Identification Through Data Mining

Abstract

Four main general purpose approaches inferring knowledge from data are presented as a useful pool of at least partially complementary techniques also in the cyber intrusion identification context. In order to reduce the dimensionality of the problem, the most salient variables can be selected by cascading to a K-means a Divisive Partitioning of data orthogonal to the Principal Directions. A rule induction method based on logical circuits synthesis after proper binarization of the original variables proves to be also able to further prune redundant variables, besides identifying logical relationships among them in an understandable “if . then ..” form. Adaptive Bayesian networks are used to build a decision tree over the hierarchy of variables ordered by Minimum Description Length. Finally, Piece-Wise Affine Identification also provides a model of the dynamics of the process underlying the data, by detecting possible switches and changes of trends on the time course of the monitoring.