Data Mining Practical Machine Learning Tools and Techniques

IEEE Transactions on Pattern Analysis and Machine Intelligence

This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

https://www.alaakhamis.org/teaching/MCT200/reading/Information%20Fusion.pdf

Multisensor data fusion: A review of the state-of-the-art

In this Chapter, we imagine a decision maker (or a group of experts) trying to establish or examine fair procedures to combine opinions about alternatives related to different points of view.

Multiple criteria decision making

Bayes networks are powerful tools for decision and reasoning under uncertainty. A very simple form of Bayes networks is called naive Bayes, which are particularly efficient for inference tasks. However, naive Bayes are based on a very strong independence assumption. This paper offers an experimental study of the use of naive Bayes in intrusion detection. We show that even if having a simple structure, naive Bayes provide very competitive results. The experimental study is done on KDD'99 intrusion data sets. We consider three levels of attack granularities depending on whether dealing with whole attacks, or grouping them in four main categories or just focusing on normal and abnormal behaviours. In the whole experimentations, we compare the performance of naive Bayes networks with one of well known machine learning techniques which is decision tree. Moreover, we compare the good performance of Bayes nets with respect to existing best results performed on KDD'99.

Naive Bayes vs decision trees in intrusion detection systems

This paper presents a method for assessing the reliability of a sensor in a classification problem based on the transferable belief model. First, we develop a method for the evaluation of the reliability of a sensor when considered alone. The method is based on finding the discounting factor minimizing the distance between the pignistic probabilities computed from the discounted beliefs and the actual values of data. Next, we develop a method for assessing the reliability of several sensors that are supposed to work jointly and their readings are aggregated. The discounting factors are computed on the basis of minimizing the distance between the pignistic probabilities computed from the combined discounted belief functions and the actual values of data.

Assessing sensor reliability for multisensor data fusion within the transferable belief model

Belief decision trees: Theoretical foundations

Decision trees as possibilistic classifiers

In the belief function framework, a unique function is induced from the use of a combination rule so allowing to synthesize all the knowledge of the initial belief functions. When information sources are reliable and independent, the conjunctive rule of combination, proposed by Smets, may be used. This rule is equivalent to the Dempster rule without the normalization process. The conjunctive combination provides interesting properties, as the commutativity and the associativity. However, it is characterized by having the empty set, called also the conflict, as an absorbing element. So, when we apply a significant number of conjunctive combinations, the mass assigned to the conflict tends to 1 which makes impossible returning the distinction between the problem arisen during the fusion and the effect due to the absorption power of the empty set.The objective of this paper is then to define a formalism preserving the initial role of the conflict as an alarm signal announcing that there is a kind of disagreement between sources. More exactly, that allows to preserve some conflict, after the fusion by keeping only the part of conflict reflecting the opposition between the belief functions. This approach is based on dissimilarity measures and on a normalization process between belief functions. Our proposed formalism is tested and compared with the conjunctive rule of combination on synthetic belief functions. In belief function theory, one of the main combination rules is the conjunctive rule.With this rule, a series of combinations results in mass equal to 1 on the conflict.In this case, it is impossible to identify a potential problem in the fusion process.The proposed method allows us to keep the real opposition between belief functions.Using this approach, the conflict regains its initial role of alarm.

https://hal.archives-ouvertes.fr/hal-03354165/document

Zied Elouedi

Papers

Naive Bayes vs decision trees in intrusion detection systems

Assessing sensor reliability for multisensor data fusion within the transferable belief model

Belief decision trees: Theoretical foundations

Decision trees as possibilistic classifiers

How to preserve the conflict as an alarm in the combination of belief functions