FUZZY ROC CURVES FOR THE 1 CLASS SVM: APPLICATION TO INTRUSION DETECTION
Paul F. Evangelista, Piero Bonnisone, Mark J. Embrechts, Boleslaw Karol Szymanski · 2005
A novel method for receiver operating characteristic (ROC) curve analysis and anomoly detection is proposed. The ROC curve provides a measure of effectiveness for binary classification problems, and this paper specifically addresses unbalanced, unsupervised, binary classification problems. Furthermore, this work explores techniques in fusing decision values from classifiers and using ROC curves to illustrate the effectiveness of the fusion techniques. In describing an unbalanced classification problem, we are addressing a problem that has a low occurrence of the positive class (generally less than 10%). Since the problem is unsupervised, the 1 class SVM is utilized. We discuss the curse of dimensionality experienced with the 1 class SVM, and to overcome this problem we create subspaces of our variables. For each subspace created, the 1 class SVM produces a decision value. The aggregation of the decision values occurs through the use of fuzzy logic, creating the fuzzy ROC curve. The primary source of data for this research is a host based computer intrusion detection dataset.