Biomedical Engineering Reference
In-Depth Information
Probabilistic Classification
Freund [
2
] devised in the field of intrusion detection with the approach as: After
extracting a number of important class association rules including normal and
intrusion, a classifier is constructed to classify new connection data into normal,
misuse, and anomaly intrusion correctly. The key points of probabilistic classifi-
cation concern three aspects. First, the probability density function of the average
matching degree of data with rules is used. Second, the probability that data is
classified to anomaly intrusion is also considered. Third, in order to improve the
classification accuracy.
MatchDegree
k
Q
i
;
a
i
ð
Þ¼
F
Qi
a
ðÞ
where F
Qi
represents the membership function of linguistic term Q
i.
Then, the
matching degree between data and rule r (including p continuous attributes and
q discrete attributes) is defined as:
!
X
Þ¼
1
p
þ
q
Match
k
d
;
r
ð
MatchDegree
k
Q
i
;
a
i
ð
Þþ
t
;
ð
5
Þ
i
2
CA
where, I is the suffix of continuous attributes in rule r; CA denotes the set of suffix
of continuous attributes in rule r; p and q represent the number of continuous
attributes and discrete attributes in rule r, respectively, and t is the number of
matched discrete attributes in rule r with data. Then, the average matching degree
can be defined as
X
m
k
ðÞ¼
1
RK
Match
k
d
;
r
ð
Þ
ð
6
Þ
;
j
j
k
2
C
where, R
k
is the set of suffixes of the extracted rules in class k in the rule pool
(normal rules or misuse rules). Finally, the marginal probability density function
f
1
(x
1
), f
2
(x
2
),…f
L
(x
k
) can be generated by calculating the distribution of the average
Search WWH ::
Custom Search