Decision trees and qualitative possibilistic inference: Application to the intrusion detection problem

Abstract

In this paper, we apply decision trees (DT) to intrusion detection problems. Experimentations are done on KDD'99 datasets. These data offer main features needed to evaluate intrusion detection systems. We consider three levels of attack granularities depending on whether dealing with all attacks, or grouping them in special categories or just focusing on normal and abnormal behaviours. We also extend the classification procedure to handle uncertain observations encountered in connection features. To this end, uncertainty is represented by possibility distributions and the inference in DT is based on the qualitative possibilistic logic.