A primary strength of the XCS approach is its ability to create maximally accurate general rules. In automatic target recognition (ATR) there is a need for robust performance beyond so-called standard operating conditions (SOCs, those conditions for which training data is available) to extended operating conditions (EOCs, conditions of known targets that cannot be foreseen and trained for). EOCs include things like vehicle-specific variations, environmental effects (mud, etc.), unanticipated viewing angles, and articulation of components of the target (hatches, turrets, etc.). This paper presents experiments where XCS addresses structural generalization over global and local features normally used in ATR classification. In many SOCs, these features are adequate for target recognition. Our goal with XCS is to form generalized rules that utilize these features for effective ATR in EOCs. Results show that XCS is effective in this generalization task. Conclusions and future directions for research are discussed.

Examines the application of statistical traffic modeling for detecting novel attacks against computer networks. We discuss the application of network activity models and application models using the 1998 DARPA Intrusion Detection Evaluation data set. Network activity models monitor the volume of traffic in the network, while application models describe the operation of application protocols. By plotting the ROC (receiver operating characteristic) curves induced by the traffic activity, we quantify the effectiveness of network activity models in discriminating normal connections from attack connections generated by denial-of-service and probing attacks. It is verified that denial-of-service and probing attacks leave traces on simple network activity models, with rates of false alarm which are comparable to the false alarm rates obtained by the participants of the 1998 DARPA evaluation, in which much more complex detection schemes were utilized. For application models, we use the Kolmogorov-Smirnov test to show that attacks using telnet connections in the DARPA data set form a population which is statistically different from the normal telnet connections. The statistics used in our study are the number of bytes from the responder and the responder-originator byte ratio. Again, our results are comparable to those obtained in the DARPA evaluation.

This paper describes a hybrid genetic algorithm (HGA) for model-based matching of observed scenes that are noisy, where only a small fraction of the scene features are expected to correspond to the model features. The problem of finding the match is framed within a hypothesize-and-test paradigm and the HGA, with a representation size minimum description length evaluation function, is formulated as the method to search for the match. Unlike most genetic algorithms, the HGA introduced is based on an integer representation with a position based recombination operator. An assignment operator, also used as a reproduction operator, introduces domain-specific constraints and defines the hybrid nature of the algorithm. Results for models and scenes derived from images of occluded and cluttered environments are described. The results show the HGA to be an efficient search technique and the related matching technique to be robust in a variety of cases.>