Handling nominal features in anomaly intrusion detection problems Conference

Shyu, ML, Sarinnapakorn, K, Kuruppu-Appuhamilage, I et al. (2005). Handling nominal features in anomaly intrusion detection problems . 55-62.

cited authors

  • Shyu, ML; Sarinnapakorn, K; Kuruppu-Appuhamilage, I; Chen, SC; Chang, LW; Goldring, T

authors

abstract

  • Computer network data stream used in intrusion detection usually involve many data types. A common data type is that of symbolic or nominal features. Whether being coded into numerical values or not, nominal features need to be treated differently from numeric features. This paper studies the effectiveness of two approaches in handling nominal features: a simple coding scheme via the use of indicator variables and a scaling method based on multiple correspondence analysis (MCA). In particular, we apply the techniques with two anomaly detection methods: the principal component classifier (PCC) and the Canberra metric. The experiments with KDD 1999 data demonstrate that MCA works better than the indicator variable approach for both detection methods with the PCC coming much ahead of the Canberra metric. © 2005 IEEE.

publication date

  • October 31, 2005

start page

  • 55

end page

  • 62