Using Gain-ratio Based Decision Trees to Improve Intrusion Detection
Kun Huang · Jisuanji gongcheng · 2006
Using the decision trees approach to classify the intrusion rules,the idea is to introduce more parallelism when checking rules.This paper presents a new attribute selection metric,called the gain-ratio criterion to replace the gain criterion.For the certain particular attack type,experiment evaluation shows that the detection engine utilized gain-ratio criterion significantly improves the speed of detection process,compared to the gain criterion.The approach improves the performance of the signature-based intrusion detection,detects intrusion behavior in time.