A decision tree algorithm for distributed data mining: Towards network intrusion detection

Abstract

This paper presents preliminary works on an agent-based approach for distributed learning of decision trees. The distributed decision tree approach is applied to intrusion detection domain, the interest of which is recently increasing. In the approach, a network profile is built by applying a distributed data analysis method for the collection of data from distributed hosts. The method integrates inductive generalization and agent-based computing, so that classification rules are learned via tree induction from distributed data to be used as intrusion profiles. Agents, in a collaborative fashion, generate partial trees and communicate the temporary results among them in the form of indices to the data records. Experimental results are presented for military network domain data used for the network intrusion detection in KDD cup 1999. Several experimental results show that the performance of distributed version of decision tree is much better than that of non-distributed version with data collected manually from distributed hosts. © Springer-Verlag Berlin Heidelberg 2004.