This paper proposes a genetic programming (GP) framework for two major data mining tasks, namely classification and generalized rule induction. The framework emphasizes the integration between a GP algorithm and relational database systems. In particular, the fitness of individuals is computed by submitting SQL queries to a (parallel) database server. Some advantages of this integration from a data mining viewpoint are scalability, data-privacy control and automatic parallelization. The paper also proposes some genetic operators tailored for the two above data mining tasks. 1. Introduction Data Mining (DM) consists of the extraction of interesting, novel knowledge from real-world databases [Fayyad et al. 96]. DM is an interdisciplinary subject, whose core lies at the intersection of machine learning and databases. Four desirable characteristics of a DM system are: (1) the discovery of comprehensible knowledge, typically expressed by high-level rules; (2) integration with databases [Ha...

Real-world problems are often too difficult to be solved by a single monolithic system. Many natural and artificial systems use a modular approach to reduce the complexity of a set of subtasks while solving the overall problem satisfactorily. There are two distinct ways to do this. In functional modularization, the components perform very different tasks, such as subroutines of a large software project. In categorical modularization, the components perform different versions of basically the same task, such as antibodies in the immune system. This second aspect is the more natural for acquiring strategies in games of conflict. An evolutionary learning system is presented which follows this second approach to automatically create a repertoire of specialist strategies for a game-playing system. This relieves the human effort of deciding how to divide and specialize: species automatically form to deal with different high-quality potential opponents, and a gating algorithm manages the re...

Differentiating anomalous network activity from normal network traffic is difficult and tedious. A human analyst must search through vast amounts of data to find anomalous sequences of network connections. To support the analyst’s job, we built an application which enhances domain knowledge with machine learning techniques to create rules for an intrusion detection expert system. We employ genetic algorithms and decision trees to automatically generate rules for classifying network connections. This paper describes the machine learning methodology and the applications employing this methodology. 1.

This paper describes a technique that extends the unimodal particle swarm optimizer to efficiently locate multiple optimal solutions in multimodal problems. Multiple subswarms are grown from an initial particle swarm by monitoring the fitness of individual particles. Experimental results show that the proposed algorithm can successfully locate all maxima on a small set of test functions during all simulation runs. 1.

An adaptive niching scheme called coevolutionary shared niching (CSN) is proposed, implemented, analyzed and tested. The scheme overcomes the limitations of fixed sharing schemes by permitting the locations and radii of niches to adapt to complex landscapes, thereby permitting a better distribution of solutions in problems with many badly spaced optima. The scheme takes its inspiration from the model of monopolistic competition in economics and utilizes two populations, a population of businessmen and a population of customers, where the locations of the businessmen correspond to niche locations and the locations of customers correspond to solutions. Initial results on straightforward test functions validate the distributional effectiveness of the basic scheme, although tests on a massively multimodal function do not find the best niches in the allotted time. This result spurs the design of an imprint mechanism that turns the best customers into businessmen, thereby making better use o...

This paper describes a technique of applying Genetic Algorithm (GA) to network Intrusion Detection Systems (IDSs). A brief overview of the Intrusion Detection System, genetic algorithm, and related detection techniques is presented. Parameters and evolution process for GA are discussed in detail. Unlike other implementations of the same problem, this implementation considers both temporal and spatial information of network connections in encoding the network connection information into rules in IDS. This is helpful for identification of complex anomalous behaviors. This work is focused on the TCP/IP network protocols. 1.

abstract – Multi-objective formulations are a realistic models for many complex engineering optimization problems. Customized genetic algorithms have been demonstrated to be particularly effective to determine excellent solutions to these problems. In many real-life problems, objectives under consideration conflict with each other, and optimizing a particular solution with respect to a single objective can result in unacceptable results with respect to the other objectives. A reasonable solution to a multi-objective problem is to investigate a set of solutions, each of which satisfies the objectives at an acceptable level without being dominated by any other solution. In this paper, an overview and tutorial is presented describing genetic algorithms developed specifically for these problems with multiple objectives. They differ from traditional genetic algorithms by using specialized fitness functions, introducing methods to promote solution diversity, and other approaches. 1.

We present a diversity-oriented hybrid evolutionary approach for the graph coloring problem. This approach is based on both generally applicable strategies and specifically tailored techniques. Particular attention is paid to ensuring population diversity by carefully controlling spacing among individuals. Using a distance measure between potential solutions, the general population management strategy decides whether an offspring should be accepted in the population, which individual needs to be replaced and when mutation is applied. Furthermore, we introduce a special grouping-based multi-parent crossover operator which relies on several relevant features to identify meaningful building blocks for offspring construction. The proposed approach can be generally characterized as “well-informed”, in the sense that the design of each component is based on the most pertinent information which is identified by both experimental observation and careful analysis of the given problem. The resulting algorithm proves to be highly competitive when it is applied on the whole set of the DIMACS benchmark graphs.

The work presented in this paper is intended to test crucial system services against stack overflow vulnerabilities. The focus of the test is the user-accessible variables, that is to say, the inputs from the user as specified at the command line or in a configuration file. The tester is defined as a process for automatically generating a wide variety of user-accessible variables that result in malicious buffers (an exploit). In this work, the search for successful exploits is formulated as an optimization problem and solved using evolutionary computation. Moreover the resulting attacks are passed through the Snort misuse detection system to observe the detection (or not) of each exploit.

Niching genetic algorithms (NGAs) are designed to locate multiple fitness function optima.