=== Run information ===

Scheme:       weka.classifiers.misc.InputMappedClassifier -I -trim -W weka.classifiers.meta.AttributeSelectedClassifier -- -E "weka.attributeSelection.CfsSubsetEval -P 1 -E 1" -S "weka.attributeSelection.BestFirst -D 1 -N 5" -W weka.classifiers.trees.J48 -- -C 0.25 -M 2
Relation:     TrainingKDD99
Instances:    40000
Attributes:   40
              duration
              protocol_type
              service
              flag
              src_bytes
              dst_bytes
              land
              wrong_fragment
              urgent
              hot
              num_failed_logins
              logged_in
              num_compromised
              root_shell
              su_attempted
              num_root
              num_file_creations
              num_shells
              num_access_files
              is_guest_login
              count
              srv_count
              serror_rate
              srv_serror_rate
              rerror_rate
              srv_rerror_rate
              same_srv_rate
              diff_srv_rate
              srv_diff_host_rate
              dst_host_count
              dst_host_srv_count
              dst_host_same_srv_rate
              dst_host_diff_srv_rate
              dst_host_same_src_port_rate
              dst_host_srv_diff_host_rate
              dst_host_serror_rate
              dst_host_srv_serror_rate
              dst_host_rerror_rate
              dst_host_srv_rerror_rate
              label
Test mode:    user supplied test set:  size unknown (reading incrementally)

=== Classifier model (full training set) ===

InputMappedClassifier:

AttributeSelectedClassifier:



=== Attribute Selection on all input data ===

Search Method:
	Best first.
	Start set: no attributes
	Search direction: forward
	Stale search after 5 node expansions
	Total number of subsets evaluated: 408
	Merit of best subset found:    0.663

Attribute Subset Evaluator (supervised, Class (nominal): 40 label):
	CFS Subset Evaluator
	Including locally predictive attributes

Selected attributes: 3,6,12,14,21,23,28,35 : 8
                     service
                     dst_bytes
                     logged_in
                     root_shell
                     count
                     serror_rate
                     diff_srv_rate
                     dst_host_srv_diff_host_rate


Header of reduced data:
@relation 'TrainingKDD99-weka.filters.unsupervised.attribute.Remove-V-R3,6,12,14,21,23,28,35,40'

@attribute service numeric
@attribute dst_bytes numeric
@attribute logged_in numeric
@attribute root_shell numeric
@attribute count numeric
@attribute serror_rate numeric
@attribute diff_srv_rate numeric
@attribute dst_host_srv_diff_host_rate numeric
@attribute label {probe,dos,normal,r2l,u2r}

@data


Classifier Model
J48 pruned tree
------------------

count <= 0.082192
|   dst_host_srv_diff_host_rate <= 0.24
|   |   serror_rate <= 0.69
|   |   |   service <= 0.0625
|   |   |   |   dst_host_srv_diff_host_rate <= 0
|   |   |   |   |   dst_bytes <= 0.001353
|   |   |   |   |   |   diff_srv_rate <= 0.44: normal (3441.0/27.0)
|   |   |   |   |   |   diff_srv_rate > 0.44
|   |   |   |   |   |   |   count <= 0.005871
|   |   |   |   |   |   |   |   serror_rate <= 0.16: normal (37.0/1.0)
|   |   |   |   |   |   |   |   serror_rate > 0.16: dos (2.0)
|   |   |   |   |   |   |   count > 0.005871: probe (4.0)
|   |   |   |   |   dst_bytes > 0.001353
|   |   |   |   |   |   dst_bytes <= 0.001621
|   |   |   |   |   |   |   count <= 0.013699
|   |   |   |   |   |   |   |   dst_bytes <= 0.00159
|   |   |   |   |   |   |   |   |   dst_bytes <= 0.001433
|   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.001395: normal (5.0)
|   |   |   |   |   |   |   |   |   |   dst_bytes > 0.001395: dos (40.0/4.0)
|   |   |   |   |   |   |   |   |   dst_bytes > 0.001433
|   |   |   |   |   |   |   |   |   |   root_shell <= 0: normal (18.0)
|   |   |   |   |   |   |   |   |   |   root_shell > 0: r2l (4.0)
|   |   |   |   |   |   |   |   dst_bytes > 0.00159: dos (891.0/1.0)
|   |   |   |   |   |   |   count > 0.013699
|   |   |   |   |   |   |   |   dst_bytes <= 0.00158: normal (44.0)
|   |   |   |   |   |   |   |   dst_bytes > 0.00158
|   |   |   |   |   |   |   |   |   dst_bytes <= 0.001603
|   |   |   |   |   |   |   |   |   |   count <= 0.015656: normal (3.0/1.0)
|   |   |   |   |   |   |   |   |   |   count > 0.015656: dos (15.0)
|   |   |   |   |   |   |   |   |   dst_bytes > 0.001603: normal (3.0)
|   |   |   |   |   |   dst_bytes > 0.001621: normal (352.0)
|   |   |   |   dst_host_srv_diff_host_rate > 0: normal (6310.0/4.0)
|   |   |   service > 0.0625
|   |   |   |   logged_in <= 0
|   |   |   |   |   count <= 0.009785
|   |   |   |   |   |   dst_bytes <= 0.000015
|   |   |   |   |   |   |   dst_host_srv_diff_host_rate <= 0
|   |   |   |   |   |   |   |   count <= 0.003914
|   |   |   |   |   |   |   |   |   service <= 0.140625
|   |   |   |   |   |   |   |   |   |   service <= 0.125
|   |   |   |   |   |   |   |   |   |   |   service <= 0.09375: probe (4.0)
|   |   |   |   |   |   |   |   |   |   |   service > 0.09375: normal (69.0/8.0)
|   |   |   |   |   |   |   |   |   |   service > 0.125
|   |   |   |   |   |   |   |   |   |   |   count <= 0.001957: normal (35.0/11.0)
|   |   |   |   |   |   |   |   |   |   |   count > 0.001957: dos (9.0/2.0)
|   |   |   |   |   |   |   |   |   service > 0.140625
|   |   |   |   |   |   |   |   |   |   service <= 0.1875
|   |   |   |   |   |   |   |   |   |   |   service <= 0.15625
|   |   |   |   |   |   |   |   |   |   |   |   count <= 0.001957: normal (65.0/24.0)
|   |   |   |   |   |   |   |   |   |   |   |   count > 0.001957
|   |   |   |   |   |   |   |   |   |   |   |   |   diff_srv_rate <= 0.5: probe (32.0/1.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   diff_srv_rate > 0.5: normal (7.0)
|   |   |   |   |   |   |   |   |   |   |   service > 0.15625: probe (315.0/47.0)
|   |   |   |   |   |   |   |   |   |   service > 0.1875
|   |   |   |   |   |   |   |   |   |   |   service <= 0.90625
|   |   |   |   |   |   |   |   |   |   |   |   service <= 0.234375: normal (36.0/4.0)
|   |   |   |   |   |   |   |   |   |   |   |   service > 0.234375: probe (33.0)
|   |   |   |   |   |   |   |   |   |   |   service > 0.90625
|   |   |   |   |   |   |   |   |   |   |   |   service <= 0.96875: normal (23.0/1.0)
|   |   |   |   |   |   |   |   |   |   |   |   service > 0.96875: dos (3.0)
|   |   |   |   |   |   |   |   count > 0.003914
|   |   |   |   |   |   |   |   |   diff_srv_rate <= 0.2
|   |   |   |   |   |   |   |   |   |   service <= 0.1875: dos (48.0/9.0)
|   |   |   |   |   |   |   |   |   |   service > 0.1875
|   |   |   |   |   |   |   |   |   |   |   serror_rate <= 0.25: normal (17.0)
|   |   |   |   |   |   |   |   |   |   |   serror_rate > 0.25: r2l (4.0)
|   |   |   |   |   |   |   |   |   diff_srv_rate > 0.2: normal (79.0/2.0)
|   |   |   |   |   |   |   dst_host_srv_diff_host_rate > 0
|   |   |   |   |   |   |   |   service <= 0.171875: dos (61.0/2.0)
|   |   |   |   |   |   |   |   service > 0.171875: normal (42.0/4.0)
|   |   |   |   |   |   dst_bytes > 0.000015
|   |   |   |   |   |   |   service <= 0.078125: r2l (56.0/5.0)
|   |   |   |   |   |   |   service > 0.078125
|   |   |   |   |   |   |   |   service <= 0.1875: normal (547.0)
|   |   |   |   |   |   |   |   service > 0.1875: r2l (22.0/1.0)
|   |   |   |   |   count > 0.009785
|   |   |   |   |   |   service <= 0.1875
|   |   |   |   |   |   |   diff_srv_rate <= 0.08: dos (404.0/17.0)
|   |   |   |   |   |   |   diff_srv_rate > 0.08
|   |   |   |   |   |   |   |   count <= 0.017613
|   |   |   |   |   |   |   |   |   dst_bytes <= 0.00001
|   |   |   |   |   |   |   |   |   |   service <= 0.15625
|   |   |   |   |   |   |   |   |   |   |   count <= 0.013699: probe (2.0)
|   |   |   |   |   |   |   |   |   |   |   count > 0.013699: normal (2.0)
|   |   |   |   |   |   |   |   |   |   service > 0.15625: probe (10.0/1.0)
|   |   |   |   |   |   |   |   |   dst_bytes > 0.00001: normal (10.0/1.0)
|   |   |   |   |   |   |   |   count > 0.017613: probe (120.0/7.0)
|   |   |   |   |   |   service > 0.1875
|   |   |   |   |   |   |   diff_srv_rate <= 0.64: normal (60.0)
|   |   |   |   |   |   |   diff_srv_rate > 0.64: probe (2.0)
|   |   |   |   logged_in > 0
|   |   |   |   |   count <= 0.003914
|   |   |   |   |   |   service <= 0.078125
|   |   |   |   |   |   |   root_shell <= 0
|   |   |   |   |   |   |   |   dst_bytes <= 0.00137
|   |   |   |   |   |   |   |   |   dst_bytes <= 0.000278
|   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.000241: normal (2.0)
|   |   |   |   |   |   |   |   |   |   dst_bytes > 0.000241: u2r (3.0)
|   |   |   |   |   |   |   |   |   dst_bytes > 0.000278: normal (7.0/3.0)
|   |   |   |   |   |   |   |   dst_bytes > 0.00137: normal (26.0/2.0)
|   |   |   |   |   |   |   root_shell > 0
|   |   |   |   |   |   |   |   dst_bytes <= 0.001729: u2r (18.0)
|   |   |   |   |   |   |   |   dst_bytes > 0.001729: r2l (3.0/1.0)
|   |   |   |   |   |   service > 0.078125
|   |   |   |   |   |   |   dst_host_srv_diff_host_rate <= 0.06
|   |   |   |   |   |   |   |   dst_bytes <= 0.000216
|   |   |   |   |   |   |   |   |   dst_bytes <= 0.000106
|   |   |   |   |   |   |   |   |   |   service <= 0.171875: r2l (10.0/1.0)
|   |   |   |   |   |   |   |   |   |   service > 0.171875
|   |   |   |   |   |   |   |   |   |   |   dst_host_srv_diff_host_rate <= 0
|   |   |   |   |   |   |   |   |   |   |   |   diff_srv_rate <= 0.5
|   |   |   |   |   |   |   |   |   |   |   |   |   count <= 0.001957
|   |   |   |   |   |   |   |   |   |   |   |   |   |   service <= 0.1875: normal (2.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   service > 0.1875: r2l (54.0/23.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   count > 0.001957: normal (64.0/23.0)
|   |   |   |   |   |   |   |   |   |   |   |   diff_srv_rate > 0.5: r2l (3.0)
|   |   |   |   |   |   |   |   |   |   |   dst_host_srv_diff_host_rate > 0: normal (149.0/23.0)
|   |   |   |   |   |   |   |   |   dst_bytes > 0.000106
|   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.00014: u2r (2.0)
|   |   |   |   |   |   |   |   |   |   dst_bytes > 0.00014: normal (33.0)
|   |   |   |   |   |   |   |   dst_bytes > 0.000216
|   |   |   |   |   |   |   |   |   dst_bytes <= 0.00048
|   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.000409
|   |   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.00032: r2l (13.0/2.0)
|   |   |   |   |   |   |   |   |   |   |   dst_bytes > 0.00032: normal (3.0)
|   |   |   |   |   |   |   |   |   |   dst_bytes > 0.000409: r2l (296.0)
|   |   |   |   |   |   |   |   |   dst_bytes > 0.00048
|   |   |   |   |   |   |   |   |   |   service <= 0.1875: normal (17.0/1.0)
|   |   |   |   |   |   |   |   |   |   service > 0.1875
|   |   |   |   |   |   |   |   |   |   |   service <= 0.28125: u2r (4.0)
|   |   |   |   |   |   |   |   |   |   |   service > 0.28125: r2l (4.0/1.0)
|   |   |   |   |   |   |   dst_host_srv_diff_host_rate > 0.06: r2l (466.0/18.0)
|   |   |   |   |   count > 0.003914
|   |   |   |   |   |   dst_bytes <= 0.000008: normal (204.0/2.0)
|   |   |   |   |   |   dst_bytes > 0.000008
|   |   |   |   |   |   |   count <= 0.005871: u2r (4.0)
|   |   |   |   |   |   |   count > 0.005871: normal (3.0/1.0)
|   |   serror_rate > 0.69
|   |   |   count <= 0.003914
|   |   |   |   logged_in <= 0
|   |   |   |   |   service <= 0.28125
|   |   |   |   |   |   count <= 0.001957
|   |   |   |   |   |   |   service <= 0.125: dos (9.0/2.0)
|   |   |   |   |   |   |   service > 0.125: probe (31.0/3.0)
|   |   |   |   |   |   count > 0.001957: dos (10.0/1.0)
|   |   |   |   |   service > 0.28125
|   |   |   |   |   |   service <= 0.40625: r2l (6.0)
|   |   |   |   |   |   service > 0.40625: probe (2.0)
|   |   |   |   logged_in > 0
|   |   |   |   |   dst_bytes <= 0.000134: r2l (3.0/1.0)
|   |   |   |   |   dst_bytes > 0.000134: normal (5.0)
|   |   |   count > 0.003914
|   |   |   |   diff_srv_rate <= 0.4: dos (524.0)
|   |   |   |   diff_srv_rate > 0.4
|   |   |   |   |   serror_rate <= 0.9: probe (4.0)
|   |   |   |   |   serror_rate > 0.9: dos (67.0)
|   dst_host_srv_diff_host_rate > 0.24
|   |   service <= 0.078125
|   |   |   root_shell <= 0
|   |   |   |   serror_rate <= 0.4
|   |   |   |   |   dst_host_srv_diff_host_rate <= 0.67: normal (99.0/2.0)
|   |   |   |   |   dst_host_srv_diff_host_rate > 0.67
|   |   |   |   |   |   service <= 0.03125: probe (3.0)
|   |   |   |   |   |   service > 0.03125: normal (3.0/1.0)
|   |   |   |   serror_rate > 0.4: dos (16.0/1.0)
|   |   |   root_shell > 0: u2r (4.0)
|   |   service > 0.078125
|   |   |   logged_in <= 0
|   |   |   |   service <= 0.125: probe (653.0/1.0)
|   |   |   |   service > 0.125
|   |   |   |   |   dst_host_srv_diff_host_rate <= 0.67
|   |   |   |   |   |   service <= 0.171875: dos (60.0)
|   |   |   |   |   |   service > 0.171875: r2l (2.0)
|   |   |   |   |   dst_host_srv_diff_host_rate > 0.67: probe (59.0)
|   |   |   logged_in > 0
|   |   |   |   diff_srv_rate <= 0.25
|   |   |   |   |   service <= 0.25: r2l (54.0/1.0)
|   |   |   |   |   service > 0.25: probe (2.0)
|   |   |   |   diff_srv_rate > 0.25: u2r (3.0)
count > 0.082192
|   diff_srv_rate <= 0.17
|   |   service <= 0.046875
|   |   |   diff_srv_rate <= 0.03: normal (225.0)
|   |   |   diff_srv_rate > 0.03
|   |   |   |   diff_srv_rate <= 0.04
|   |   |   |   |   service <= 0.03125: dos (2.0)
|   |   |   |   |   service > 0.03125: normal (2.0)
|   |   |   |   diff_srv_rate > 0.04: dos (149.0)
|   |   service > 0.046875
|   |   |   count <= 0.164384: dos (975.0/18.0)
|   |   |   count > 0.164384
|   |   |   |   diff_srv_rate <= 0.04
|   |   |   |   |   diff_srv_rate <= 0
|   |   |   |   |   |   service <= 0.140625: dos (566.0)
|   |   |   |   |   |   service > 0.140625
|   |   |   |   |   |   |   service <= 0.15625: normal (4.0)
|   |   |   |   |   |   |   service > 0.15625: dos (92.0)
|   |   |   |   |   diff_srv_rate > 0
|   |   |   |   |   |   serror_rate <= 0: probe (12.0)
|   |   |   |   |   |   serror_rate > 0: dos (285.0)
|   |   |   |   diff_srv_rate > 0.04: dos (20594.0/6.0)
|   diff_srv_rate > 0.17: probe (799.0)

Number of Leaves  : 	102

Size of the tree : 	203

Attribute mappings:

Model attributes                       	    Incoming attributes
---------------------------------------	    ----------------
(numeric) duration                     	--> 1 (numeric) duration
(numeric) protocol_type                	--> 2 (numeric) protocol_type
(numeric) service                      	--> 3 (numeric) service
(numeric) flag                         	--> 4 (numeric) flag
(numeric) src_bytes                    	--> 5 (numeric) src_bytes
(numeric) dst_bytes                    	--> 6 (numeric) dst_bytes
(numeric) land                         	--> 7 (numeric) land
(numeric) wrong_fragment               	--> 8 (numeric) wrong_fragment
(numeric) urgent                       	--> 9 (numeric) urgent
(numeric) hot                          	--> 10 (numeric) hot
(numeric) num_failed_logins            	--> 11 (numeric) num_failed_logins
(numeric) logged_in                    	--> 12 (numeric) logged_in
(numeric) num_compromised              	--> 13 (numeric) num_compromised
(numeric) root_shell                   	--> 14 (numeric) root_shell
(numeric) su_attempted                 	--> 15 (numeric) su_attempted
(numeric) num_root                     	--> 16 (numeric) num_root
(numeric) num_file_creations           	--> 17 (numeric) num_file_creations
(numeric) num_shells                   	--> 18 (numeric) num_shells
(numeric) num_access_files             	--> 19 (numeric) num_access_files
(numeric) is_guest_login               	--> 20 (numeric) is_guest_login
(numeric) count                        	--> 21 (numeric) count
(numeric) srv_count                    	--> 22 (numeric) srv_count
(numeric) serror_rate                  	--> 23 (numeric) serror_rate
(numeric) srv_serror_rate              	--> 24 (numeric) srv_serror_rate
(numeric) rerror_rate                  	--> 25 (numeric) rerror_rate
(numeric) srv_rerror_rate              	--> 26 (numeric) srv_rerror_rate
(numeric) same_srv_rate                	--> 27 (numeric) same_srv_rate
(numeric) diff_srv_rate                	--> 28 (numeric) diff_srv_rate
(numeric) srv_diff_host_rate           	--> 29 (numeric) srv_diff_host_rate
(numeric) dst_host_count               	--> 30 (numeric) dst_host_count
(numeric) dst_host_srv_count           	--> 31 (numeric) dst_host_srv_count
(numeric) dst_host_same_srv_rate       	--> 32 (numeric) dst_host_same_srv_rate
(numeric) dst_host_diff_srv_rate       	--> 33 (numeric) dst_host_diff_srv_rate
(numeric) dst_host_same_src_port_rate  	--> 34 (numeric) dst_host_same_src_port_rate
(numeric) dst_host_srv_diff_host_rate  	--> 35 (numeric) dst_host_srv_diff_host_rate
(numeric) dst_host_serror_rate         	--> 36 (numeric) dst_host_serror_rate
(numeric) dst_host_srv_serror_rate     	--> 37 (numeric) dst_host_srv_serror_rate
(numeric) dst_host_rerror_rate         	--> 38 (numeric) dst_host_rerror_rate
(numeric) dst_host_srv_rerror_rate     	--> 39 (numeric) dst_host_srv_rerror_rate
(nominal) label                        	--> 40 (nominal) label


Time taken to build model: 4.31 seconds

=== Evaluation on test set ===

Time taken to test model on supplied test set: 3.13 seconds

=== Summary ===

Correctly Classified Instances      283039               91.0008 %
Incorrectly Classified Instances     27990                8.9992 %
Kappa statistic                          0.7826
Mean absolute error                      0.036 
Root mean squared error                  0.1842
Relative absolute error                 18.7269 %
Root relative squared error             62.0496 %
Coverage of cases (0.95 level)          92.403  %
Mean rel. region size (0.95 level)      21.013  %
Total Number of Instances           311029     

=== Detailed Accuracy By Class ===

                 TP Rate  FP Rate  Precision  Recall   F-Measure  MCC      ROC Area  PRC Area  Class
                 0,787    0,017    0,392      0,787    0,523      0,547    0,939     0,589     probe
                 0,972    0,042    0,985      0,972    0,979      0,920    0,986     0,992     dos
                 0,915    0,075    0,748      0,915    0,823      0,781    0,945     0,704     normal
                 0,052    0,001    0,766      0,052    0,097      0,191    0,546     0,115     r2l
                 0,092    0,002    0,037      0,092    0,053      0,058    0,864     0,072     u2r
Weighted Avg.    0,910    0,046    0,919      0,910    0,896      0,849    0,955     0,884     

=== Confusion Matrix ===

      a      b      c      d      e   <-- classified as
   3279    185    534    167      1 |      a = probe
    773 223483   5597      0      0 |      b = dos
   3981   1132  55417     58      5 |      c = normal
    335   2088  12392    839    535 |      d = r2l
      6      0    169     32     21 |      e = u2r

