A new Cloud Security Intrusion Detection Model based On Rough Set and FSVM

1. Thunder team Members:conan_zhao,xiaoping_fang,nan_Deng A new Cloud Security Intrusion Detection Model based On Rough Set and FSVM 由NordriDesign™提供 www.nordridesign.com

2. Introduction to cloud Security A a new model used on cloud Security Core of the model Rough set FSVM Fuzzy membership design Advantages of the model Reference Outlines

3. Introduction to cloud Security

4. Introduction to cloud Security What is Cloud Security? Cloud is a very hot topic in the field of information and technology.Therefore,cloud Security is concerned by users.It combines parallel processing,grid computing,judgement of unknown viruses and other emerging technologies and concepts. Cloud Security detection procedure Collecting various invasion virus,clients send the characters of those virus to the center of cloud security, by analysing, the security center will distinguish whether this invasion is normal or not,and then,reply information to client terminal.

5. Introduction to cloud safety Detection methods of cloud Security In the modern,the cloud Securityconsists of misuse detection and anomaly detection. Misuse detection is the tradition way used widely in the security field,but it has the limit of the deformation of known invasion or new invasions. It detects these invasions by known attack methods which have been stored in the database. But for the deformation of known attacks or new attacks are powerless. Anomaly detection is a very promising way for virus detection,it can be used in anyway

6. Introduction to cloud safety Which method does the model use? Anomaly detection For Anomaly detection, the system must establish the model of normal behavior firstly, all behaviors which is the deviation from the model behavior is considered unusual. Because anomaly detection system has the capacity of detecting unknown attack behavior, this system hasbeen widespread concern.

7. A new model used on cloud security Cloud Input data Preprocessed by RS Send to Cloud Classified by RS User(Clients) Reduce attributes Select Fuzzy membership Send to Clients Classify by FSVM Classification result Send to Clients

8. Core of the model Rough Set(RS) Use RS as a preprocessor of FSVM to reduce attributes and to filtrate some abnormal behaviors which are easy to identify, so that it would saves resource and time. Fuzzy Support Vector Machine(FSVM) Detect the invasion which has a high accuracy Fuzzy membership designed by RS Designthe fuzzy membership according to RS computing.

9. Rough set——Introduction to RS What is Rough Set? Definition Rough set,which is a new mathematical tool to solve the uncertainty problem. What problems does the RS solve? Experience of learning and acquiring knowledge from experience Approximate pattern classification Inconsistent information analysis The retention of information under the premise of simplifying the data

10. Step into world of Rough set Define set A={x1,x2,x3,x4,x5,x6,x7,x8} A/R1={X1(red),X2(yellow),X3(blue)}={{x1,x2,x6},{x3,x4},{x5,x7,x8}} (classified by color,R1:color feature) A/R2={Y1(triangle),Y2(rectangle),Y3(circle)}={{x1,x2},{x5,x8},{x3,x4,x6,x7}} (classified by shape,R2:shape feature) A/R3={Z1(big),Z2(moderate),Z3(small)}={{x1,x2,x5},{x6,x8},{x3,x4,x7}} (classified by qulity,R3:qulity feature) Rough set——Introduction to RS

11. Define: big&triangle:{x1,x2,x5}∩{x1,x2}={x1,x2} blue&small&cricle:({x5,x7,x8}∩{x3,x4,x7}∩{x3,x4,x6,x7} blue or moderate:{x5,x7,x8}∪{x6,x8}={x5,x6,x7,x8} By computing on Set,we can define many new set containing many features. However, says,X={x2,x5,x7},how can we describe this set? No matter how can we compute on set,we don’t conclude an accurate definition. So we can propose Lower approximations and Upper approximations . Rough set——Introduction to RS

12. We use approximate description to define the set. We define Lower approximations as follows: blue&big&rectangle OR blue&small&circle{x5,x7} We define Upper approximations as follows: triangle OR blue{x1,x2,x5,x7,x8} Rough set——Introduction to RS

13. Rough set——why choose RS? Save detection time and computing resource On the premise that performace doesn’t go bad,extracting features which are of greatest contributions on the characteristics of the classification results, remove redundant features.The less features,the quickly the model run. The first time filtration of this model,improve classification accurancy Using the Decision table,RS can conclude category of every dataroughly so that some data can be classified evidently. It can also be used to compare with the finnal result from FSVMas a referencefor the final result.

14. FSVM——Brief view of SVM & FSVM Support Vector Machine (SVM) It is a new pattern recognition technique. It is a powerful tool for solving classification problems and provides higher performance in pattern recognition than traditional learning machines. It has strong theoretical fundations and effective approaches implementation. Fuzzy Supprot Vector Machine (FSVM) FSVM is a kind of promising method to solve noise or outlier problems,which are often includede in training datat in practical applications The fuzzy membership in our model is designed by RS

15. FSVM——Introduction of FSVM Firstly, SVM maps the samples from different classes into a high-demensional feature space through a nonlinear map as follows: This step converts nonlinear separable problems to linear separable problems.

16. FSVM——Introduction of FSVM Then, SVM separates different classes with a hyperplane that maximizes the margin between two classes in the feature space. There are many hyperplanes that can separate these two different classes correctly, but the optimal margin hyperplane is the best one to get a best generalization ability,which is a quadratic programming(QP) problem.

17. FSVM——Introduction of FSVM To solve the noise or outlier sample problems for higher accuracy, fuzzy membership to each input sample can be introduced to SVM, which known as FSVM. In the feature space, with the priciple of structural risk minimization and the principle of interval maximization,the optimal hyper_plane could be found by solving the following quadratic programming problem: Then the corresponding optimal decision function is

18. FSVM——Why choose FSVM ? A new and smart technique Most anomaly detection are based on machine learning methods. As a new pattern recognition technique and a smart technique, it is highly appropriate for intrusion detection in furture, especially for Smart Protection Network aganist the intrusion from the Internet. Strong theoretical fundations The strong theoretical fundations ensure the correctness and feasibility and give a guiding . SVM was proposed based on Statistical Learning Theory(SLT), which is regarded as the optimal theory machine learning with small sample.

19. Good generalization ability Generalization ability is the adaptive capacity of machine learning for fresh samples, which is important in misuse detection. SVM aims at minimizing the upper bound of generalization error rather than the training error which causes overfitting usually coming out in nuero, so that it has a better generalization ability. SVM has a better genernlization ability especially in high dimensional data space, which is especially good for intrusion detection. Suitable for small sample SVM can solve the machine learning problems in small sample,wich is superior compared to those asking for large number of samples,such as clustering. FSVM——Why choose FSVM ?

20. Solve nonlinear separable problems In linear separable problems,optimal margine hyperplane has a good generalization ability. However, most of pattern recognitions are nonlinear separable problem in practical issues such as in invasion detection. In SVM, a nonlinear mapping is used to make the original space mapped to high dimensional feature space, in which it is a linear separable problem shown in following figure. SO,SVM has a good generlization even for nonlinear separable problems. FSVM——Why choose FSVM ?

21. Kenerl function avoid dimension disaster Dimension of the space would increase sharply with the nonlinear map , which is diffcult to calculate optimal hyperplane directly in most cases. SVM converts the calculation in the high dimension space to that in the original by defining the kernel function. The processes are as followes: Compulation complexity would't increase much as the dimension of feature space increases much, which avoided dimension disaster in high dimension space. FSVM——Why choose FSVM ?

22. Global optimization instead of local optimization The problem is converted to a quadratic programming finnally, which has a unique solution known as global optimization instead of local optimization which often exists in neural network. The global optimization ensure hyperplane is the optimal one which would ensure the accuracy. FSVM aganist noise or outlier samples FSVM combinating the SVM with fuzzy logic is an effective method to these problems which enhances the accuracy of classification. FSVM——Why choose FSVM ?

23. Fuzzy membership design. Fuzzy membership of every sample stands for different contributions to the learning of decision surface. However,traditional fuzzy memfership is notreasonable for non-regular distribution of samples. Fuzzy membership designed here is on the basis of RS.The propocess are as follows: • Firstly, use RS to reduce attributes of samples which has down in preprocessor of FSVM; • Secondly, only consider the reduced attributes of every sample for fuzzy membership and give weighted values to these attributes. • Lastly, calculate the fuzzy membership like the traditional method but only with the reduced attributes and weighted values

24. Advantages of our model Good performances of both high accuracy and time-saving RS FSVM time-saving time-consuming low accuracy high accuracy time-saving and high accuracy

25. Availability of this model Effective approache for large scale problems AS the development of SVM, there are already some improved algorithms for large scale problems,such as chunking algorithm,decomposing algorithm and sequential minimal optimization(SMO). SMO is a general used algorithm in practical applications. Effective approache for reducing features There are many algorithms to be used on reducing features.They can calculate exactly how every contribute to. Advantages of our model

26. Thank you !