Dynamic Fuzzy Rule Interpolation and Its Application to Intrusion Detection

Abstract

Fuzzy rule interpolation (FRI) offers an effective approach for making inference possible in sparse rule-based systems (and also for reducing the complexity of fuzzy models). However, requirements of fuzzy systems may change over time and hence, the use of a static rule base may affect the accuracy of FRI applications. Fortunately, an FRI system in action will produce interpolated rules in abundance during the interpolative reasoning process. While such interpolated results are discarded in existing FRI systems, they can be utilized to facilitate the development of a dynamic rule base in supporting subsequent inference. This is because the otherwise relinquished interpolated rules may contain possibly valuable information, covering regions that were uncovered by the original sparse rule base. This paper presents a dynamic fuzzy rule interpolation (D-FRI) approach by exploiting such interpolated rules in order to improve the overall system's coverage and efficacy. The resulting D-FRI system is able to select, combine, and generalize informative, frequently used interpolated rules for merging with the existing rule base while performing interpolative reasoning. Systematic experimental investigations demonstrate that D-FRI outperforms conventional FRI techniques, with increased accuracy and robustness. Furthermore, D-FRI is herein applied for network security analysis, in devising a dynamic intrusion detection system (IDS) through integration with the Snort software, one of the most popular open source IDSs. This integration, denoted as D-FRI-Snort hereafter, delivers an extra amount of intelligence to predict the level of potential threats. Experimental results show that with the inclusion of a dynamic rule base, by generalising newly interpolated rules based on the current network traffic conditions, D-FRI-Snort helps reduce both false positives and false negatives in intrusion detection.

A Ransomware Detection Method Using Fuzzy Hashing for Mitigating the Risk of Occlusion of Information Systems

“…This reflects the importance of similarity scores produced by each fuzzy hashing as it determines the success of the clustering method. Therefore, if a suitable fuzzy hashing is selected, the clustering can provide relatively better results, which can be further utilised in developing fuzzy rules for the fuzzy rule-based systems [27], [28], [29], [30], [31], [32].…”

Fuzzy Rule Based Interpolative Reasoning Supported by Attribute Ranking

“…Finally, the current approach presumes the use of a fixed (sparse) rule base. The most recently proposed mechanism for dynamic fuzzy rule interpolation [53] should be integrated with it to allow the collection and refinement of any intermediate fuzzy rules and interpolated results, in order to enrich the rule base and avoid unnecessary interpolation on the fly. Changjing Shang received the Ph.D. degree in computing and electrical engineering from Heriot-Watt University, Edinburgh, U.K., in 1995.…”

Improving fuzzy rule interpolation performance with information gain-guided antecedent weighting

“…However, having run the process of rule interpolation, intermediate fuzzy rules are generated. These can be collected and refined to form additional rules to support subsequent inference, thereby enriching the rule base and avoiding unnecessary interpolation afterwards (Naik et al 2017).…”