Intrusion detection has emerged as an importantapproach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user pro les built from normal usage data. In particular, program pro les based on Unix system calls and user pro les based on Unix shell commands are modeled using two di erent types of behavioral models for data mining. The dynamic modeling approach isbased on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach isbasedonevent occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classi cation approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classi ed as normal, we use a scheme that can be justi ed from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.

Boosting is recognized as one of the most successful techniques for generating classifier ensembles. Typically, the classifier outputs are combined by the weighted majority vote. The purpose of this study is to demonstrate the advantages of some fuzzy combination methods for ensembles of classifiers designed by Boosting. We ran 2-fold cross-validation experiments on 6 benchmark data sets to compare the fuzzy and non-fuzzy combination methods. On the "fuzzy side" we used the fuzzy integral and the decision templates with different similarity measures. On the "non-fuzzy side" we tried simple combiners such as the majority vote, minimum, maximum, average, product, and the Naive Bayes combination. Surprisingly, the minimum, maximum, average and product, which have been reported elsewhere to work very well on a variety of problems, appeared to be inadequate for our task. Thus the real contest was among the fuzzy combination methods on the one hand, and the weighted majority vote, the simple majority vote, and the Naive Bayes combiner, on the other hand. In our experiments, the fuzzy methods performed consistently better than the nonfuzzy methods. The weighted majority vote showed a stable performance, though slightly inferior to the performance of the fuzzy combiners. The majority vote and the Naive Bayes combiners had erratic behavior, ranging from the best to the worst contestants for different data sets.

For simplicity of pattern recognition system design, a sequential approach consisting of sensing, feature extraction and classification/matching is conventionally adopted, where each stage transforms its input relatively independently. In practice, the interaction between these modules is limited. Some of the errors in this end-to-end sequential processing can be eliminated, especially for the feature extraction stage, by revisiting the input pattern. We propose a feature refinement stage followed by a feedforward of the original grayscale image data to a feature verification stage in the context of a minutiae-based fingerprint verification system. We show that a feature refinement stage that assigns one of two class labels to each detected minutia (ridge ending and ridge bifurcation) can improve the matching performance by 1%. Further, we show that a minutia verification stage based on reexamining the grayscale profile in a detected minutia's spatial neighborhood in the sensed image can further improve the matching performance by 2.2% on our fingerprint database.

Well-calibrated probabilities are necessary in many applications like probabilistic frameworks or cost-sensitive tasks. Based on previous success of asymmetric Laplace method in calibrating text classi ers' scores, we propose to use piecewise logistic regression, which is a simple extension of standard logistic regression, as an alternative method in the discriminative family. We show that both methods have the exibility to be piecewise linear functions in log-odds, but they are based on quite dierent assumptions. We evaluated asymmetric Laplace method, piecewise logistic regression and standard logistic regression over standard text categorization collections (Reuters-21578 and TRECAP) with three classi ers (SVM, Naive Bayes and Logistic Regression Classi er), and observed that piecewise logistic regression performs signi cantly better than the other two methods in the log-loss metric.

clustering is typically considered a subjective process, which makes it problematic. For instance, how does one make statistical inferences based onclustering The matter is di#erent with pattern classi#cation, for which two fundamental characteristics can be stated: (1) the error of a classi#er can be estimatedusing "test data," and (2) a classi#er can be learnedusing "training data." This paper presents a probabilistic theory ofclustering including bothlearning (training and error estimation (testingb The theory is based on operators on random labeled point processes. It includes an error criterion in the context of random point sets and representation of the Bayes (optimal) cluster operator for ag"#" random labeled point process.Training is illustratedusing anearest-neigbg approach, and trained cluster operators are compared to several classical clustering algeringx ? 2003 PatternRecogLL"Lb Society. Published by Elsevier Ltd. Allrig:L reserved.

In this paper, we formally present a novel estimation method, referred to as the Stochastic Learning Weak Estimator (SLWE), which yields the estimate of the parameters of a binomial distribution, where the convergence of the estimate is weak, i.e. with regard to the rst and second moments. The estimation is based on the principles of stochastic learning. The mean of the nal estimate is independent of the scheme's learning coe cient, λ, and both the variance of the nal distribution and the speed decrease with λ. Similar results are true for the multinomial case, except that the equations transform from being of a scalar type to be of a vector type. Amazingly enough, the speed of the latter only depends on the same parameter, λ, which turns out to be the only non-unity eigenvalue of the underlying stochastic matrix that determines the time-dependence of the estimates. An empirical analysis on synthetic data shows the advantages of the scheme for nonstationary distributions. The paper also brie y reports (without detailed explanation) conclusive results that demonstrate the superiority of SLWE in pattern-recognition-based data compression, where the underlying data distribution is non-stationary. Finally, and more importantly, the paper includes the results of two pattern recognition exercises, the rst of which involves arti cial data,

In this paper we propose thediscxzx cscx transform (DCT) mod 2 feature set, whic utilizes polynomial clynomial derived from 2D DCT cfz#:TxfI obtained from spatially neighboringblochb Fac veri#cring results on the multi-session VidTIMIT database suggest that the DCT-mod 2 feature set is superior (in terms of robustness to illuminationdirecina creci and discTMfIkVkx: ability) to features extracsf using three popular methods:eigenfack princfac cincfac analysis, 2D DCT and 2D Gabor wavelets. Moreover,creover to Gabor wavelets, the DCT-mod 2 feature set is over 80 times faster to cofVAAk Additional experiments on the Weizmann database also show that the DCT-mod 2approac is more robust than 2D Gabor wavelets and 2D DCTcfzxxx#fIk ? 2003 Elsevier Scvier B.V. All rights reserved.

Understanding the mechanisms underlying visual object recognition has been an important subject in both human and machine vision since the early days of cognitive science. Current state-of-the-art machine vision systems can perform only rudimen-tary tasks in highly constrained situations compared to the powerful and exible recognition abilities of the human visual system. In this work, we provide an algorithmic analysis of psychological and anatomical models of the ventral visual pathway, more speci cally the pathway that is responsible for expert object recognition, using the current state of machine vision technology. As a result, we propose a biologically plausible expert object recognition system composed of a set of distinct component subsystems performing feature extraction and pattern matching. The proposed system is evaluated on four di erent multi-class data sets, compar-ing the performance of the system as a whole to the performance of its component subsystems alone. The results show that the system matches the performance of state-of-the-art machine vision techniques on uncompressed data, and performs bet-

Conventib-i electroencephalography (EEG) and magnetoencephalography (MEG)analysi often rely onaveragiovermultiWj trii to extractstati-Y#xjBrelevantdivant -Of between two or more experix-kYf condix-kY We demonstrate that byliObjjb iObjjb-kYf iObjjb-kYf over multijj spatijjx diijjxb-k sensorswisor a prede#nedtid wide#n one candiO#ffO-kYj condiffOon a trijY-kYOBBfbasi wii hii accuracy. Werestri# ourselves to aliW#B iW#BOti as i allows thecomputatiY of aspatiO diiO-kYYbB of thediOYWx#-kYYbB sourceactie-jB In the present set ofexperi-kYb theresulti# sourceactie-Y die-YW##f-k correspond to functinc - neuroanatomyconsinato win the task (e.g. contralateral sensory-motor cortex andanterix cierixx-k 2003Elsevix Scivi B.V. Allri-YB reserved. Keywords:Liib iib-b-b-i Hib-b-b-i electroencephalography (EEG); Magnetoencephalography (MEG); Si;-BBYBB-k analysiY BraiiYBB-kBj i-iiY (BCI) 1.I33 Tri- averagib i often used toi-YOb#Y thesiYWj#f-k#fbx-ii (SIR) rati- for examplei analysi of event-relatedpotentila (ERPs) [3].WiO the large number of Correspondii author.

In this study minimum spanning tree (MST) clustering is used to cluster EEG signals which contain epileptic seizures. Three strategies to get a clustering from the MST are presented and tested. As a reference, standard k-means clustering method is used on the same data and the results are compared. The results show that MST clustering is a promising method but further research is still needed. 1. BACKGROUND The problem behind this study is the detection of epileptic seizures from pre-recorded electroencephalogram (EEG) signals using computational methods. Six features have been calculatedfrom the data so that the measurements are presented as time-dependent vectors