PID-Based Feature Weight Learning and Its Application in Intrusion Detection

In case-based reasoning (CBR), cases are generally represented by features. Different features have different importance, which are often described by weights. So how to adaptively learning weights of different features is a very key issue in CBR, which impact directly the quality and performance of case extraction. Currently, in most practical CBR systems, the feature weights are given by domain experts subjectively. In this paper, we propose a PID operator-based feature weight learning method based on the fundamental theory of the control system. PID-based feature weighting method is a self-adaptive method, which utilizing the similar neural network architecture to construct the case base. Through designing 3 kinds of adjusting operators: Proportional, integral and derivative operator (PID), and each operator with different properties: reactive, prudent and sensitive, we can adjust the feature weight from different point of views, such as the current adjust results, the history results or the last two results. In order to evaluate the effectiveness of the method, the experiment of network anomaly detection is conducted and the experimental results show that all 3 operators are effective which can converge the intrusion detection system into a stable state in relative small iterations.