\documentstyle[twocolumn,eclepsf,IEEEtran]{article}

\def\BibTeX{{\rm B\kern-.05em{\sc i\kern-.025em b}\kern-.08em
    T\kern-.1667em\lower.7ex\hbox{E}\kern-.125emX}}
\def\bs{-0.5ex}
\newtheorem{theorem}{Theorem}

\begin{document}

%%\title{\mbox{When an iris flower is normal then are others abnormal?}}
\title{When an iris flower is normal then are others?}

\author{{\bf Akira Imada} \\
            \normalsize Brest State Technical University, Belarus \\ [\bs]
            \normalsize Moskowskaja 267, 224017 Brest, Belarus \\ [\bs]
            \normalsize akira@bstu.by \\ [\bs]
                \And
        {\bf Leonard da'Vinci} \\
            \normalsize Graduate School of Information Science\\ [\bs]
            \normalsize Nara Institute of Science and Technology\\ [\bs]
            \normalsize 8916-5 Takayama, Ikoma, Nara,\\ [\bs]
            \normalsize 630-01 Japan\\ [\bs]
            \normalsize araki@is.aist-nara.ac.jp \\ [\bs]}
\pagestyle{empty}
\maketitle

\begin{abstracttext}
\noindent
In the context of Network Intrusion Detection,
we test a lately reported technique which generates
a set of fuzzy rules to recognize unknown abnormal patterns
using a test-function, what we call 
a-tiny-island-in-a-huge-lake.
Our concern is whether or not we can train the system
only with a set of already known normal patterns.
Yet another of our concern is what happens in an extreme case where
a  sample of abnormal patterns are extremely few comparing to  
the normal ones, and what if it eventually shrinks to zero, which is
what they call a-needle-in-a-haystack.
\end{abstracttext}


\bigskip
\section{Introduction}
\noindent
This paper reports a snapshot of our on-going experiments 
in which a common target we call {\it a-tiny-island-in-a-huge-lake} 
is explored with different methods ranging from 
a data-mining technique to an artificial immune system. 
Our implicit interest is a network intrusion detection, and
we assume data floating in the {\it huge lake} are normal while 
ones found on the {\it tiny island} are abnormal.

\bigskip
\subsection{How to put figures?}
\noindent
Our goal here is twofold. One is to know 
{\it whether or not it is possible
to train a system using just normal data alone.}
The other is to study {\it a limit of the size of the detectable area},
when we decrease the size of the island 
eventually shrinking to zero, equivalently  so-called
{\it a-needle-in-a-haystack} (See Fig.~1) which is still an open and 
worth while tackling problem.

\bigskip
\subsection{This is an example}
To learn these two issues, a fuzzy rule extraction system 
with fixed triangle/trapezoid membership functions 
are exploited in this paper.\\

%%-------------------------------------------------------
\begin{figure}[hb]
 \begin{center}
 \epsfile{file=a-needle-0.eps,width=8cm,height=1.5cm}
 \caption{A fictitious sketch of fitness landscape of 
          {\it a-needle-in-a-haystack}. The haystack here is drawn 
          as a two-dimensional flat plane of fitness zero.}
 \end{center}
\end{figure}
%%-------------------------------------------------------

\noindent
When we think of a network intrusion detection, 
we have a large collection of normal patterns
while the number of possible anomaly patterns we know 
is extremely few, which is of usual cases.
Then our concern is how we can train a system
with a lack of negative training data.\\

\subsection{How to cite a reference}
Furthermore, we usually don't know
what do anomaly patterns look like in advance \cite{akir}.
It is usually too late when we know it. 
Hence, our second concern is whether or not
we can train the system with only a set of normal patterns.
So far, lots of such approaches have been proposed 
claiming they had very successful results. 
In other words, those intrusion detection systems train themselves 
with already known normal patterns and then it succeeds in warning
when a so far unknown anomaly pattern is given,
though we doubt  it more or less.\\

\section{An example of equations}
\noindent
A set of fuzzy rules is used to cover the non-self patterns. 
As already mentioned, self/non-self cells are represented by 
$n$-dimensional real valued vectors each of whose coordinate 
lies in $[-1, 1]$.

%%-------------------------------------------------------
\begin{displaymath}
\mbox{fitness} (R) = 1 - \max_{\mbox{\bf x} \in Self} 
\{ \min_{i=1, \cdots, n} \{ \mu_{T_i} (x_i)\}\}
\end{displaymath}
%%-------------------------------------------------------
\noindent
which implies how the rule covers the non-self space.\\

\bigskip
\section{CONCLUSION}
\noindent
We have described how we would be able to find
a small island in a huge lake with a system training
only using data in a lake. This is a metaphor in which
a very few of unpredictable abnormal transaction patterns 
hidden in an enormous amount of normal patterns, in the context
of network intrusion detection.\\


\bigskip
\begin{thebibliography}{99}

\bibitem{akir}
A. Imada (2004)
``How a Peak on a Completely-flatland-elsewhere can be Searched for?
--- A Fitness Landscape of Associative Memory by Spiking Neurons.''
Proceedings of Advanced Computer Systems (ACS) and 
Computer Information Systems
and Industrial Management Applications (CISIM), Vol.2, pp. 171--150.

\end{thebibliography}
\end{document}
