A rare category is a minority class containing substantially fewer observations than the majority class or classes in a classification dataset. Its low frequency can make it resemble an outlier class, but rarity alone does not make every observation anomalous. section 8.6 section 5.2.1
Rare categories provide labeled data for testing outlier detectors. Researchers may use naturally imbalanced classification datasets or down-sample a balanced dataset until one or more classes become rare enough to test as outliers. section 8.6
Interpret rare categories cautiously:
- Treating a rare class as outliers can work well, but majority-class rows may be equally or more statistically rare. section 8.6
- High class imbalance can simplify outlier detection while making supervised classification more difficult. section 5.2.1
- Use labeled classification datasets as a starting point, not as proof that a detector suits a particular project. section 8.6 section 5.2.1
KDD Cup network attacks
The KDD Cup dataset groups network attacks into a class representing abnormal use. Attacks comprise about 0.3% of the full SA subset, or about 3.5% when 10% of the normal data is collected, making them a rare, labeled class for evaluating outlier detectors. section 5.2.1
Table 5.1 Sample of KDD Cup dataset (view table figure)
| duration |
protocol type |
service |
src bytes |
dst bytes |
logged in |
su attempted |
num file creations |
num access files |
serror rate |
|---|---|---|---|---|---|---|---|---|---|
| 0 |
tcp |
http |
234 |
5450 |
1 |
0 |
1 |
1 |
0.00 |
| 0 |
icmp |
http |
256 |
487 |
1 |
0 |
0 |
0 |
0.00 |
| 3 |
tcp |
private |
158 |
1535 |
0 |
0 |
0 |
0 |
0.07 |
| 5 |
udp |
smtp |
199 |
2363 |
1 |
0 |
0 |
0 |
0.00 |
| 0 |
icmp |
other |
310 |
2361 |
1 |
1 |
0 |
0 |
0.00 |
Inspect sample KDD Cup records and their mixed network, categorical, and activity features. section 5.2.1
