Networks, Lie Monoids,

1
Networks, Lie Monoids, Generalized Entropy
Metrics

• St. Petersburg Russia
• September 25, 2005
• Joseph E. Johnson PhD
• Professor, Department of Physics
• University of South Carolina

2
I. Introduction
3
The Problem

• Networks, such as the Internet, are of
  extraordinary complexity for which there is
  currently no complete mathematical foundation.
• With only 1,000 nodes there are 1,000,000 real
  numbers representing the data transfer weights
  for that topology (using Cij as an information
  connection matrix).
• Furthermore these values change every fraction of
  a second. Thus every hour one must usefully
  monitor a trillion (1012) values to track the
  network.

4
(No Transcript)
5
Analogy to Thermodynamics

• This is similar to knowing the positions and
  momenta of billions of molecules and trying to
  understand what a system is doing. The
  information is voluminous useless.
• Thermodynamic concepts like pressure,
  temperature, heat, volume, etc suggest themselves
  as macro variables.
• But networks lack a measure of nearness and
  energy making these useless.
• Entropy is suggestive as a measure but is
  meaningful only on probability distributions
  which also are not overtly apparent in networks.

6
Additional Problems

• Yet things are much worse
• Although the Cij connection matrix captures the
  network topology and information flows, there are
  n! different C matrices that describe the same
  network.
• This is due to the random numbering of the
  network nodes necessary to specify the C matrix.

7
Critical Remark

• The connection matrix Cij has off-diagonal
  elements that are exactly defined by the
  information transfers or weights between node i
  and node j.
• However, the diagonal elements of C are totally
  arbitrary and can be set to any value for a given
  network.

8
II. Proposed Theoretical Foundation
9
Previous Work

• In 1985, the author found a new way to decompose
  all continuous general linear transformations
  (GL(n,R)) into a Markov-type Lie group (that
  conserves the sum of the components of a vector)
  and another Abelian Lie group that scales or
  stretches the axes.
• This Markov type Lie group was shown to give all
  continuous Markov transformations (a Lie monoid,
  M) when the parameter space of the Lie algebra,
  L, is restricted to non-negative values l, thus
  M(l)elL

10
Nature of Markov Transformation

• A Markov transformation (Markov 1905), transforms
  a vector of non-negative reals into another
  vector of non-negative reals (such as probability
  distributions).
• Every column of a Markov transformation is itself
  a vector of non-negative reals that sum to unity
  and thus is a probability distribution.

11
Recent Advance

• The author has recently observed (DARPA internal
  report) that if the ambiguous diagonal values of
  the C matrix are chosen to be the negatives of
  the sum of the other values in that column, then
  the resulting C matrix is a unique element of the
  Markov Lie monoid, L, and thus generates a well
  defined Markov matrix.
• In essence this means that the L matrices that
  generate Markov transformations are in 1-1
  correspondence to possible networks (ignoring the
  ambiguity of nodal numbering).

12
Conclusion 1

• Both the topology and information flow rates of
  any given network (as specified by the connection
  matrix C) exactly correspond to a unique
  (infinitesimal) Markov transformation.
• Thus network theory and Markov transformations
  and Lie group theory are now intimately
  connected allowing the tools and techniques in
  one to be used in the others.

13
Conclusion 2

• Any of the (a) generalized (Renyi) entropies are
  now well defined on the columns of the resulting
  Markov matrix (for a given value of l).
• Thus one can distill the information of each
  column, (and thus each node (i)) to an entropy
  value E(i, a, l). For each node there is now an
  associated entropy.
• The value of l is related to the extent of
  connectivity connection that one wishes to
  characterize for that node.

14
Interpretation of M

• The Markov transformation that results from a
  given connection matrix is the infinitesimal set
  of flows, of a conserved probability, away from
  a given node, in proportion to the C values.

15
Ambiguity of Node Numbering

• Each time the entropy is computed for the N
  different nodes, the set of values can be sorted
  by (largest to smallest) value as the order of
  the nodes is unimportant.
• This results in a curve or function that is
  monotonically non-increasing.
• The next time the entropies are computed the
  nodes are again resorted and will end up in a
  different order but that is unimportant as only
  the functional form is essential i.e. some node
  does the same thing.

16
Conclusion 3

• The functional curve of entropy values distills
  the order associated with the nodes and removes
  the ambiguity of nodal ordering.

17
Asymmetrical Row Computation

• The C matrix diagonals can also be set to the
  negative of the sum of row values so that the
  resulting M matrix reflects the asymmetry of the
  C matrix and associated row entropies.
• Using the ordering of the column entropies (as
  above) defines an ordering of the nodes so that
  the associated row entropies define a function.
• This function, when displayed, can also indicate
  anomalies when it assumes abnormal values.

18
Conclusion 4

• The ordered column entropy values form one
  function and the same ordering for row entropies
  forms a second function both of which can be
  continuously monitored for abnormal behavior.
• The abnormalities in these functions indicate
  exactly which nodes have such behavior and the
  probability of the abnormality being that devient

19
III. Application to Intrusion Detection
20
Column Entropy - Order 1
21
Column Entropy - Order 2
22
Column Entropy - Order 3
23
Order 1 Order 2 Difference Plot
24
Order 2 Order 3 Difference Plot
25
Column/Row Ratio Plot(Symmetry Plot) Order 2
26
Further Insights

• Normalization of c matrix relative to size
• Time window size versus entropy
• Type and severity of intrusion anomalies in terms
  of column and row entropy signatures