Material Detail
Weighting versus Pruning in Rule Validation for Detecting Network and Host Anomalies
This video was recorded at 13th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), San Jose 2007. For intrusion detection, the LERAD algorithm learns a succinct set of comprehensible rules for detecting anomalies, which could be novel attacks. LERAD validates the learned rules on a separate held-out validation set and removes rules that cause false alarms. However, removing rules with possible high coverage can lead to missed detections. We propose to retain these rules and associate weights to them. We present three weighting schemes and our empirical results indicate that, for LERAD, rule weighting can detect more attacks than pruning with minimal computational overhead.
Quality
- User Rating
- Comments
- Learning Exercises
- Bookmark Collections
- Course ePortfolios
- Accessibility Info
More about this material
- Mobile Compatibility:
- Not specified at this time
- Language:
- English
- Cost Involved:
- No
- Source Code Available:
- No
- Accessibility Information Available:
- Unknown
- Creative Commons:
-
This work is licensed under a Attribution-NonCommercial-NoDerivs 3.0 United States
