KDD-99 classifier learning contest LLSoft's results overview

Abstract

Kernel Miner is a new data-mining tool based on building the optimal decision forest. The tool won second place in the KDD99 Classifier Learning Contest, August 1999. We describe the Kernel Miner's approach and method used for solving the contest task. The received results are analyzed and explained.Kernel Miner is a data-mining tool for the description, classification and generalization of data, and for predicting the new cases. Kernel Miner is a fully automated tool that provides solutions to database users. Although Kernel Miner applies a system of sophisticated mathematical models and algorithms, it is extremely simple for users. The tool has been developed for Windows 95/98/NT and works with different databases such as dBase, MS Access, SQL Server, Oracle, etc. directly or through ODBC or OLEDB. GENERAL MODEL AND ALGORITHMKernel Miner is based upon the global optimization model developed. This global model is then decomposed into a system of interrelated, intereoordinated and interconsistent models and criteria. As a result, Kernel Miner constructs the set of locally optimal decision trees (the decision forest) from which it selects the optimal subset of trees (the subforest) used for predicting the new cages.The predictive modeling technique is based on sophisticated methods for reduction of individual prediction results received from individual classification trees. This enables us to calculate the value of the global optimization criterion for any subset of trees.The global optimization criterion is to minimize a value of the multiple estimator including the total cost of misclassifications, and taking into account parameters of reliability and stability for prediction. Here the notion of stability is analogous to the corresponding concept applied in the mathematical programming theory. Taking into account the parameters of reliability and stability for prediction enables us to avoid the overfitting problem.Each constructed decision tree "covers" all the examples of the training data set. It is optimal in the sense of minimizing the above criterion given the initial "good" partition. To find the set of such partitions, a special optimization task is solved on the set of two-and three-dimensional contingency tables, where the last dimension is the dependent variable. Note that, in particular, the "good" partition can be defined by the found function of two independent numeric variables, so that the discretization of values of this fimction separates the values (classes) of the dependent variable "well". The notion of a "good" (and the best) splitting is used at different stages of the algorithm and is based upon a proprietary measure. The number of classification trees to be built is equal to the number of found initial "good" partitions. Although each decision tree is built optimal, we call it locally optimal because it is generally not unique element of the final optimal decision subforest. In particular (in the simplest cases), the optimal subforest may consist of one tree. T A S KThe task for the KDD99...

Design of Multilevel Hybrid Classifier with Variant Feature Sets for Intrusion Detection System

“…The performance metrics of our proposed IDS are compared with other methods that are presented on other research papers (Table 19 and Table 20). We would like to note that there are some papers that used the KDD Test set with their proposed method [2], [39]- [41], but they included the http-tunnel attack into the U2R class [39], [40]. In fact, the http-tunnel attack is a Remoteto-Local (R2L) attack [26], which intends to gain local access from a remote machine.…”

A Novel Method to Enhance the Security of Computer System using AIS in Intrusion Detection System

“…The colossal increase of attacks on network and is the key reason for the data mining based intrusion detection techniques which is enormously beneficial in detecting the attacks [19], [20] . This paper describes a system which gives idea about network data mining that is the usage of data mining method which helps in capturing flow data and data packet in a network together with comparative study of other methods.…”

On Copulas-Based Classification Method for Intrusion Detection

“…[7] 69.60 98.00 100.00 71.40 99.20 C.L.C. [15] 73.95 99.88 87.83 61.36 98.50 Multi-PD [16] 97.30 88.70 29.80 09.60 ADWICE [4] 98.30 96.00 81.10 70.80 Our method 97.375 97.357 90.548 100.00 100.00…”