuracy, false positive) = (79\%, 21\%)
      \end{itemize}
   \end{itemize}
\end{itemize}

\clearpage
\begin{center}
{\bf It might be interesting here to see \\ KDD-cup-99 winner's result}\\
\hspace*{1in}\\
Detection rate for 4 attack types
\end{center}

{\it
\begin{table}[h]
\begin{center}
\hspace*{1in}\\
\begin{tabular}{c c c c} \hline
                Probe  & DoS  & U2R  &  R2L \\ \hline
               83.3\%   & 97.1\% & 13.2\% & 8.4\%  \\ \hline
\end{tabular} 
\end{center}
\end{table}
}

\clearpage
\begin{center}
{\bf Detection rate by Sabhnani et al.~(2003)}
\end{center}
{\it
\begin{table}[h]
\begin{center}
\begin{tabular}{l c c c c} \hline
\hspace*{.1in}                     & Probe  & DoS  & U2R  &  R2L \\ \hline
Multi-layer Perceptron             & 88.7   & 97.2 & 13.2 & 5.6  \\
Gaussian Classifier                & 90.2   & 82.4 & 22.8 & 9.6  \\
$K$-mean Clustering                & 87.6   & 97.3 & 29.8 & 6.4  \\
Nearest Cluster Algorithm          & 88.8   & 97.1 &  2.2 & 3.4  \\
Radial Basis Function              & 93.2   & 73.0 &  6.1 & 5.9  \\
Leader Algorithm                   & 83.8   & 97.2 &  6.6 & 1.0  \\
Hypersphere Algorithm              & 84.8   & 97.2 &  8.3 & 1.0  \\
Fuzzy Art Map                      & 77.2   & 97.0 &  6.1 & 3.7  \\
C4.5 Decision Tree                 & 80.8   & 97.0 &  1.8 & 4.6  \\ \hline
\end{tabular} 
\end{center}
\end{table}
}

\clearpage
\begin{center}
{\bf We doubt the success by Kuchimanchi et al.}\\
\end{center}
\begin{itemize}
\item[]\hspace*{1in}
   \begin{itemize}
   \item[$\star$] 41-D to 19-D (by PCA)
      \begin{itemize}
      \item[$\cdot$] (detection accuracy, false positive) = (99.92\%, 0.26\%)
      \end{itemize}
   \item[$\star$] while the original being
      \begin{itemize}
      \item[$\cdot$] (detection accuracy, false positive) = (99.94\%, 0.23\%)
      \end{itemize}
   \end{itemize}
\end{itemize}
\begin{center}
$\Downarrow$\\
We won't go into detail here, but\\
\bigskip
Why U2R and R2L attacks resist to be detected?
\end{center}


\clearpage
\begin{center}
{\bf Ratios in the samples for testing}
\end{center}
{\it
\begin{table}[h]
\begin{center}
\hspace*{1in}\\
\begin{tabular}{c c c c c} \hline
\hspace*{.1in} Normal & Probe  & DoS    & U2R    &  R2L   \\ \hline
               19.5\% & 1.3\%  & 73.9\% & 5.2\%  & 0.1\%  \\ \hline
\end{tabular} 
\end{center}
\end{table}
}

\begin{center}
$\Downarrow$\\
{\it Always-return-U2R-strategy} would result in
\end{center}
{\it
\begin{table}[h]
\begin{center}
\begin{tabular}{c c c c} \hline
Probe    & DoS     & U2R    & R2L    \\ \hline
0.0\%    & 0.0\%   & 5.2\%  & 0.0\%  \\ \hline
\end{tabular} 
\end{center}
\end{table}
}
\hfill $\Rightarrow$ Better than C4.5 in Sabhnani et al.~(2003)


\clearpage
\begin{center}
{\bf Or}
\end{center}
\begin{itemize}
\item[] {\it always-return-randomly-strategy}
   \begin{itemize}
   \item[] which returns either Normal, Probe, DoS, U2R, or R2L at random regardless of the input.
   \end{itemize}
\item[]
\item[] $\Rightarrow$ a high score to detect DoS attacks, like
\end{itemize}
{\it
\begin{table}[h]
\begin{center}
\hspace*{1in}\\
\begin{tabular}{c c c c c} \hline
\hspace*{.1in} Normal & Probe  & DoS    & U2R    &  R2L   \\ \hline
               19.5\% & 1.3\%  & 73.9\% & 5.2\%  & 0.1\%  \\ \hline 
\end{tabular}
\end{center}
\hfill {\LARGE (Winner of KDD-cup-99)} \hspace*{1.2in}
\end{table}
}


\clearpage
\begin{center}
{\bf What we want?}
\end{center} 
\begin{figure}[hb]
 \begin{center}
 \epsfile{file=b-box-kdd.eps,width=16cm,height=8cm}
 \end{center}
\end{figure}


\clearpage
\noindent
{\bf A tiny set of R2L in a huge amount of Normal} \\
\begin{Large}
\begin{table}[h]
\begin{center}
\hspace*{1in}\\
\begin{tabular}{l c c c c c c} \hline
\hspace*{.1in}         & Total     & Normal & Probe  & DoS  & U2R  &  R2L \\ \hline
Labeled for Training   & 4,898,430 & 19.9\% & 0.8\%  & 79.3\% & $\approx$ 0.0\% & $\approx$0.0\%\\
Non-labeled for Testing& 311,029   & 19.5\% & 1.3\%  & 73.9\% & 5.2\%           & 0.1\%
\end{tabular} 
\end{center}
\end{table}
\end{Large}
\begin{center}
$\Downarrow$\\
Fictitious but possible distributions
\end{center}
\begin{figure}[h]
\begin{center}
  \epsfile{file=gauss-10.eps,width=5.8cm,height=4.5cm}
  \epsfile{file=gauss-20.eps,width=5.8cm,height=4.5cm}
  \epsfile{file=gauss-30.eps,width=5.8cm,height=4.5cm}
%%\epsfile{file=gauss-2.eps,width=12cm,height=4cm}
\end{center}
\end{figure}


\clearpage
\begin{center}
{\bf $\Box$ Conjecture 1}\\
\hspace*{1in}\\

{\it $\bullet$ U2R, R2L and Real Attacks are \\
\hspace*{2in} like needles in a haystack.}
\end{center}

\clearpage
\begin{center}
{\bf What does a needle look like in a haystack?}\\
\bigskip
The original Hinton \& Nowlan's Needle: \\
\end{center}
\begin{itemize}
\setlength{\itemsep}{0pt}
\item A-needle $\Rightarrow$ Only one configuration of 20-bit binary string.
             \hspace*{2.1in}{\LARGE like (11000 11010 11101 0100)}
%%   \begin{itemize}
%%   \item[$\star$] We don't know where the needle locates, but God knows.
%%   \end{itemize}
\item Haystack $\Rightarrow$ $2^{20}-1$ search points
\end{itemize}
\bigskip
\begin{center}
A fictitious needle in a haystack in 2D.
\end{center}
\begin{figure}[hb]
\begin{center}
\epsfile{file=a-needle-0.eps,width=15cm,height=1.5cm}
\end{center}
\end{figure}

\clearpage
\hspace*{2.2in}{\bf  Simple Gene}\\

\begin{figure}[h]
 \begin{center}
 \epsfile{file=gene-1.eps,width=10cm,height=3.5cm}
 \end{center}
\end{figure}

\clearpage
\begin{center}
{\bf 1. Random Fall of Parachutists}\\
\end{center}
\noindent
{\bf $\Box$ Algorithm 1}
{\it
\begin{itemize}
\item[(1)] Create a $p$-bit octal PIN at random.
\item[(2)] Create randomly one $3p$-bit of binary string.
\item[(3)] Translate the string into $p$-bit octal code. 
\item[(4)] Check if the translated code matches the PIN. 
\item[(5)] If matches, end the run. Otherwise go back to 2.
\end{itemize}
}
\begin{center}
$\Downarrow$\\ 
How many random tries will be needed to find the needle?
\end{center}

\clearpage
\begin{center}
{\bf Random Fall -- a critarion of comparison}
\end{center}
\begin{figure}[hb]
\begin{center}
\epsfile{file=random-fall.eps,width=16cm,height=8cm}
\end{center}
\end{figure}



\clearpage
\begin{center}
{\bf 2. What if they are allowed to walk after fall?}\\
\end{center}
\noindent
{\bf $\Box$ Algorithm 2}
{\it
\begin{itemize}
\setlength{\itemsep}{0pt}
\item[]  \hspace*{2in}$\cdots$
\item[(5)]  If matches, end the run. 
\item[]     If not matches,
   \begin{itemize}
   \item[$\cdot$] give a mutation (by flipping a bit chosen at random) 
                  with a probability of $1/3p$
   \end{itemize}
\item[] until the translation matches the PIN,\\ or number of steps exceeds 1000.
\end{itemize}
}

\clearpage
\begin{center}
{\bf Random Fall \& Walks after Fall}
\end{center}
\begin{figure}[hb]
\begin{center}
\epsfile{file=parachuters.eps,width=16cm,height=8cm}
\end{center}
\end{figure}


\clearpage
\begin{center}
{\bf But really that efficient?} \\
\end{center}
\begin{figure}[h]
\begin{center}
\epsfile{file=actual-how-many.eps,width=14cm,height=5cm}
\end{center}
\end{figure}
\begin{center}
$\Downarrow$\\
Alas, the actuall number of points searched for is much more than our random search.
\end{center}


\clearpage
\begin{center}
{\bf 3. Neutral Mutation}\\
\hspace*{1in}\\
Neutral genotype-phenotype Mappings \\
\hfill --- by Shipman et al.~(2000)\\
\hspace*{1in}\\
What is neutral mutation? \\
\bigskip
{\it One-to-many} genotype-phenotype mapping\\
$\Downarrow$\\
A mutation on a genotype without affecting phenotype
\end{center}

\clearpage
\begin{center}
{\bf Walk by Neutral Mutation}\\
\end{center}
\noindent
{\bf $\Box$ Algorithm 3} 
{\it
\begin{itemize}
\item[(3)] Try point-wise mutation on the genotype such that the result maps 
into the same phenotype as the one  before the mutation.
\item[(4)] Assess all possible single-mutation-neighbors of the new genotype 
to determine whether any new phenotype is discovered.
\item[(5)] Step 3 to 4 are repeated untill the phenotype matches the PIN, or
untill a pre-fixed number of steps is reached. 
\end{itemize}
}


\clearpage
\begin{center}
{\bf To implement a neutrality}\\

\hspace*{1in}\\

the-number-of-1 (mod 8) $\Rightarrow$ phenotype 
\end{center}

\begin{figure}[h]
 \begin{center}
 \epsfile{file=gene-2.eps,width=16cm,height=2.5cm}
 \end{center}
\end{figure}

\begin{center}
$\Downarrow$\\
\hspace*{1in}\\
Again, our result was worse than our random search.
\end{center}


\clearpage
\begin{center}
{\bf 4. Mutation on Intron}\\
\hspace*{1in}\\
What is mutation on intron? \\
\bigskip
Assume some of the genes do not affect phenotype.\\
$\Downarrow$\\
A mutation on the gene will not affect phenotype, either.\\
$\Downarrow$\\
neutral mutation
\end{center}



\clearpage
\begin{center}
{\bf Does Neutral Mutation on Intron Enhance Efficiency of Search?}\\

\hspace*{1in}\\
Yu \& Miller (2002) \\ 
{\it ``Finding needles in haystack is not hard with neutrality''} \\
vs.\\
~Collin's (2005)\\
{\it ``Finding needles in haystack is harder with neutrality''} \\
\end{center}


\clearpage
\begin{center}
{\bf Even-Parity Problem} \\
\bigskip
A strange fitness landscape\\
$\Downarrow$\\
Output $\Rightarrow$ all-correct/half-correct/not-correct-at-all\\
\end{center}
\bigskip
\begin{displaymath}
((XOR,A,B)(EQ,C,D)(XOR,1,E)(EQ,F,G)(EQ,3,H))
\end{displaymath}
\begin{center}$\Downarrow$\end{center}
\begin{figure}[h]
 \begin{center}
 \epsfile{file=even-5-parity.eps,width=12cm,height=2.5cm}
 \end{center}
\end{figure}


\clearpage
\begin{center}
{\bf Mutation on Intron}\\
\end{center}
\noindent
{\bf $\Box$ Algorithm 4}  -- by Yu \& Miller (2002) 
{\it
\begin{itemize}
\item[(2)] Create randomly an initial individual
which is considered to be the winner to the next generation.
\item[(3)] Carry out point-wise mutation on the winning parent to generate 4 offspring.
\item[(4)] Construct a new generation with the winner and its offspring.
\item[(5)] Select a winner from the current population using the following rules. 
      \begin{itemize}
      \item[(i)]  If any offspring has a better fitness than the parent,
           the one with highest fitness becomes the winner.
      \item[(ii)] If fitness of all offspring have the same fitness as the parent,
              one offspring is randomly selected, and
           if the parent-offspring pair has a Hamming distance within the permitted range, 
              the offspring becomes the winner, otherwise the parent remains as the winner.
      \end{itemize}
\item[(5)] Back to step 2 unless the maximum number of generations reaches, or a solution is found.
\end{itemize}
}


\clearpage
\begin{center}
{\bf  Intron}\\
\end{center}

\begin{figure}[hb]
 \begin{center}
 \epsfile{file=gene-3.eps,width=10cm,height=3.5cm}
 \end{center}
\end{figure}

\begin{center}
$\Downarrow$\\
Almost similar result as our random search.
\end{center}



\clearpage
\begin{center}
{\bf $\Box$ Conjecture 2}\\
\hspace*{1in}\\
{\it $\bullet$ No such effective algorithm to look for a needle}
\end{center}


\clearpage
\begin{center}
{\bf  ``Artificial immune system detects an attack!''} \\ 
\bigskip
How fantastic it sounds!\\
\hspace*{1in}\\
{\LARGE A landmark}\\
Forrest, Perelson et al.~(1994)\\
{\it ``Self Nonself Discrimination in a Computer''}\\
\hspace*{1in}\\
But two decads has passed since then and still an open issue.\\
\hspace*{1in}\\
$\Downarrow$ \\
We hope not, but isn't it just a fantasy?
\end{center}

\clearpage
\begin{center}
{\bf Training only by Normal}\\
\bigskip
Can a Sommelier be trained without bootlegs?

\bigskip
Gomez et al.~(2003)\\
{\it ``A  set of fuzzy rules characterized abnormal space 
using only normal samples.''}\\
by\\
10\% dataset of KDD-cup-1999 dataset \\
$\Downarrow$\\
{\it ``It detects attacks with the detection rate 98.30\% 
and false alarm rate 2.0\%.''} \\
$\Downarrow$\\
Really satisfactory, if it's really true.\\

\end{center}

\clearpage
\begin{center}
{\bf Attack by Dummy}
\end{center}

\noindent
{\bf $\Box$ Charrange 2}
{\it
\begin{itemize}
\item[(1)] Prepare two sub-datasets from KDD-cup-1999 dataset.
One is picked up from normal samples and call it  $D_{\mbox{\small normal}}$.
The other is from  attack samples and call it $D_{\mbox{\small attack}}$.
\item[(2)] Furthermore, randomly create an attack dataset -- dummy attacks, and call it 
$D_{\mbox{\small dummy}}$. 
\item[(3)] Train your intrusion detection system only with $D_{\mbox{\small normal}}$.
\item[(4)] Then, try two tests, one with only $D_{\mbox{\small attack}}$, and 
the other with only $D_{\mbox{\small dummy}}$, avoiding any a~priori prediction.
\end{itemize}
}


\clearpage
\begin{center}
{\bf Placebo Experiment}\\
\bigskip
Compare your system with a {\it random-replyer}
\end{center}

\noindent
{\bf $\Box$ Charrange 3}
{\it
\begin{itemize}
\item[(1)] Create a simple device which randomly returns 
either one of Normal, Prove, DoS, U2R, or R2L for any input. 
\item[(2)] Prepare a test dataset including enough amount of 
records uniformly from Normal, Prove, DoS, U2R, and R2L.
\item[(3)] Compare the performances of the detector you designed
with the random-reply-machine created in step 1,
feeding the same dataset prepared in step 2.
\end{itemize}
}


\clearpage
\begin{center}
{\bf Conclusion}
\end{center}

\noindent
a hacker is a person who is extremely good at finding 
a pattern which is very close to the normal traffic\\

%%\hspace*{1in}\\
\noindent
Sorry for this negatively sound conclusion


\noindent
Needless to say, however, this article is not to negate the possibility, but
we hope this will be a serious challenge to intrusion detection community
to emerge real innovative ideas.
\end{huge}
\end{document}

