HAL Id: hal-01400263
https://hal.inria.fr/hal-01400263
Submitted on 20 Dec 2016
HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.
L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.
VorAIS: A Multi-Objective Voronoi Diagram-based Artificial Immune System
Luis Marti, Arsene Fansi-Tchango, Laurent Navarro, Marc Schoenauer
To cite this version:
Luis Marti, Arsene Fansi-Tchango, Laurent Navarro, Marc Schoenauer. VorAIS: A Multi-Objective Voronoi Diagram-based Artificial Immune System . T. Friedrich and F. Neumann. Genetic and Evolutionary Computation Conference, GECCO 2016, Jul 2016, Denver, United States. pp.11 - 12, 2016, Poster at GECCO 2016 (Companion). �10.1145/2908961.2909027�. �hal-01400263�
VorAIS: A Multi-Objective Voronoi Diagram-based
Artificial Immune System
Luis Martí
1,2Arsene Fansi-Tchango
3Laurent Navarro
3Marc Schoenauer
11 TAO team, INRIA/LRI(CNRS & UPSud), Université Paris-Saclay, Paris, France.
2 Universidade Federal Flumnense, Niterói (RJ) Brazil.
3 ThereSIS, Thales Group, Paris, France.
Ź Artificial Immune Systems have been derived from existing theories of the
functioning of biological immune systems.
Ź They create a model that is able to discriminate between normal (self) and
abnormal (non-self) objects.
Ź This feature makes AISs specially suited for dealing with problems related
to anomaly and intrusion detection.
Context
VorAIS models the self/non-self using a Voronoi diagram that determines which areas of the problem domain correspond to self
or to non-self.
Ź Various classification metrics, like accuracy, recall, and specificity, must be
taken into account.
Ź Multi-objective approach based on non-dominated sorting of NSGA-II.
Ź We introduce a mating operator as part of the AIS.
Voronoi diagram-based Artificial Immune System
Voronoi diagram individuals
15 10 5 0 5 10 15 15 10 5 0 5 10 15 Ind. 1; accuracy=0.7260 15 10 5 0 5 10 15 15 10 5 0 5 10 15 Ind. 2; accuracy=0.4600 15 10 5 0 5 10 15 15 10 5 0 5 10 15 Ind. 3; accuracy=0.2970 15 10 5 0 5 10 15 15 10 5 0 5 10 15 Ind. 4; accuracy=0.4550
Correct classification Incorrect classification
Mating operator
Mutation operator
function mutate_voronoi(I, ps, pf, pt, p`, p´, η)
Ź I, individual to be mutated.
Ź ps P r0, 1s, prob. of mutating a site.
Ź pf P r0, 1s, prob. of mutating a site’s feature. Ź pt P r0, 1s, prob. of changing the label of a site. Ź p` P r0, 1s, prob. of adding a new site.
Ź p´ P r0, 1s, prob. of removing a site. Ź η P p0, 8s, learning rate. for all S P I do if Ur0, 1q ă ps then for all x P S do if Ur0, 1q ă pf then x Ð mutate_log_normalpx, ηq if Ur0, 1q ă pt then S.` Ð switch_labelpS.`qq. if Ur0, 1q ă p` then I Ð I Y trandom_siteu. if Ur0, 1q ă p´ then i Ð Ur1, |I|q. I Ð Iz tIpiqu.
return I, mutated individual.
VorAIS components
1. Create an initial random population P0 of npop individuals.
2. At iteration t, individuals in Pt are mated and mutated.
3. An offspring population, Poff, with noff individuals is created.
4. From Pt Y Poff the best npop individuals are selected using non-dominated
sorting (with crowding distance).
Hyperparameters tuned by grid search (see PPSN paper).
VorAIS outline
Ź Influence of the mating operator (+m) and the use of the classification
met-rics (a, r and s, respectively), on two-dimensioal problems.
15 10 5 0 5 10 15 15 10 5 0 5 10
15 Two Spirals Problem
15 10 5 0 5 10 15 15 10 5 0 5 10
15 Full Moon/Crescent Moon Problem
Anom OK 20 15 10 5 0 5 10 15 20 20 10 0 10 20
Half Kernel Problem
0.5 0.6 0.7 0.8 0.9 1.0 1.1 Accuracy Two Spirals 0.5 0.6 0.7 0.8 0.9 1.0 1.1Full/Crescent Moon 0.5 0.6 0.7 0.8 0.9 1.0 1.1 Half Kernel 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 VorAIS(a)
VorAIS(a+m) VorAIS(a,r) VorAIS(a,r+m) VorAIS(a,r,s)
VorAIS(a,r,s+m) 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Specificity VorAIS(a)
VorAIS(a+m) VorAIS(a,r) VorAIS(a,r+m) VorAIS(a,r,s)
VorAIS(a,r,s+m) 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 VorAIS(a)
VorAIS(a+m) VorAIS(a,r) VorAIS(a,r+m) VorAIS(a,r,s)
VorAIS(a,r,s+m) 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Bergmann-Hommel tests
grouped by problem and metric.
Accuracy Recall Specificity
Metric 0 1 2 3 4 5
Average performance ranking
VorAIS(a) VorAIS(a+m) VorAIS(a,r) VorAIS(a,r+m) VorAIS(a,r,s) VorAIS(a,r,s+m) Full/Crescent
Moon KernelHalf SpiralsTwo
Problems 0 1 2 3 4 5
Average performance ranking
VorAIS(a) VorAIS(a+m) VorAIS(a,r) VorAIS(a,r+m) VorAIS(a,r,s) VorAIS(a,r,s+m)
Preliminary study on test problems
Ź Compare VorAIS with other AISs in a computer network anomaly detection
benchmark problem.
Ź NSL-KDD’99 has 41 —38 numeric and 3 categorical— features and one class
attribute describing the nature of the events.
0.55 0.60 0.65 0.70 0.75 0.80 0.85 0.90 0.95 1.00 Accuracy
Hypersphere Self Only Hypersphere Self/Non-self Hyperrectangle Self Only Hyperrectangle Self/Non-self VorAIS
0.90 0.92 0.94 0.96 0.98 1.00
Recall Hypersphere Self Only
Hypersphere Self/Non-self Hyperrectangle Self Only Hyperrectangle Self/Non-self VorAIS
0.90 0.92 0.94 0.96 0.98 1.00
Specificity Hypersphere Self Only
Hypersphere Self/Non-self Hyperrectangle Self Only Hyperrectangle Self/Non-self VorAIS
Bergmann-Hommel tests.
NSAsp NSA`sp NSAre NSA`re VorAIS
Accuracy NSAsp ˆ ´ „ ´ ´ NSA` sp ` ˆ ` ´ ´ NSAre „ ´ ˆ ´ ´ NSA` re ` ` ` ˆ ´ VorAIS ` ` ` ` ˆ Recall NSAsp ˆ ` ´ ` „ NSA` sp ´ ˆ ´ ` „ NSAre ` ` ˆ ` ` NSA` re ´ ´ ´ ˆ ´ VorAIS „ „ ´ ` ˆ Specificity NSAsp ˆ ` ´ ` ´ NSA` sp ´ ˆ ´ ` ´ NSAre ` ` ˆ ` ` NSA` re ´ ´ ´ ˆ ´ VorAIS ` ` ´ ` ˆ
NSL KDD’99 anomaly detection problem
Ź We have obtained a performance comparable with the state of the art but
adequate classification performance is not enough.
Ź It is necessary to create a compact representation of the ‘normal’ data.
Ź We developed custom objective functions that rely on volume-based
ap-proaches.
L. Martí, A. Fansi-Tchango, L. Navarro, and M. Schoenauer, Anomaly detection with the Voronoi diagram evolutionary algorithm,in Proceedings of the 14th International Conference on Parallel Problem Solving from Nature (PPSN XIV), Edinburgh, UK: Springer, 2016.
