Hi,
I have a number of trace files which I used it to extract features and create a lot of records in both situation normal, and abnormal. Are there any rules can we rely on to determine the final number of records in dataset for each class? can we choose the same number for both? or the normal class must has more number of records?Please what is the best solution which is more reliability?
Hi Ms.Muna
you can use hybrid method. the hybrid method include Decision Tree and another algorithm such as Naive Bayes to determine the number of records for each class in intrusion dataset.
Mr. Mohammad
my question about choose the number of record("instances") for each class in data set before we use classification....
Hi Muna,
This question requires a bit of analysis but I can point something out: In many cases, we would like to have approximately the same number of instances for both "normal" and "abnormal" behavior. Consider the following extreme case for illustration: you have a data-set with 99% of normal behavior and 1% of abnormal behavior. Imagine you have a very bad classifier that always classifies elements as 'normal behavior'. Then, this classifier will have 99% of accuracy even if it is a very bad classifier!. That is because it will always label things as 'normal' and 99% of the records are normal.
When we have such a dis-balance between the number of instances in different classes you can do a couple of things: First,. you can differentiate between different type of errors: false positives and false negatives. And penalize one error more than the other. For example, if the data set has 99% of normal instances and 1% of abnormal instances, then you can say: 'well, if a normal instance is classified as abnormal it is kind of ok and I won't penalize it much, but if an abnormal instance is classified as normal you might want to penalize that more severely.
If you have a lot of instances in a class and no many instances in another class, you might want to try to create your own 'artificial instances' for the class with few instances. There are some techniques in machine learning that use small noise to create such instances. They take instances from the class with very few instances and add some random (but small) noise to them to create new instances and compensate the small amount of instances in that class.
I hope it can help you. All the best! byee
Thanks a lot for this answer Mr. Jhordany..
It is valuable information ...:)
Try out with maximum or Minimum likelihood Estimation combined with Bayesian Method. the MLE can help you detect the Positive likelihood ratio and the negative likelihood ratio of ur data set.
If you have all traces labelled and your problem is a classification one, maybe PCA (Principal Component Analysis) can help you - R is a very powerful framework you can use to try it... but that is not your main point, since it only helps you to see if all features are required. Concerning the number of representatives of each class, from my experience, it depends on the algorithm/technique you are using for training. The most important thing is to cover, as much as possible, all possible features' values for each class.
Can you provide more information about the two classes of data and what exactly you are trying to answer. By example, the relationship between the data or the relationship to a specific event?
- Badges
- Science topic