Research ArticlePractical Employment of Granular Computing to ComplexApplication Layer Cyberattack Detection

RafaB Kozik 1 Marek Pawlicki 1 MichaB ChoraV1 and Witold Pedrycz2

1 Institute of Telecommunications and Computer Science UTP University of Science and Technology Bydgoszcz Poland2Department Electrical and Computer Engineering University of Alberta Canada

Correspondence should be addressed to Rafał Kozik rkozikutpedupl

Received 12 October 2018 Revised 28 December 2018 Accepted 6 January 2019 Published 16 January 2019

Guest Editor Fernando Sanchez Lasheras

Copyright copy 2019 Rafał Kozik et al This is an open access article distributed under the Creative Commons Attribution Licensewhich permits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

Network and information security are regarded as some of the most pressing problems of contemporary economy affecting bothindividual citizens and entire societies making them a highlight for homeland security Innovative approaches to handle thischallenge are undertaken by the scientific community proposing the utilization of the emerging advanced machine learningmethodsThis very paper puts forward a novel approach to the detection of cyberattacks taking inventory of the practical applicationof information granules The feasibility of utilizing Granular Computing (GC) as a solution to the most current challenges incybersecurity is researched To the best of our knowledge granular computing has not yet been widely examined or used forcybersecurity application purposes The major contribution of this work is a method for constructing information granules fromnetwork data We then report promising results on a benchmark dataset

1 Introduction and Rationale

In the lifecycle of any technological advancement the appli-cation domain and the target user base grow shift and alterHowever the very technological advancements that con-tribute to the usersrsquo well-being can be twisted into submissionbymalevolent agents Apart from the obvious uses which arebeneficial to the society they can also be both the origin andthe objective of a cybercrime

It does not require exhaustive research to notice that thenumber and the severity of attacks targeted at the applicationlayer is on the rise

This situation is echoed by the rankings of cyberattackseg by OWASP [1] where SQLIA (SQL Injection Attack)and XSS (Cross Site Scripting) are on top of the list Selectedexamples of critical systems which were successfully attackedthrough the application layer are the flight managementsystem in Poland or the energy grid inUkraine [2]Thereforewe aim at proposing novel methods to effectively detectand counter the cyberattacks in the application layer Theresearch we are conducting aims at investigating the ability ofthe emerging methods of machine learning to counter theseattacks Several attempts have beenmade to utilize innovative

machine learning solutions to tackle the cyberattack problemThose solutions include lifelong learning intelligent systemsor deep learning [3 4]

We hereby offer in this paper the implementation in thedomain of cybersecurity of yet another emerging conceptnamely Granular Computing

Therefore the major contribution of this paper is theapplication of a granular computing paradigm for cyberse-curity

We propose to extract information granules (which canalso be known as tokens) in order to better understand thestructure semantics andmeaning ofHTTP requests Such anapproach allows for effective anomaly detection as is provenby the results we report

In particular the main contributions of this paper are

(i) an innovative anomaly detection algorithm based onextracted information granules

(ii) a description of packet structure(iii) an efficient method for request sequence encoding

and classification and(iv) evaluation of the proposed approach

HindawiComplexityVolume 2019 Article ID 5826737 9 pageshttpsdoiorg10115520195826737

2 Complexity

The remainder of the paper is structured as follows Section 2is focused on current trends and challenges related tocybersecurity and anomaly detection approaches Section 3discusses the application of granular computing in cyber-security and Section 4 presents an approach for extractinginformation granules from network data while Section 5presents the results of the conducted experiments Conclu-sions are given thereafter

2 Cybersecurity A Quick Primer onChallenges and Trends

The rising numbers of attacks aimed at citizens societies andeven seemingly secure systems built for critical infrastruc-tures are easily observable [2 5]The inadequacy of signature-based systems in cyberattack detection is one of the primarycauses of this situation Whenever new attacks are createdor even slightly modified families of malware are utilizedthose systems which constitute an industry standard fallshort of properly handling the hazard until new signaturesare added Anomaly detectors which could tackle either newor obfuscated attacks are likely to generate false positivesThere is a plethora of solutions that aim at countering attackstargeting the application layer Many of those products usethe signature-based approach The signature-based categoryof cyber-attack detection includes Intrusion Prevention andDetection Systems (IDS and IPS) which use a predefined setof patterns (called signatures) to identify an attack IPS andIDS are deployed to improve the security of computer systemsand networks through detection (in the case of IDS) andblocking (in the case of IPS) of the cyberattacks

Another class of solutions is called WAF (Web Appli-cation Firewall [6ndash8]) Those solutions are based on blackand white listing approach Classification of requests sentfrom client to server is performed WAFs work on the basisof regular expressions patterns and signatures to detectcyberattacks The predefined patterns (or rules) are typicallycompared to the content of incoming requests (either theheader or the payload) A very popular IDSIPS open productis called SNORT [9] It is an open source project with acommunity of users who can freely modify the softwareproviding new rules to the Snort engine

Injection attacks such as SQL or XSS occur when animproperly validated request containing malicious code issent to an interpreter as part of a command or query XSSflaws might occur when the application processes maliciousdata and sends it to a web browser without proper validationor escaping (the reformatting of ambiguous characters) By itsnature XSS allows attackers to execute scripts in the victimrsquosbrowser This leads to hijacking user sessions defacing websites or redirecting the user to malicious sites

The problem of developing effective signatures for suchattacks is a highly complex one as these attack vectors andpatterns lend themselves to obfuscation Another drawbackof many WAF solutions is the fact that those are based onthe preliminary (or previously learnt) assumptions regard-ing the requestrsquos structure (eg [6 7]) However differentprotocols utilizing HTTP as the transportation protocol are

characterized by different payload structures For examplethe structure sent via a plain HTML form is different fromthat of a GWT-RPC or a SOAP call In such cases a numberof pre-prepared signatures will not match a differently-structured payload and in consequence those attacks willnot effectively be detected

Another approach toHTTP traffic anomaly detectionwaspresented in [10] The authors applied a DFA (DeterministicFinite Automaton) to compare the requests described bymeans of tokens The method based on the n-grams appliedfor anomaly detection and cyber-attacks detection has beenpresented in [11] Other systems have also implementedalgorithms to analyze the n-grams for example with theuse of statistical analysis [12] Self-Organizing Maps [13]Bloom filters [14] and a wide variety of different machinelearning classifiers [15] However depending on the analyzedprotocols and the methodology used to analyze n-gramsresearchers report very diverse results for n-grams tech-niques For instance in [11] authors reported a high numberof false positives for various state of the art methods Incontrast authors in [16] reported a recognition rate of over85 while having quite low false positive rate of only 1

3 Information Granules in Cybersecurity

One of the most serious challenges of the methods andalgorithms used in cybersecurity is being able to reacha correct understanding of the network data Undeniablycyberecosystems are quickly changing as are the character-istics of the data This fluctuation of properties producesuncertainty and difficulties in data partitioningclusteringIt is profoundly challenging to construct correct generaliza-tions rules and thresholds and substandard choices greatlydecrease the efficiency of typical pattern recognition andanomaly detection algorithms In addition many of the usedpattern recognition techniques do not try to incorporate oreven take into account the semantics of the analyzed networkdata

We propose the utilization of the practical elements ofGranular Computing for anomaly detection as a solution ofthe preceding problems

Granular computing refers to a general data analysis andrecognition framework incorporating data partitioning intoso called information granules

Granular Computing emerged as a general structure ofdata processing and knowledge discovery utilizing itemscalled information granules The very concept of granulationappeared independently in an array of fields including fuzzyand rough sets or cluster analysis [17] Granules are align-ments of elements drawn together by their similarity close-ness or functionality [18] A granule which occurs at a partic-ular granularity level conveys a certain aspect of the modelledissue [19] In situations with a certain degree of uncertaintygranules can provide a convenient solution This propertycan be translated into a certain economy when dealing withintricate problems The tolerance for uncertainty bears adegree of resemblance to human thinking itself [18] Whatfollows is the utilization of Granular Computing in designing

Complexity 3

real-life smart systems The hierarchical nature of GranularComputing in conjunction with the basics of human rea-soning conveyed in its premise makes it a perfect match formeaningful abstraction on various levels of detail [20]

Granules are essentially tiny parts of a larger constructwhich describe a particular facet of that construct whenviewed from a particular level of granulation [21] As anillustration of this principle one can consider how in clusteranalysis objects can be grouped together based on similarityor distance functions Since objects grouped in one clustershould exemplify a strong degree of similarity clusters can beconsidered as granules [20] Granules can be thus amassedinto larger collections which are then perceived as newlarger granules or divided into smaller pieces which aremorespecific [21]

Ideally the extracted information granules should complywith the Principle of Justifiable Granularity (PJG) [22] PJGis a guideline for information granules to best comply withtwo competing requirements justifiability and specificity Itstipulates that the constructed granules cover the relevantportion of the data but should not be highly dispersedacross the dataset This can be achieved by selecting granulesthat resemble relevant semantics describing the data Typicalpractical methods of granular computing are fuzzy sets [23]rough sets [24ndash26] and intuitionistic sets [27]

Granular computing allows for better data understandingthrough the incorporation of semantic aspects similari-ties and uncertainties Granular computing has been usedrecently for the analysis of spatiotemporal data [28] toconcept-cognitive learning from large and multi-source datain formal concept analysis [29]

Granular Computing has been used to estimate a powerplantrsquos electrical power output [30]The principles of granularcomputing are utilized to cluster the data with regard tothe distance between granules and the density of the newlyconstructed granules Data prepared this way is fed intoan Adaptive Neuro-Fuzzy Inference System (ANFIS) Theprocedure has been tested and proven to be a close fit [30]

Another application of granular computing allows for therecognition of faces that were surgically altered Multiple lev-els of granules are created some granules contain informationabout the whole face some about specific regions and someabout the fine detail of specific features Those granulationlevels are then directed to classifiers [31]

The utilization of granular computing allowed for thecreation of more accurate medical classifiers which has anappreciable value in medical procedures Data is granulatedon multiple levels with regards to the Euclidean distance ofthe data points to the centroids This distance constitutesthe level of granulation with higher granulation achievedthrough enlarging the distanceData onmultiple levels is thenserved to classifiers which return a value between 0 and 1Thevalues are then introduced to a final stage classifier [32]

One of the recent research papers proposed a systemintroducing granular computing to financial markets Theproposed method of time series forecasting bested the state-of -the-art benchmark algorithms Clustering is performedwith an adaptation of the possibilistic fuzzy c-means algo-rithm supplemented with the ability to process intervals The

algorithm recursively gauges cluster centers as it brings innovel data [33]

Granular computing can be used to increase the calcu-lating speed when solving the economic dispatch problemin order to reach the minimal running cost of a power gridThe described method breaks down a large power grid intosmaller components which are treated as equivalent powerstationsTheprocess can be repeated obtaining a finer level ofgranulation with each iteration Determining optimal valueson each level before trying to reach a global optimum makesthe procedure both quicker and easier [34]

We apply our own methods to construct a practicalsolution based on information granules obtained from thenetwork data

To the best of our knowledge granular computing hasnot yet been widely examined nor adapted for cybersecurityapplication purposes One of the rare published papers isauthored by Napoles et al [35] The authors addressedthe problem of modeling and classification for networkintrusion detection by utilizing a recently proposed gran-ular model named Rough Cognitive Networks (RCN) Theauthors both proposed and defined RCN for detection ofatypical (abnormal and potentially dangerous) patterns inthe network traffic RCN has been delineated as a sig-moid FCM (Fuzzy Cognitive Map) Map concepts denoteinformation granules corresponding to the RST (Rough SetTheory) -based positive boundary and negative regions ofdecision classes Learning mechanisms for RCN are basedon a self-adaptive Harmony Search algorithm The pro-posed model has been evaluated with the NSL-KDD dataset(httpsgithubcomdefcom17NSL KDD) and is shown to bea suitable and promising approach for detecting abnormaltraffic in computer networks Future work will addressvalidation and further evaluation of the model based on realnetwork traffic

In the upcoming section we present our innovative meth-ods for extracting information granules to counter cyber-attacks in the application layer

4 Proposed Approach for ExtractingInformation Granules from NetworkData in Cybersecurity

Hereby we propose a new method for the clustering of mul-tiple HTTP sequences utilizing a machine-learning classifierand granular computing approach

As a way of grasping the semantics and the granularitywe use the information about the request structure and thestatistical measurements of the structure content to detectanomalous behavior of untrusted sessions between client andserver

An overview of the proposed algorithm is presentedin Figure 1 while a general overview of the granulationprocedure utilized in our approach is presented in Figure 2

As can be seen later in Section 5 the conducted experi-ments confirm the promising results and we can report thatthe proposed approach andmethod is competitive with otherstate-of-the-art solutions

Complexity 3

real-life smart systems The hierarchical nature of GranularComputing in conjunction with the basics of human rea-soning conveyed in its premise makes it a perfect match formeaningful abstraction on various levels of detail [20]

Granules are essentially tiny parts of a larger constructwhich describe a particular facet of that construct whenviewed from a particular level of granulation [21] As anillustration of this principle one can consider how in clusteranalysis objects can be grouped together based on similarityor distance functions Since objects grouped in one clustershould exemplify a strong degree of similarity clusters can beconsidered as granules [20] Granules can be thus amassedinto larger collections which are then perceived as newlarger granules or divided into smaller pieces which aremorespecific [21]

Ideally the extracted information granules should complywith the Principle of Justifiable Granularity (PJG) [22] PJGis a guideline for information granules to best comply withtwo competing requirements justifiability and specificity Itstipulates that the constructed granules cover the relevantportion of the data but should not be highly dispersedacross the dataset This can be achieved by selecting granulesthat resemble relevant semantics describing the data Typicalpractical methods of granular computing are fuzzy sets [23]rough sets [24ndash26] and intuitionistic sets [27]

Granular computing allows for better data understandingthrough the incorporation of semantic aspects similari-ties and uncertainties Granular computing has been usedrecently for the analysis of spatiotemporal data [28] toconcept-cognitive learning from large and multi-source datain formal concept analysis [29]

Granular Computing has been used to estimate a powerplantrsquos electrical power output [30]The principles of granularcomputing are utilized to cluster the data with regard tothe distance between granules and the density of the newlyconstructed granules Data prepared this way is fed intoan Adaptive Neuro-Fuzzy Inference System (ANFIS) Theprocedure has been tested and proven to be a close fit [30]

Another application of granular computing allows for therecognition of faces that were surgically altered Multiple lev-els of granules are created some granules contain informationabout the whole face some about specific regions and someabout the fine detail of specific features Those granulationlevels are then directed to classifiers [31]

The utilization of granular computing allowed for thecreation of more accurate medical classifiers which has anappreciable value in medical procedures Data is granulatedon multiple levels with regards to the Euclidean distance ofthe data points to the centroids This distance constitutesthe level of granulation with higher granulation achievedthrough enlarging the distanceData onmultiple levels is thenserved to classifiers which return a value between 0 and 1Thevalues are then introduced to a final stage classifier [32]

One of the recent research papers proposed a systemintroducing granular computing to financial markets Theproposed method of time series forecasting bested the state-of -the-art benchmark algorithms Clustering is performedwith an adaptation of the possibilistic fuzzy c-means algo-rithm supplemented with the ability to process intervals The

algorithm recursively gauges cluster centers as it brings innovel data [33]

Granular computing can be used to increase the calcu-lating speed when solving the economic dispatch problemin order to reach the minimal running cost of a power gridThe described method breaks down a large power grid intosmaller components which are treated as equivalent powerstationsTheprocess can be repeated obtaining a finer level ofgranulation with each iteration Determining optimal valueson each level before trying to reach a global optimum makesthe procedure both quicker and easier [34]

We apply our own methods to construct a practicalsolution based on information granules obtained from thenetwork data

To the best of our knowledge granular computing hasnot yet been widely examined nor adapted for cybersecurityapplication purposes One of the rare published papers isauthored by Napoles et al [35] The authors addressedthe problem of modeling and classification for networkintrusion detection by utilizing a recently proposed gran-ular model named Rough Cognitive Networks (RCN) Theauthors both proposed and defined RCN for detection ofatypical (abnormal and potentially dangerous) patterns inthe network traffic RCN has been delineated as a sig-moid FCM (Fuzzy Cognitive Map) Map concepts denoteinformation granules corresponding to the RST (Rough SetTheory) -based positive boundary and negative regions ofdecision classes Learning mechanisms for RCN are basedon a self-adaptive Harmony Search algorithm The pro-posed model has been evaluated with the NSL-KDD dataset(httpsgithubcomdefcom17NSL KDD) and is shown to bea suitable and promising approach for detecting abnormaltraffic in computer networks Future work will addressvalidation and further evaluation of the model based on realnetwork traffic

In the upcoming section we present our innovative meth-ods for extracting information granules to counter cyber-attacks in the application layer

4 Proposed Approach for ExtractingInformation Granules from NetworkData in Cybersecurity

Hereby we propose a new method for the clustering of mul-tiple HTTP sequences utilizing a machine-learning classifierand granular computing approach

As a way of grasping the semantics and the granularitywe use the information about the request structure and thestatistical measurements of the structure content to detectanomalous behavior of untrusted sessions between client andserver

An overview of the proposed algorithm is presentedin Figure 1 while a general overview of the granulationprocedure utilized in our approach is presented in Figure 2

As can be seen later in Section 5 the conducted experi-ments confirm the promising results and we can report thatthe proposed approach andmethod is competitive with otherstate-of-the-art solutions

4 Complexity

HTTPrequest

finding a modelthrough URL

structurecomparison

checkingthe

model

AN

groupingby URL

StructureExtraction

buildingthe model

learning phase

Figure 1 High-level overview of the proposed algorithm

Granulationbrowsephpcat=oldamppage=1(browsephpcat=oldamppage=1)

browsephpcat=oldamppage=1(browsephp)(cat=oldamppage=1)

browsephpcat=oldamppage=1(browsephpcat)=old(amppage=)1

browsephpcat=oldamppage=1(b)(r)(o)(w)(s)(e)()(p)(h)(p)()(c)(a)(t)(=)(o)(l)(d)(amp)(p)(a)(g)(e)(=)(1)

one large granule

optimal granulation level

each character a granulelevel n

level 1

browsephpcat=oldamppage=1

(headerbody)

GET

GET

http

http

12

3

nbrowsephpcat=newamppage=15

Figure 2 The overview of the granulation algorithm The HTTP requests undergo a textual semantic segmentation of similar requests Theoptimal level of granulation reveals data that can be used to calculate the feature vector

The crucial advantage of the method proposed in thispaper is that it is invariant to the underlying protocolstack (the method is protocol agnostic) In other words itdoes not need to be tuned to any of the used protocolsor application interfaces using HTTP for transport (egthe RESTful API and SOAP) Hypertext Transfer Protocol(HTTP) is now frequently used due to its simplicity andreliability in assuring communication between computers in

distributed networks and allowing for increased usage of theweb applications

In our method we apply a granular computing approachand extract information granules from HTTP requests

An information granule in this approach is defined as arecurring sequence of information which shares semanticsfor all the requests sent to the same resource or server (inFigure 2)

Complexity 5

x=12ampy=34

x=56ampy=67

x=78ampy=84

x= 12 ampy= 34

67

84

56

78

token 1 token 2

phase 1extractionof tokensfrom samples

phase 2calculatingthe distributionof features

Figure 3 The parameter encoding approach

The analysis of each single request can result in severalgranules (tokens) Our goal is to extract granules that willidentify in the analyzed requests the delimiters of regionsrepresenting positions injected with cyberattacks or mal-ware

After these tokens are found we have to describe thesequences between them by calculating their statistical prop-erties (these tokens are represented on the optimal granula-tion level in Figure 2) We propose a two-step segmentationofHTTP requests In the first step we divide the request spaceinto smaller subsets to perform further calculations in theparallelized manner In the second step we perform the actualsegmentation of requests in order to identify their structureThe structure is described and represented by the extractedinformation granules Those information granules (shadedboxes in Figure 3) allow us to identify the clusters in thefeature space consisting of the feature vectors extracted fromthe granularized data

Afterwards when feature vectors are assigned to theappropriate clusters we apply a machine-learning classifierThe classification task is to assign them either to the normalor anomalous class In our experiments we have used varioussupervised methodsThese have been explained in the exper-iments section

In order to extract the granules we implemented theknown LZW compression method (Lempel-Ziv-Welch [3637]) Firstly we create the LZW dictionary D which allowsus to transform the textual input (eg logs) into naturalnumbers (see the following)

119863 119908119900119903119889 997888rarr 119894 119894euro119873 (1)

The algorithm performs scanning within the set S in orderto find the successively longer subsequences This step isperformed until the algorithm finds a sequence that does notyet belong to the dictionary The found substring is added tothe dictionary unless it is already represented The described

6 Complexity

Data Set of HTTP payloads SResult Dictionary Ds = empty stringwhile there is still data to be read in S do

endend

else

ch larr read a characterif (s + ch) isin D then

s larr s+ch

D larr D cup (s+ch)s larr ch

Figure 4 The algorithm for creating the dictionary D

procedure repeats until the entire dataset is scanned Thedescribed algorithm is shown in Figure 4

At the end of the processing a set S of HTTP payloads thedictionary D containing a list of sequences is created

This dictionary has the form of an unordered list Posi-tions in the list can be taken only by one wordThe dictionaryD is implemented as a hash-table to achieveO(1 ) lookup time

Of course as in LZWmethod creating the dictionary Dalso allows for compressing the data The algorithm replaceswords by numbers corresponding to the position of thesequence in the dictionary

It is worth noticing that even after the single scan of thedata we can extract a reasonable number of candidates forappropriate information granules Of course it is not a trivialtask given the need to achieve balance between the specificityand justifiability Another advantage is the compression of thedata

Still we have to further process the dictionary in order toobtain the collection of information granules First conditionis that we remove all the candidates that do not appear in allthe samples used for structure extraction In the next step weremove the sequences that also appear elsewhere as the sub-sequences of others

TheHTTP requests have the form of character sequenceswhose lengths vary

Moreover single granule can appear at different positionsin consecutive HTTP requests Also the distance betweengranules may vary and additionally it happens that some-times one granule is a subset of another information granule

In our approach we propose to use IDC (Idealized Char-acter Distribution) method We calculate it in the trainingphase from normal requests sent to a web application (theassumption is that the requests are normal and manualinspection is needed in this step) The IDC is calculated asthe mean value of all the character distributions During thedetection phase we calculate and evaluate the probability thatthe character distribution of a sequence is an actual sampledrawn from its ICD Hereby we use the well-known Chi-Square metric

Equation (2) is used for computing the value of the Chi-Square metric Dchisq(Q) for a sequence Q

119863119888ℎ119894119904119902 (119876) =119873

sum119899=0

(119868119862119863119899 minus ℎ119899 (119876))2

119868119862119863119899(2)

whereN indicates the number of bins in the histogram(in ourapproach we used N=9) ICD the distribution established forall the samples and h() the distribution of the sequenceQ thatis being tested

In order to calculate the distributions we count thenumber of characters that fall into each of the range of theASCII table We use the following ranges for this distributioncount lt031gtlt3247gtlt4857gt lt5864gt lt6590gtlt9196gtlt97122gt lt123127gt and lt12825gtThe chosen ASCII rangesrepresent different types of signs such as numbers quotesletters or special characters and in result represent well thedistribution The histogram that is used here will have 9 bins(due to 9 ranges)

5 Experiments

The CSIC10 benchmark dataset [38] was used for the experi-ments It contains several thousand HTTP protocol requestswhich are organized in a form similar to the Apache AccessLog The dataset was developed at the Information SecurityInstitute of CSIC (Spanish Research National Council) andit contains the generated traffic targeted to an e-Commerceweb application For convenience the data was split intoanomalous training and normal sets The dataset con-tains approx 36000 normal and 25000 anomalous requestsThe anomalous requests are not always cyberattacks Theymight refer to some anomalies (eg requesting unavailableresource) but more importantly they contain a wide rangeof application layer attacks such as SQL injection bufferoverflow information gathering files disclosure CRLF injec-tion XSS server side include and parameter tampering Tounderstand the results it is important to remember that therequests targeting hidden (or unavailable) resources are alsoconsidered anomalies Some examples of such anomalies arerequests for configuration files default files or session IDsin a URL (symptoms of an http session takeover attempt)Moreover the requests with an appropriate format (eg atelephone number composed of letters) are also labeled asanomalies As authors of the dataset explained such requestsmay not have a malicious intent but nevertheless they do notfollow the normal behavior of the web application Still thereis no other appropriate publicly available dataset for the webattack detection problem where we could reliably compareour results

To verify our method based on information granuleextraction we checked how our solution handles differentquantities of learning data As it is the typical case in ourexperiments we also used the 10-fold approach

The 10-fold cross-validation also known as rotationestimation is a model validation technique applied forevaluation of a machine learning model effectiveness ingeneralising themodel to anunforseen datasetThemethod isutilised in spotting problems like overfitting or selection biasIt provides an overview of how the model might performIn general k-fold cross-validation achieves results less biasedthan other methods based on splitting the dataset intotraining and testing data subsets (eg repeated random sub-sampling) Cross-validation averages the results of all the

Complexity 7

Table 1 True positive rate and false positive rate for differentlearning algorithms

Algorithm True Positive Rate False Positive RateICD 978 81DS AdaBoost 937 01RepTree 931 03Random Forest 919 07

folds to come up with a more accurate assessment of a modelperformance

In our case the data used in learning and evaluationpurposes is divided randomly into 10 parts (folds) Onepart of the data (10 of the entire dataset) is used forevaluation while the remaining 90 is used for training(eg establishing model parameters)The whole procedure isrepeated 10 times so each time a different part of the datasetis used for evaluation and a different part is used for trainingThe results for all 10 folds are averaged to yield an overall errorestimate

51 Comparison of Different Classification Techniques In thisexperiment we have compared the effectiveness of variousmachine learning methods As it was explained earlier firstthe granules are extracted and data for each granule isencoded used histograms These histograms are used to trainthe algorithms

It must be noticed that ICD is purely anomaly detec-tion method and it can be trained on normal data Otheralgorithms require both normal and anomalous data As itis shown in Table 1 the ICD algorithm achieves the highestanomaly detection (TPR) However the number of falsealarms in contrast to other methods is relatively high

52 Assessment of Training Dataset Size Impact of Classifica-tion Effectiveness For each fold we deliberately picked only asubset of data to train the classifier In such approach we stillhave the same number of testing samples (common baselinefor comparison) even if we have used only a fraction of theavailable training data The entire 10-fold cross validationis repeated for different proportions of the training datanamely 1 10 20 and 100 Results are presented inTable 2

To obtain a better overview of the effectiveness ofour method we calculated and present the ROC curvesThe ROC curve for 300 learning samples is presented inFigure 5 while the curve for 32400 samples is presented inFigure 6

6 Conclusions

In this paper we have proposed using the elegant theoryof Granular Computing (GC) as the new approach tocybersecurity and network anomaly detection The majorcontribution and innovation of this work is the first practical

70

75

80

85

90

95

100

TPR

[]

10 20 30 400FPR []

With granulation Without granulation

Figure 5 ROC curves for the Chi-Square metric comparingeffectiveness of anomaly detection when granules for payload areextracted and otherwise The experiment was conducted for analgorithm trained on 300 samples

With granulation Without granulation

70

75

80

85

90

95

100TP

R [

]

10 20 30 400FPR []

Figure 6 ROC curves for the Chi-Square metric comparingeffectiveness of anomaly detection when granules for payloadare extracted and otherwise The experiment conducted for analgorithm trained on 32000 samples

implementation of the method to extract information gran-ules in order to detect cyberattacks The proposed solutionis designed to work with a typical HTTP-based request-response web application It can be described as an anomalydetection tool that receives HTTP requests analyses theircontent extracts information granules and classifies thoseeither as normal or as anomalies We conducted the set ofexperiments on a standard benchmark dataset and typicalevaluation scenarios We report promising results whichdemonstrate the efficiency of our approach and motivateour further research in applying Granular Computing to thecybersecurity domain (eg for other types of attacks in otherlayers)

Data Availability

The data used to support the findings of this study areincluded within the article

8 Complexity

Table 2 True positive rate and false positive rate for different numbers of learning samples

TP Rate [] FP Rate [] Data Set Size Number of samples866 18 1 300956 58 10 3000969 68 20 6000977 81 100 32400

Conflicts of Interest

The authors declare that they have no conflicts of interest

References

[1] ldquoOWASP Top 10 2013 OWASP project homepagerdquo 2018[2] M Choras R Kozik A Flizikowski W Hołubowicz and R

Renk ldquoCyber Threats Impacting Critical Infrastructuresrdquo inManaging the Complexity of Critical Infrastructures R SetolaV Rosato E Kyriakides and E Rome Eds vol 90 pp 139ndash161Springer International Publishing Cham Switzerland 2016

[3] M Choras R Kozik R Renk and W Hołubowicz ldquoThe con-cept of applying lifelong learning paradigm to cybersecurityrdquoIntelligent Computing Methodologies pp 663ndash671 2017

[4] D Ariu I Corona R Tronci and G Giacinto ldquoMachineLearning in Security Applicationsrdquo Transactions on MachineLearning and Data Mining vol 8 no 1 2015

[5] R Kozik M Choras A Flizikowski M Theocharidou VRosato and E Rome ldquoAdvanced services for critical infrastruc-tures protectionrdquo Journal of Ambient Intelligence and Human-ized Computing vol 6 no 6 pp 783ndash795 2015

[6] ldquoSCALP Project homepagerdquo httpcodegooglecompapache-scalp 2018

[7] ldquoPHPIDS Project homepagerdquo 2018[8] ldquoOWASP Stinger Project homepagerdquo httpswwwowasporg

indexphpCategoryOWASPStingerProject 2018[9] ldquoSNORT Project homepagerdquo httpwwwsnortorg 2018[10] K L Ingham A Somayaji J Burge and S Forrest ldquoLearning

DFA representations of HTTP for protecting web applicationsrdquoComputer Networks vol 51 no 5 pp 1239ndash1255 2007

[11] D Hadziosmanovic L Simionato D Bolzoni E Zambon andS Etalle ldquoN-Gramagainst theMachineOn the Feasibility of theN-GramNetwork Analysis for Binary Protocolsrdquo in Research inAttacks Intrusions and Defenses pp 354ndash373 2012

[12] K Wang and S J Stolfo ldquoAnomalous payload-based networkintrusion detectionrdquo in Recent Advances in Intrusion Detectionvol 3224 pp 203ndash222 Springer Berlin Germany 2004

[13] D Bolzoni S Etalle P Hartel and E Zambon ldquoPOSEIDONA 2-tier anomaly-based network intrusion detection systemrdquoin Proceedings of the 4th IEEE International Workshop onInformation Assurance IWIA 2006 pp 144ndash156 UK April2006

[14] K Wang J J Parekh and S J Stolfo ldquoAnagram a con-tent anomaly detector resistant to mimicry attackrdquo in RecentAdvances in Intrusion Detection vol 4219 pp 226ndash248Springer Berlin Germany 2006

[15] R Perdisci D Ariu P Fogla G Giacinto andW Lee ldquoMcPADa multiple classifier system for accurate payload-based anomalydetectionrdquoComputer Networks vol 53 no 6 pp 864ndash881 2009

[16] K L Ingham and H Inoue ldquoComparing Anomaly DetectionTechniques for HTTPrdquo Recent Advances in Intrusion Detectionpp 42ndash62 2007

[17] T Y Lin and C J Liau ldquoGranular computing and rough setsrdquo inData Mining and Knowledge Discovery Handbook O Maimonand L Rokach Eds pp 535ndash561 Springer Boston Mass USA2005

[18] L A Zadeh ldquoToward a theory of fuzzy information granulationand its centrality in human reasoning and fuzzy logicrdquo FuzzySets and Systems vol 90 no 2 pp 111ndash127 1997

[19] A Bargiela andW Pedrycz ldquoThe roots of granular computingrdquoin Proceedings of the IEEE International Conference on GranularComputing pp 806ndash809 2006

[20] Y Yao ldquoA partition model of granular computingrdquo Transactionson Rough Sets I vol 1 pp 232ndash253 2004

[21] Y Y Yao ldquoGranular Computingrdquo in Proceedings of the 4thChineseNational Conference on Rough Sets vol 31 pp 1ndash5 2004

[22] W Pedrycz and W Homenda ldquoBuilding the Fundamentals ofGranular Computing A Principle of Justifiable GranularityrdquoApplied So Computing vol 13 no 10 pp 4209ndash4218 2013

[23] C Wagner S Miller J M Garibaldi D T Anderson and TC Havens ldquoFrom interval-valued data to general type-2 fuzzysetsrdquo IEEETransactions on Fuzzy Systems vol 23 no 2 pp 248ndash269 2015

[24] F Gong M-W Shao and G Qiu ldquoConcept granular comput-ing systems and their approximation operatorsrdquo InternationalJournal of Machine Learning and Cybernetics vol 8 no 2 pp627ndash640 2017

[25] Y H Qian J Liang and C Y Dang ldquoIncomplete multigran-ulation rough setrdquo IEEE Transactions on Systems Man andCybernetics Systems vol 40 no 2 pp 420ndash431 2010

[26] M I Ali B Davvaz and M Shabir ldquoSome properties ofgeneralized rough setsrdquo Information Sciences vol 224 pp 170ndash179 2013

[27] B Huang Y Zhuang and H Li ldquoInformation granulationand uncertainty measures in interval-valued intuitionisticfuzzy information systemsrdquo European Journal of OperationalResearch vol 231 no 1 pp 162ndash170 2013

[28] M Song W Shang L Wang and W Pedrycz ldquoAnalysis ofspatiotemporal data relationship using information granulesrdquoInternational Journal of Machine Learning and Cybernetics vol8 no 5 pp 1439ndash1446 2017

[29] J Niu C Huang J Li and M Fan ldquoParallel computingtechniques for concept-cognitive learning based on granularcomputingrdquo International Journal of Machine Learning andCybernetics vol 9 no 11 pp 1785ndash1805 2018

[30] W Sun J Zhang and R Wang ldquoPredicting electrical poweroutput by usingGranular Computing basedNeuro-Fuzzymod-eling methodrdquo in Proceedings of the 27th Chinese Control andDecision Conference CCDC 2015 pp 2865ndash2870 China May2015

Complexity 5

x=12ampy=34

x=56ampy=67

x=78ampy=84

x= 12 ampy= 34

67

84

56

78

token 1 token 2

phase 1extractionof tokensfrom samples

phase 2calculatingthe distributionof features

Figure 3 The parameter encoding approach

The analysis of each single request can result in severalgranules (tokens) Our goal is to extract granules that willidentify in the analyzed requests the delimiters of regionsrepresenting positions injected with cyberattacks or mal-ware

After these tokens are found we have to describe thesequences between them by calculating their statistical prop-erties (these tokens are represented on the optimal granula-tion level in Figure 2) We propose a two-step segmentationofHTTP requests In the first step we divide the request spaceinto smaller subsets to perform further calculations in theparallelized manner In the second step we perform the actualsegmentation of requests in order to identify their structureThe structure is described and represented by the extractedinformation granules Those information granules (shadedboxes in Figure 3) allow us to identify the clusters in thefeature space consisting of the feature vectors extracted fromthe granularized data

Afterwards when feature vectors are assigned to theappropriate clusters we apply a machine-learning classifierThe classification task is to assign them either to the normalor anomalous class In our experiments we have used varioussupervised methodsThese have been explained in the exper-iments section

In order to extract the granules we implemented theknown LZW compression method (Lempel-Ziv-Welch [3637]) Firstly we create the LZW dictionary D which allowsus to transform the textual input (eg logs) into naturalnumbers (see the following)

119863 119908119900119903119889 997888rarr 119894 119894euro119873 (1)

The algorithm performs scanning within the set S in orderto find the successively longer subsequences This step isperformed until the algorithm finds a sequence that does notyet belong to the dictionary The found substring is added tothe dictionary unless it is already represented The described

6 Complexity

Data Set of HTTP payloads SResult Dictionary Ds = empty stringwhile there is still data to be read in S do

endend

else

ch larr read a characterif (s + ch) isin D then

s larr s+ch

D larr D cup (s+ch)s larr ch

Figure 4 The algorithm for creating the dictionary D

procedure repeats until the entire dataset is scanned Thedescribed algorithm is shown in Figure 4

At the end of the processing a set S of HTTP payloads thedictionary D containing a list of sequences is created

This dictionary has the form of an unordered list Posi-tions in the list can be taken only by one wordThe dictionaryD is implemented as a hash-table to achieveO(1 ) lookup time

Of course as in LZWmethod creating the dictionary Dalso allows for compressing the data The algorithm replaceswords by numbers corresponding to the position of thesequence in the dictionary

It is worth noticing that even after the single scan of thedata we can extract a reasonable number of candidates forappropriate information granules Of course it is not a trivialtask given the need to achieve balance between the specificityand justifiability Another advantage is the compression of thedata

Still we have to further process the dictionary in order toobtain the collection of information granules First conditionis that we remove all the candidates that do not appear in allthe samples used for structure extraction In the next step weremove the sequences that also appear elsewhere as the sub-sequences of others

TheHTTP requests have the form of character sequenceswhose lengths vary

Moreover single granule can appear at different positionsin consecutive HTTP requests Also the distance betweengranules may vary and additionally it happens that some-times one granule is a subset of another information granule

In our approach we propose to use IDC (Idealized Char-acter Distribution) method We calculate it in the trainingphase from normal requests sent to a web application (theassumption is that the requests are normal and manualinspection is needed in this step) The IDC is calculated asthe mean value of all the character distributions During thedetection phase we calculate and evaluate the probability thatthe character distribution of a sequence is an actual sampledrawn from its ICD Hereby we use the well-known Chi-Square metric

Equation (2) is used for computing the value of the Chi-Square metric Dchisq(Q) for a sequence Q

119863119888ℎ119894119904119902 (119876) =119873

sum119899=0

(119868119862119863119899 minus ℎ119899 (119876))2

119868119862119863119899(2)

whereN indicates the number of bins in the histogram(in ourapproach we used N=9) ICD the distribution established forall the samples and h() the distribution of the sequenceQ thatis being tested

In order to calculate the distributions we count thenumber of characters that fall into each of the range of theASCII table We use the following ranges for this distributioncount lt031gtlt3247gtlt4857gt lt5864gt lt6590gtlt9196gtlt97122gt lt123127gt and lt12825gtThe chosen ASCII rangesrepresent different types of signs such as numbers quotesletters or special characters and in result represent well thedistribution The histogram that is used here will have 9 bins(due to 9 ranges)

5 Experiments

The CSIC10 benchmark dataset [38] was used for the experi-ments It contains several thousand HTTP protocol requestswhich are organized in a form similar to the Apache AccessLog The dataset was developed at the Information SecurityInstitute of CSIC (Spanish Research National Council) andit contains the generated traffic targeted to an e-Commerceweb application For convenience the data was split intoanomalous training and normal sets The dataset con-tains approx 36000 normal and 25000 anomalous requestsThe anomalous requests are not always cyberattacks Theymight refer to some anomalies (eg requesting unavailableresource) but more importantly they contain a wide rangeof application layer attacks such as SQL injection bufferoverflow information gathering files disclosure CRLF injec-tion XSS server side include and parameter tampering Tounderstand the results it is important to remember that therequests targeting hidden (or unavailable) resources are alsoconsidered anomalies Some examples of such anomalies arerequests for configuration files default files or session IDsin a URL (symptoms of an http session takeover attempt)Moreover the requests with an appropriate format (eg atelephone number composed of letters) are also labeled asanomalies As authors of the dataset explained such requestsmay not have a malicious intent but nevertheless they do notfollow the normal behavior of the web application Still thereis no other appropriate publicly available dataset for the webattack detection problem where we could reliably compareour results

To verify our method based on information granuleextraction we checked how our solution handles differentquantities of learning data As it is the typical case in ourexperiments we also used the 10-fold approach

The 10-fold cross-validation also known as rotationestimation is a model validation technique applied forevaluation of a machine learning model effectiveness ingeneralising themodel to anunforseen datasetThemethod isutilised in spotting problems like overfitting or selection biasIt provides an overview of how the model might performIn general k-fold cross-validation achieves results less biasedthan other methods based on splitting the dataset intotraining and testing data subsets (eg repeated random sub-sampling) Cross-validation averages the results of all the

Complexity 7

Table 1 True positive rate and false positive rate for differentlearning algorithms

Algorithm True Positive Rate False Positive RateICD 978 81DS AdaBoost 937 01RepTree 931 03Random Forest 919 07

folds to come up with a more accurate assessment of a modelperformance

In our case the data used in learning and evaluationpurposes is divided randomly into 10 parts (folds) Onepart of the data (10 of the entire dataset) is used forevaluation while the remaining 90 is used for training(eg establishing model parameters)The whole procedure isrepeated 10 times so each time a different part of the datasetis used for evaluation and a different part is used for trainingThe results for all 10 folds are averaged to yield an overall errorestimate

51 Comparison of Different Classification Techniques In thisexperiment we have compared the effectiveness of variousmachine learning methods As it was explained earlier firstthe granules are extracted and data for each granule isencoded used histograms These histograms are used to trainthe algorithms

It must be noticed that ICD is purely anomaly detec-tion method and it can be trained on normal data Otheralgorithms require both normal and anomalous data As itis shown in Table 1 the ICD algorithm achieves the highestanomaly detection (TPR) However the number of falsealarms in contrast to other methods is relatively high

52 Assessment of Training Dataset Size Impact of Classifica-tion Effectiveness For each fold we deliberately picked only asubset of data to train the classifier In such approach we stillhave the same number of testing samples (common baselinefor comparison) even if we have used only a fraction of theavailable training data The entire 10-fold cross validationis repeated for different proportions of the training datanamely 1 10 20 and 100 Results are presented inTable 2

To obtain a better overview of the effectiveness ofour method we calculated and present the ROC curvesThe ROC curve for 300 learning samples is presented inFigure 5 while the curve for 32400 samples is presented inFigure 6

6 Conclusions

In this paper we have proposed using the elegant theoryof Granular Computing (GC) as the new approach tocybersecurity and network anomaly detection The majorcontribution and innovation of this work is the first practical

70

75

80

85

90

95

100

TPR

[]

10 20 30 400FPR []

With granulation Without granulation

Figure 5 ROC curves for the Chi-Square metric comparingeffectiveness of anomaly detection when granules for payload areextracted and otherwise The experiment was conducted for analgorithm trained on 300 samples

With granulation Without granulation

70

75

80

85

90

95

100TP

R [

]

10 20 30 400FPR []

Figure 6 ROC curves for the Chi-Square metric comparingeffectiveness of anomaly detection when granules for payloadare extracted and otherwise The experiment conducted for analgorithm trained on 32000 samples

implementation of the method to extract information gran-ules in order to detect cyberattacks The proposed solutionis designed to work with a typical HTTP-based request-response web application It can be described as an anomalydetection tool that receives HTTP requests analyses theircontent extracts information granules and classifies thoseeither as normal or as anomalies We conducted the set ofexperiments on a standard benchmark dataset and typicalevaluation scenarios We report promising results whichdemonstrate the efficiency of our approach and motivateour further research in applying Granular Computing to thecybersecurity domain (eg for other types of attacks in otherlayers)

Data Availability

The data used to support the findings of this study areincluded within the article

8 Complexity

Table 2 True positive rate and false positive rate for different numbers of learning samples

TP Rate [] FP Rate [] Data Set Size Number of samples866 18 1 300956 58 10 3000969 68 20 6000977 81 100 32400

Conflicts of Interest

The authors declare that they have no conflicts of interest

References

[1] ldquoOWASP Top 10 2013 OWASP project homepagerdquo 2018[2] M Choras R Kozik A Flizikowski W Hołubowicz and R

Renk ldquoCyber Threats Impacting Critical Infrastructuresrdquo inManaging the Complexity of Critical Infrastructures R SetolaV Rosato E Kyriakides and E Rome Eds vol 90 pp 139ndash161Springer International Publishing Cham Switzerland 2016

[3] M Choras R Kozik R Renk and W Hołubowicz ldquoThe con-cept of applying lifelong learning paradigm to cybersecurityrdquoIntelligent Computing Methodologies pp 663ndash671 2017

[4] D Ariu I Corona R Tronci and G Giacinto ldquoMachineLearning in Security Applicationsrdquo Transactions on MachineLearning and Data Mining vol 8 no 1 2015

[5] R Kozik M Choras A Flizikowski M Theocharidou VRosato and E Rome ldquoAdvanced services for critical infrastruc-tures protectionrdquo Journal of Ambient Intelligence and Human-ized Computing vol 6 no 6 pp 783ndash795 2015

[6] ldquoSCALP Project homepagerdquo httpcodegooglecompapache-scalp 2018

[7] ldquoPHPIDS Project homepagerdquo 2018[8] ldquoOWASP Stinger Project homepagerdquo httpswwwowasporg

indexphpCategoryOWASPStingerProject 2018[9] ldquoSNORT Project homepagerdquo httpwwwsnortorg 2018[10] K L Ingham A Somayaji J Burge and S Forrest ldquoLearning

DFA representations of HTTP for protecting web applicationsrdquoComputer Networks vol 51 no 5 pp 1239ndash1255 2007

[11] D Hadziosmanovic L Simionato D Bolzoni E Zambon andS Etalle ldquoN-Gramagainst theMachineOn the Feasibility of theN-GramNetwork Analysis for Binary Protocolsrdquo in Research inAttacks Intrusions and Defenses pp 354ndash373 2012

[12] K Wang and S J Stolfo ldquoAnomalous payload-based networkintrusion detectionrdquo in Recent Advances in Intrusion Detectionvol 3224 pp 203ndash222 Springer Berlin Germany 2004

[13] D Bolzoni S Etalle P Hartel and E Zambon ldquoPOSEIDONA 2-tier anomaly-based network intrusion detection systemrdquoin Proceedings of the 4th IEEE International Workshop onInformation Assurance IWIA 2006 pp 144ndash156 UK April2006

[14] K Wang J J Parekh and S J Stolfo ldquoAnagram a con-tent anomaly detector resistant to mimicry attackrdquo in RecentAdvances in Intrusion Detection vol 4219 pp 226ndash248Springer Berlin Germany 2006

[15] R Perdisci D Ariu P Fogla G Giacinto andW Lee ldquoMcPADa multiple classifier system for accurate payload-based anomalydetectionrdquoComputer Networks vol 53 no 6 pp 864ndash881 2009

[16] K L Ingham and H Inoue ldquoComparing Anomaly DetectionTechniques for HTTPrdquo Recent Advances in Intrusion Detectionpp 42ndash62 2007

[17] T Y Lin and C J Liau ldquoGranular computing and rough setsrdquo inData Mining and Knowledge Discovery Handbook O Maimonand L Rokach Eds pp 535ndash561 Springer Boston Mass USA2005

[18] L A Zadeh ldquoToward a theory of fuzzy information granulationand its centrality in human reasoning and fuzzy logicrdquo FuzzySets and Systems vol 90 no 2 pp 111ndash127 1997

[19] A Bargiela andW Pedrycz ldquoThe roots of granular computingrdquoin Proceedings of the IEEE International Conference on GranularComputing pp 806ndash809 2006

[20] Y Yao ldquoA partition model of granular computingrdquo Transactionson Rough Sets I vol 1 pp 232ndash253 2004

[21] Y Y Yao ldquoGranular Computingrdquo in Proceedings of the 4thChineseNational Conference on Rough Sets vol 31 pp 1ndash5 2004

[22] W Pedrycz and W Homenda ldquoBuilding the Fundamentals ofGranular Computing A Principle of Justifiable GranularityrdquoApplied So Computing vol 13 no 10 pp 4209ndash4218 2013

[23] C Wagner S Miller J M Garibaldi D T Anderson and TC Havens ldquoFrom interval-valued data to general type-2 fuzzysetsrdquo IEEETransactions on Fuzzy Systems vol 23 no 2 pp 248ndash269 2015

[24] F Gong M-W Shao and G Qiu ldquoConcept granular comput-ing systems and their approximation operatorsrdquo InternationalJournal of Machine Learning and Cybernetics vol 8 no 2 pp627ndash640 2017

[25] Y H Qian J Liang and C Y Dang ldquoIncomplete multigran-ulation rough setrdquo IEEE Transactions on Systems Man andCybernetics Systems vol 40 no 2 pp 420ndash431 2010

[26] M I Ali B Davvaz and M Shabir ldquoSome properties ofgeneralized rough setsrdquo Information Sciences vol 224 pp 170ndash179 2013

[27] B Huang Y Zhuang and H Li ldquoInformation granulationand uncertainty measures in interval-valued intuitionisticfuzzy information systemsrdquo European Journal of OperationalResearch vol 231 no 1 pp 162ndash170 2013

[28] M Song W Shang L Wang and W Pedrycz ldquoAnalysis ofspatiotemporal data relationship using information granulesrdquoInternational Journal of Machine Learning and Cybernetics vol8 no 5 pp 1439ndash1446 2017

[29] J Niu C Huang J Li and M Fan ldquoParallel computingtechniques for concept-cognitive learning based on granularcomputingrdquo International Journal of Machine Learning andCybernetics vol 9 no 11 pp 1785ndash1805 2018

[30] W Sun J Zhang and R Wang ldquoPredicting electrical poweroutput by usingGranular Computing basedNeuro-Fuzzymod-eling methodrdquo in Proceedings of the 27th Chinese Control andDecision Conference CCDC 2015 pp 2865ndash2870 China May2015

6 Complexity

Data Set of HTTP payloads SResult Dictionary Ds = empty stringwhile there is still data to be read in S do

endend

else

ch larr read a characterif (s + ch) isin D then

s larr s+ch

D larr D cup (s+ch)s larr ch

Figure 4 The algorithm for creating the dictionary D

procedure repeats until the entire dataset is scanned Thedescribed algorithm is shown in Figure 4

At the end of the processing a set S of HTTP payloads thedictionary D containing a list of sequences is created

This dictionary has the form of an unordered list Posi-tions in the list can be taken only by one wordThe dictionaryD is implemented as a hash-table to achieveO(1 ) lookup time

Of course as in LZWmethod creating the dictionary Dalso allows for compressing the data The algorithm replaceswords by numbers corresponding to the position of thesequence in the dictionary

It is worth noticing that even after the single scan of thedata we can extract a reasonable number of candidates forappropriate information granules Of course it is not a trivialtask given the need to achieve balance between the specificityand justifiability Another advantage is the compression of thedata

Still we have to further process the dictionary in order toobtain the collection of information granules First conditionis that we remove all the candidates that do not appear in allthe samples used for structure extraction In the next step weremove the sequences that also appear elsewhere as the sub-sequences of others

TheHTTP requests have the form of character sequenceswhose lengths vary

Moreover single granule can appear at different positionsin consecutive HTTP requests Also the distance betweengranules may vary and additionally it happens that some-times one granule is a subset of another information granule

In our approach we propose to use IDC (Idealized Char-acter Distribution) method We calculate it in the trainingphase from normal requests sent to a web application (theassumption is that the requests are normal and manualinspection is needed in this step) The IDC is calculated asthe mean value of all the character distributions During thedetection phase we calculate and evaluate the probability thatthe character distribution of a sequence is an actual sampledrawn from its ICD Hereby we use the well-known Chi-Square metric

Equation (2) is used for computing the value of the Chi-Square metric Dchisq(Q) for a sequence Q

119863119888ℎ119894119904119902 (119876) =119873

sum119899=0

(119868119862119863119899 minus ℎ119899 (119876))2

119868119862119863119899(2)

whereN indicates the number of bins in the histogram(in ourapproach we used N=9) ICD the distribution established forall the samples and h() the distribution of the sequenceQ thatis being tested

In order to calculate the distributions we count thenumber of characters that fall into each of the range of theASCII table We use the following ranges for this distributioncount lt031gtlt3247gtlt4857gt lt5864gt lt6590gtlt9196gtlt97122gt lt123127gt and lt12825gtThe chosen ASCII rangesrepresent different types of signs such as numbers quotesletters or special characters and in result represent well thedistribution The histogram that is used here will have 9 bins(due to 9 ranges)

5 Experiments

The CSIC10 benchmark dataset [38] was used for the experi-ments It contains several thousand HTTP protocol requestswhich are organized in a form similar to the Apache AccessLog The dataset was developed at the Information SecurityInstitute of CSIC (Spanish Research National Council) andit contains the generated traffic targeted to an e-Commerceweb application For convenience the data was split intoanomalous training and normal sets The dataset con-tains approx 36000 normal and 25000 anomalous requestsThe anomalous requests are not always cyberattacks Theymight refer to some anomalies (eg requesting unavailableresource) but more importantly they contain a wide rangeof application layer attacks such as SQL injection bufferoverflow information gathering files disclosure CRLF injec-tion XSS server side include and parameter tampering Tounderstand the results it is important to remember that therequests targeting hidden (or unavailable) resources are alsoconsidered anomalies Some examples of such anomalies arerequests for configuration files default files or session IDsin a URL (symptoms of an http session takeover attempt)Moreover the requests with an appropriate format (eg atelephone number composed of letters) are also labeled asanomalies As authors of the dataset explained such requestsmay not have a malicious intent but nevertheless they do notfollow the normal behavior of the web application Still thereis no other appropriate publicly available dataset for the webattack detection problem where we could reliably compareour results

To verify our method based on information granuleextraction we checked how our solution handles differentquantities of learning data As it is the typical case in ourexperiments we also used the 10-fold approach

The 10-fold cross-validation also known as rotationestimation is a model validation technique applied forevaluation of a machine learning model effectiveness ingeneralising themodel to anunforseen datasetThemethod isutilised in spotting problems like overfitting or selection biasIt provides an overview of how the model might performIn general k-fold cross-validation achieves results less biasedthan other methods based on splitting the dataset intotraining and testing data subsets (eg repeated random sub-sampling) Cross-validation averages the results of all the

Complexity 7

Table 1 True positive rate and false positive rate for differentlearning algorithms

Algorithm True Positive Rate False Positive RateICD 978 81DS AdaBoost 937 01RepTree 931 03Random Forest 919 07

folds to come up with a more accurate assessment of a modelperformance

In our case the data used in learning and evaluationpurposes is divided randomly into 10 parts (folds) Onepart of the data (10 of the entire dataset) is used forevaluation while the remaining 90 is used for training(eg establishing model parameters)The whole procedure isrepeated 10 times so each time a different part of the datasetis used for evaluation and a different part is used for trainingThe results for all 10 folds are averaged to yield an overall errorestimate

51 Comparison of Different Classification Techniques In thisexperiment we have compared the effectiveness of variousmachine learning methods As it was explained earlier firstthe granules are extracted and data for each granule isencoded used histograms These histograms are used to trainthe algorithms

It must be noticed that ICD is purely anomaly detec-tion method and it can be trained on normal data Otheralgorithms require both normal and anomalous data As itis shown in Table 1 the ICD algorithm achieves the highestanomaly detection (TPR) However the number of falsealarms in contrast to other methods is relatively high

52 Assessment of Training Dataset Size Impact of Classifica-tion Effectiveness For each fold we deliberately picked only asubset of data to train the classifier In such approach we stillhave the same number of testing samples (common baselinefor comparison) even if we have used only a fraction of theavailable training data The entire 10-fold cross validationis repeated for different proportions of the training datanamely 1 10 20 and 100 Results are presented inTable 2

To obtain a better overview of the effectiveness ofour method we calculated and present the ROC curvesThe ROC curve for 300 learning samples is presented inFigure 5 while the curve for 32400 samples is presented inFigure 6

6 Conclusions

In this paper we have proposed using the elegant theoryof Granular Computing (GC) as the new approach tocybersecurity and network anomaly detection The majorcontribution and innovation of this work is the first practical

70

75

80

85

90

95

100

TPR

[]

10 20 30 400FPR []

With granulation Without granulation

Figure 5 ROC curves for the Chi-Square metric comparingeffectiveness of anomaly detection when granules for payload areextracted and otherwise The experiment was conducted for analgorithm trained on 300 samples

With granulation Without granulation

70

75

80

85

90

95

100TP

R [

]

10 20 30 400FPR []

Figure 6 ROC curves for the Chi-Square metric comparingeffectiveness of anomaly detection when granules for payloadare extracted and otherwise The experiment conducted for analgorithm trained on 32000 samples

implementation of the method to extract information gran-ules in order to detect cyberattacks The proposed solutionis designed to work with a typical HTTP-based request-response web application It can be described as an anomalydetection tool that receives HTTP requests analyses theircontent extracts information granules and classifies thoseeither as normal or as anomalies We conducted the set ofexperiments on a standard benchmark dataset and typicalevaluation scenarios We report promising results whichdemonstrate the efficiency of our approach and motivateour further research in applying Granular Computing to thecybersecurity domain (eg for other types of attacks in otherlayers)

Data Availability

The data used to support the findings of this study areincluded within the article

8 Complexity

Table 2 True positive rate and false positive rate for different numbers of learning samples

TP Rate [] FP Rate [] Data Set Size Number of samples866 18 1 300956 58 10 3000969 68 20 6000977 81 100 32400

Conflicts of Interest

The authors declare that they have no conflicts of interest

References

[1] ldquoOWASP Top 10 2013 OWASP project homepagerdquo 2018[2] M Choras R Kozik A Flizikowski W Hołubowicz and R

Renk ldquoCyber Threats Impacting Critical Infrastructuresrdquo inManaging the Complexity of Critical Infrastructures R SetolaV Rosato E Kyriakides and E Rome Eds vol 90 pp 139ndash161Springer International Publishing Cham Switzerland 2016

[3] M Choras R Kozik R Renk and W Hołubowicz ldquoThe con-cept of applying lifelong learning paradigm to cybersecurityrdquoIntelligent Computing Methodologies pp 663ndash671 2017

[4] D Ariu I Corona R Tronci and G Giacinto ldquoMachineLearning in Security Applicationsrdquo Transactions on MachineLearning and Data Mining vol 8 no 1 2015

[5] R Kozik M Choras A Flizikowski M Theocharidou VRosato and E Rome ldquoAdvanced services for critical infrastruc-tures protectionrdquo Journal of Ambient Intelligence and Human-ized Computing vol 6 no 6 pp 783ndash795 2015

[6] ldquoSCALP Project homepagerdquo httpcodegooglecompapache-scalp 2018

[7] ldquoPHPIDS Project homepagerdquo 2018[8] ldquoOWASP Stinger Project homepagerdquo httpswwwowasporg

indexphpCategoryOWASPStingerProject 2018[9] ldquoSNORT Project homepagerdquo httpwwwsnortorg 2018[10] K L Ingham A Somayaji J Burge and S Forrest ldquoLearning

DFA representations of HTTP for protecting web applicationsrdquoComputer Networks vol 51 no 5 pp 1239ndash1255 2007

[11] D Hadziosmanovic L Simionato D Bolzoni E Zambon andS Etalle ldquoN-Gramagainst theMachineOn the Feasibility of theN-GramNetwork Analysis for Binary Protocolsrdquo in Research inAttacks Intrusions and Defenses pp 354ndash373 2012

[12] K Wang and S J Stolfo ldquoAnomalous payload-based networkintrusion detectionrdquo in Recent Advances in Intrusion Detectionvol 3224 pp 203ndash222 Springer Berlin Germany 2004

[13] D Bolzoni S Etalle P Hartel and E Zambon ldquoPOSEIDONA 2-tier anomaly-based network intrusion detection systemrdquoin Proceedings of the 4th IEEE International Workshop onInformation Assurance IWIA 2006 pp 144ndash156 UK April2006

[14] K Wang J J Parekh and S J Stolfo ldquoAnagram a con-tent anomaly detector resistant to mimicry attackrdquo in RecentAdvances in Intrusion Detection vol 4219 pp 226ndash248Springer Berlin Germany 2006

[15] R Perdisci D Ariu P Fogla G Giacinto andW Lee ldquoMcPADa multiple classifier system for accurate payload-based anomalydetectionrdquoComputer Networks vol 53 no 6 pp 864ndash881 2009

[16] K L Ingham and H Inoue ldquoComparing Anomaly DetectionTechniques for HTTPrdquo Recent Advances in Intrusion Detectionpp 42ndash62 2007

[17] T Y Lin and C J Liau ldquoGranular computing and rough setsrdquo inData Mining and Knowledge Discovery Handbook O Maimonand L Rokach Eds pp 535ndash561 Springer Boston Mass USA2005

[18] L A Zadeh ldquoToward a theory of fuzzy information granulationand its centrality in human reasoning and fuzzy logicrdquo FuzzySets and Systems vol 90 no 2 pp 111ndash127 1997

[19] A Bargiela andW Pedrycz ldquoThe roots of granular computingrdquoin Proceedings of the IEEE International Conference on GranularComputing pp 806ndash809 2006

[20] Y Yao ldquoA partition model of granular computingrdquo Transactionson Rough Sets I vol 1 pp 232ndash253 2004

[21] Y Y Yao ldquoGranular Computingrdquo in Proceedings of the 4thChineseNational Conference on Rough Sets vol 31 pp 1ndash5 2004

[22] W Pedrycz and W Homenda ldquoBuilding the Fundamentals ofGranular Computing A Principle of Justifiable GranularityrdquoApplied So Computing vol 13 no 10 pp 4209ndash4218 2013

[23] C Wagner S Miller J M Garibaldi D T Anderson and TC Havens ldquoFrom interval-valued data to general type-2 fuzzysetsrdquo IEEETransactions on Fuzzy Systems vol 23 no 2 pp 248ndash269 2015

[24] F Gong M-W Shao and G Qiu ldquoConcept granular comput-ing systems and their approximation operatorsrdquo InternationalJournal of Machine Learning and Cybernetics vol 8 no 2 pp627ndash640 2017

[25] Y H Qian J Liang and C Y Dang ldquoIncomplete multigran-ulation rough setrdquo IEEE Transactions on Systems Man andCybernetics Systems vol 40 no 2 pp 420ndash431 2010

[26] M I Ali B Davvaz and M Shabir ldquoSome properties ofgeneralized rough setsrdquo Information Sciences vol 224 pp 170ndash179 2013

[27] B Huang Y Zhuang and H Li ldquoInformation granulationand uncertainty measures in interval-valued intuitionisticfuzzy information systemsrdquo European Journal of OperationalResearch vol 231 no 1 pp 162ndash170 2013

[28] M Song W Shang L Wang and W Pedrycz ldquoAnalysis ofspatiotemporal data relationship using information granulesrdquoInternational Journal of Machine Learning and Cybernetics vol8 no 5 pp 1439ndash1446 2017

[29] J Niu C Huang J Li and M Fan ldquoParallel computingtechniques for concept-cognitive learning based on granularcomputingrdquo International Journal of Machine Learning andCybernetics vol 9 no 11 pp 1785ndash1805 2018

[30] W Sun J Zhang and R Wang ldquoPredicting electrical poweroutput by usingGranular Computing basedNeuro-Fuzzymod-eling methodrdquo in Proceedings of the 27th Chinese Control andDecision Conference CCDC 2015 pp 2865ndash2870 China May2015

Complexity 7

Table 1 True positive rate and false positive rate for differentlearning algorithms

Algorithm True Positive Rate False Positive RateICD 978 81DS AdaBoost 937 01RepTree 931 03Random Forest 919 07

folds to come up with a more accurate assessment of a modelperformance

In our case the data used in learning and evaluationpurposes is divided randomly into 10 parts (folds) Onepart of the data (10 of the entire dataset) is used forevaluation while the remaining 90 is used for training(eg establishing model parameters)The whole procedure isrepeated 10 times so each time a different part of the datasetis used for evaluation and a different part is used for trainingThe results for all 10 folds are averaged to yield an overall errorestimate

51 Comparison of Different Classification Techniques In thisexperiment we have compared the effectiveness of variousmachine learning methods As it was explained earlier firstthe granules are extracted and data for each granule isencoded used histograms These histograms are used to trainthe algorithms

It must be noticed that ICD is purely anomaly detec-tion method and it can be trained on normal data Otheralgorithms require both normal and anomalous data As itis shown in Table 1 the ICD algorithm achieves the highestanomaly detection (TPR) However the number of falsealarms in contrast to other methods is relatively high

52 Assessment of Training Dataset Size Impact of Classifica-tion Effectiveness For each fold we deliberately picked only asubset of data to train the classifier In such approach we stillhave the same number of testing samples (common baselinefor comparison) even if we have used only a fraction of theavailable training data The entire 10-fold cross validationis repeated for different proportions of the training datanamely 1 10 20 and 100 Results are presented inTable 2

To obtain a better overview of the effectiveness ofour method we calculated and present the ROC curvesThe ROC curve for 300 learning samples is presented inFigure 5 while the curve for 32400 samples is presented inFigure 6

6 Conclusions

In this paper we have proposed using the elegant theoryof Granular Computing (GC) as the new approach tocybersecurity and network anomaly detection The majorcontribution and innovation of this work is the first practical

70

75

80

85

90

95

100

TPR

[]

10 20 30 400FPR []

With granulation Without granulation

Figure 5 ROC curves for the Chi-Square metric comparingeffectiveness of anomaly detection when granules for payload areextracted and otherwise The experiment was conducted for analgorithm trained on 300 samples

With granulation Without granulation

70

75

80

85

90

95

100TP

R [

]

10 20 30 400FPR []

Figure 6 ROC curves for the Chi-Square metric comparingeffectiveness of anomaly detection when granules for payloadare extracted and otherwise The experiment conducted for analgorithm trained on 32000 samples

implementation of the method to extract information gran-ules in order to detect cyberattacks The proposed solutionis designed to work with a typical HTTP-based request-response web application It can be described as an anomalydetection tool that receives HTTP requests analyses theircontent extracts information granules and classifies thoseeither as normal or as anomalies We conducted the set ofexperiments on a standard benchmark dataset and typicalevaluation scenarios We report promising results whichdemonstrate the efficiency of our approach and motivateour further research in applying Granular Computing to thecybersecurity domain (eg for other types of attacks in otherlayers)

Data Availability

The data used to support the findings of this study areincluded within the article

8 Complexity

Table 2 True positive rate and false positive rate for different numbers of learning samples

TP Rate [] FP Rate [] Data Set Size Number of samples866 18 1 300956 58 10 3000969 68 20 6000977 81 100 32400

Conflicts of Interest

The authors declare that they have no conflicts of interest

References

[1] ldquoOWASP Top 10 2013 OWASP project homepagerdquo 2018[2] M Choras R Kozik A Flizikowski W Hołubowicz and R

Renk ldquoCyber Threats Impacting Critical Infrastructuresrdquo inManaging the Complexity of Critical Infrastructures R SetolaV Rosato E Kyriakides and E Rome Eds vol 90 pp 139ndash161Springer International Publishing Cham Switzerland 2016

[3] M Choras R Kozik R Renk and W Hołubowicz ldquoThe con-cept of applying lifelong learning paradigm to cybersecurityrdquoIntelligent Computing Methodologies pp 663ndash671 2017

[4] D Ariu I Corona R Tronci and G Giacinto ldquoMachineLearning in Security Applicationsrdquo Transactions on MachineLearning and Data Mining vol 8 no 1 2015

[5] R Kozik M Choras A Flizikowski M Theocharidou VRosato and E Rome ldquoAdvanced services for critical infrastruc-tures protectionrdquo Journal of Ambient Intelligence and Human-ized Computing vol 6 no 6 pp 783ndash795 2015

[6] ldquoSCALP Project homepagerdquo httpcodegooglecompapache-scalp 2018

[7] ldquoPHPIDS Project homepagerdquo 2018[8] ldquoOWASP Stinger Project homepagerdquo httpswwwowasporg

indexphpCategoryOWASPStingerProject 2018[9] ldquoSNORT Project homepagerdquo httpwwwsnortorg 2018[10] K L Ingham A Somayaji J Burge and S Forrest ldquoLearning

DFA representations of HTTP for protecting web applicationsrdquoComputer Networks vol 51 no 5 pp 1239ndash1255 2007

[11] D Hadziosmanovic L Simionato D Bolzoni E Zambon andS Etalle ldquoN-Gramagainst theMachineOn the Feasibility of theN-GramNetwork Analysis for Binary Protocolsrdquo in Research inAttacks Intrusions and Defenses pp 354ndash373 2012

[12] K Wang and S J Stolfo ldquoAnomalous payload-based networkintrusion detectionrdquo in Recent Advances in Intrusion Detectionvol 3224 pp 203ndash222 Springer Berlin Germany 2004

[13] D Bolzoni S Etalle P Hartel and E Zambon ldquoPOSEIDONA 2-tier anomaly-based network intrusion detection systemrdquoin Proceedings of the 4th IEEE International Workshop onInformation Assurance IWIA 2006 pp 144ndash156 UK April2006

[14] K Wang J J Parekh and S J Stolfo ldquoAnagram a con-tent anomaly detector resistant to mimicry attackrdquo in RecentAdvances in Intrusion Detection vol 4219 pp 226ndash248Springer Berlin Germany 2006

[15] R Perdisci D Ariu P Fogla G Giacinto andW Lee ldquoMcPADa multiple classifier system for accurate payload-based anomalydetectionrdquoComputer Networks vol 53 no 6 pp 864ndash881 2009

[16] K L Ingham and H Inoue ldquoComparing Anomaly DetectionTechniques for HTTPrdquo Recent Advances in Intrusion Detectionpp 42ndash62 2007

[17] T Y Lin and C J Liau ldquoGranular computing and rough setsrdquo inData Mining and Knowledge Discovery Handbook O Maimonand L Rokach Eds pp 535ndash561 Springer Boston Mass USA2005

[18] L A Zadeh ldquoToward a theory of fuzzy information granulationand its centrality in human reasoning and fuzzy logicrdquo FuzzySets and Systems vol 90 no 2 pp 111ndash127 1997

[19] A Bargiela andW Pedrycz ldquoThe roots of granular computingrdquoin Proceedings of the IEEE International Conference on GranularComputing pp 806ndash809 2006

[20] Y Yao ldquoA partition model of granular computingrdquo Transactionson Rough Sets I vol 1 pp 232ndash253 2004

[21] Y Y Yao ldquoGranular Computingrdquo in Proceedings of the 4thChineseNational Conference on Rough Sets vol 31 pp 1ndash5 2004

[22] W Pedrycz and W Homenda ldquoBuilding the Fundamentals ofGranular Computing A Principle of Justifiable GranularityrdquoApplied So Computing vol 13 no 10 pp 4209ndash4218 2013

[23] C Wagner S Miller J M Garibaldi D T Anderson and TC Havens ldquoFrom interval-valued data to general type-2 fuzzysetsrdquo IEEETransactions on Fuzzy Systems vol 23 no 2 pp 248ndash269 2015

[24] F Gong M-W Shao and G Qiu ldquoConcept granular comput-ing systems and their approximation operatorsrdquo InternationalJournal of Machine Learning and Cybernetics vol 8 no 2 pp627ndash640 2017

[25] Y H Qian J Liang and C Y Dang ldquoIncomplete multigran-ulation rough setrdquo IEEE Transactions on Systems Man andCybernetics Systems vol 40 no 2 pp 420ndash431 2010

[26] M I Ali B Davvaz and M Shabir ldquoSome properties ofgeneralized rough setsrdquo Information Sciences vol 224 pp 170ndash179 2013

[27] B Huang Y Zhuang and H Li ldquoInformation granulationand uncertainty measures in interval-valued intuitionisticfuzzy information systemsrdquo European Journal of OperationalResearch vol 231 no 1 pp 162ndash170 2013

[28] M Song W Shang L Wang and W Pedrycz ldquoAnalysis ofspatiotemporal data relationship using information granulesrdquoInternational Journal of Machine Learning and Cybernetics vol8 no 5 pp 1439ndash1446 2017

[29] J Niu C Huang J Li and M Fan ldquoParallel computingtechniques for concept-cognitive learning based on granularcomputingrdquo International Journal of Machine Learning andCybernetics vol 9 no 11 pp 1785ndash1805 2018

[30] W Sun J Zhang and R Wang ldquoPredicting electrical poweroutput by usingGranular Computing basedNeuro-Fuzzymod-eling methodrdquo in Proceedings of the 27th Chinese Control andDecision Conference CCDC 2015 pp 2865ndash2870 China May2015

8 Complexity

Table 2 True positive rate and false positive rate for different numbers of learning samples

TP Rate [] FP Rate [] Data Set Size Number of samples866 18 1 300956 58 10 3000969 68 20 6000977 81 100 32400

Conflicts of Interest

The authors declare that they have no conflicts of interest

References

[1] ldquoOWASP Top 10 2013 OWASP project homepagerdquo 2018[2] M Choras R Kozik A Flizikowski W Hołubowicz and R

Renk ldquoCyber Threats Impacting Critical Infrastructuresrdquo inManaging the Complexity of Critical Infrastructures R SetolaV Rosato E Kyriakides and E Rome Eds vol 90 pp 139ndash161Springer International Publishing Cham Switzerland 2016

[3] M Choras R Kozik R Renk and W Hołubowicz ldquoThe con-cept of applying lifelong learning paradigm to cybersecurityrdquoIntelligent Computing Methodologies pp 663ndash671 2017

[4] D Ariu I Corona R Tronci and G Giacinto ldquoMachineLearning in Security Applicationsrdquo Transactions on MachineLearning and Data Mining vol 8 no 1 2015

[5] R Kozik M Choras A Flizikowski M Theocharidou VRosato and E Rome ldquoAdvanced services for critical infrastruc-tures protectionrdquo Journal of Ambient Intelligence and Human-ized Computing vol 6 no 6 pp 783ndash795 2015

[6] ldquoSCALP Project homepagerdquo httpcodegooglecompapache-scalp 2018

[7] ldquoPHPIDS Project homepagerdquo 2018[8] ldquoOWASP Stinger Project homepagerdquo httpswwwowasporg

indexphpCategoryOWASPStingerProject 2018[9] ldquoSNORT Project homepagerdquo httpwwwsnortorg 2018[10] K L Ingham A Somayaji J Burge and S Forrest ldquoLearning

DFA representations of HTTP for protecting web applicationsrdquoComputer Networks vol 51 no 5 pp 1239ndash1255 2007

[11] D Hadziosmanovic L Simionato D Bolzoni E Zambon andS Etalle ldquoN-Gramagainst theMachineOn the Feasibility of theN-GramNetwork Analysis for Binary Protocolsrdquo in Research inAttacks Intrusions and Defenses pp 354ndash373 2012

[12] K Wang and S J Stolfo ldquoAnomalous payload-based networkintrusion detectionrdquo in Recent Advances in Intrusion Detectionvol 3224 pp 203ndash222 Springer Berlin Germany 2004

[13] D Bolzoni S Etalle P Hartel and E Zambon ldquoPOSEIDONA 2-tier anomaly-based network intrusion detection systemrdquoin Proceedings of the 4th IEEE International Workshop onInformation Assurance IWIA 2006 pp 144ndash156 UK April2006

[14] K Wang J J Parekh and S J Stolfo ldquoAnagram a con-tent anomaly detector resistant to mimicry attackrdquo in RecentAdvances in Intrusion Detection vol 4219 pp 226ndash248Springer Berlin Germany 2006

[15] R Perdisci D Ariu P Fogla G Giacinto andW Lee ldquoMcPADa multiple classifier system for accurate payload-based anomalydetectionrdquoComputer Networks vol 53 no 6 pp 864ndash881 2009

[16] K L Ingham and H Inoue ldquoComparing Anomaly DetectionTechniques for HTTPrdquo Recent Advances in Intrusion Detectionpp 42ndash62 2007

[17] T Y Lin and C J Liau ldquoGranular computing and rough setsrdquo inData Mining and Knowledge Discovery Handbook O Maimonand L Rokach Eds pp 535ndash561 Springer Boston Mass USA2005

[18] L A Zadeh ldquoToward a theory of fuzzy information granulationand its centrality in human reasoning and fuzzy logicrdquo FuzzySets and Systems vol 90 no 2 pp 111ndash127 1997

[19] A Bargiela andW Pedrycz ldquoThe roots of granular computingrdquoin Proceedings of the IEEE International Conference on GranularComputing pp 806ndash809 2006

[20] Y Yao ldquoA partition model of granular computingrdquo Transactionson Rough Sets I vol 1 pp 232ndash253 2004

[21] Y Y Yao ldquoGranular Computingrdquo in Proceedings of the 4thChineseNational Conference on Rough Sets vol 31 pp 1ndash5 2004

[22] W Pedrycz and W Homenda ldquoBuilding the Fundamentals ofGranular Computing A Principle of Justifiable GranularityrdquoApplied So Computing vol 13 no 10 pp 4209ndash4218 2013

[23] C Wagner S Miller J M Garibaldi D T Anderson and TC Havens ldquoFrom interval-valued data to general type-2 fuzzysetsrdquo IEEETransactions on Fuzzy Systems vol 23 no 2 pp 248ndash269 2015

[24] F Gong M-W Shao and G Qiu ldquoConcept granular comput-ing systems and their approximation operatorsrdquo InternationalJournal of Machine Learning and Cybernetics vol 8 no 2 pp627ndash640 2017

[25] Y H Qian J Liang and C Y Dang ldquoIncomplete multigran-ulation rough setrdquo IEEE Transactions on Systems Man andCybernetics Systems vol 40 no 2 pp 420ndash431 2010

[26] M I Ali B Davvaz and M Shabir ldquoSome properties ofgeneralized rough setsrdquo Information Sciences vol 224 pp 170ndash179 2013

[27] B Huang Y Zhuang and H Li ldquoInformation granulationand uncertainty measures in interval-valued intuitionisticfuzzy information systemsrdquo European Journal of OperationalResearch vol 231 no 1 pp 162ndash170 2013

[28] M Song W Shang L Wang and W Pedrycz ldquoAnalysis ofspatiotemporal data relationship using information granulesrdquoInternational Journal of Machine Learning and Cybernetics vol8 no 5 pp 1439ndash1446 2017

[29] J Niu C Huang J Li and M Fan ldquoParallel computingtechniques for concept-cognitive learning based on granularcomputingrdquo International Journal of Machine Learning andCybernetics vol 9 no 11 pp 1785ndash1805 2018

[30] W Sun J Zhang and R Wang ldquoPredicting electrical poweroutput by usingGranular Computing basedNeuro-Fuzzymod-eling methodrdquo in Proceedings of the 27th Chinese Control andDecision Conference CCDC 2015 pp 2865ndash2870 China May2015

Complexity 9

[31] K Vimitha andM Jayasree ldquoRecognizing faces from surgicallyaltered face images using granular approachrdquo in Proceedings ofthe 2017 International Conference on Wireless CommunicationsSignal Processing and Networking (WiSPNET) pp 463ndash466Chennai India March 2017

[32] M Al-Shammaa and M F Abbod ldquoGranular computingapproach for the design of medical data classification systemsrdquoin Proceedings of the IEEE Conference on Computational Intelli-gence in Bioinformatics andComputational Biology CIBCB 2015pp 1ndash7 Canada August 2015

[33] L Maciel R Ballini and F Gomide ldquoEvolving granular ana-lytics for interval time series forecastingrdquo Granular Computingvol 1 no 4 pp 213ndash224 2016

[34] X Li and L Fang ldquoResearch on economic dispatch of largepower grid based on granular computingrdquo in Proceedings ofthe 2016 IEEE PES Asia Pacific Power and Energy EngineeringConference APPEEC 2016 pp 1130ndash1133 China October 2016

[35] G Napoles I Grau R Falcon R Bello and K Vanhoof ldquoAGranular Intrusion Detection System Using Rough CognitiveNetworksrdquo Recent Advances in Computational Intelligence inDefense and Security vol 621 pp 169ndash191 2016

[36] T AWelch ldquoA Technique for high-performance data compres-sionrdquo13e Computer Journal vol 17 no 6 pp 8ndash19 1984

[37] J Ziv and A Lempel ldquoA universal algorithm for sequential datacompressionrdquo IEEETransactions on Information13eory vol 23no 3 pp 337ndash343 1977

[38] C Torrano-Gimnez A Prez-Villegas and G Alvarez ldquoTheHTTP dataset CSIC 2010rdquo httpusersaberacukpds7csic-datasetcsic2010httphtml

Hindawiwwwhindawicom Volume 2018

MathematicsJournal of

Hindawiwwwhindawicom Volume 2018

Mathematical Problems in Engineering

Applied MathematicsJournal of

Hindawiwwwhindawicom Volume 2018

Probability and StatisticsHindawiwwwhindawicom Volume 2018

Journal of

Hindawiwwwhindawicom Volume 2018

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawiwwwhindawicom Volume 2018

OptimizationJournal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Engineering Mathematics

International Journal of

Hindawiwwwhindawicom Volume 2018

Operations ResearchAdvances in

Journal of

Hindawiwwwhindawicom Volume 2018

Function SpacesAbstract and Applied AnalysisHindawiwwwhindawicom Volume 2018

International Journal of Mathematics and Mathematical Sciences

Hindawiwwwhindawicom Volume 2018

Hindawi Publishing Corporation httpwwwhindawicom Volume 2013Hindawiwwwhindawicom

The Scientific World Journal

Volume 2018

Hindawiwwwhindawicom Volume 2018Volume 2018

Numerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisNumerical AnalysisAdvances inAdvances in Discrete Dynamics in

Nature and SocietyHindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom

Dierential EquationsInternational Journal of

Volume 2018

Hindawiwwwhindawicom Volume 2018

Decision SciencesAdvances in

Hindawiwwwhindawicom Volume 2018

AnalysisInternational Journal of

Hindawiwwwhindawicom Volume 2018

Stochastic AnalysisInternational Journal of

Submit your manuscripts atwwwhindawicom