Show simple item record

dc.contributor.authorMunson, Arten_US
dc.contributor.authorCaruana, Richen_US
dc.date.accessioned2007-04-04T20:42:20Z
dc.date.available2007-04-04T20:42:20Z
dc.date.issued2006-09-28en_US
dc.identifier.citationhttp://techreports.library.cornell.edu:8081/Dienst/UI/1.0/Display/cul.cis/TR2006-2047en_US
dc.identifier.urihttps://hdl.handle.net/1813/5744
dc.description.abstractCluster ensembles aim to find better, more natural clusterings by combining multiple clusterings. We apply ensemble clustering to anomaly detection, hypothesizing that multiple views of the data will improve the detection of attacks. Each clustering rates how anomalous a point is; ratings are combined by averaging or taking either the minimum, the maximum, or median score. The evaluation shows that taking the median prediction from the cluster ensemble results in better performance than single clusterings. Surprisingly, averaging the individual predictions a) leads to worse performance than that of individual clusterings, and b) performs identically to taking the minimum prediction from the ensemble. This counter-intuitive result stems from asymmetric prediction distributions.en_US
dc.format.extent232008 bytes
dc.format.mimetypeapplication/pdf
dc.language.isoen_USen_US
dc.publisherCornell Universityen_US
dc.subjectcomputer scienceen_US
dc.subjecttechnical reporten_US
dc.titleCluster Ensembles for Network Anomaly Detectionen_US
dc.typetechnical reporten_US


Files in this item

Thumbnail

This item appears in the following Collection(s)

Show simple item record

Statistics