Download Quiz 2 - Suraj @ LUMS

ROLL NO.
NAME
CS 636 – Adv. Data Mining
Quiz 2 Solution
(Time limit: 10 minutes)
1. (3 points) Feature identification/construction is essential in the design of a network
IDS. Identify one feature with the intrusive scenario it relates to from the following
categories of features.
a. Single connection features




Connection from a banned IP address, port number, etc (policy restrictions)
Duration of a connection exceeding threshold value (policy restrictions)
Access to restricted resource (e.g. directory, file) (policy restrictions)
b. Time-based features

Number of different connections from a network to a given IP address (exceeding
a threshold) in the last T seconds (denial-of-service, etc)

c. Connection-based features

Number of unique connections within a network from a given IP address
(exceeding a threshold) in the last N connections (scanning, IP mapping, etc)

2. (6 points) Oftentimes the following two performance measures are used for
evaluating intrusion detection systems:
detection rate = TP / (TP + FN), false alarm rate = FP / (FP + TP)
a. (3 points) For a typical IDS (or classifier in general), plot the general trend
between detection rate (y-axis) and false alarm rate (x-axis).
Typically, as the parameters of a classifier are modified to improve its detection rate, its
false alarm rate also increases. This results from the greater sensitivity of the classifier at
higher detection rates.
CS 636 (Wi 04/05) – Dr. Asim Karim
Page 1 of 2
Detection rate
False alarm rate
b. (3 points) Compare the above two measures with the measures recall and
precision.
detection rate is identical to recall. That is, decteion rate and recall = TP / (TP + FN)
false alarm rate = 1 – precision.
3. (1 points) Name an approach to improve the performance of a rare-class classifier.
PN rule
CREDOS
Rare-Boost
SMOTEBoost
CS 536 (Au 03/04) – Dr. Asim Karim
Page 2 of 2