Decision-forest voting scheme for classification of rare classes in network intrusion detection
| Autor: | Brabec, Jan, Machlica, Lukas |
|---|---|
| Rok vydání: | 2021 |
| Předmět: | |
| Zdroj: | 2018 IEEE International Conference on Systems, Man, and Cybernetics (SMC), 2018, pp. 3325-3330 |
| Druh dokumentu: | Working Paper |
| DOI: | 10.1109/SMC.2018.00563 |
| Popis: | In this paper, Bayesian based aggregation of decision trees in an ensemble (decision forest) is investigated. The focus is laid on multi-class classification with number of samples significantly skewed toward one of the classes. The algorithm leverages out-of-bag datasets to estimate prediction errors of individual trees, which are then used in accordance with the Bayes rule to refine the decision of the ensemble. The algorithm takes prevalence of individual classes into account and does not require setting of any additional parameters related to class weights or decision-score thresholds. Evaluation is based on publicly available datasets as well as on an proprietary dataset comprising network traffic telemetry from hundreds of enterprise networks with over a million of users overall. The aim is to increase the detection capabilities of an operating malware detection system. While we were able to keep precision of the system higher than 94\%, that is only 6 out of 100 detections shown to the network administrator are false alarms, we were able to achieve increase of approximately 7\% in the number of detections. The algorithm effectively handles large amounts of data, and can be used in conjunction with most of the state-of-the-art algorithms used to train decision forests. Comment: \copyright 2018 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works |
| Databáze: | arXiv |
| Externí odkaz: |
|