When a flower of iris is normal then are others abnormal?

Akira Imada

Brest State Technical University Belarus

In pattern recognition/classification

above all

ANOMALY (intrusion) DETECTION our current concerne

we need

test data to test an intrusion-detector we are designing.

(PRIP-2005 – at Minsk, Belarus) 3

“When a flower of iris is normal then are others abnormal?”

So many used Fisher’s Iris Dataset. But why IRIS? Why not the other one? just saying “Because this is a widely used benchmark data.” ⇓ Tautology?

(PRIP-2005 – at Minsk, Belarus) 4

References

[1] Timmis et al. (2000) An artificial immune system for data analysis. Biosystems, 55(1/3):143–150.

[2] J. Kim and P. J. Bentley (2001) Towards an Artificial Immune System for Network Intrusion Detection: An Investigation of Clonal Selection with a Negative Selection Operator. Proceedings of the Congress on Evolutionary Computation.

[3] Yu Guan K-means+: An Autonomous Clustering Algorithm.

[4] L. N. de Castro and J. Timmis Artificial Immune Systems: A Novel Paradigm to Pattern Recognition.

[5] I. Antoniou et al. (1999) Information processing in Artificial Immune Systems: approaches and state of the art. Preprint of the International Solvay Institutes for Physics and Chemistry, SOLVAY 01-03, Brussels, 1999.

[6] A. Watkins et al. (2004) Artificial immune recognition system (AIRS): Revisions and refinments. Proc. of the Society for the Study of Artificial Intelligence and the Simulation of Behaviour (AISB) 2004 Symposium on the Immune System and cognition. pp. 18–26.

[7] E. Hart (2002) Immunology as a Metaphor for Computational Information Processing: Fact or Fiction ? Ph.D. Dissertation. Artifcial Intelligence Applications Institute, Division of Informatics, University of Edinburgh

[8] D. E. Goodman, Jr et al. (2001) An Investigation into the Source of Power for AIRS, an Artificial Immune Classification System.

[9] J. Mill et al. (2003) An Application of Fuzzy Support Vectors.

[10] D. E. Hershberger et al. (2002) Distributed Multivariate Regression Using Wavelet-based Collective Data Mining.

(PRIP-2005 – at Minsk, Belarus) 5

However, very impressive results are shown. e.g., Kim &Bentley (2001) three different data sets

by taking one set as a SELF set and the rest as a

NON-SELF set. A tenfold cross-validation method ⇓ the best TP rate reached 100%

the worst FP average rate was only 1%.

(PRIP-2005 – at Minsk, Belarus) 6

tiny island in huge lake

needle in haystack

or

A random set of SELF and NON-SELF. (Ayara et al.)

All points in the space should be representative of

transaction. ⇓

We doubt IRIS is not such a case.

(PRIP-2005 – at Minsk, Belarus) 7

what does iris data look like?

5.1 3.5 1.4 0.2 setosa
4.9 3.0 1.4 0.2 setosa
4.7 3.2 1.3 0.2 setosa
· · · · · · · · · · · ·  ⋯
7.0 3.2 4.7 1.4 versicolor
6.4 3.2 4.5 1.5 versicolor
6.9 3.1 4.9 1.5 versicolor
· · · · · · · · · · · ·  ⋯
6.3 3.3 6.0 2.5 virginica
5.8 2.7 5.1 1.9 virginica
7.1 3.0 5.9 2.1 virginica
· · · · · · · · · · · ·  ⋯

(PRIP-2005 – at Minsk, Belarus) 9

□ Let’s visualize the Iris Dataset of 4D — Sammon Mapping

(PRIP-2005 – at Minsk, Belarus) 10

□ A tiny-flat-island in a huge-lake

(PRIP-2005 – at Minsk, Belarus) 11

—-

in conclusion if we know anomalcy should be in a known set its really easy to detect.

another training should be only by nomal