PNNL-13501 - Pacific Northwest National Laboratory

Unknowns include
1. What is a representative set of data?
2. How do you know when training is complete?
3. How do you know that the artificial neural networks
is fully trained?
4. How do you know that the artificial neural networks
has not found local minima?
5. How do you know that the artificial neural networks
will generalize properly?
Genetic Algorithms and Evolution Programming
Genetic algorithms and evolution programming are
unlikely to be useful in this complex near real-time
reactive environment. However, genetic algorithms have
been used successfully in optimizing neural networks.
They may also be used to support new procedures
required in a dynamic environment.
Lattice Automata
Lattice automata is a relatively new field being developed
for the British defense community. Preliminary results
show that a particular strength of this method is the ability
of several autonomous agents to plan a simultaneous
meeting time and location even in the event that the
domain topology changes in a dramatic way. These
agents will then be able to renegotiate a new plan. This
strength could be used to coordinate several other
decision-making engines, but not as part of the anomaly
detection engine core.
Artificial Intelligence Planning Systems
Generative planning systems are computing intensive and
are usually not considered in near real-time scenarios.
Petri Nets and Colored Petri Nets
Petri nets were developed to overcome the limitations of
finite state machines, which could handle only a single
event at any given time. Coordinated actions are difficult
to model. Petri nets are good at describing actions, but
are not good at describing the reasons behind the actions.
Petri nets have been used to model network protocols and
information flow. Other applications include
152 FY 2000 Laboratory Directed Research and Development Annual Report
1. Naval Command and Control System
2. Intelligent network simulation
3. Work flow model in a nuclear waste plant
4. Model for document storage system
5. Purdue IDIOT intrusion detection system.
At the level of this research, petri nets are not applicable.
Petri nets are not suitable for detection of novel and new
threats (Bace 2000).
Enhanced Anomaly Detection Engines
With the multiple algorithm solution in mind, the
enhanced engines will take advantage of any algorithm
specially suited to a particular scenario that is presented.
The decision engine allows from one to all available
engines to be engaged upon the general engine detecting
anomalous behavior. This allows us to implement
methodologies that span the whole solution spectrum with
minimum impact to the system. The following algorithms
are considered top candidates for these engines.
Operational model (Bace 2000) – event counters
• Quantitative analysis (Bace 2000)
• Threshold detection
• Heuristic Threshold detection
• Signature Analysis
• Target Based Integrity Checks
• Quantitative Analysis and Data Reduction
Statistical Methods
• Mean and Standard Deviation (Bace 2000)
• Multivariate (Bace 2000)
• Markov process (Bace 2000)
• Parametric statistical methods
• Non-parametric statistical methods
Neural Networks
• Neural networks will be used for one or more of the
enhanced engines
Rule Base Approaches
• Time Based Induction Machine
• Markov.
Obviously, not all of these methods will be implemented.
A subset of the above methods will be selected on the