設計與實作一個新的物件導向規則式知識庫平台

Abstract

近年來，用來模擬專家決策與思考的專家系統，被廣泛的應用在許多電腦資訊系統中，而專家系統所提供的知識處理能力，也成為下一個世代的資訊系統中相當重要的一項特徵。而在專家系統的範疇中，規則式知識庫（Rule Base）的技術，則是應用相當廣泛的一種手法，在這類規則式知識庫系統中，專家的知識被表示成容易理解與管理的規則，而規則式知識庫提供了這類資料儲存的功能，以及依據事實推論規則的能力；專家系統的開發者藉著此類工具，便可以在系統中提供知識處理的功能。

本篇論文中，我們提出了一個新的物件導向規則式知識庫平台（New Object-oriented Rule Base Platform，NORBP），並在其中提供一個更為彈性，有效率，容易維護，以及更有意義的知識表示法；同時也提供對應此種知識表示法所需的各類機制。在NORBP中，定義了這個平台中專屬的知識表示法（Knowledge Representation）與其對應的推論法、知識擷取法（Knowledge Acquisition）、知識探勘法（Knowledge Discovery）、以及知識融合法（Knowledge Fushion），藉由這些機制，提供更為完整的知識庫平台。

針對知識的表示與推論，本論文提出了一個新的物件導向式規則模式（New Object-oriented Rule Model，NORM），藉由物件導向的觀念，定義知識模組之間的關係。而在知識擷取方面，我們提出了基於語意距離的概念學習與知識擷取機制（Concept Learning from Cases based on Semantic Distance for Knowledge Acquisition）；對於知識的探勘，則以資料探勘的技術為基礎，設計了針對使用者行為紀錄找出隱藏知識的知識探勘法（Knowledge Discovery）。對於利用知識探勘所找出來的知識，最後我們可以利用知識融合的技術（Knowledge Fusion），將之與現有的知識加以融合，加強知識的結構並減少知識重複的狀況，藉此提昇知識庫中的知識品質。經過這幾個階段不斷的精練，可以讓利用此知識平台所建立的專家系統更為精確有效，提昇專家系統的效率與品質。

在本論文最後，我們實作了NORBP中各項的機制，並且進行相關的實驗，同時為了驗證整個系統的實用性，我們以電腦輔助教學（Computer Assisted Learning，CAL）與網路入侵偵測（Network Intrusion Detection，NID）為領域，設計兩套對應的專家系統作為本論文的實例說明。其中針對網路入侵偵測部分所實作的網路入侵偵測專家系統（NID-ES），包含了整套NORBP架構的各項機制，藉此實作整套專家系統發展維護的生命週期（Lifecycle），並驗證本論文所提出架構在實際應用上的完整性。

In recent years, Expert System, the system to model expert’s decision making process and help to build up knowledge systems, becomes more and more important in Computer Science domain for next generation computer systems. For constructing an Expert System, Rule Base is a widely used approach, where knowledge and expertise are represented as rules, a well-known logical knowledge representation. An inference engine is also part of a rule base, which can be used to process the rules of knowledge and inference as a human expert. It is easy to construct knowledge system using rule base since the representation of knowledge, the storage of knowledge, and the processing of knowledge are well designed in rule base system.

In this thesis, a New Object-oriented Rule Base Platform (NORBP) is proposed, which is designed to provide more flexible, efficient, maintainable, and meaningful knowledge representation, and also correspondingly knowledge systems mechanisms based on the lifecycle of an expert system we defined. In NORBP, several corresponding mechanisms are designed to provide a complete knowledge platform, including knowledge representation, knowledge acquisition, knowledge discovery, and knowledge fusion. In NORBP, the New Object-oriented Rule Model (NORM) is designed to represent knowledge according to Object-oriented concept, and knowledge relations are defined to construct the knowledge model. In order to provide KA methodology in NORBP, Concept Learning from Cases based on Semantic Distance for Knowledge Acquisition is proposed based on NORM concepts. Moreover, to acquire the knowledge of users daily behaviors, Knowledge Discovery mechanism is used for extracting knowledge from huge amount of user activities. Newly discovered knowledge in Knowledge Discovery mechanism may be redundant or conflict to existing knowledge, and Knowledge Fusion mechanism in NORBP is proposed to fuse different knowledge sources for the same knowledge domain, resolve the conflict and redundant of knowledge, and reconstruct the knowledge model in more meaningful structure.

Some implementations and experiments for NORBP are also done in this work. A Computer Assisted Learning Expert System (CAL-ES) and a Network Intrusion Detection Expert System (NID-ES) are proposed as case studies for NORBP. In the NID-ES, the mechanisms for complete NORBP lifecycle are designed, in which four systems, including Two-Layer Network Intrusion Detection System, Intrusion Detection Knowledge Acquisition System, Intrusion Detection Knowledge Mining System, and Intrusion Detection Knowledge Bases Fusion System, are implemented according to each phase in NORBP.