Digging into IP Flow Records with a Visual Kernel Method - Computational Intelligence in Security for Information Systems - page 114

sets 8 and 9 were designed in complying with this idea. Data set 8 contains low-
density scans given that they have been reduced to only 5 packets. It was decided that
a scan aimed at less than 5 hosts should not constitute a network scan. On the other
hand, data set 9 contains medium-density scans. In this case, each one of them has
been extended to 30 packets.

4.2 Results

For the sake of brevity, experiments were conducted only on two of the data sets
described above: data set 6 and 9. All the classifiers were trained on the original data-
set, comprising an MIB information transfer and scans aimed at port numbers 161,
162 and 3750.
To check the performance of the classifier ensembles when confronting different
numbers of classes, the data sets were labeled in a different way. Two different labels
were assigned to packets in dataset 6, differentiating attacks from normal traffic. On
the other hand, four different classes were defined for data set 9, namely: normal,
scan#1, scan#2, and MIB transfer.

Table 2. Results on data set 9 (four classes)

Ensembles Classifier Correctly Classified Instances

Training (99.9489%) for MLP
Training (99.8977%) for Reptree
Training (99.9489%) for PART
Training (99.9148%) for id3
Training (99.9659%) for SMO
Classification (81.25%) for all of
then. 12 errors in the one of the
classes.

MLP, REPTree, PART,
id3, SMO

FilteredClassifier

Training (99.9148%)
Classification (100%)

Adaboost JRip

Training (99.9148%)
Classification (100%)

MultiboostAB JRip

Training (99.983%)
Classification (100%)

MultiboostAB REPTree

Training (99.9659%)
Classification (100%)

RandomSubSpace REPTree

Training (99.983%)
Classification (100%)

RandomSubSpace SImpleCart

Training (99.983%) for RepTree
Classification (89.0625%) for
RepTree.
Training (99.983%) for PART
Classification (53.125%) for
PART.

RotationForest REPTree and PART

Training (99.983%)
Classification (100%)

AttributeSelectedClassifier SImpleCart

Training (99.983%)
Classification (100%)

Bagging REPTree