Chaotic Cuttle Fish Algorithm for Feature Selection of ... · 12 VIS Visibility degree 13 rn Reflection 14 vy Visibility 15 Pi Individual Population Case 1 , 2 The population is sorted

Chaotic Cuttle Fish Algorithm for Feature

Selection of Intrusion Detection System 1V.R. Balasaraswathi,

2M. Sugumaran and

3Yasir Hamid

1Department of Computer Science & Engineering,

Pondicherry Engineering College, Pondicherry, India.

[email protected] 2Department of Computer Science & Engineering,

Pondicherry Engineering College, Pondicherry, India. 3Department of Computer Science & Engineering,

Pondicherry Engineering College, Pondicherry, India.

Abstract As usage of computer grows hastily, masses of data have been generated

in almost all the fields and security also becomes the most important need

to protect the data and network. The generated data is extremely large and

it is very difficult to extract knowledge from it. Feature Selection (FS) is a

perpetual method used to select the efficient and relevant features and also

reduces the dataset size. Since FS is a complex task in extracting the

important features in data mining, many heuristic algorithms were used for

FS. Cuttle Fish Algorithm (CFA) is a metaheuristic algorithm which works

based on colour changing behaviour of cuttlefish used to solve optimisation

problems. Chaotic Cuttle Fish Algorithm (CCFA) is proposed to select the

important and non redundant features for Intrusion Detection System

(IDS). In view of the fact that random number plays important role in CFA,

Choatic map is used in CCFA to generate random number sequence.

Experimental results and analysis shows the performance of CCFA has

been improved by chaotic random sequences.

Key Words:Cuttle fish algorithm, choatic map, heuristic algorithm,

feature selection, intrusion detection system.

International Journal of Pure and Applied MathematicsVolume 119 No. 10 2018, 921-935ISSN: 1311-8080 (printed version); ISSN: 1314-3395 (on-line version)url: http://www.ijpam.euSpecial Issue ijpam.eu

921

1. Introduction

Recently security becomes must in all the networking domains. IDS is a

software to detect the intruders entering into a network (Smaha, Stephen E,

1988). The detected activity is informed to the administrator (Depren, Ozgur, et

al., 2005). Most commonly IDS is classified into Network Intrusion Detection

Systems (NIDS) and Host Based Intrusion Detection Systems (HIDS)

(Zhengbing, Hu, Li Zhitang, and Wu Junqi, 2008)(E. Biermann, E. Cloete, and

L. M. Venter, 2001). Network traffic is monitored and analyzed by NIDS. HIDS

monitors and analyze the host system.

Traditional algorithms do not produce better results for complex optimisation

problems. Now a day’s enormous bio-inspired heuristic algorithm are emerging

to solve optimisation problems (Baghel, Malti, Shikha Agrawal, and Sanjay

Silakari, 2012). Bio-inspired are based on individual behavior or collective

behavior of swarms. Ant Colony Optimisation (ACO), Firefly Algorithm,

Particle Swarm Optimisation (PCO), Bat Algorithm (BA), Artificial Bee Colony

Algorithm (ABC), Genetic Programming etc were used in various fields to solve

real time as well as complex Engineering problems(Dressler, Falko, and Ozgur

B. Akan, 2010). The applications of bio-inspired algorithms are feature

selection, feature extraction, segmentation, scheduling, control systems, routing,

etc(Yang, Xin-She, et al., 2013).

Metaheuristic algorithms have been used in an all the fields (Yang, Xin-She,

2010). Chaotic systems generate excellent random number sequence

(Thompson, John Michael Tutill, and H. Bruce Stewart, 2002). Recently,

parameters in metaheuristic algorithms are replaced by chaotic sequences in

order to fine tune it(Sheikholeslami, R., and A. Kaveh, 2013).The parameters of

BA, PSO, Firefly, Bee colony etc have been replaced by chaotic

sequences(Fister, Iztok, Matjaž Perc, and Salahuddin M. Kamal,

2015),(Afrabandpey, Homayun, et al., 2014),(Alatas, Bilal, 2010)(Kuang,

Fangjun, et al., Springer). Chaotic sequences improve the performance of the

algorithm since the solution generated has higher mobility and multiplicity.

Section 2 describes about the related work of FS. Section 3 gives the

introduction of chaotic maps and different types of maps. Section 4 explains the

Chaotic Cuttle Fish algorithm and its pseudocode. Section 5 described about the

KDD99 Dataset used. Section 6 illustrates the experimental analysis and section

7 gives the conclusion.

2. Related Work

FS is the process of extracting the best set of features from the entire set (Jain,

Anil, and Douglas Zongker, 1997). Instead of using entire feature set for

constructing a model, it is enough to use relevant and significant features to

build a model (Guyon, Isabelle, and André Elisseeff, 2003). FS is used in almost

International Journal of Pure and Applied Mathematics Special Issue

922

all the fields to reduce the dataset size (Weston, Jason, et al., 2001) and reduces

training time and evaluation time. FS also improves accuracy and overall

performance. Two methods of FS are filter, wrapper and hybrid method (Das,

Sanmay, 2001). The filter is a traditional method which does not use any

classifier for evaluation. Evaluation is done by some measures like dependency,

correlation, distance, similarity etc. Wrapper method uses classifier for

evaluation. To improve the performance, filter and wrapper method are

combined and it is called as hybrid method.

Many traditional methods were used for FS. Principal Component Analysis

(PCA) is used to select the relevant features (Xin Xu and Xuening Wang, 2005)

and Support Vector Machine (SVM) is used for classification. The binary

gravitational search algorithm is combined with mutual information for FS of

IDS (Bostani, Hamid, and Mansour Sheikhan, 2017). Gaussian SVM with

Pulse-Coupled Neural Network algorithm (PCNN) performs better(Shrivastava,

Aditya, Mukesh Baghel, and Hitesh Gupta, 2013). Linear Discriminant Analysis

(LDA)(Tan, Zhiyuan, et al., 2010) is also used. Features are selected by

calculating attribute ratio (Chae, Hee-su, et al., 2013) and it gives better

accuracy.

Evolutionary algorithms are also used for FS of IDS. A genetic algorithm is

used for selecting important features(Stein, Gary et al., 2005).GA is also

combined with PCA (Iftikhar Ahmad, Azween B Abdulah et al., 2011), Kernel

PCA(Kuang, Fangjun, Weihong Xu, and Siyang Zhang, 2014) and

SVM(Aslahi-Shahri, B. M., et al., 2016). A combination of GA with PCA,

Kernel PCA and SVM performs well when compared with traditional methods.

Recently bio-inspired algorithms are also used for FS of IDS. These algorithms

performed well in terms of accuracy, detection rate, and error rate. PSO (Wang,

Jun, et al., 2009) and the combination of PSO with SVM (Tian, Jiang, and Hong

Gu, 2010) gives high detection rate and accuracy. Bee algorithm is also used for

selecting more relevant features(Alomari, Osama, and Zulaiha Ali Othman,

2012).Membrane computing concept is used with Bee algorithm in order to

improvise its performance (Rufai, Kazeem I., RavieChandren Muniyandi, and

Zulaiha A. Othman, 2014). Ant colony algorithm with SVM as classifier

produces less alarm rate (Xingzhu, Wang, 2015).CFA is a metaheuristic

algorithm used for FS gives better performance.

3. Chaotic Maps

Chaos was introduced by Lorenz in the year 1963 (E.N.Lorenz, 1963). Chaos is

modeled by chaotic maps (González, Jorge A., and Ramiro Pino, 1999).

Randomness is obtained by probability distributions in metaheuristic algorithms.

The randomness can be replaced by chaotic maps since it has better randomness

with dynamical and statistical properties. Chaotic Optimization (CO) is a

method of replacing random variables with chaotic maps (Stojanovski, Toni,

and Ljupco Kocarev,2001). Chaotic maps have two properties such as stochastic


923

and ergodicity. One –dimensional map are given below.

Logistic Map

Robert May introduced logistic map in the year of 1976(Phatak, S. C., and S.

Suresh Rao, 1995). It is defined as

Iterative Map

Iterative map is defined as

)

Sine Map

Where 0 < a ≤ 4

Sinusoidal Map

It is defined as

Circle Map

It is defined (DeGuzman, G. C., and J. AS Kelso, 1991) as

+ b –

Where a = 0.5 and b = 0.2

Chebyshev Map

It is defined as

= cos

Gauss/Mouse Map

The Gaussian map was written by Gauss in 1825 and published in 1827(Ruh,

Ernst A, and Jaak Vilms, 1970). It is defined as

Singer Map

It is a one-dimensional map defined as

Where a = 7.86, b = 23.31, c = 28.75 and s = 13.3

Where lies between 0.9 and 1.08.


924

Arnold’s Cat Map

It was introduced by Vladimir Arnold in the year 1960 using cat’s image

(Peterson, Gabriel , 1997). It is defined as

xn and yn

Henon Map

It was introduced by Michel Henon (Grassberger, P., H. Kantz, and U. Moenig,

1989). It is defined as

Where a =1.4 and b=0.3.

4. Chaotic Cuttle Fish Algorithm for

Feature Selection of IDS

CFA is a metaheuristic algorithm works based on the color changing behavior

(Eesa, Adel Sabry, Adnan Mohsin Abdulazeez Brifcani, and Zeynep Orman,

2013). Cuttlefish changes its color based on its environment using different

layers of skin (Hanlon, Roger T and Messenger, John B, 1988). Reflection and

visibility are the two parameters used in it. The algorithm contains six cases

(Eesa, Adel Sabry, Zeynep Orman, and Adnan Mohsin, 2015) and the six cases

are grouped into four steps. The six cases are based on the stretch and shrinking

of three layers of skin such as iridophores, chromatophores and leucophores.

Figure 1: Shows Skin Layers of Cuttlefish

Figure 2: Shows 6 Cases of Colo

Changing Behavio

Initialisation

The initial population is formed by using Chebyshev chaotic maps from the

entire dataset randomly from the whole dataset. The ranking is done for the

features. Each population is connected with selected feature set and unselected

feature set. Fitness is calculated for each population using fitness function given


925

below.

Where α ϵ [0, 1], β = 1-α

Both detection rate and false positive rate is important, consider α = 0.5, β = 0.5.

If only detection rate is important consider α = 0.5, β = 0.3

After fitness is calculated, each population is evaluated using j48 Decision Tree

(DT) classifier. The best solution is kept in BS and AVBS.

Table 1

S.No Parameters Meaning

1 A Total number of population

2 BS Best subset of all the subsets

3 AVBS Average best subset among the subsets

4 SFS Size of the selected features set

6 USFS Size of the unselected features set

7 Sf Set of the selected features

8 USfs Set of the unselected features

9 RS Subset formed randomly

10 NS Newly formed subset

11 REF Reflection degree

12 VIS Visibility degree

13 rn Reflection

14 vy Visibility

15 Pi Individual Population

Case 1, 2

The population is sorted and best kl populations are taken randomly from (1,

A/2).

KL=random (A/2)

Where KL is a random number generated between 0 and A/2.

kl is calculated and selected randomly by using logistic map from total

population.

For each population rn and vy (subsets with REF and VIS elements) is calculated

to obtain NS.REF and rn are calculated from Sf. VIS and vy are calculated from

USf.

rn = RS[REF] from pi..Sf (2)

vy = RS[VIS] from pi..USf (3)

REF = γ (0, SFS) (4)

VIS = δ (0, USFS) (5)

NS =rn +vy (6)

Where γ and δ are chaotic random sequences generated by Gauss and henon’s

chaotic maps.

REF is nothing but reflection degree which helps to calculate the stretch and

shrink interval and VIS is the ultimate view of the corresponding pattern.


926

Case 3,4

Iridhophores cells reflect the incoming colour. Reflected colour is considered as

the removal of one feature from the Sf. A single feature is chosen from USfs

randomly.

rn = Sfs of BS – Sfs of BS[REF] (7)

vy = USfs of BS[VIS] (8)

REF = ε (0, size of Sfs of BS) (9)

VIS =δ (0, size of USfs of BS) (10)

Where ε and ζ are chaotic random sequences generated by sine and sinusoidal

chaotic maps.

The NS is calculated from equation (6)

Case 5

The light which comes from the chromatophores is similar to outgoing light

since leucophores acts as a mirror. A feature which is removed from SFS is vy.

rn = AVBS – Sfs (11)

vyi = AVBS – Sfs[i] (12)

Where i = {1, 2,...,REF} (13)

NSi = rn - vyi (14)

Case 6

The new solution is obtained from incoming color since leucophores reflect

the incoming color. The random solution is generated by circle map from the

population kl to A. NS is obtained from kl to A population.

Pseudocode of CCFA 1. Initial population P [A] is formed with subsets randomly.

2. J48 Decision Tree (DT) is used to evaluate the population fitness and rank the

population.

3. The best solution is placed in AVBS and BS (Remove one feature).

4. Repeat until stopping criteria is met

1. Case 1, 2

Population is sorted based on the fitness

Find kl = random (A/2)

For i = 0 to kl

{

vy and rn is calculated from Eq.(2) and(3)

REF and VIS is calculated from Eq. (4) and (5)

NS is calculated from Eq.(6)

NS is evaluated by j48 classifier

if( NS is better than AVBS)

Assign NS as AVBS

}

2. Case 3, 4


927

For i = 0 to n

{

Using BS one feature is exchanged randomly between Sf and USf to form NS.


if (NS is better than BS)

Assign NS as BS

}

3. Case 5

For i = 0 to AVBS.SFS

{

NS is created by removing i feature from AVBS


If (NS is better than BS)

Assign NS as BS

}

4. Case 6

For i = kl to A

{

New population Pi is generated using A-kl

NS is generated randomly

NS is evaluated using j48 classifier

If (NS is better than Pi)

Assign NS as Pi

If (Pi is better than AVBS)

Assign Pi as AVBS

}

5. End

6. Return BS

5. KDD99 Dataset

A group of Lincoln Laboratories at MIT University was generated called

KDD99 Dataset (Cup, K. D. D., 2007). It is a simulation of connections and data

transfer over a military network. The dataset is of 4GB in size and contains 5

million connections. It contains normal and four different attacks such as Denial

of Service (DOS), Probe, Remote to Local (R2L) and User to Root (U2R)

attacks. Dataset is grouped into training and testing datasets. The dataset

contains 41 different features and the features were classified into basic, content,

intrinsic and traffic features. Many IDS researchers are using this dataset for

classifier evaluation

6. Experimental Results and Analysis

The KDDCUP99 dataset is used for evaluation of chaotic CFA (CCFA)

algorithm. The algorithm is implemented on Dual core CPU,1 GB RAM and

windows operating system. The experiment is done for a various subset of

features and results are given for various performance measures. The results of


928

CFA and CCFA are shown in the table 1.CCFA comparatively performs much

better than CFA.

Table 2: Illustrates the Experimental Results o CFA and CCFA

S.No Number of Features

Fitness Computation Time (sec) Detection Rate Accuracy False Positive Rate

CFA CCFA CFA CCFA CFA CCFA CFA CCFA CFA CCFA

1 41 74.45 79.01 0.31 0.28 71.08 77.26 73.26 80.5 17.8 14.33

2 33 78.01 83.33 0.25 0.20 69.5 82.18 75.1 84.26 2.20 2.008

3 25 83.62 87.55 0.20 0.17 78.21 84.21 81.71 88.25 3.75 3.332

4 18 92.15 92.54 0.16 0.12 91.10 92.8 92.2 93.66 3.40 3.212

5 12 93.18 95.66 0.11 0.1 92.4 96.4 92.55 96.01 3.77 3.51

Figure 3: Shows Fitness of CFA and CCFA

Figure 4: Shows Computation Time of CFA and CCFA

Figure 5: Shows Detection Rate of CFA and CCFA


929

Figure 6: Show Accuracy of CFA and CCFA

Figure 7: Shows False Positive Rate of CFA and CCFA

7. Conclusion

In this paper, the proposed chaotic CFA shows how the color changing the

behavior of cuttlefish helps in selecting best features for IDS.A six different

chaotic maps have been used to acclimatize the CFA parameters. The

randomness of CFA is improved by using the chaotic random sequences Chaotic

CFA improves the performance of CFA in terms of accuracy, detection rate,

computation time and false alarm rate. Chaotic random number sequence in

CFA enhances the global search of CFA algorithm. The chaotic random

sequences in CCFA select the efficient, relevant and non-repeated features to

enhance the performance of IDS. The chaotic random sequences can be used in

bio-inspired and heuristic algorithms where randomness and ergodicity plays an

important role.

Acknowledgment

This work was supported by the University Grants Commission under Rajiv

Gandhi National Fellowship for SC students.


930

Bibliography

[1] Afrabandpey H., Ghaffari M., Mirzaei A., Safayani M., A novel bat algorithm based on chaos for optimization tasks, Iranian Conference on Intelligent Systems (2014), 1-6.

[2] Alatas B., Chaotic bee colony algorithms for global numerical optimization, Expert Systems with Applications 37(8) (2010), 5682-5687.

[3] Alomari O., Zulaiha Ali O., Bees algorithm for feature selection in network anomaly detection, Journal of Applied Sciences Research 8(3) (2012), 1748-1756.

[4] Aslahi-Shahri B.M., Rahmani R., Chizari M., Maralani A., Eslami M., Golkar M.J., Ebrahimi A., A hybrid method consisting of GA and SVM for intrusion detection system, Neural computing and applications 27(6) (2016), 1669-1676.

[5] Baghel M., Agrawal S., Silakari S., Survey of metaheuristic algorithms for combinatorial optimization, International Journal of Computer Applications 58(19) (2012).

[6] Bostani H., Sheikhan M., Hybrid of binary gravitational search algorithm and mutual information for feature selection in intrusion detection systems, Soft Computing 21(9) (2017), 2307-2324.

[7] Chae H.S., Jo B.O., Choi S.H., Park T.K., Feature selection for intrusion detection using nsl-kdd, Recent advances in computer science (2013),184-187.

[8] http://kdd.ics.uci.edu/databases/kddcup99/kddcup99. html .

[9] Das S., Filters, wrappers and a boosting-based hybrid for feature selection, ICML 1 (2001), 74-81.

[10] DeGuzman G.C., Kelso J.A.S., Multifrequency behavioral patterns and the phase attractive circle map, Biological cybernetics 64(6) (1991), 485-495.

[11] Depren O., Topallar M., Anarim E., Ciliz M.K., An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks, Expert systems with Applications 29(4) (2005), 713-722.

[12] Dressler F., Akan O.B., A survey on bio-inspired networking. Computer Networks 54(6) (2010), 881-900.

[13] Biermann E., Cloete E., Venter. L.M, Biermann, Elmarie, Elsabe CloetA comparison of intrusion detection systems, Computers & Security 20(8) (2001), 676-683.


931

[14] Lorenz E.N., Deterministic non-periodicflows, journal of Atmos. Sci. 20 (1963), 130-141.

[15] Eesa A.S., Brifcani A.M.A., Orman Z., Cuttlefish algorithm–a novel bio-inspired optimization algorithm, International Journal of Scientific and Engineering Research 4(9) (2013), 1978-1986.

[16] Eesa A.S., Orman Z., Brifcani A.M.A., A novel feature-selection approach based on the cuttlefish optimization algorithm for intrusion detection systems, Expert Systems with Applications 42(5) (2015), 2670-2679.

[17] Fister Jr I., Perc M., Kamal S.M., Fister I., A review of chaos-based firefly algorithms: perspectives and research challenges, Applied Mathematics and Computation 252 (2015), 155-165.

[18] González J.A., andPino R., A random number generator based on unpredictable chaotic functions, Computer Physics Communications 120(2-3) (1999), 109-114.

[19] Grassberger P., Kantz H., Moenig U., On the symbolic dynamics of the Hénon map, Journal of Physics A: Mathematical and General 22(24) (1989).

[20] Guyon I., Elisseeff A., An introduction to variable and feature selection, Journal of machine learning research (2003), 1157-1182.

[21] Hanlon R.T., Messenger J.B., Adaptive coloration in young cuttlefish (Sepia officinalis L.): the morphology and development of body patterns and their relation to behaviour, Philosophical Transactions of the Royal Society of London B: Biological Sciences (1988), 437-487.

[22] Ahmad I., Abdulah A.B., Alghamdi A.S., Alnfajan K., Hussain M., Feature subset selection for network intrusion detection mechanism using genetic eigen vectors, Proceedings of International Conference on Telecommunication Technology and Applications (2011), 75-79.

[23] Jain A., Zongker D., Feature selection: Evaluation, application, and small sample performance, IEEE transactions on pattern analysis and machine intelligence19 (1997), 153-158.

[24] Kuang F., Zhang S., Jin Z., Xu W., A novel SVM by combining kernel principal component analysis and improved chaotic particle swarm optimization for intrusion detection, Soft Computing 19(5) (2015), 1187-1199.

[25] Kuang F., Xu W., Zhang S., A novel hybrid KPCA and SVM with GA model for intrusion detection, Applied Soft Computing 18 (2014), 178-184.


932

[26] Peterson G., Arnold’s cat map, Math45-Linear algebra (1997).

[27] Phatak S.C., Suresh Rao S., Logistic map: A possible random-number generator, Physical review E 51(4) (1995).

[28] Rufai K.I., Muniyandi R.C., Othman Z.A., Improving bee algorithm based feature selection in intrusion detection system using membrane computing, JNW 9(3) (2014), 523-529.

[29] Ruh E.A., Vilms J., The tension field of the Gauss map, Transactions of the American Mathematical Society 149(2) (1970), 569-573.

[30] Sheikholeslami R., Kaveh A., A survey of chaos embedded metaheuristic algorithms, International Journal of Optim Civil Eng. 3(4) (2013), 617-633.

[31] Shrivastava A., Baghel M., Gupta H., A Novel Hybrid Feature Selection and Intrusion Detection Based On PCNN and Support Vector Machine, International journal of computer technology and applications 4(6) (2013).

[32] Smaha S.E., Haystack: An intrusion detection system, Aerospace Computer Security Applications Conference IEEE (1988).

[33] Stein G., Chen B., Wu A.S., Hua K.A., Decision tree classifier for network intrusion detection with GA-based feature selection, Proceedings of the 43rd annual Southeast regional conference (2005), 136-141.

[34] Stojanovski T., Kocarev L., Chaos-based random number generators-part I: analysis [cryptography], IEEE Transactions on Circuits and Systems I: Fundamental Theory and Applications 48(3) (2001), 281-288.

[35] Stojanovski T., Pihl J., Kocarev L., Chaos-based random number generators, Part II: practical realization, IEEE Transactions on Circuits and Systems I: Fundamental Theory and Applications 48(3) (2001), 382-385.

[36] Tan Z., Jamdagni A., He X., Nanda P., Network intrusion detection based on LDA for payload feature selection, GLOBECOM Workshops (2010), 1545-1549.

[37] Thompson J.M.T., Stewart H.B., Nonlinear dynamics and chaos. John Wiley & Sons (2002).

[38] Tian J., Gu H., Anomaly detection combining one-class SVMs and particle swarm optimization algorithms, Nonlinear Dynamics 61(1-2) (2010), 303-310.

[39] Wang J., Hong X., Ren R.R., Li T.H., A real-time intrusion detection system based on PSO-SVM, Proceedings of the


933

international workshop on information security and application (2001), 319-321.

[40] Weston J., Mukherjee S., Chapelle O., Pontil M., Poggio T., Vapnik V., Feature selection for SVMs, Advances in neural information processing systems (2001), 668-674.

[41] Xu X., Wang X., An adaptive network intrusion detection method based on PCA and support vector machines, International Conference on Advanced Data Mining and Applications (2005), 696-703.

[42] Xingzhu W., ACO and SVM Selection Feature Weighting of Network Intrusion Detection Method, Analysis 9(4) (2015).

[43] Yang X.S., Nature-inspired metaheuristic algorithms, Luniver press (2010).

[44] Yang X.S., Karamanoglu M., Swarm intelligence and bio-inspired computation: an overview, Swarm Intelligence and Bio-Inspired Computation (2013), 3-23.

[45] Zhengbing H., Zhitang L., Junqi W., A novel Network Intrusion Detection System (NIDS) based on signatures search of data mining, Proceedings of the 1st international Conference on Forensic Applications and Techniques in Telecommunications, information, and Multimedia and Workshop (2008).


934

935

936

Documents

Chaotic Cuttle Fish Algorithm for Feature Selection of ... · 12 VIS Visibility degree 13 rn Reflection 14 vy Visibility 15 Pi Individual Population Case 1 , 2 The population is sorted