=== Run information ===

Scheme:       weka.classifiers.misc.InputMappedClassifier -I -trim -W weka.classifiers.trees.J48 -- -C 0.25 -M 2
Relation:     TrainingKDD99
Instances:    40000
Attributes:   40
              duration
              protocol_type
              service
              flag
              src_bytes
              dst_bytes
              land
              wrong_fragment
              urgent
              hot
              num_failed_logins
              logged_in
              num_compromised
              root_shell
              su_attempted
              num_root
              num_file_creations
              num_shells
              num_access_files
              is_guest_login
              count
              srv_count
              serror_rate
              srv_serror_rate
              rerror_rate
              srv_rerror_rate
              same_srv_rate
              diff_srv_rate
              srv_diff_host_rate
              dst_host_count
              dst_host_srv_count
              dst_host_same_srv_rate
              dst_host_diff_srv_rate
              dst_host_same_src_port_rate
              dst_host_srv_diff_host_rate
              dst_host_serror_rate
              dst_host_srv_serror_rate
              dst_host_rerror_rate
              dst_host_srv_rerror_rate
              label
Test mode:    user supplied test set:  size unknown (reading incrementally)

=== Classifier model (full training set) ===

InputMappedClassifier:

J48 pruned tree
------------------

count <= 0.082192
|   num_compromised <= 0
|   |   wrong_fragment <= 0
|   |   |   dst_host_serror_rate <= 0.96
|   |   |   |   hot <= 0
|   |   |   |   |   flag <= 0.3
|   |   |   |   |   |   dst_host_same_src_port_rate <= 0.99
|   |   |   |   |   |   |   same_srv_rate <= 0.93
|   |   |   |   |   |   |   |   dst_host_rerror_rate <= 0.01
|   |   |   |   |   |   |   |   |   dst_host_serror_rate <= 0.01: normal (267.0/5.0)
|   |   |   |   |   |   |   |   |   dst_host_serror_rate > 0.01
|   |   |   |   |   |   |   |   |   |   dst_host_srv_serror_rate <= 0.03: normal (6.0)
|   |   |   |   |   |   |   |   |   |   dst_host_srv_serror_rate > 0.03: r2l (3.0)
|   |   |   |   |   |   |   |   dst_host_rerror_rate > 0.01
|   |   |   |   |   |   |   |   |   dst_host_rerror_rate <= 0.98: probe (134.0)
|   |   |   |   |   |   |   |   |   dst_host_rerror_rate > 0.98: dos (4.0)
|   |   |   |   |   |   |   same_srv_rate > 0.93
|   |   |   |   |   |   |   |   service <= 0.0625
|   |   |   |   |   |   |   |   |   dst_host_srv_rerror_rate <= 0.02: normal (9114.0/3.0)
|   |   |   |   |   |   |   |   |   dst_host_srv_rerror_rate > 0.02
|   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.001579: normal (775.0/3.0)
|   |   |   |   |   |   |   |   |   |   dst_bytes > 0.001579
|   |   |   |   |   |   |   |   |   |   |   src_bytes <= 0.000038: normal (24.0)
|   |   |   |   |   |   |   |   |   |   |   src_bytes > 0.000038: dos (6.0)
|   |   |   |   |   |   |   |   service > 0.0625
|   |   |   |   |   |   |   |   |   dst_host_rerror_rate <= 0.06
|   |   |   |   |   |   |   |   |   |   dst_host_count <= 0.054902
|   |   |   |   |   |   |   |   |   |   |   protocol_type <= 0.5
|   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_diff_host_rate <= 0.1
|   |   |   |   |   |   |   |   |   |   |   |   |   service <= 0.296875
|   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_count <= 0.015686: u2r (5.0/1.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_count > 0.015686: normal (24.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   service > 0.296875: r2l (4.0)
|   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_diff_host_rate > 0.1: r2l (12.0)
|   |   |   |   |   |   |   |   |   |   |   protocol_type > 0.5: probe (3.0)
|   |   |   |   |   |   |   |   |   |   dst_host_count > 0.054902
|   |   |   |   |   |   |   |   |   |   |   dst_host_srv_serror_rate <= 0
|   |   |   |   |   |   |   |   |   |   |   |   protocol_type <= 0
|   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_count <= 0.015686
|   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_same_src_port_rate <= 0.03
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   root_shell <= 0
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   duration <= 0.000926: normal (8.0/1.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   duration > 0.000926: u2r (2.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   root_shell > 0: u2r (2.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_same_src_port_rate > 0.03: r2l (4.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_count > 0.015686
|   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_count <= 0.862745: normal (362.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_count > 0.862745
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   srv_count <= 0.003914
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_diff_host_rate <= 0.01
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   logged_in <= 0: normal (10.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   logged_in > 0
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_same_src_port_rate <= 0.39: normal (22.0/2.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_same_src_port_rate > 0.39: r2l (5.0/1.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_diff_host_rate > 0.01
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_diff_host_rate <= 0.02: r2l (7.0/1.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_srv_diff_host_rate > 0.02: normal (2.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   srv_count > 0.003914: normal (40.0)
|   |   |   |   |   |   |   |   |   |   |   |   protocol_type > 0
|   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_count <= 0.956863
|   |   |   |   |   |   |   |   |   |   |   |   |   |   count <= 0.001957: normal (63.0/1.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   count > 0.001957
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.00001
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_same_srv_rate <= 0.91: probe (25.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_same_srv_rate > 0.91: normal (2.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_bytes > 0.00001: normal (7.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_count > 0.956863
|   |   |   |   |   |   |   |   |   |   |   |   |   |   count <= 0.009785: normal (418.0/4.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   count > 0.009785
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_diff_srv_rate <= 0.01: normal (4.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_diff_srv_rate > 0.01: dos (5.0/1.0)
|   |   |   |   |   |   |   |   |   |   |   dst_host_srv_serror_rate > 0
|   |   |   |   |   |   |   |   |   |   |   |   dst_host_count <= 0.996078: normal (53.0/2.0)
|   |   |   |   |   |   |   |   |   |   |   |   dst_host_count > 0.996078
|   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_serror_rate <= 0: normal (5.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   dst_host_serror_rate > 0: r2l (21.0/2.0)
|   |   |   |   |   |   |   |   |   dst_host_rerror_rate > 0.06
|   |   |   |   |   |   |   |   |   |   logged_in <= 0: probe (98.0/2.0)
|   |   |   |   |   |   |   |   |   |   logged_in > 0
|   |   |   |   |   |   |   |   |   |   |   duration <= 0.000377: normal (13.0)
|   |   |   |   |   |   |   |   |   |   |   duration > 0.000377: u2r (2.0)
|   |   |   |   |   |   dst_host_same_src_port_rate > 0.99
|   |   |   |   |   |   |   service <= 0.1875
|   |   |   |   |   |   |   |   service <= 0.15625
|   |   |   |   |   |   |   |   |   count <= 0.009785
|   |   |   |   |   |   |   |   |   |   protocol_type <= 0.5: normal (411.0/7.0)
|   |   |   |   |   |   |   |   |   |   protocol_type > 0.5
|   |   |   |   |   |   |   |   |   |   |   count <= 0.003914
|   |   |   |   |   |   |   |   |   |   |   |   dst_host_count <= 0.058824: probe (663.0/3.0)
|   |   |   |   |   |   |   |   |   |   |   |   dst_host_count > 0.058824: normal (40.0)
|   |   |   |   |   |   |   |   |   |   |   count > 0.003914: dos (3.0)
|   |   |   |   |   |   |   |   |   count > 0.009785
|   |   |   |   |   |   |   |   |   |   protocol_type <= 0.5
|   |   |   |   |   |   |   |   |   |   |   same_srv_rate <= 0.31: probe (8.0)
|   |   |   |   |   |   |   |   |   |   |   same_srv_rate > 0.31: normal (20.0)
|   |   |   |   |   |   |   |   |   |   protocol_type > 0.5: dos (30.0)
|   |   |   |   |   |   |   |   service > 0.15625: probe (39.0/1.0)
|   |   |   |   |   |   |   service > 0.1875
|   |   |   |   |   |   |   |   dst_host_srv_count <= 0.278431
|   |   |   |   |   |   |   |   |   dst_host_srv_count <= 0.011765
|   |   |   |   |   |   |   |   |   |   protocol_type <= 0.5
|   |   |   |   |   |   |   |   |   |   |   flag <= 0.1
|   |   |   |   |   |   |   |   |   |   |   |   logged_in <= 0: r2l (7.0)
|   |   |   |   |   |   |   |   |   |   |   |   logged_in > 0
|   |   |   |   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.000482: r2l (7.0)
|   |   |   |   |   |   |   |   |   |   |   |   |   dst_bytes > 0.000482: u2r (4.0)
|   |   |   |   |   |   |   |   |   |   |   flag > 0.1: probe (2.0)
|   |   |   |   |   |   |   |   |   |   protocol_type > 0.5: dos (3.0)
|   |   |   |   |   |   |   |   |   dst_host_srv_count > 0.011765: r2l (494.0/4.0)
|   |   |   |   |   |   |   |   dst_host_srv_count > 0.278431
|   |   |   |   |   |   |   |   |   flag <= 0.1
|   |   |   |   |   |   |   |   |   |   dst_bytes <= 0.000484
|   |   |   |   |   |   |   |   |   |   |   dst_host_srv_count <= 0.341176: r2l (2.0)
|   |   |   |   |   |   |   |   |   |   |   dst_host_srv_count > 0.341176: normal (2.0)
|   |   |   |   |   |   |   |   |   |   dst_bytes > 0.000484: u2r (3.0)
|   |   |   |   |   |   |   |   |   flag > 0.1: probe (3.0)
|   |   |   |   |   flag > 0.3
|   |   |   |   |   |   logged_in <= 0
|   |   |   |   |   |   |   srv_diff_host_rate <= 0.18
|   |   |   |   |   |   |   |   dst_host_same_srv_rate <= 0.14: probe (293.0)
|   |   |   |   |   |   |   |   dst_host_same_srv_rate > 0.14
|   |   |   |   |   |   |   |   |   count <= 0.019569
|   |   |   |   |   |   |   |   |   |   dst_host_srv_rerror_rate <= 0.03: probe (5.0/1.0)
|   |   |   |   |   |   |   |   |   |   dst_host_srv_rerror_rate > 0.03: normal (3.0/1.0)
|   |   |   |   |   |   |   |   |   count > 0.019569: dos (2.0)
|   |   |   |   |   |   |   srv_diff_host_rate > 0.18
|   |   |   |   |   |   |   |   srv_rerror_rate <= 0.02
|   |   |   |   |   |   |   |   |   srv_diff_host_rate <= 0.86: normal (2.0)
|   |   |   |   |   |   |   |   |   srv_diff_host_rate > 0.86: dos (4.0)
|   |   |   |   |   |   |   |   srv_rerror_rate > 0.02: r2l (3.0/1.0)
|   |   |   |   |   |   logged_in > 0
|   |   |   |   |   |   |   src_bytes <= 0.00001: normal (10.0/2.0)
|   |   |   |   |   |   |   src_bytes > 0.00001: dos (4.0/1.0)
|   |   |   |   hot > 0
|   |   |   |   |   flag <= 0.6
|   |   |   |   |   |   dst_host_srv_count <= 0.988235
|   |   |   |   |   |   |   duration <= 0.000274
|   |   |   |   |   |   |   |   count <= 0.003914
|   |   |   |   |   |   |   |   |   duration <= 0.000086: r2l (319.0/1.0)
|   |   |   |   |   |   |   |   |   duration > 0.000086
|   |   |   |   |   |   |   |   |   |   num_file_creations <= 0.02: r2l (5.0)
|   |   |   |   |   |   |   |   |   |   num_file_creations > 0.02: u2r (2.0)
|   |   |   |   |   |   |   |   count > 0.003914
|   |   |   |   |   |   |   |   |   logged_in <= 0: r2l (3.0)
|   |   |   |   |   |   |   |   |   logged_in > 0
|   |   |   |   |   |   |   |   |   |   service <= 0.09375: probe (2.0/1.0)
|   |   |   |   |   |   |   |   |   |   service > 0.09375: u2r (3.0)
|   |   |   |   |   |   |   duration > 0.000274
|   |   |   |   |   |   |   |   duration <= 0.000823
|   |   |   |   |   |   |   |   |   num_file_creations <= 0: normal (50.0)
|   |   |   |   |   |   |   |   |   num_file_creations > 0: r2l (3.0/1.0)
|   |   |   |   |   |   |   |   duration > 0.000823: r2l (88.0)
|   |   |   |   |   |   dst_host_srv_count > 0.988235
|   |   |   |   |   |   |   src_bytes <= 0.000038: normal (20.0/1.0)
|   |   |   |   |   |   |   src_bytes > 0.000038: dos (5.0)
|   |   |   |   |   flag > 0.6
|   |   |   |   |   |   service <= 0.03125: dos (58.0)
|   |   |   |   |   |   service > 0.03125: r2l (4.0)
|   |   |   dst_host_serror_rate > 0.96
|   |   |   |   dst_host_same_src_port_rate <= 0.22: dos (606.0)
|   |   |   |   dst_host_same_src_port_rate > 0.22
|   |   |   |   |   land <= 0
|   |   |   |   |   |   dst_host_same_srv_rate <= 0.25: probe (8.0)
|   |   |   |   |   |   dst_host_same_srv_rate > 0.25
|   |   |   |   |   |   |   flag <= 0.2: normal (2.0)
|   |   |   |   |   |   |   flag > 0.2: r2l (4.0)
|   |   |   |   |   land > 0: dos (15.0)
|   |   wrong_fragment > 0: dos (538.0)
|   num_compromised > 0
|   |   src_bytes <= 0.000015
|   |   |   dst_host_srv_serror_rate <= 0
|   |   |   |   num_compromised <= 0.006787
|   |   |   |   |   dst_host_diff_srv_rate <= 0.03: u2r (24.0/1.0)
|   |   |   |   |   dst_host_diff_srv_rate > 0.03: normal (3.0/1.0)
|   |   |   |   num_compromised > 0.006787: r2l (3.0)
|   |   |   dst_host_srv_serror_rate > 0: normal (7.0)
|   |   src_bytes > 0.000015: dos (895.0)
count > 0.082192
|   diff_srv_rate <= 0.17
|   |   service <= 0.046875
|   |   |   flag <= 0.1: normal (227.0)
|   |   |   flag > 0.1: dos (151.0)
|   |   service > 0.046875
|   |   |   dst_host_same_src_port_rate <= 0.76: dos (22018.0/4.0)
|   |   |   dst_host_same_src_port_rate > 0.76
|   |   |   |   protocol_type <= 0.5
|   |   |   |   |   dst_host_diff_srv_rate <= 0.01: normal (5.0/1.0)
|   |   |   |   |   dst_host_diff_srv_rate > 0.01: probe (31.0)
|   |   |   |   protocol_type > 0.5: dos (474.0/1.0)
|   diff_srv_rate > 0.17: probe (799.0)

Number of Leaves  : 	96

Size of the tree : 	191

Attribute mappings:

Model attributes                       	    Incoming attributes
---------------------------------------	    ----------------
(numeric) duration                     	--> 1 (numeric) duration
(numeric) protocol_type                	--> 2 (numeric) protocol_type
(numeric) service                      	--> 3 (numeric) service
(numeric) flag                         	--> 4 (numeric) flag
(numeric) src_bytes                    	--> 5 (numeric) src_bytes
(numeric) dst_bytes                    	--> 6 (numeric) dst_bytes
(numeric) land                         	--> 7 (numeric) land
(numeric) wrong_fragment               	--> 8 (numeric) wrong_fragment
(numeric) urgent                       	--> 9 (numeric) urgent
(numeric) hot                          	--> 10 (numeric) hot
(numeric) num_failed_logins            	--> 11 (numeric) num_failed_logins
(numeric) logged_in                    	--> 12 (numeric) logged_in
(numeric) num_compromised              	--> 13 (numeric) num_compromised
(numeric) root_shell                   	--> 14 (numeric) root_shell
(numeric) su_attempted                 	--> 15 (numeric) su_attempted
(numeric) num_root                     	--> 16 (numeric) num_root
(numeric) num_file_creations           	--> 17 (numeric) num_file_creations
(numeric) num_shells                   	--> 18 (numeric) num_shells
(numeric) num_access_files             	--> 19 (numeric) num_access_files
(numeric) is_guest_login               	--> 20 (numeric) is_guest_login
(numeric) count                        	--> 21 (numeric) count
(numeric) srv_count                    	--> 22 (numeric) srv_count
(numeric) serror_rate                  	--> 23 (numeric) serror_rate
(numeric) srv_serror_rate              	--> 24 (numeric) srv_serror_rate
(numeric) rerror_rate                  	--> 25 (numeric) rerror_rate
(numeric) srv_rerror_rate              	--> 26 (numeric) srv_rerror_rate
(numeric) same_srv_rate                	--> 27 (numeric) same_srv_rate
(numeric) diff_srv_rate                	--> 28 (numeric) diff_srv_rate
(numeric) srv_diff_host_rate           	--> 29 (numeric) srv_diff_host_rate
(numeric) dst_host_count               	--> 30 (numeric) dst_host_count
(numeric) dst_host_srv_count           	--> 31 (numeric) dst_host_srv_count
(numeric) dst_host_same_srv_rate       	--> 32 (numeric) dst_host_same_srv_rate
(numeric) dst_host_diff_srv_rate       	--> 33 (numeric) dst_host_diff_srv_rate
(numeric) dst_host_same_src_port_rate  	--> 34 (numeric) dst_host_same_src_port_rate
(numeric) dst_host_srv_diff_host_rate  	--> 35 (numeric) dst_host_srv_diff_host_rate
(numeric) dst_host_serror_rate         	--> 36 (numeric) dst_host_serror_rate
(numeric) dst_host_srv_serror_rate     	--> 37 (numeric) dst_host_srv_serror_rate
(numeric) dst_host_rerror_rate         	--> 38 (numeric) dst_host_rerror_rate
(numeric) dst_host_srv_rerror_rate     	--> 39 (numeric) dst_host_srv_rerror_rate
(nominal) label                        	--> 40 (nominal) label


Time taken to build model: 6.89 seconds

=== Evaluation on test set ===

Time taken to test model on supplied test set: 4.98 seconds

=== Summary ===

Correctly Classified Instances      289299               93.0135 %
Incorrectly Classified Instances     21730                6.9865 %
Kappa statistic                          0.8324
Mean absolute error                      0.0284
Root mean squared error                  0.1637
Relative absolute error                 14.7716 %
Root relative squared error             55.1643 %
Coverage of cases (0.95 level)          94.1594 %
Mean rel. region size (0.95 level)      20.3506 %
Total Number of Instances           311029     

=== Detailed Accuracy By Class ===

                 TP Rate  FP Rate  Precision  Recall   F-Measure  MCC      ROC Area  PRC Area  Class
                 0,855    0,005    0,713      0,855    0,777      0,777    0,951     0,744     probe
                 0,974    0,004    0,999      0,974    0,986      0,950    0,980     0,990     dos
                 0,991    0,077    0,756      0,991    0,858      0,830    0,975     0,851     normal
                 0,108    0,002    0,771      0,108    0,189      0,277    0,649     0,296     r2l
                 0,048    0,000    0,155      0,048    0,074      0,086    0,413     0,011     u2r
Weighted Avg.    0,930    0,018    0,935      0,930    0,916      0,889    0,961     0,923     

=== Confusion Matrix ===

      a      b      c      d      e   <-- classified as
   3562    181    195    228      0 |      a = probe
    951 223933   4762    206      1 |      b = dos
    327    138  60049     57     22 |      c = normal
     66      4  14338   1744     37 |      d = r2l
     92      1     96     28     11 |      e = u2r

