Enhancing network intrusion classification through the Kolmogorov-Smirnov splitting criterion

Thanh Nghi Do (1, 2, 3) , Philippe Lenca (4, 1) , Stéphane Lallich (5)

1 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
2 Lab-STICC - Laboratoire des sciences et techniques de l'information, de la communication et de la connaissance (UMR 3192)
3 CICT - College of Information and Communication Technology (.)
4 Lab-STICC_TB_CID_DECIDE
5 ERIC - Equipe de Recherche en Ingénierie des Connaissances

Our investigation aims at detecting network intrusions using decision tree algorithms. Large differences in prior class probabilities of intrusion data have been reported to hinder the performance of decision trees.We propose to replace the Shannon entropy used in tree induction algorithms with a Kolmogorov-Smirnov splitting criterion which locates a Bayes optimal cutpoint of attributes. The Kolmogorov-Smirnov distance based on the cumulative distributions is not degraded by class imbalance. Numerical test results on the KDDCup99 dataset showed that our proposals are attractive to network intrusion detection tasks. The single decision tree gives best results for minority classes, cost metric and global accuracy compared with the bagged boosting of trees of the KDDCup’99 winner and classical decision tree algorithms using the Shannon entropy. In contrast to the complex model of KDDCup winner, our decision tree represents inductive rules (IF-THEN) that facilitate human interpretation.

Mots clés: Network intrusion; Decision tree; Imbalance class

Domaines: Apprentissage [cs.LG]; Machine Learning [stat.ML]

Thanh Nghi Do, Philippe Lenca, Stéphane Lallich. Enhancing network intrusion classification through the Kolmogorov-Smirnov splitting criterion. Journal of science and technology, 2010, 48 (4), pp.50 - 61. ⟨hal-00523096⟩