=== Run information ===

Scheme:       weka.classifiers.misc.InputMappedClassifier -I -trim -W weka.classifiers.meta.AttributeSelectedClassifier -- -E "weka.attributeSelection.CfsSubsetEval -P 1 -E 1" -S "weka.attributeSelection.BestFirst -D 1 -N 5" -W weka.classifiers.rules.JRip -- -F 3 -N 2.0 -O 2 -S 1
Relation:     TrainingKDD99
Instances:    40000
Attributes:   40
              duration
              protocol_type
              service
              flag
              src_bytes
              dst_bytes
              land
              wrong_fragment
              urgent
              hot
              num_failed_logins
              logged_in
              num_compromised
              root_shell
              su_attempted
              num_root
              num_file_creations
              num_shells
              num_access_files
              is_guest_login
              count
              srv_count
              serror_rate
              srv_serror_rate
              rerror_rate
              srv_rerror_rate
              same_srv_rate
              diff_srv_rate
              srv_diff_host_rate
              dst_host_count
              dst_host_srv_count
              dst_host_same_srv_rate
              dst_host_diff_srv_rate
              dst_host_same_src_port_rate
              dst_host_srv_diff_host_rate
              dst_host_serror_rate
              dst_host_srv_serror_rate
              dst_host_rerror_rate
              dst_host_srv_rerror_rate
              label
Test mode:    user supplied test set:  size unknown (reading incrementally)

=== Classifier model (full training set) ===

InputMappedClassifier:

AttributeSelectedClassifier:



=== Attribute Selection on all input data ===

Search Method:
	Best first.
	Start set: no attributes
	Search direction: forward
	Stale search after 5 node expansions
	Total number of subsets evaluated: 408
	Merit of best subset found:    0.663

Attribute Subset Evaluator (supervised, Class (nominal): 40 label):
	CFS Subset Evaluator
	Including locally predictive attributes

Selected attributes: 3,6,12,14,21,23,28,35 : 8
                     service
                     dst_bytes
                     logged_in
                     root_shell
                     count
                     serror_rate
                     diff_srv_rate
                     dst_host_srv_diff_host_rate


Header of reduced data:
@relation 'TrainingKDD99-weka.filters.unsupervised.attribute.Remove-V-R3,6,12,14,21,23,28,35,40'

@attribute service numeric
@attribute dst_bytes numeric
@attribute logged_in numeric
@attribute root_shell numeric
@attribute count numeric
@attribute serror_rate numeric
@attribute diff_srv_rate numeric
@attribute dst_host_srv_diff_host_rate numeric
@attribute label {probe,dos,normal,r2l,u2r}

@data


Classifier Model
JRIP rules:
===========

(root_shell >= 1) and (dst_bytes <= 0.000875) => label=u2r (23.0/0.0)
(count <= 0.005871) and (service >= 0.078125) and (dst_bytes >= 0.000964) and (dst_bytes <= 0.001706) => label=u2r (17.0/5.0)
(count <= 0.003914) and (service >= 0.203125) and (dst_host_srv_diff_host_rate >= 0.07) and (service <= 0.203125) => label=r2l (521.0/17.0)
(count <= 0.003914) and (service >= 0.078125) and (logged_in >= 1) and (dst_bytes >= 0.00042) and (dst_bytes <= 0.00049) => label=r2l (297.0/0.0)
(count <= 0.003914) and (service >= 0.203125) and (dst_bytes >= 0.000031) => label=r2l (26.0/3.0)
(count <= 0.003914) and (service >= 0.203125) and (logged_in >= 1) and (dst_host_srv_diff_host_rate <= 0) and (count <= 0.001957) => label=r2l (54.0/23.0)
(count <= 0.005871) and (service >= 0.078125) and (dst_bytes >= 0.000034) and (dst_bytes <= 0.000034) => label=r2l (51.0/0.0)
(diff_srv_rate >= 0.36) and (count >= 0.031311) => label=probe (824.0/2.0)
(dst_host_srv_diff_host_rate >= 0.25) and (service >= 0.09375) and (service <= 0.109375) => label=probe (654.0/1.0)
(count <= 0.003914) and (service >= 0.171875) and (service <= 0.171875) and (dst_bytes <= 0) and (dst_host_srv_diff_host_rate >= 1) => label=probe (51.0/0.0)
(count <= 0.003914) and (service >= 0.171875) and (service <= 0.171875) and (dst_bytes <= 0) and (serror_rate <= 0) => label=probe (311.0/47.0)
(count <= 0.003914) and (service >= 0.15625) and (dst_bytes <= 0) and (service <= 0.1875) and (service >= 0.171875) and (count <= 0.001957) => label=probe (33.0/3.0)
(diff_srv_rate >= 0.09) and (serror_rate <= 0.71) and (count >= 0.013699) and (count <= 0.086106) and (count >= 0.027397) and (logged_in <= 0) => label=probe (86.0/6.0)
(count <= 0.003914) and (service >= 0.15625) and (dst_bytes <= 0.000003) and (service <= 0.1875) and (count >= 0.003914) and (diff_srv_rate <= 0) and (service <= 0.15625) => label=probe (32.0/1.0)
(count <= 0.144814) and (dst_bytes <= 0.000006) and (service >= 0.21875) and (count <= 0.003914) and (service <= 0.90625) and (serror_rate <= 0) => label=probe (47.0/3.0)
(diff_srv_rate >= 0.12) and (serror_rate <= 0) and (count >= 0.013699) and (service <= 0.171875) and (dst_bytes <= 0.000022) => label=probe (32.0/4.0)
(count <= 0.080235) and (dst_host_srv_diff_host_rate >= 0.01) and (service <= 0.015625) and (dst_bytes >= 0.000023) => label=normal (5623.0/1.0)
(count <= 0.082192) and (dst_bytes <= 0.001398) and (dst_bytes >= 0.000005) and (count >= 0.009785) => label=normal (2166.0/3.0)
(count <= 0.035225) and (dst_bytes <= 0.001384) and (service <= 0.0625) and (serror_rate <= 0.25) and (dst_bytes <= 0.00028) and (dst_bytes >= 0.000018) => label=normal (909.0/0.0)
(count <= 0.041096) and (count <= 0.001957) and (service <= 0) and (dst_bytes <= 0.001542) and (dst_host_srv_diff_host_rate <= 0.5) => label=normal (707.0/1.0)
(count <= 0.043053) and (dst_bytes <= 0.001388) and (dst_bytes >= 0.000003) and (dst_bytes <= 0.000036) and (service >= 0.09375) => label=normal (560.0/1.0)
(count <= 0.046967) and (service >= 0.1875) and (serror_rate <= 0.17) => label=normal (618.0/66.0)
(service <= 0.15625) and (dst_bytes >= 0.001607) and (root_shell <= 0) => label=normal (388.0/2.0)
(count <= 0.02544) and (dst_bytes <= 0.001384) and (service <= 0.0625) and (serror_rate <= 0.25) and (service >= 0.046875) => label=normal (267.0/1.0)
(service <= 0.15625) and (dst_bytes <= 0.001587) and (dst_bytes >= 0.000001) and (count >= 0.015656) and (serror_rate <= 0.02) => label=normal (263.0/0.0)
(count <= 0.009785) and (dst_bytes <= 0.001384) and (logged_in >= 1) and (dst_bytes >= 0.000299) and (dst_bytes <= 0.000556) => label=normal (128.0/1.0)
(count <= 0.009785) and (dst_bytes <= 0.001388) and (logged_in >= 1) and (dst_bytes >= 0.000576) and (dst_bytes <= 0.00084) => label=normal (57.0/0.0)
(count <= 0.009785) and (dst_bytes <= 0.001581) and (dst_host_srv_diff_host_rate <= 0) and (service <= 0.15625) and (service >= 0.15625) => label=normal (132.0/30.0)
(count <= 0.029354) and (dst_bytes <= 0.001593) and (logged_in >= 1) and (dst_bytes >= 0.001407) and (root_shell <= 0) => label=normal (22.0/0.0)
(count <= 0.009785) and (dst_bytes <= 0.001384) and (logged_in >= 1) and (dst_bytes >= 0.000857) => label=normal (34.0/1.0)
(count <= 0.003914) and (dst_bytes <= 0.000227) and (dst_host_srv_diff_host_rate <= 0) and (dst_bytes >= 0.000146) => label=normal (37.0/1.0)
(count <= 0.091977) and (count <= 0.003914) and (service >= 0.015625) and (dst_host_srv_diff_host_rate <= 0.02) and (serror_rate <= 0.5) and (service >= 0.109375) => label=normal (89.0/35.0)
(count <= 0.035225) and (dst_bytes <= 0.001388) and (service <= 0.15625) and (service >= 0.15625) and (diff_srv_rate >= 0.17) => label=normal (5.0/0.0)
(service <= 0.078125) and (dst_host_srv_diff_host_rate >= 0.01) and (serror_rate <= 0.5) and (count >= 0.003914) => label=normal (27.0/0.0)
(count <= 0.007828) and (dst_bytes <= 0.001388) and (dst_bytes >= 0.000283) and (dst_bytes <= 0.000294) => label=normal (8.0/0.0)
 => label=dos (24901.0/137.0)

Number of Rules : 36

Attribute mappings:

Model attributes                       	    Incoming attributes
---------------------------------------	    ----------------
(numeric) duration                     	--> 1 (numeric) duration
(numeric) protocol_type                	--> 2 (numeric) protocol_type
(numeric) service                      	--> 3 (numeric) service
(numeric) flag                         	--> 4 (numeric) flag
(numeric) src_bytes                    	--> 5 (numeric) src_bytes
(numeric) dst_bytes                    	--> 6 (numeric) dst_bytes
(numeric) land                         	--> 7 (numeric) land
(numeric) wrong_fragment               	--> 8 (numeric) wrong_fragment
(numeric) urgent                       	--> 9 (numeric) urgent
(numeric) hot                          	--> 10 (numeric) hot
(numeric) num_failed_logins            	--> 11 (numeric) num_failed_logins
(numeric) logged_in                    	--> 12 (numeric) logged_in
(numeric) num_compromised              	--> 13 (numeric) num_compromised
(numeric) root_shell                   	--> 14 (numeric) root_shell
(numeric) su_attempted                 	--> 15 (numeric) su_attempted
(numeric) num_root                     	--> 16 (numeric) num_root
(numeric) num_file_creations           	--> 17 (numeric) num_file_creations
(numeric) num_shells                   	--> 18 (numeric) num_shells
(numeric) num_access_files             	--> 19 (numeric) num_access_files
(numeric) is_guest_login               	--> 20 (numeric) is_guest_login
(numeric) count                        	--> 21 (numeric) count
(numeric) srv_count                    	--> 22 (numeric) srv_count
(numeric) serror_rate                  	--> 23 (numeric) serror_rate
(numeric) srv_serror_rate              	--> 24 (numeric) srv_serror_rate
(numeric) rerror_rate                  	--> 25 (numeric) rerror_rate
(numeric) srv_rerror_rate              	--> 26 (numeric) srv_rerror_rate
(numeric) same_srv_rate                	--> 27 (numeric) same_srv_rate
(numeric) diff_srv_rate                	--> 28 (numeric) diff_srv_rate
(numeric) srv_diff_host_rate           	--> 29 (numeric) srv_diff_host_rate
(numeric) dst_host_count               	--> 30 (numeric) dst_host_count
(numeric) dst_host_srv_count           	--> 31 (numeric) dst_host_srv_count
(numeric) dst_host_same_srv_rate       	--> 32 (numeric) dst_host_same_srv_rate
(numeric) dst_host_diff_srv_rate       	--> 33 (numeric) dst_host_diff_srv_rate
(numeric) dst_host_same_src_port_rate  	--> 34 (numeric) dst_host_same_src_port_rate
(numeric) dst_host_srv_diff_host_rate  	--> 35 (numeric) dst_host_srv_diff_host_rate
(numeric) dst_host_serror_rate         	--> 36 (numeric) dst_host_serror_rate
(numeric) dst_host_srv_serror_rate     	--> 37 (numeric) dst_host_srv_serror_rate
(numeric) dst_host_rerror_rate         	--> 38 (numeric) dst_host_rerror_rate
(numeric) dst_host_srv_rerror_rate     	--> 39 (numeric) dst_host_srv_rerror_rate
(nominal) label                        	--> 40 (nominal) label


Time taken to build model: 21.81 seconds

=== Evaluation on test set ===

Time taken to test model on supplied test set: 3.18 seconds

=== Summary ===

Correctly Classified Instances      283488               91.1452 %
Incorrectly Classified Instances     27541                8.8548 %
Kappa statistic                          0.7828
Mean absolute error                      0.0369
Root mean squared error                  0.1843
Relative absolute error                 19.1769 %
Root relative squared error             62.083  %
Coverage of cases (0.95 level)          92.6264 %
Mean rel. region size (0.95 level)      20.7811 %
Total Number of Instances           311029     

=== Detailed Accuracy By Class ===

                 TP Rate  FP Rate  Precision  Recall   F-Measure  MCC      ROC Area  PRC Area  Class
                 0,774    0,014    0,425      0,774    0,549      0,566    0,887     0,726     probe
                 0,978    0,063    0,978      0,978    0,978      0,915    0,955     0,973     dos
                 0,907    0,072    0,753      0,907    0,823      0,780    0,955     0,786     normal
                 0,033    0,000    0,859      0,033    0,064      0,163    0,273     0,089     r2l
                 0,075    0,000    0,340      0,075    0,122      0,159    0,863     0,412     u2r
Weighted Avg.    0,911    0,060    0,920      0,911    0,894      0,845    0,919     0,887     

=== Confusion Matrix ===

      a      b      c      d      e   <-- classified as
   3224    346    596      0      0 |      a = probe
     47 224773   5033      0      0 |      b = dos
   4010   1534  54937     85     27 |      c = normal
    298   3166  12182    537      6 |      d = r2l
      6     32    170      3     17 |      e = u2r

