Conversion methods for symbolic features: A comparison applied to an intrusion detection problem

  • Hernández-Pereira E
  • Suárez-Romero J
  • Fontenla-Romero O
 et al. 
  • 36

    Readers

    Mendeley users who have this article in their library.
  • 17

    Citations

    Citations of this article.

Abstract

The success of any Intrusion Detection System (IDS) lies in the selection of a set of significant features, that can be quantitative or qualitative, taken out from a network traffic data stream. The machine learning methods provide potential solutions for the IDS problem. However, most of these methods used for classification are not able to handle symbolic attributes directly. In this paper, three methods for symbolic features conversion - indicator variables, conditional probabilities and the Separability Split Value method - are contrasted with the arbitrary conversion method, all of them applied to an intrusion detection problem, the KDD Cup 99 data set. In particular, three classification methods were subsequently applied to the dataset: a one-layer feedforward neural network, a support vector machine and a multilayer feedforward neural network. The results obtained demonstrate that the three conversion methods improve the prediction ability of the classifiers utilized, with respect to the arbitrary and commonly used assignment of numerical values. © 2009 Elsevier Ltd. All rights reserved.

Author-supplied keywords

  • Anomaly detection
  • Intrusion detection systems
  • Machine learning
  • Symbolic features

Get free article suggestions today

Mendeley saves you time finding and organizing research

Sign up here
Already have an account ?Sign in

Find this document

Authors

Cite this document

Choose a citation style from the tabs below

Save time finding and organizing research with Mendeley

Sign up for free