Effect of Knowledge Representations on Performance of Classification Algorithms

A lot of classification algorithms have been evaluated over Knowledge Discovery and Data Mining 1999 (KDDCUP ’99) dataset. All of them use test data which contains attacks present in train data plus some additional attacks. Most of the multilevel classifier have signature based Intrusion Detection Systems (IDS) at the first level and statistical IDS at the next level. Such multilevel classifiers will perform better only if both IDS are complementary. Signature based IDS perform better for known attacks. So it is expected that statistical IDS should perform better for new attacks i.e. novelty attacks. This paper evaluates performance of feature selection algorithm, different classification algorithms, classifier combinations using bagging, boosting and stacking over the KDD’99 dataset for novelty attacks as well as for original data. It is found that the performance of statistical based intrusion detection system is better for novelty attack. It also evaluates the impact of knowledge representations on the performance of network based IDS. This work compares the performance of different classification algorithm for selection of different number of classes for attack such as 41 class, 5 class, and 2 class knowledge representations.