\documentstyle[twocolumn,eclepsf,IEEEtran]{article}

\def\BibTeX{{\rm B\kern-.05em{\sc i\kern-.025em b}\kern-.08em
    T\kern-.1667em\lower.7ex\hbox{E}\kern-.125emX}}
\def\bs{-0.5ex}
\newtheorem{theorem}{Theorem}

\begin{document}

%%\title{\mbox{When an iris flower is normal then are others abnormal?}}
\title{When an iris flower is normal then are others?}

\author{{\bf Akira Imada} \\
            \normalsize Brest State Technical University, Belarus \\ [\bs]
            \normalsize Moskowskaja 267, 224017 Brest, Belarus \\ [\bs]
            \normalsize akira@bstu.by \\ [\bs]
                \And
        {\bf Leonard da'Vinci} \\
            \normalsize Graduate School of Information Science\\ [\bs]
            \normalsize Nara Institute of Science and Technology\\ [\bs]
            \normalsize 8916-5 Takayama, Ikoma, Nara,\\ [\bs]
            \normalsize 630-01 Japan\\ [\bs]
            \normalsize araki@is.aist-nara.ac.jp \\ [\bs]}
\pagestyle{empty}
\maketitle

\begin{abstracttext}
\noindent
In the context of Network Intrusion Detection,
we test a lately reported technique which generates
a set of fuzzy rules to recognize unknown abnormal patterns
using a test-function, what we call 
a-tiny-island-in-a-huge-lake.
Our concern is whether or not we can train the system
only with a set of already known normal patterns.
Yet another of our concern is what happens in an extreme case where
a  sample of abnormal patterns are extremely few comparing to  
the normal ones, and what if it eventually shrinks to zero, which is
what they call a-needle-in-a-haystack.
\end{abstracttext}


\bigskip
\section{Introduction}
\noindent
This paper reports a snapshot of our on-going experiments 
in which a common target we call {\it a-tiny-island-in-a-huge-lake} 
is explored with different methods ranging from 
a data-mining technique to an artificial immune system. 
Our implicit interest is a network intrusion detection, and
we assume data floating in the {\it huge lake} are normal while 
ones found on the {\it tiny island} are abnormal.

\bigskip
\subsection{How to put figures?}
\noindent
Our goal here is twofold. One is to know 
{\it whether or not it is possible
to train a system using just normal data alone.}
The other is to study {\it a limit of the size of the detectable area},
when we decrease the size of the island 
eventually shrinking to zero, equivalently  so-called
{\it a-needle-in-a-haystack} (See Fig.~1) which is still an open and 
worth while tackling problem.

\bigskip
\subsection{This is an example}
To learn these two issues, a fuzzy rule extraction system 
with fixed triangle/trapezoid membership functions 
are exploited in this paper.\\

%%-------------------------------------------------------
\begin{figure}[hb]
 \begin{center}
 \epsfile{file=a-needle-0.eps,width=8cm,height=1.5cm}
 \caption{A fictitious sketch of fitness landscape of 
          {\it a-needle-in-a-haystack}. The haystack here is drawn 
          as a two-dimensional flat plane of fitness zero.}
 \end{center}
\end{figure}
%%-------------------------------------------------------


\bigskip
\subsection{An example of table}
\noindent
When we think of a network intrusion detection, 
we have a large collection of normal patterns
while the number of possible anomaly patterns we know 
is extremely few, which is of usual cases. See Table 1.

\begin{table}[bhtp]
\begin{center}
\caption{Generation number at which the elitest individual 
in the generation attains fitness of 1.000, for 12, 13, 14, 15 and 16 
patterns.}
\vspace{.1in}
\begin{footnotesize}
\begin{tabular}{c c c c c c}                           \hline \hline
patterns                & 12  &  13   &   14  &   15    &   16    \\   \hline
generation              & 354 & 1268  &  6003 &  6688   &  10795  \\   \hline \hline
\end{tabular}
\end{footnotesize}
\end{center}
\end{table}

\subsection{How to cite a reference}
Furthermore, we usually don't know
what do anomaly patterns look like in advance \cite{akir}.
It is usually too late when we know it. 
Hence, our second concern is whether or not
we can train the system with only a set of normal patterns.

\section{An example of equations}
\noindent
A set of fuzzy rules is used to cover the non-self patterns. 
As already mentioned, self/non-self cells are represented by 
$n$-dimensional real valued vectors each of whose coordinate 
lies in $[-1, 1]$.

%%-------------------------------------------------------
\begin{displaymath}
\mbox{fitness} (R) = 1 - \max_{\mbox{\bf x} \in Self} 
\{ \min_{i=1, \cdots, n} \{ \mu_{T_i} (x_i)\}\}
\end{displaymath}
%%-------------------------------------------------------
\noindent
which implies how the rule covers the non-self space.\\

\bigskip
\section{CONCLUSION}
\noindent
We have described how we would be able to find
a small island in a huge lake with a system training
only using data in a lake. This is a metaphor in which
a very few of unpredictable abnormal transaction patterns 
hidden in an enormous amount of normal patterns, in the context
of network intrusion detection.


\bigskip
\begin{thebibliography}{99}

\bibitem{akir}
A. Imada (2004)
``How a Peak on a Completely-flatland-elsewhere can be Searched for?''
Proceedings of Advanced Computer Systems (ACS) and 
Computer Information Systems
and Industrial Management Applications (CISIM), Vol.2, pp. 171--150.

\end{thebibliography}
\end{document}
