=== Run information ===

Scheme:       weka.classifiers.misc.InputMappedClassifier -I -trim -W weka.classifiers.rules.JRip -- -F 3 -N 2.0 -O 2 -S 1
Relation:     TrainingKDD99
Instances:    40000
Attributes:   40
              duration
              protocol_type
              service
              flag
              src_bytes
              dst_bytes
              land
              wrong_fragment
              urgent
              hot
              num_failed_logins
              logged_in
              num_compromised
              root_shell
              su_attempted
              num_root
              num_file_creations
              num_shells
              num_access_files
              is_guest_login
              count
              srv_count
              serror_rate
              srv_serror_rate
              rerror_rate
              srv_rerror_rate
              same_srv_rate
              diff_srv_rate
              srv_diff_host_rate
              dst_host_count
              dst_host_srv_count
              dst_host_same_srv_rate
              dst_host_diff_srv_rate
              dst_host_same_src_port_rate
              dst_host_srv_diff_host_rate
              dst_host_serror_rate
              dst_host_srv_serror_rate
              dst_host_rerror_rate
              dst_host_srv_rerror_rate
              label
Test mode:    user supplied test set:  size unknown (reading incrementally)

=== Classifier model (full training set) ===

InputMappedClassifier:

JRIP rules:
===========

(root_shell >= 1) => label=u2r (34.0/8.0)
(duration >= 0.00012) and (dst_host_count <= 0.035294) and (dst_bytes >= 0.000133) and (dst_bytes <= 0.000248) => label=u2r (4.0/0.0)
(dst_host_count <= 0.019608) and (dst_host_srv_count <= 0.019608) and (dst_bytes >= 0.00026) and (dst_bytes <= 0.001138) and (flag <= 0) => label=u2r (8.0/1.0)
(num_file_creations >= 0.01) and (duration >= 0.00012) and (duration <= 0.00036) => label=u2r (2.0/0.0)
(dst_host_count <= 0.023529) and (dst_host_srv_diff_host_rate <= 0.02) and (service >= 0.078125) and (dst_bytes >= 0.000363) and (dst_bytes <= 0.001139) => label=u2r (5.0/1.0)
(dst_host_count <= 0.007843) and (service >= 0.15625) and (service <= 0.15625) => label=u2r (2.0/0.0)
(count <= 0.003914) and (service >= 0.203125) and (dst_host_same_srv_rate >= 0.75) and (dst_host_srv_diff_host_rate >= 0.04) => label=r2l (515.0/3.0)
(hot >= 0.029703) and (duration <= 0.000103) => label=r2l (275.0/1.0)
(count <= 0.003914) and (service >= 0.203125) and (dst_host_same_srv_rate >= 1) and (dst_host_count >= 0.019608) => label=r2l (38.0/4.0)
(hot >= 0.009901) and (dst_bytes <= 0.00049) and (dst_host_serror_rate >= 0.02) and (count <= 0.007828) => label=r2l (87.0/2.0)
(service >= 0.203125) and (count <= 0.005871) and (dst_host_serror_rate >= 0.01) and (dst_host_count >= 1) => label=r2l (24.0/3.0)
(count <= 0.003914) and (service >= 0.203125) and (dst_host_count <= 0.023529) and (num_root <= 0.001007) and (rerror_rate <= 0) and (protocol_type <= 0) => label=r2l (26.0/3.0)
(count <= 0.003914) and (service >= 0.203125) and (dst_host_diff_srv_rate <= 0.02) and (dst_host_same_srv_rate >= 0.35) and (logged_in >= 1) and (src_bytes <= 0) => label=r2l (12.0/2.0)
(is_guest_login >= 1) and (duration >= 0.002674) => label=r2l (9.0/0.0)
(count <= 0.005871) and (service >= 0.203125) and (dst_host_count <= 0.109804) and (dst_host_diff_srv_rate <= 0.08) and (dst_host_srv_count <= 0.015686) and (protocol_type <= 0) => label=r2l (6.0/0.0)
(dst_host_same_src_port_rate >= 0.2) and (hot >= 0.019802) and (service >= 0.09375) => label=r2l (4.0/0.0)
(is_guest_login >= 1) and (duration <= 0.00012) => label=r2l (3.0/1.0)
(dst_host_diff_srv_rate >= 0.11) and (rerror_rate >= 0.21) and (dst_host_same_srv_rate <= 0.05) => label=probe (1165.0/0.0)
(dst_host_srv_diff_host_rate >= 0.25) and (srv_count >= 0.009785) and (protocol_type >= 1) => label=probe (460.0/0.0)
(dst_host_same_src_port_rate >= 0.38) and (dst_host_srv_diff_host_rate >= 0.25) and (service <= 0.109375) and (service >= 0.09375) => label=probe (194.0/1.0)
(dst_host_same_src_port_rate >= 0.18) and (same_srv_rate <= 0.93) and (count >= 0.013699) and (serror_rate <= 0) and (count >= 0.02544) => label=probe (115.0/0.0)
(dst_host_same_src_port_rate >= 0.53) and (service >= 0.171875) and (dst_host_same_srv_rate <= 0.29) => label=probe (56.0/0.0)
(dst_host_same_src_port_rate >= 0.03) and (dst_host_srv_count <= 0.047059) and (dst_host_rerror_rate >= 0.01) and (dst_host_same_srv_rate <= 0.02) => label=probe (34.0/0.0)
(protocol_type >= 0.5) and (dst_host_count <= 0.015686) and (src_bytes <= 0) and (protocol_type >= 1) => label=probe (10.0/1.0)
(protocol_type >= 0.5) and (srv_count <= 0.027397) and (service >= 0.171875) and (dst_host_same_src_port_rate >= 0.81) and (protocol_type <= 0.5) => label=probe (24.0/0.0)
(dst_host_diff_srv_rate >= 0.87) and (dst_host_same_src_port_rate <= 0.25) and (wrong_fragment <= 0) and (num_root <= 0) => label=probe (32.0/1.0)
(protocol_type >= 0.5) and (dst_host_srv_count <= 0.12549) and (dst_host_diff_srv_rate <= 0.24) and (wrong_fragment <= 0) and (service >= 0.140625) and (protocol_type <= 0.5) and (dst_bytes <= 0) => label=probe (16.0/1.0)
(diff_srv_rate >= 0.5) and (rerror_rate >= 0.29) => label=probe (7.0/2.0)
(flag >= 0.7) and (src_bytes <= 0) => label=probe (7.0/0.0)
(diff_srv_rate >= 0.12) and (service <= 0.046875) and (dst_host_srv_count <= 0.027451) => label=probe (6.0/2.0)
(dst_host_count <= 0.043137) and (service >= 0.140625) and (src_bytes <= 0) and (count <= 0.001957) and (dst_host_srv_count >= 0.007843) and (dst_host_count <= 0.019608) => label=probe (4.0/0.0)
(count <= 0.082192) and (dst_host_srv_count >= 0.635294) and (src_bytes <= 0.000019) and (protocol_type <= 0.5) => label=normal (8866.0/0.0)
(count <= 0.029354) and (src_bytes <= 0.000024) and (dst_bytes >= 0.000001) and (dst_host_diff_srv_rate >= 0.03) => label=normal (1322.0/1.0)
(same_srv_rate >= 0.33) and (dst_host_srv_diff_host_rate >= 0.01) and (wrong_fragment <= 0) and (dst_host_srv_serror_rate <= 0.02) => label=normal (787.0/3.0)
(flag <= 0) and (srv_count <= 0.003914) and (num_compromised <= 0) and (wrong_fragment <= 0) and (dst_host_same_srv_rate <= 0.16) and (duration <= 0.000326) => label=normal (232.0/2.0)
(flag <= 0) and (dst_host_rerror_rate <= 0) and (service <= 0.125) and (num_compromised <= 0) and (duration <= 0.000789) => label=normal (473.0/0.0)
(count <= 0.043053) and (service >= 0.203125) and (dst_host_srv_serror_rate <= 0.02) and (dst_host_srv_count >= 0.019608) => label=normal (209.0/2.0)
(count <= 0.003914) and (src_bytes <= 0.000001) and (dst_host_srv_count >= 0.066667) and (dst_host_same_srv_rate >= 0.59) => label=normal (62.0/0.0)
(count <= 0.003914) and (src_bytes <= 0.000001) and (dst_host_serror_rate <= 0.02) and (dst_host_srv_count >= 0.011765) and (dst_host_same_src_port_rate <= 0.19) => label=normal (11.0/0.0)
(dst_host_count <= 0.992157) and (service >= 0.203125) and (src_bytes >= 0.000001) and (protocol_type <= 0) => label=normal (6.0/0.0)
(dst_bytes >= 0.000001) and (service >= 0.015625) and (dst_host_srv_count >= 0.196078) and (wrong_fragment <= 0) => label=normal (9.0/0.0)
(dst_host_count <= 0.039216) and (src_bytes <= 0.000001) and (flag <= 0.2) and (service <= 0.03125) => label=normal (3.0/0.0)
 => label=dos (24836.0/21.0)

Number of Rules : 43

Attribute mappings:

Model attributes                       	    Incoming attributes
---------------------------------------	    ----------------
(numeric) duration                     	--> 1 (numeric) duration
(numeric) protocol_type                	--> 2 (numeric) protocol_type
(numeric) service                      	--> 3 (numeric) service
(numeric) flag                         	--> 4 (numeric) flag
(numeric) src_bytes                    	--> 5 (numeric) src_bytes
(numeric) dst_bytes                    	--> 6 (numeric) dst_bytes
(numeric) land                         	--> 7 (numeric) land
(numeric) wrong_fragment               	--> 8 (numeric) wrong_fragment
(numeric) urgent                       	--> 9 (numeric) urgent
(numeric) hot                          	--> 10 (numeric) hot
(numeric) num_failed_logins            	--> 11 (numeric) num_failed_logins
(numeric) logged_in                    	--> 12 (numeric) logged_in
(numeric) num_compromised              	--> 13 (numeric) num_compromised
(numeric) root_shell                   	--> 14 (numeric) root_shell
(numeric) su_attempted                 	--> 15 (numeric) su_attempted
(numeric) num_root                     	--> 16 (numeric) num_root
(numeric) num_file_creations           	--> 17 (numeric) num_file_creations
(numeric) num_shells                   	--> 18 (numeric) num_shells
(numeric) num_access_files             	--> 19 (numeric) num_access_files
(numeric) is_guest_login               	--> 20 (numeric) is_guest_login
(numeric) count                        	--> 21 (numeric) count
(numeric) srv_count                    	--> 22 (numeric) srv_count
(numeric) serror_rate                  	--> 23 (numeric) serror_rate
(numeric) srv_serror_rate              	--> 24 (numeric) srv_serror_rate
(numeric) rerror_rate                  	--> 25 (numeric) rerror_rate
(numeric) srv_rerror_rate              	--> 26 (numeric) srv_rerror_rate
(numeric) same_srv_rate                	--> 27 (numeric) same_srv_rate
(numeric) diff_srv_rate                	--> 28 (numeric) diff_srv_rate
(numeric) srv_diff_host_rate           	--> 29 (numeric) srv_diff_host_rate
(numeric) dst_host_count               	--> 30 (numeric) dst_host_count
(numeric) dst_host_srv_count           	--> 31 (numeric) dst_host_srv_count
(numeric) dst_host_same_srv_rate       	--> 32 (numeric) dst_host_same_srv_rate
(numeric) dst_host_diff_srv_rate       	--> 33 (numeric) dst_host_diff_srv_rate
(numeric) dst_host_same_src_port_rate  	--> 34 (numeric) dst_host_same_src_port_rate
(numeric) dst_host_srv_diff_host_rate  	--> 35 (numeric) dst_host_srv_diff_host_rate
(numeric) dst_host_serror_rate         	--> 36 (numeric) dst_host_serror_rate
(numeric) dst_host_srv_serror_rate     	--> 37 (numeric) dst_host_srv_serror_rate
(numeric) dst_host_rerror_rate         	--> 38 (numeric) dst_host_rerror_rate
(numeric) dst_host_srv_rerror_rate     	--> 39 (numeric) dst_host_srv_rerror_rate
(nominal) label                        	--> 40 (nominal) label


Time taken to build model: 44.09 seconds

=== Evaluation on test set ===

Time taken to test model on supplied test set: 3.15 seconds

=== Summary ===

Correctly Classified Instances      289307               93.0161 %
Incorrectly Classified Instances     21722                6.9839 %
Kappa statistic                          0.8321
Mean absolute error                      0.0285
Root mean squared error                  0.1669
Relative absolute error                 14.7988 %
Root relative squared error             56.2366 %
Coverage of cases (0.95 level)          93.0981 %
Mean rel. region size (0.95 level)      20.1085 %
Total Number of Instances           311029     

=== Detailed Accuracy By Class ===

                 TP Rate  FP Rate  Precision  Recall   F-Measure  MCC      ROC Area  PRC Area  Class
                 0,883    0,002    0,872      0,883    0,878      0,876    0,946     0,820     probe
                 0,974    0,004    0,998      0,974    0,986      0,950    0,985     0,992     dos
                 0,991    0,083    0,744      0,991    0,850      0,821    0,952     0,734     normal
                 0,100    0,000    0,943      0,100    0,181      0,299    0,217     0,152     r2l
                 0,140    0,000    0,364      0,140    0,203      0,226    0,286     0,049     u2r
Weighted Avg.    0,930    0,019    0,944      0,930    0,916      0,889    0,937     0,895     

=== Confusion Matrix ===

      a      b      c      d      e   <-- classified as
   3679    182    271     34      0 |      a = probe
    198 223921   5732      2      0 |      b = dos
    295    146  60059     46     47 |      c = normal
     25     22  14517   1616      9 |      d = r2l
     21      7    153     15     32 |      e = u2r

