Databases Reference
In-Depth Information
Fig. 2.7. Regression outputs an equation which transforms data in a high dimensional
space into a specific value or a range of values in a low dimensional space according to
different class labels.
numeric values are allowed in the representations of tree-based GP or LGP.
Categorical attributes have to be converted to a numeric value beforehand.
Abraham
et al.
61-64
and Heywood
et al.
11,65,66
are two major research
groups working on LGP and its application in intrusion detection. Abraham
et al.
focused on investigating basic LGP and its variations, such as Multi-
Expression Programming (MEP)
67
and Gene Expression Programming
(GEP),
14
to detect network intrusion. Experiments, in comparing LGP,
MEP, GEP and other machine learning algorithms, showed that LGP
outperformed SVMs and ANNs in terms of detection accuracy at the
expense of time;
64,68
MEP outperformed LGP on Normal, U2R and R2L
classes and LGP outperformed MEP on Probe and DoS classes.
61-63
Song
et al.
implemented a page-based LGP with a two-layer subset selection
scheme to address the binary classification problem. An individual is
described in terms of a number of pages, where each page has the
same number of instructions. Page size was dynamically adjusted when
the fitness reached a “plateau” (i.e. fitness does not change for several
generations). Since intrusion detection benchmarks are highly skewed,
the authors pointed out that the definition of fitness should reflect the
distribution of class types in the training set. Two dynamic fitness schemes,
dynamic weighted penalty and lexicographic fitness, were introduced.
The application of this algorithm to other problems related to intrusion
detection can be found in Refs. 69 and 70.
The above mentioned transform functions evolved by GPs are only used
for binary classification. Therefore, Faraoun
et al.
71
and Lichodzijewski
et al.
72
investigated the possibility of GP in multi-category classification.
