Grant: Research Tools and Instruments - Category 1 (<$150,000)

Computing infrastructure is sought to support research addressing the mining of rule sets in large network data repositories and the continuous evolution of models that provide an innovative approach to supporting this task. Specifically, the server system has the following properties: 1) Large data sets: Data sourced from network log files are generally measured in terms of terabytes to tens of terabytes. Pre-processing the data into formats appropriate for applying data mining/ machine learning paradigms generally multiplies the original size of the data set. Providing fast access to such data for the purposes of benchmarking multiple algorithms under real-world scenarios adds to the need to provide suitable computing infrastructure to support the research groups current international standing in this area. This is especially true in the case of traffic classification under encrypted protocols, where this is applicable to services with the most growth (e.g., Skype and Peer-to-peer applications). 2) Continuous coevolution: Genetic Programing (GP) is a form of Machine Learning in which genetically motivated processes for adaptation are the norm. GP provides a very effective metaphor for mining data sets care of competitive coevolution or an "arms race" between learners and training scenarios. By operating under a framework of competitive coevolution, such models may operate under streaming data scenarios. Moreover, the addition of metaphors based on symbiosis provides a very effective scheme for scaling the process of model building to much larger problem domains than would otherwise be the case. This is particularly true in the case of behavioral modeling -- where this implies that feedback is not available on an instance by instance basis. Thus, much like playing chess, a definitive outcome is only available at the conclusion of the game. From a behavioral modeling perspective the availability of definitive feedback denoting an explicitly malicious behavior might only be available after a variable number of interactions with a computing system.