Network intrusion detection using multi-attributed frame decision tree

TLDR: A new decision tree algorithm that uses multiple attributes to construct a core vector generated from two farthest records and recursively partition the dataset along this core vector using the vector projection.

Abstract: Network intrusion problem has been received more attention during the past few years due to the increase company network usages. Many network intrusion systems have been proposed and in cooperated various classifiers to identify malicious packages among all regular network packages using the past history. Decision tree algorithm is one of the popular adapted classifier. It utilizes the training records to build a decision tree model which select the best split of a single attribute among all candidate attributes that best classifies training records. To facilitate a combination of attributes, the decision tree must apply a finite number of branches which may generate a tall tree. Attributes may relate in a more complex setting that they need to be simultaneously used for branching. This paper proposes a new decision tree algorithm that uses multiple attributes to construct a core vector generated from two farthest records. Then the algorithm recursively partition the dataset along this core vector using the vector projection. The best split is identified along this core vector based on the information gain. Our results show the improvement of the network intrusion problem from UCI over the regular decision tree algorithm.