Collective Classification for Spam Filtering - Computational Intelligence in Security for Information Systems - page 37

The next step after fuzzification is to formulate particular rules that express
the combination of the influences. As an example, a possible simple basic struc-
ture of such fuzzy logic rules is as follows:

Algorithm 1. Fuzzy Rules
01: if (SD is LOW) OR ((SD is MEDIUM) AND (TD is NOT HIGH))
02: then
03: Aggregation-Decision is YES ;
04: else
05: Aggregation-Decision is NO ;
06: endif

The above rules can be also represented according to Table 1.
There can be more than one rule assigning values to the aggregation decision.
In this case, the assignments to the aggregation decision are combined by an
implicit AND, so that the corresponding probability of the Aggregation-Decision
is given by the minimum between both input probabilities for SD and LD. After
all rules have been evaluated, the decision will be either YES or NO depending
on which of the two has got the higher assigned probability by the rules.
For example, if the SD is 10 m and so it is fuzzified to LOW with a degree of
0.32 and to MEDIUM with a degree of 0.68, and for the same pair of packets the
TD is 20 min and so the TD is fuzzified to MEDIUM with a degree of 0.58 and
to HIGH with a degree of 0.42, the Aggregation-Decision would be YES with
adegree0.58andNOwithadegree0.42, so the final decision is YES and we
aggregate both packets because we concluded they refer to the same event.
Data received by an agent must be stored in a local database with the ob-
jective not only of aggregation but also because the channel could get overload,
restricting the amount of data that can be sent, and in this case, the agent is
allowed to send only a subset of its database. In order to solve the problem of se-
lection, we might use an approach also based on fuzzy logic to take into account
relevant parameters for spreading the more adequate and accurate information
that is currently available in the database. Then, each agent should carry out a
qualification process of the data in its database in order to conclude which are
the most relevant data stored that must be sent according to the restrictions of
the channel. Several factors, such as severity or antiquity of an event, can play an
important role in this selection. As of the aggregation decision, rating relevance
of different parameters of a piece of information often depends on the specific
application. Relevance ranking provides an order on the parameters to be con-
sidered and on data stored so that according to this order, the agent always
knows which packages should be sent without collapsing the channel.

Table 1. Fuzzy Rules

HIGH NO NO NO

MEDIUM YES YES NO

LOW YES YES YES

SD/TD LOW MEDIUM HIGH