Can an Immuno-fuzzy Approach Detect Only a Few Non-self Cells Existed in an Enormous Amount of Self Cells?
Akira Imada 
Brest State Technical University, Moskowskaja 267 Brest 224017 Belarus, akira@bstu.by, http://neuro.bstu.by/ai/akira.html

Abstract - In the context of Network Intrusion Detection, we test a lately reported technique which generates a set of fuzzy rules to recognize unknown abnormal  atterns using a test-function, what we call a-tiny-island-in-a-huge-lake. Our concern is whether or not we can train the system only with a set of already known  normal patterns. Yet another of our concern is what happens in an extreme case where a  sample of abnormal patterns are extremely few comparing to  the normal ones, and what if it eventually shrinks to zero, which is what they call a-needle-in-a-haystack.

Keywords - Network Intrusion Detection, Test samples, Fuzzy rule.
I.	Introduction
This paper reports a snapshot of our on-going experiments in which a common target we call {\it a-tiny-island-in-a-huge-lake} is explored ith different methods ranging from a data-mining technique to an artificial immune system. Our implicit interest is a network intrusion detection, and
we assume data floating in the {\it huge lake} are normal while ones found on the {\it tiny island} are abnormal. Our goal here is twofold. One is to know {\it whether or not it is possible to train a system using just normal data alone.} The other is to study {\it a limit of the size of the  etectable area}, when we decrease the size of the island  eventually shrinking to zero, equivalently  so-called {\it a-needle-in-a-haystack} (See Fig.~1) which is still an open and worth while tackling problem. To learn these two issues, a fuzzy rule extraction system with fixed triangle/trapezoid membership functions are exploited in this paper.\\

When we think of a network intrusion detection, we have a large collection of normal patterns while the number of possible anomaly patterns we know is extremely few, which is of usual cases. Then our concern is how we can train a system with a lack of negative training data.
Furthermore, we usually don't know what do anomaly patterns look like in advance. It is usually too late when we know it.  Hence, our second concern is whether or not we can train the system with only a set of normal patterns. So far, lots of such approaches have been proposed claiming they had very successful results.  In other words, those intrusion detection systems train themselves  with already known normal  atterns and then it succeeds in warning when a so far unknown anomaly pattern is given, though we doubt  it more or less.\\
{\it ``A tiny island in a huge lake''} --- this is a problem we'd proposed in which a few number of unknown patterns should be recognized or classified from an enormous number of known patterns~\cite{akir}, which is up to now still an open issue. Originally the problem described, in particular, a fitness landscape when we searched for a weight configuration which gives a network with fully-connected spiking neurons a function of associative memory. In this paper, we regard the problem from a view point of  anomaly detection by an immuno-fuzzy approach.
That is, we take it just a general  pattern classification problem on the condition, however, that we have two classes one of which has an extremely few patterns while the other has almost infinite number of patterns.  Or, we might as well take it  a task of discrimination of  a few of non-self cells as anomaly patterns from enormous amount of self cells  from artificial immune system point of view.\\
In order to explore this issue, we formalize the problem as follows. We assume we have $n$-dimensional patterns all of  whose real-valued co-ordinates lie in $[-1,1]$. This construct our self/non-self space. Anomaly patterns have their co-ordinates each of whose value lies in $[-a,a]$,  while all others  are regarded as normal patterns. We can control the difficulty of the task by changing the value of $a$. In the ultimate case in which the pattern whose co-ordinates are all zero, is called a-needle-in-a-haystack problem.

II. 	Experiment
Your goal is to simulate the usual appearance of papers in an IEEE conference proceedings. For items not addressed in these instructions, please refer to the last issue of your conference’s proceedings or your Publications chair.
Preparing your Electronic Paper
The authors should submit 4-6 MS WORD pages of camera-ready paper (in English only) by e-mail. Use A4 (210 x 297 mm) format of the paper. The camera-ready paper size should be NO MORE than six pages. Authors are strongly recommended to fill the last page of the paper at least up to the 2/3 of sheet. Please, don’t use numbering pages in your papers.
Type sizes and typefaces: Follow the type sizes specified in Table I. The text should be typed single-spaced. Use Times New Roman typeface throughout the paper.
A4 margins: top = 19mm (0.75 in), bottom = 43mm (1.69 in), left = 23mm (0.91 in), right = 20mm (0.79 in). The column width is 81,5mm (3.21 in). The space between the two columns is 4mm (0.16 in). Paragraph indentation is 3.5 mm (0.14 in). Space from the top headline (first page only) 17mm (0.67 in).
Type the text of the paper in two columns. Balance the length of the columns, especially on the last page of the paper. Left- and right-justify your columns. Use tables and figures to adjust column length. On the last page of your paper, adjust the lengths of the columns so that they are equal. Use automatic hyphenation and check spelling. Digitize or paste down figures.

II.	Helpful Hints
A.	Figures and Tables

Fig. 1. Magnetization as a function of applied field. Note how the caption is centered in the column.
TABLE I
Type Sizes for Papers
Type size (pts.)	Appearance	
	Regular	Bold	Italic	
8	References, table header,a footnotes, text subscripts, and superscripts			
9	Table captions,a table names,a table superscripts, figure captions		Abstract, keywords	
10	Authors’ affiliations, main text, equations		Subheading	
12	Authors’ names			
16		Paper title		
	aUppercase			

Position figures and tables at the tops and bottoms of columns. Avoid placing them in the middle of columns. Large figures and tables may span across both columns. Figure captions should be centered below the figures; table captions should be centered above. Avoid placing figures and tables before their first mention in the text. Use the abbreviation “Fig. 1,” even at the beginning of a sentence.
Figure axis labels are often a source of confusion. Use words rather than symbols. For example, write “Magnetization,” or “Magnetization, M,” not just “M.” Put units in parentheses. Do not label axes only with units. In the example, write “Magnetization (A/m)” or “Magnetization (A × m-1).” Do not label axes with a ratio of quantities and units. For example, write “Temperature (K),” not “Temperature/K.”
Multipliers can be especially confusing. Write “Magnetization (kA/m)” or “Magnetization (103 A/m).” Figure labels should be legible, about 9-point type.
B.	References
Number citations consecutively in square brackets [1]. Punctuation follows the bracket [2]. Refer simply to the reference number, as in [3]. Use “Ref. [3]” or Reference [3]” at the beginning of a sentence: “Reference [3] was the first …”
Number footnotes separately in superscripts. Place the actual footnote at the bottom of the column in which it was cited. Do not put footnotes in the reference list. Use letters for table footnotes (see Table I). IEEE Transactions no longer use a journal prefix before the volume number. For example, use “IEEE Trans. Magn., vol. 25,” not “vol. MAG-25.
Give all authors’ names; use “et al.” if there are six authors or more. Papers that have not been published, even if they have been submitted for publication, should be cited as “unpublished” [4]. Papers that have been accepted for publication should be cited as “in press” [5]. In a paper title, capitalize the first word and all other words except for conjunctions, prepositions less than seven letters, and prepositional phrases.
For papers published in translated journals, first give the English citation, then the original foreign-language citation [6].
C.	Abbreviations and Acronyms
Define abbreviations and acronyms the first time they are used in the text, even if they have been defined in the abstract. Abbreviations such as IEEE, SI, MKS, CGS, sc, dc, and rms do not have to be defined. Do not use abbreviations in the title unless they are unavoidable.
D.	Equations
Number equations consecutively with equation numbers in parentheses flush with the right margin, as in (1). To make your equations more compact, you may use the solidus ( / ), the exp function, or appropriate exponents. Italicize Roman symbols for quantities and variables, but not Greek symbols. Use an en dash (–) rather than a hyphen for a minus sign. Use parentheses to avoid ambiguities in denominators. 

	(1)

Please set in Microsoft Equation following fonts: Regular – 12 pt, Large index – 7 pt, Small index – 5 pt, Large symbol – 18 pt, Small Symbol – 12 pt. Leave one blank line above and below each equation. For example, the line expression
Symbols in your equation should be defined before the equation appears or immediately following. Use “(1),” not “Eq. (1)” or “equation (1),” except at the beginning of a sentence: “Equation (1) is …”
E.	Other Recommendations
The Roman numerals used to number the section headings are optional. If you do use them, do not number Acknowledgment and References, and begin Subheadings with letters. Hyphenate complex modifiers: “zero-field-cooled magnetization.” Avoid dangling participles, such as, “Using (1), the potential was calculated.” Write instead, “The potential was calculated using (1),” or “Using (1), we calculated the potential.”
Use a zero before decimal points: “0.25,” not “.25.” Use “cm3,” not “cc.” Do not mix complete spellings and abbreviations of units: “Wb/m2” or “webers per square meter,” not “webers/m2.” Spell units when they appear in text: “…a few henries,” not “…a few H.” If your native language is not English, try to get a native English-speaking colleague to proofread your paper. Do not add page numbers.
III.	Units
Use either SI (MKS) or CGS as primary units. (SI units are encouraged.) English units may be used as secondary units (in parentheses). An exception would be the use of English units as identifiers in trade, such as “3.5-inch disk drive.”
Avoid combining SI and CGS units, such as current in amperes and magnetic field in oersteds. This often leads to confusion because equations do not balance dimensionally. If you must use mixed units, clearly state the units for each quantity that you use in an equation.
IV.	Some Common Mistakes
The word “data” is plural, not singular. The subscript for the permeability of vacuum0 is zero, not a lowercase letter “o.” In American English, periods and commas are within quotation marks, like “this period.” A parenthetical statement at the end of a sentence is punctuated outside of the closing parenthesis (like this). (A parenthetical sentence is punctuated within the parentheses.) A graph within a graph is an “inset,” not an “insert.” The word alternatively is preferred to the word “alternately” (unless you mean something that alternates). Do not use the word “essentially” to mean “approximately” or “effectively.” Be aware of the different meanings of the homophones “affect” and “effect,” “complement” and “compliment,” “discreet” and “discrete,” “principal” and “principle.” Do not confuse “imply” and “infer.” The prefix “non” is not a word; it should be joined to the word it modifies, usually without a hyphen. There is no period after the “et” in the Latin abbreviation “et al.” The abbreviation “i.e.” means “that is,” and the abbreviation “e.g.” means “for example.” An excellent style manual for science writers is [7].
References
[1]	G. Eason, B. Noble, and I.N. Sneddon, “On certain integrals of Lipschitz-Hankel type involving products of Bessel functions,” Phil. Trans. Roy. Soc. London, vol. A247, pp. 529-551, April 1955.

[1] A. Imada "How a Peak on a Completely-flatland-elsewhere can be Searched for? --- A Fitness Landscape of Associative Memory by Spiking Neurons.'' Proceedings of Advanced Computer Systems (ACS) and Computer Information Systems and Industrial Management Applications (CISIM), Vol.2, pp. 171--150, 2004.
[2] J. Gomez, F. Gonzalez, and  D. Dasgupta (2003) "An Immuno-Fuzzy Approach to Anomaly Detection" Proceedings of the 12th IEEE International Conference on Fuzzy Systems, Vol. 2, pp.~1219-1224, 2003.
[3] M. Ayara, J. Timmis, R. D. Lemos, L. N. D. Castro, and R. Duncan. "Negative Selection: How to Generate Detectors."  Proceedings of 1st International Conference on Artificial Immune Systems pp. 89--98, 2002.
[4] P. Helman and S. Forrest. "An Efficient Algorithm for Generating Random Antibody Strings." Technical Report 94-07, University of New Mexico, Albuquerque, NM. 1994.
[5] P. D'haeseleer, S. Forrest, and P. Helman. "An immunological approach to change detection: algorithms, analysis and implications." Proceedings of the 1996 IEEE Symposium on Computer Security and Privacy, pp. 110--119, 1996.
[6] F. Esponda, S. Forrest. "Detector coverage under the r-contiguous bits matching rule." University of New Mexico Technical Report TR-CS-2002-03, 2002.
[7] F. Esponda, S. Forrest, and P. Helman. "A formal framework for positive and negative detection." IEEE Transactions on Systems, Man, and Cybernetics 34:1 pp. 357-373, 2004.
[8] J. Kim and P. J. Bentley "Towards an Artificial Immune System for Network Intrusion Detection: An Investigation of Clonal Selection with a Negative Selection Operator.'' Proceedings of the Congress on Evolutionary Computation. 2001.
[9] Kwee-Bo Sim and Dong-Wook Lee.  "Modeling of Positive Selection for the Development of a Computer Immune System and a Self-Recognition Algorithm." International Journal of Control, Automation, and Systems Vol. 1, No. 4,  pp. 453--458, 2003.
[10] Dasgupta, et al (1999) "An Anomaly Detection Algorithm Inspired by the Immune System." Dasgupta et al. (Eds), Artificial Immune System and Their Application, 1999.
[11] Z. Ji and D. Dasgupata. "Augmented Negative Selection Algorithm with Variable-Coverage Detectors." Proceedings of the Congress on Evolutionary Computation, 2004.
[12] F. Gonzalez, D. Dasgupta. "Anomaly Detection Using Real-Valued Negative Selection." Genetic Programming and Evolvable Machines, Vol. 4 No. 4, Kluwer Academic Press, pp 383-403, 2003.
[13] F. Gonzalez, D. Dasgupta and L. F. Nino. "A Randomized Real-Valued Negative Selection Algorithm." Proceedings of the 2nd International Conference on Artificial Immune Systems, 
[14] Gonzalez, F., D. Dasgupta, J. Gomez. "The Effect of Binary Matching Rules in Negative Selection."  GECCO, 2003
[15] D. Dasgupta and N. S. Majumdar. "Anomaly detection in Multidimensional Data using Negative Selection algorithm." Proceedings of the Congress on Evolutionary Computation, 2002.
[16] Ceong, H. T., et al.  "Complementary Dual Detectors for Effective Classification." ICARIS-03, pp.242-248, 2003.
[17] J. Kim and P. Bentley. "An evaluation of negative selection in an artificial immune system for network intrusion detection." Proceedings Genetic Evolutionary Computation Conference, 2001.
[18] J. Gomez, F. Gonzalez, and  D. Dasgupta. "An Immuno-Fuzzy Approach to Anomaly Detection" Proceedings of the 12th IEEE International Conference on Fuzzy Systems, Vol. 2, pp. 1219-1224, 2003.
[19] J. Gomez and D. Dasgupta. "Evolving Fuzzy Classifiers for Intrusion Detection"  J. Gomez, O. Nasraoui, D. Dasgupta, and F. Gonzalez. "Complete Expression Trees for Evolving Fuzzy Classifier Systems with Genetic Algorithms and Application to Network Intrusion Detection." Proceedings of the IEEE, North American Fuzzy Information Processing Society Conference on Fuzzy Learning, 2002.
[20] J. Gomez and D. Dasgupta. "Using Competitive Operators and a Local Selection Scheme in Genetic Search." Proceedings (Late-Breaking) of the Genetic and Evolutionary Computation Conference, pp. 193-200, 2002.
[21] F. HOFFMANN Soft Computing Techniques for the Design of Mobile Robot Be-haviours"
[22] F. Hofmann and G. Pfister "A New Learning Method for the Design of Hierarchical Fuzzy Controllers Using Messy Genetic Algorithms" 1995
[23] M. M. Chowdhury and Yun Li "Messy Genetic Algorithm Based New Learning Method for Structurally Optimised Neurofuzzy Controllers" 
[24] W. Lee and S. Stolfo. "Data mining approaches for intrusion detection." Proceedings of the 7th USENIX security symposium (San Antonio, TX). 1998