The Android Application

The developed Android application also follows a client-server model, in order to perform the computationally demanding operations more fluently. Figure 6.10 shows the sequence diagram of the application, showing when the application com- municates with the server. All in all three client-server requests are performed:

The softwares implemented to create the Android application resemble the ones implemented for the web platform version. This is mostly due to the fact that most of the computation is performed on the same server, regardless of the ap- plication used, where JSP, Javascript and Java are the core components. Java was also used for programming the Android application itself. Sockets are used in the Android application-server communication to share the fuzzy ontology search re- sults. To increase the security of the whole application, the connection between the Android application and the database is conducted through the server, i.e. not di- rectly via a JSP script. Eclipse IDE, Netbeans IDE and the Software Development Kit provided by Android were the development environments used.

To demonstrate the graphical user interface of the Android application, screen- shots based on the same example as the one presented in Section 6.2.1 are pre- sented:

Figure 6.10: Sequence diagram for the Android application

• Figure 6.11 shows the input part of the Android application as well as the initial fuzzy ontology results screen.

• Figure 6.12 shows an example of a question from the questionnaire. Ques- tions are showed one by one to the users to improve the readability. The figure also shows the results displaying screen.

6.3 Summary

This Chapter has introduced applications that utilize tacit knowledge and imprecise data in a mobile context. The developed novel applications show that by combining a fuzzy ontology with decision support algorithms, it is possible to utilize impre- cise information to create mobile decision support. Demonstrating that imprecise expert knowledge, traditionally stored and analysed in non-mobile devices, can be distributed and successfully managed using mobile devices. This mobilisation of knowledge will make it possible for users to receive support for their decisions, based on imprecise data, regardless of where they are.

For the applications presented in this Chapter, the Fuzzy Wine Ontology was used as the main source of knowledge. In the context of wines, information is imprecise as it comes from the opinions of wine connoisseurs who express them- selves in a terminology that is imprecise through the concepts and the language used. Without the capability of fuzzy ontology to model and manage imprecise knowledge, the development of this application could not have been possible.

Figure 6.11: Search information screenshot and wine ontology results screenshot (Android application)

Figure 6.12: Questionnaire screenshot and temporary results decision screenshot (Android application)

The applications demonstrate how wine connoisseur knowledge can be trans- formed into useful advice and distributed to amateurs. Also, it becomes possible for the participants to use the applications as a basis for discussion and voting pro- cedures. As the location is introduced in the computation, the alternatives that are not available are omitted in order to avoid impossible choices and to speed up the computations. As the applications have been designed to be used also with mobile devices, the dinner guests can use the applications in real time at the restaurant where they are seated.

The underlying goal with the structure presented in this Chapter is to present an example of how one can build applications by utilizing imprecise data. The used structure can be applied to resolve many other situations apart from the ones presented.

Chapter 7

Fuzzy Ontology for Real-Life

Decisions

This chapter is aimed at applying the theories and techniques that have been devel- oped in this thesis, for solving problems that are found imminent in real-life and thereby showing the practical benefits from implementing the theoretical contribu- tions presented in this thesis. The technical application and its graphical user inter- face is based on the structure presented in Chapter 6, where, for instance, f uzzyDL and OWL are used for creating fuzzy ontologies that can be used as knowledge bases for mobile applications.

One approach to demonstrate the benefits of fuzzy ontologies is to model a fuzzy ontology by developing and implementing similarity measures that can be used for intrusion detection purposes. The mathematical contributions presented in Chapter 5 where used for calculating the similarities between the new entities detected and the previously stored entities in the knowledge base. Although the methods used for intrusions are seldom limited to a specific context, the fuzzy ontology was created with the mindset to find risks that are relevant for financial institutions. The fuzzy intrusion detection ontology was developed as a simple application, to show a practical example of how a fuzzy ontology can aid intrusion detection by computing the risk for certain intrusions to occur.

With the intention to support the arguments for developing an intrusion detec- tion system with similarity measures and a fuzzy ontology, a short literature review about intrusion detection systems in financial institutes is presented. The similarity measures for interval-valued fuzzy sets are introduced and presented more thor- oughly in Chapter 5. The contributions from this chapter address three concerns that are not widely recognized for intrusion detection systems:

• Making use of expert knowledge to identify anomalies

• Representation of (imprecise) information about previous intrusion cases • Utilizing imprecise descriptions to identify the potential risks of an intrusion

7.1 Intrusion Detection

Intrusion detection systems (IDS’s) are important for supervising networks, espe- cially as the number of intrusion events is increasing rapidly due to the widespread use of internet. Normally an intrusion detection system works as a decision support system that helps to identify potentially dangerous activities by utilizing real-time information and event reports of previous intrusion cases. There are two main ap- proaches to conduct intrusion detection: (i) misuse detection (known patterns of intrusion are compared to present activities) and (ii) anomaly detection (activities that deviate from normal system behaviour but cannot be matched to any previous cases) [6, 274].

As sensors and data collection methods are improving, intrusion detection sys- tems are forced to process a constantly increasing amount of information and alerts (also including false alerts) [216]. A fair part of this information consists of im- precise and vague knowledge [195]. Dickerson et al. [89] suggested that fuzzy ontologies could be implemented for analysing this vague knowledge, especially for analysing anomalies, as it would be possible to find cases that are similar in a fuzzy sense, but not in any crisp sense. Detecting anomalies is an important way to find unwanted behaviour, not only for intrusion detection purposes but also in e.g. fraud detection and military surveillance.

Similarity measures proved to be successful in anomaly detection implementa- tions [65]. For instance, kernel based similarity measures (cosine and binary [189]) together with text processing techniques were used to detect host-based intrusions by Sharma et al. [252]. By applying similarity measures on the collected intrusion alerts (modelled as a fuzzy ontology), one can find the similarity to different attack strategies. By anticipating the attack strategy (or at least what it is similar to), one can predict the coming moves by the attacker.

Expert knowledge plays a crucial role in identifying anomalies and assessing the potential loss that can be caused by an intrusion. Even though IDS’s are gen- erally moving towards more automation by excluding human experts, it has even been stated that it is necessary to include experts in IDS, as fully automated reli- able systems seem impossible to achieve [64]. There are systems which are able to detect malwares and intrusions based on behavioural patterns; however, few come even close to automatically decide if the spotted abnormality is a malware or not, and therefore depend on experts to make the final decision [150, 293].

Experts usually express themselves using linguistic terms, i.e. "the activity level is quite high" and "one should deactivate some of the measures". These im- precise linguistic terms, fully understandable for other experts, are hard to interpret for a computer. Computers are designed to compute precise data, but the linguistic terms are imprecise.

Using a fuzzy ontology to represent available information in terms of interval- valued fuzzy sets, with a combination of similarity analysis and expert opinions, it creates a promising tool for identifying and measuring the risks of misuse and

anomalies. The support system aims at providing information to the users concern- ing two types of decisions: (i) identifying suspicious activities that can indicate intrusions, and (ii) recommendation on countermeasures for any given case.