Attack recall control in anomaly detection

Abstract

This paper presents an approach to control the attack recall in an anomaly detection system using support vector machines (SVM). The recall and precision of SVM are controlled by the selection of the training model. The training model is selected by optimization method using genetic algorithm. A SVM training model optimization problem is presented and an expected attack recall is controlled by a tradeoff parameter /spl rho/ in the objective function. Experimental results demonstrate that as /spl rho/ increases from 0 to 1, the recall increases from 0 to 1. If we use the value of /spl rho/ to estimate the recall, the mean square error of this estimation is decreased during the evolution of the training model. Our approach allows a user to design a system with an expected recall while the precision is high.