Many knowledge acquisition methodologies have been proposed to elicit rules systematically with embedded meaning from domain experts. But. none of these methods discusses the issue of discovering new modified objects in it traditional classification knowledge based system. For experts to sense the occurrence of new variants and revise the original rule base, to collect sufficient relevant information becomes increasingly important in the knowledge acquisition field. In this paper, the method variant objects discovering knowledge acquisition (VODKA) we proposed includes three stages (log collecting stage, knowledge learning stage, and knowledge polishing stage) to facilitate the acquisition of new inference rules for a classification knowledge based system. The originality of VODKA is to identify these new modified objects, the variants, from the way that the existing knowledge based system fails in applying sonic rules with low certainly degree. In this method, we try to classify the current new evolving object identified according to its attributes and their corresponding values. According to the analysis of the collected inference logs, one of the three recommendations (including adding it new attribute-value of ail attribute, modifying the data type of an attribute, Or adding it new attribute) will be suggested to help experts observe and characterize the new confirmed variants. VODKA requires E-EMCUD (extended embedded meaning capturing and uncertainty deciding). EMCUD is it knowledge acquisition system which relics oil the repertory grids technique to manage objcet/attribute-values tables and to produce inferences rules from these tables. The E-EMCUD We Used here is a new version of EMCUD to update existing tables by adding new objects or new attributes and to adapt the original embedded rules. Here, a computer worm detection prototype is implemented to evaluate the effectiveness of VODKA. The experimental results show that new worm variants could be discovered from inference logs to customize the corresponding detection rules for computer worms. Moreover, VODKA can be applied to the e-learning area to learn the variant learning behaviors of Students and to reconstruct the teaching materials in improving the performance of e-learners. (C) 2007 Elsevier Ltd. All rights reserved.
Relation:
EXPERT SYSTEMS WITH APPLICATIONS 36 (2): 2433-2450 Part 1
