Title :
A method for partial-memory incremental learning and its application to computer intrusion detection
Author :
Maloof, Marcus A. ; Michalski, Ryszard S.
Author_Institution :
Machine Learning & Inference Lab., George Mason Univ., Fairfax, VA, USA
Abstract :
This paper describes a partial-memory incremental learning method based on the AQ15c inductive learning system. The method maintains a representative set of past training examples that are used together with new examples to appropriately modify the currently held hypotheses. Incremental learning is evoked by feedback from the environment or from the user. Such a method is useful in applications involving intelligent agents acting in a changing environment, active vision, and dynamic knowledge-bases. For this study, the method is applied to the problem of computer intrusion detection in which symbolic profiles are learned for a computer system´s users. In the experiments, the proposed method yielded significant gains in terms of learning time and memory requirements at the expense of slightly lower predictive accuracy and higher concept complexity, when compared to batch learning, in which all examples are given at once
Keywords :
cooperative systems; heuristic programming; knowledge based systems; learning by example; security of data; software agents; AQ15c; active vision; batch learning; computer intrusion detection; concept complexity; dynamic knowledge-bases; feedback; hypotheses; inductive learning system; intelligent agents; learning by example; learning time; memory requirements; partial-memory incremental learning; predictive accuracy; symbolic profiles; training examples; Accuracy; Application software; Computer applications; Computer science; Feedback; Intelligent agent; Intrusion detection; Laboratories; Learning systems; Machine learning;
Conference_Titel :
Tools with Artificial Intelligence, 1995. Proceedings., Seventh International Conference on
Conference_Location :
Herndon, VA
Print_ISBN :
0-8186-7312-5
DOI :
10.1109/TAI.1995.479784