Class imbalance occurs when one or more target classes contain far fewer observations than another. Rare classes may represent genuine anomalies, making them difficult for classification but easier for outlier detection. section 5.2.1
The interpretation remains conditional: detector performance depends on whether the data matches the problem, rare cases may be masked by other statistical outliers, and labeled datasets may not represent operational data. section 5.2.1
KDD Cup intrusion data
In the KDD Cup dataset, attacks form about 0.3% of the full subset or 3.5% when only 10% of normal data is collected. The labeled attacks support realistic detector evaluation, while also illustrating the limits of fixed attack categories and the emergence of novel attacks. section 5.2.1
Table 5.1 Sample of KDD Cup dataset (view table figure)
| duration |
protocol type |
service |
src bytes |
dst bytes |
logged in |
su attempted |
num file creations |
num access files |
serror rate |
|---|---|---|---|---|---|---|---|---|---|
| 0 |
tcp |
http |
234 |
5450 |
1 |
0 |
1 |
1 |
0.00 |
| 0 |
icmp |
http |
256 |
487 |
1 |
0 |
0 |
0 |
0.00 |
| 3 |
tcp |
private |
158 |
1535 |
0 |
0 |
0 |
0 |
0.07 |
| 5 |
udp |
smtp |
199 |
2363 |
1 |
0 |
0 |
0 |
0.00 |
| 0 |
icmp |
other |
310 |
2361 |
1 |
1 |
0 |
0 |
0.00 |
Inspect representative KDD Cup records containing duration, protocol, service, byte counts, login indicators, and error rates. section 5.2.1
