Company

LOGO

Multi-Agent Intrusion Detection System in Industrial Network using Ant ColonyClustering Approach and Unsupervised Feature Extraction

Oleh : Chi-Ho Tsang and Sam Kwong

Bahan Presentasi Teknik Elektro dan Informatika Lanjut 1 dan 2

SCADA Network

Agents

Monitor Agents (M)

Decision agents (D)

Action agents (A)

Coordination agents (C)

User Interface

agents (UI)

Registration agents (R)

ACCM

Inside Monitor Agent (M)

Raw network packets captured from subnets Packet capture engine Feature type

construction

PCA dimensionality reduction ICA feature extraction

Pre-processed data sent to communication

module of its associiated Decission

Agent

Inside Decission Agent (D)

ACCM (Ant Colony Clustering Models)?

Evolving ACO-MH

•Deneubourg dkk•Goss dkk•Path Selection Process

Binary Bridge Experiment

•Dorigo dkk•Double Bridge Experiment

SACO

•Dorigo dkk•Addition of heuristic information (β)

Ant System (AS)

•Maniezo & Colorni, 1999•Ellitis AS•Use only α

Modified AS

•Gambardella & Dorigo•4 difference aspects from AS

Ant Colony System (ACS) Max-Min AS

Ant-QFast Ant System (FANT)

Antabu

AS-Rank ANTSFundamentals of Computational Swarm IntelligenceAndries P. EngelbrechtWiley & Sons @2005

BINARY BRIDGE EXPERIMENTPerkembangan Ant System

Binary Bridge Experiment

The probability of the next ant to choose path A at time step t + 1 is given as,

where c quantifies the degree of attraction of an unexplored branch, α is the bias to using pheromone deposits in the decision process

Goss et al. extended the binary bridge experiment

This algorithm is executed at each point where the ant needs to make a decision.

it is assumed that ants deposit the same amount of pheromone and that pheromone does not evaporate

SIMPLE ANT COLONY OPTIMIZATION - SACO

Perkembangan Ant System

Graph for Shortest Path Problem

SACO - Transition Probability

ij is pheromone concentration associtated with edge (i,j)

A number of ants, k = 1, . . . , nk, are placed on the source node.

Nki is the set of feasible nodes connected to node i, with respect to ant k.

α is a positive constant used to amplify the influence of pheromone concentrations.

If ant k is currently located at node i, it selects the next node j N∈ ki , based on the

transition probability:

SACO – Amount of deposit pheromone

After a complete path from the origin node to the destination node is accomplished, and all loops have been removed, each ant retraces its path to the source node deterministically, and deposits a pheromone amount,

to each link, (i, j), of the corresponding path; Lk(t) is the length of the path constructed by ant k at time step t.

That is,

Where nk is the number of ants

(17.4)

SACO – evaporation of pheromone intensities

Ants rapidly converge to a solution, and that little time is spent exploring alternative paths.

To explore more, and to prevent premature convergence, pheromone intensities on links are allowed to “evaporate” at each iteration of the algorithm before being reinforced on the basis of the newly constructed paths.

For each link, (i, j), let

with ρ [0, 1].∈

The constant, ρ, specifies the rate at which pheromones evaporate.

The large values of ρ, pheromone evaporates rapidly, while small values of ρ result in slower evaporation rates.

The more pheromones evaporate, the more random the search becomes, facilitating better exploration. For ρ = 1, the search is completely random.

ANT SYSTEM - ASFirst Ant Algorithm (by Dorigo, Maniezo & Colorni)

AS – Adding the heuristic

ij = aposteriori effectiveness of the move from i to j (pheromone intensity) explorationηij = apriori effectiveness of the move from i to j (desirability/attractiveness/visibility) exploitation

ki , defines the set of feasible nodes for ant k when located on node i.

To prevent loops, Nki may include all nodes not yet visited by ant k.

For this purpose, a tabu list is usually maintained for each ant. As an ant visits a new node, that node is added to the ant’s tabu list. Nodes in the tabu list are removed from Nk

i , ensuring that no node is visited more than once.

(17.6)

AS – Modified

Maniezzo and Colorni:

Pheromone evaporation:

After completion of a path by each ant, the pheromone on each link is updated as

the amount of pheromone deposited by ant k on link (i, j) and k at time step t.

with

(17.5)

(17.10)

(17.14)

AS – Modified

(17.11)

(17.13)

AS – Modified (Elitist)

(17.4)

Dorigo dkk, introduced elitist strategy using some elite ants, so the pheromone update changes to:

(17.15)

(17.16)

AS – Algorithm

ANT COLONY SYSTEM - ACSImproving Ant System (by Dorigo & Gambardella)

ACS - A different transition rule

r0 to balance explore-exploit processSmaller r0 exploration more emphasized.

ACS - A different pheromone update rule

Pheromone is updated using the global update rule

2 methods implemented in selecting the path x+(t)

ACS – Local pheromone updates are introduced

ACS - candidate lists are used to favor specific nodes

ACS - Algorithm