Network intrusion might be like needles in hay How can we detect them?

Akira Imada Brest State Technical University Belarus When an iris flower is normal then are others abnormal?

A visualization of IRIS data by Sammon Mapping The data from KDD challange cup 98

4,920,210 data are given

⇓

each is made up of 42 attributes of which

⇓

4-crisp + 17-binary + 6-integer + 15-real

Still infinitely large area of not-defiened possible transactions remain!

Ayara’s Random Anomaly in 8-bit Binary Universe

152 and 160 abnormal patterns out of 2^{8} = 256 search points.

⇓ Asserted that successfully trained.

A Needle in a Haystack

A schematic skecth on fictitious 2D-space

The original Hinton & Nowlan’s Needle:

• A-needle ⇒ Only one configuration of 20 bits of binary string. ⋆ We don’t know where the needle locates, but God knows.

• Haystack ⇒ 2^{20} − 1 search points

How can we train the detector?

Can we train it with most likely haystack points?

How could we break a pincode of ATM?

⇓

Also a needle in a haystack!

⇓

Would a population search work?

(2 4 3 8) (0 9 5 7) (3 2 2 4)

......

Lifetime Learning – Baldwin Effect (Hinton & Nowlan 1993)

Population search + learning

(1 1 0 0 1 ? 0 ? 1 1 0 ? 1 0 0 ? 1 ? 0 1) (0 0 1 ? 1 0 0 1 1 ? 0 0 1 1 0 1 1 1 ? 1) (1 1 1 1 0 0 0 0 0 1 ? ? 0 0 1 0 ? 1 0 1)

......

How difficult?

Random Search ⇒ 2^{20} = 1, 048, 576 Random Search

⇓

Placebo ⇒ Criteria of Comparison

Yet another needles in hay — even-n-parity

Strange behavior of Even-n-parity constructed with only XOR and EQ