Performance Evaluation of Rule Learning Classifiers in Anomaly Based Intrusion Detection

Intrusion Detection Systems (IDS) are intended to protect computer networks from malicious users. Several data mining techniques have been used to build intrusion detection models for analyzing anomalous behavior of network users. However, the performance of such techniques largely depends on their ability to analyze intrusion data and raise alarm whenever suspicious activities are observed. In this paper, some rule based classification techniques, viz., Decision Table, DTNB, NNGE, JRip, and RIDOR have been applied to build intrusion detection models. Further, in order to improve the performance of the classifiers, six rank based feature selection methods, viz., Chi squared attribute evaluator, One-R, Relief-F, information Gain, Gain Ratio, and Symmetrical Uncertainty have been employed to select the most relevant features. Performance of different combinations of classifiers and feature selection techniques have been studied using a set of performance criteria, viz., accuracy, precision, detection rate, false alarm rate, and efficiency.