1. Bahan Presentasi Teknik Elektro dan Informatika Lanjut 1 dan 2
Multi-Agent Intrusion Detection System in Industrial Network using Ant Colony
Clustering Approach and Unsupervised Feature Extraction
Oleh : Chi-Ho Tsang and Sam Kwong
Company
LOGO
4. Inside Monitor Agent (M)
Raw network packets Feature type
Packet capture engine
captured from subnets construction
Pre-processed data
sent to communication
PCA dimensionality
ICA feature extraction module of its
reduction
associiated Decission
Agent
6. Evolving ACO-MH
• Deneubourg
• Dorigo dkk
dkk • Dorigo dkk
Binary • Goss dkk • Addition of
Bridge SACO • Double Ant System
heuristic
Experiment • Path Bridge (AS)
information
Selection Experiment
(β)
Process
• Maniezo & Ant • Gambardella
Colorni, 1999 & Dorigo
Modified Colony Max-Min
• Ellitis AS • 4 difference
AS System aspects from
AS
• Use only α (ACS) AS
Fast Ant
Ant-Q System Antabu
(FANT)
AS-
Fundamentals of Computational Swarm Intelligence Rank
ANTS
Andries P. Engelbrecht
Wiley & Sons @2005
8. Binary Bridge Experiment
The probability of the next ant to choose path A
at time step t + 1 is given as,
where c quantifies the degree of attraction of an
unexplored branch, α is the bias to using
pheromone deposits in the decision process
This algorithm is executed at each point where
the ant needs to make a decision.
Goss et al. extended the it is assumed that ants deposit the same amount of pheromone
binary bridge experiment and that pheromone does not evaporate
11. SACO - Transition Probability
If ant k is currently located at node i, it selects the next node j ∈ Nki , based on the
transition probability:
ij is pheromone concentration associtated with edge (i,j)
A number of ants, k = 1, . . . , nk, are placed on the source node.
Nki is the set of feasible nodes connected to node i, with respect to ant k.
α is a positive constant used to amplify the influence of pheromone concentrations.
12. SACO – Amount of deposit pheromone
After a complete path from the origin node to the destination node is accomplished,
and all loops have been removed, each ant retraces its path to the source node
deterministically, and deposits a pheromone amount,
to each link, (i, j), of the corresponding path; Lk(t) is the length of the path
constructed by ant k at time step t.
That is,
(17.4)
Where nk is the number of ants
13. SACO – evaporation of pheromone intensities
Ants rapidly converge to a solution, and that little time is spent exploring alternative
paths.
To explore more, and to prevent premature convergence, pheromone intensities on
links are allowed to “evaporate” at each iteration of the algorithm before being
reinforced on the basis of the newly constructed paths.
For each link, (i, j), let
with ρ ∈ [0, 1].
The constant, ρ, specifies the rate at which pheromones evaporate.
The large values of ρ, pheromone evaporates rapidly, while small values of ρ result
in slower evaporation rates.
The more pheromones evaporate, the more random the search becomes, facilitating
better exploration. For ρ = 1, the search is completely random.
15. AS – Adding the heuristic
(17.6)
ij = aposteriori effectiveness of the move from i to j (pheromone intensity)
exploration
ηij = apriori effectiveness of the move from i to j (desirability/attractiveness/visibility)
exploitation
k
, defines the set of feasible nodes for ant k when located on node i.
i
To prevent loops, Nki may include all nodes not yet visited by ant k.
For this purpose, a tabu list is usually maintained for each ant.
As an ant visits a new node, that node is added to the ant’s tabu list. Nodes in
the tabu list are removed from Nki , ensuring that no node is visited more than
once.
16. AS – Modified
Maniezzo and Colorni:
Pheromone evaporation: (17.5)
After completion of a path by each ant, the pheromone on each link is updated as
with (17.10)
the amount of pheromone deposited by ant k on link (i, j) and k at time step t.
(17.14)