I.J. Information Engineering and Electronic Business, 2013, 5, 49-56
Published Online November 2013 in MECS (https://www.doczj.com/doc/c812335628.html,/)
DOI: 10.5815/ijieeb.2013.05.07
Performance Evaluation of Bagged RBF
Classifier for Data Mining Applications
https://www.doczj.com/doc/c812335628.html,indarajan
Assistant Professor, Department of Computer Science and Engineering,
Annamalai University, Annamalai Nagar – 608002, Tamil Nadu
Email: govind_aucse@https://www.doczj.com/doc/c812335628.html,
Abstract—Data mining is the use of algorithms to extract the information and patterns derived by the knowledge discovery in databases process. Classification maps data into predefined groups or classes. It is often referred to as supervised learning because the classes are determined before examining the data. The feasibility and the benefits of the proposed approaches are demonstrated by the means of data mining applications like intrusion detection, direct marketing, and signature verification. A variety of techniques have been employed for analysis ranging from traditional statistical methods to data mining approaches. Bagging and boosting are two relatively new but popular methods for producing ensembles. In this work, bagging is evaluated on real and benchmark data sets of intrusion detection, direct marketing, and signature verification in conjunction with radial basis function classifier as the base learner. The proposed bagged radial basis function is superior to individual approach for data mining applications in terms of classification accuracy.
Index Terms—Data Mining, Radial Basis Function, Intrusion Detection, Direct Marketing Signature Verification, Classification Accuracy, Ensemble Method.
I.INTRODUCTION
1.1 Intrusion Detection
Traditional protection techniques such as user authentication, data encryption, avoiding programming errors and firewalls are used as the first line of defense for computer security. If a password is weak and is compromised, user authentication cannot prevent unauthorized use; firewalls are vulnerable to errors in configuration and suspect to ambiguous or undefined security policies (Summers, 1997). They are generally unable to protect against malicious mobile code, insider attacks and unsecured modems. Programming errors cannot be avoided as the complexity of the system and application software is evolving rapidly leaving behind some exploitable weaknesses. Consequently, computer systems are likely to remain unsecured for the foreseeable future. Therefore, intrusion detection is required as an additional wall for protecting systems despite the prevention techniques. Intrusion detection is useful not only in detecting successful intrusions, but also in monitoring attempts to break security, which provides important information for timely countermeasures (Heady et al., 1990; Sundaram, 1996). Intrusion detection is classified into two types: misuse intrusion detection and anomaly intrusion detection. Several machine-learning paradigms including neural networks (Mukkamala et al.,2003), linear genetic programming (LGP) (Mukkamala et al., 2004a), support vector machines (SVM), Bayesian networks, multivariate adaptive regression splines (MARS) (Mukkamala et al., 2004b) fuzzy inference systems (FISs) (Shah et al.,2004), etc. have been investigated for the design of IDS.
1.2 Direct Marketing
In direct marketing, companies or organizations try to establish and maintain a direct relationship with their customers in order to target them individually for specific product offers or for fund raising. There are two main approaches for companies to promote their products / services: through mass campaigns, which target the general public population, and directed campaign, which targets only a specific group of people. Formal study shows that the efficiency of mass campaign is pretty low. Usually less than 1% of the whole population will have positive response to the mass campaign. In contrast, direct campaign focuses only on a small set of people who are believed to be interested in the product/service being marketed and thus would me much more efficient. This paper focuses only on the direct marketing data. The goal is to predict if a customer will subscribe the service provided by the bank, thereby improving the effect of direct marketing.
1.3 Signature Verification
Optical Character Recognition (OCR) is a branch of pattern recognition, and also a branch of computer vision. OCR has been extensively researched for more than four decades. With the advent of digital computers, many researchers and engineers have been engaged in this interesting topic. It is not only a newly developing topic due to many potential applications, such as bank check processing, postal mail sorting, automatic reading
of tax forms and various handwritten and printed materials, but it is also a benchmark for testing and
verifying new pattern recognition theories and algorithms. In recent years, many new classifiers and feature extraction algorithms have been proposed and tested on various OCR databases and these techniques have been used in wide applications. Numerous scientific papers and inventions in OCR have been reported in the literature. It can be said that OCR is one
of the most important and active research fields in pattern recognition. Today, OCR research is addressing
a diversified number of sophisticated problems. Important research in OCR includes degraded (heavy noise) omni font text recognition, and analysis/recognition of complex documents (including texts, images, charts, tables and video documents). Handwritten numeral recognition, (as there are varieties
of handwriting styles depending on an applicant’s age, gender, education, ethnic background, etc., as well as the writer’s mood while writing), is a relatively difficult research field in OCR.
In the area of character recognition, the concept of combining multiple classifiers is proposed as a new direction for the development of highly reliable character recognition systems (C.Y.Suen et al., 1990) and some preliminary results have indicated that the combination of several complementary classifiers will improve the performance of individual classifiers (C.Y.Suen et al., 1990 and T.K.Ho et al., 1990).
The rest of this paper is organized as follows: Section
2 describes the related work. Section
3 presents classification methods and Section
4 explains the performance evaluation measures. Section
5 focuses on the experimental results and discussion. Finally, results are summarized and concluded in section 6.
II.RELATED WORK
2.1 Intrusion Detection
The Internet and online procedures is an essential tool
of our daily life today. They have been used as an important component of business operation (T. Shon and J. Moon, 2007). Therefore, network security needs to be carefully concerned to provide secure information channels. Intrusion detection (ID) is a major research problem in network security, where the concept of ID was proposed by Anderson in 1980 (J.P. Anderson, 1980). ID is based on the assumption that the behavior
of intruders is different from a legal user (W. Stallings, 2006). The goal of intrusion detection systems (IDS) is
to identify unusual access or attacks to secure internal networks (C. Tsai, et al., 2009) Network-based IDS is a valuable tool for the defense-in-depth of computer networks. It looks for known or potential malicious activities in network traffic and raises an alarm whenever a suspicious activity is detected. In general, IDSs can be divided into two techniques: misuse detection and anomaly detection (E. Biermannet al.2001; T. Verwoerd, et al., 2002) Misuse intrusion detection (signature-based detection) uses well-defined patterns of the malicious activity to identify intrusions (K. Ilgun et al., 1995; D. Marchette, 1999) However, it may not be able to alert the system administrator in case of a new attack. Anomaly detection attempts to model normal behavior profile. It identifies malicious traffic based on the deviations from the normal patterns, where the normal patterns are constructed from the statistical measures of the system features (S. Mukkamala, et al., 2002). The anomaly detection techniques have the advantage of detecting unknown attacks over the misuse detection technique (E. Lundin and E. Jonsson, 2002). Several machine learning techniques including neural networks, fuzzy logic (S. Wu and W. Banzhaf, 2010), support vector machines (SVM) (S. Mukkamala, et al., 2002; S. Wu and W. Banzhaf, 2010) have been studied for the design of IDS. In particular, these techniques are developed as classifiers, which are used to classify whether the incoming network traffics are normal or an attack. This paper focuses on the Radial Basis Function (RBF) among various machine learning algorithms.
In Ghosh and Schwartzbard (1999), it is shown how neural networks can be employed for the anomaly and misuse detection. The works present an application of neural network to learn previous behavior since it can be utilized to detection of the future intrusions against systems. Experimental results indicate that neural networks are “suited to perform intrusion state of art detection and can generalize from previously observed behavior” according to the authors.
2.2 Direct Marketing
Various data mining techniques have been used to model customer response to catalogue advertising. Traditionally statistical methods such as discriminant analysis, least squares and logistic regression have been applied to response modeling.
Given the interest in this domain, there are several works that use DM to improve bank marketing campaigns (Ling and Li, 1998) (Hu, 2005) (Li et al, 2010). In particular, often these works use a classification DM approach, where the goal is to build a predictive model that can label a data item into one of several predefined classes (e.g. “yes”, “no”).
Neural Networks have also been used in response modeling. Bounds and Ross showed that neural networks could improve the response rate from 2% up to 95% (Bounds 1997). Viaene et al have also used neural networks to select input variables in response modeling (Viaene, Baesens et al. 2001). Ha et al applied bagging neural networks to propose a response model. They used dataset DMEF4 and compared this approach to Single Multilayer Perception (SMLP) and Logistic Regression (LR) in terms of fit and Performance. They could show that bagging neural network outperformed the SMLP and LR (Ha, Cho et al. 2005). Tang applied feed forward neural network to maximize performance at desired mailing depth in direct marketing in cellular phone industry. He showed that neural networks show more balance outcome than statistical models such as logistic regression and least squares regression, in terms of potential revenue and churn likelihood of a customer (Tang 2011). Bentz and Merunkay also showed that
neural networks did better than multinomial logistic regression (Bentz 2000).
2.3 Signature Verification
In the past several decades, a wide variety of approaches have been proposed to attempt to achieve the recognition system of handwritten numerals. These approaches generally fall into two categories: statistical method and syntactic method (C. Y. Suen, et al., 1992). First category includes techniques such as template matching, measurements of density of points, moments, characteristic loci, and mathematical transforms. In the second category, efforts are aimed at capturing the essential shape features of numerals, generally from their skeletons or contours. Such features include loops, endpoints, junctions, arcs, concavities and convexities, and strokes.
Suen et al.(1992) proposed four experts for the recognition of handwritten digits. In expert one, the skeleton of a character pattern was decomposed into branches. The pattern was then classified according to the features extracted from these branches. In expert two, a fast algorithm based on decision trees was used to process the more easily recognizable samples, and a relaxation process was applied to those samples that could not be uniquely classified in the first phase. In expert three, statistical data on the frequency of occurrence of features during training were stored in a database. This database was used to deduce the identification of an unknown sample. In expert four, structural features were extracted from the contours of the digits. A tree classifier was used for classification. The resulting multiple-expert system proved that the consensus of these methods tended to compensate for individual weakness, while preserving individual strengths. The high recognition rates were reported and compared favorably with the best performance in the field.
Artificial Neural Networks (ANN), due to its useful properties such as: highly parallel mechanism, excellent fault tolerance, adaptation, and self-learning, have become increasingly developed and successfully used in character recognition (A. Amin, et al., 1996 and J. Cai, et al., 1995). The key power provided by such networks is that they admit fairly simple algorithms where the form of nonlinearity that can be learned from the training data. The models are thus extremely powerful, have nice theoretical properties, and apply well to a vast array of real-world applications.
2.4 Bagging Classifiers
Breiman (1996c) showed that bagging is effective on “unstable” learning algorithms where small changes in the training set result in large changes in predictions. Breiman (1996c) claimed that neural networks and decision trees are example of unstable learning algorithms.
The boosting literature (Schapire, Freund, Bartlett, & Lee, 1997) has recently suggested (based on a few data sets with decision trees) that it is possible to further reduce the test-set error even after ten members have been added to an ensemble (and they note that this result also applies to bagging).
In this work, bagging is evaluated on real and benchmark data sets of intrusion detection, direct marketing, and signature verification in conjunction with radial basis function classifier as the base learner. The performance of the proposed bagged RBF classifier is examined in comparison with standalone RBF.
III.CLASSIFICATION METHODS
3.1 Existing Radial Basis Function Neural Network
The RBF (Oliver Buchtala et al., 2005) design involves deciding on their centers and the sharpness (standard deviation) of their Gaussians. Generally, the centres and SD (standard deviations) are decided first by examining the vectors in the training data. RBF networks are trained in a similar way as MLP. The output layer weights are trained using the delta rule. The RBF networks used here may be defined as follows.
?RBF networks have three layers of nodes: input layer, hidden layer, and output layer.
? Feed-forward connections exist between input and hidden layers, between input and output
layers (shortcut connections), and between
hidden and output layers. Additionally, there
are connections between a bias node and each
output node. A scalar weight is associated with
the connection between nodes.
? The activation of each input node (fanout) is equal to its external input where is the i th
element of the external input vector (pattern) of
the network (denotes the number of the pattern).
? Each hidden node (neuron) determines the Euclidean distance between “its own” weight
vector and the activations of the input nodes,
i.e., the external input vector the distance is
used as an input of a radial basis function in
order to determine the activation of node. Here,
Gaussian functions are employed. The
parameter of node is the radius of the basis
function; the vector is its center.
?Each output node (neuron) computes its activation as a weighted sum The external
output vector of the network, consists of the
activations of output nodes, i.e., The activation
of a hidden node is high if the current input
vector of the network is “similar” (depending
on the value of the radius) to the center of its
basis function. The center of a basis function
can, therefore, be regarded as a prototype of a
hyper spherical cluster in the input space of the
network. The radius of the cluster is given by
the value of the radius parameter.
3.2 Proposed Bagged Radial Basis Function Neural Network
Given a set D, of d tuples, bagging works as follows.
For iteration i (i =1, 2,…..k), a training set, Di, of d tuples is sampled with replacement from the original set
of tuples, D. The bootstrap sample Di, by sampling D with replacement, from the given training data set D repeatedly. Each example in the given training set D may appear repeated times or not at all in any particular replicate training data set Di. A classifier model, Mi, is learned for each training set, Di. To classify an unknown tuple, X, each classifier, Mi, returns its class prediction, which counts as one vote. The bagged RBF, M*, counts
the votes and assigns the class with the most votes to X. Algorithm:RBF ensemble classifier using bagging Input:
?D, a set of d tuples.
?k = 1, the number of models in the ensemble.
?Base Classifier (Radial Basis Function)
Output: A Bagged RBF, M*
Method:
1. for i = 1 to k do // create k models
2.
Create a bootstrap sample, D i, by
sampling D with replacement, from the
given training data set D repeatedly. Each
example in the given training set D may
appear repeated times or not at all in any
particular replicate training data set D i
3. Use D i to derive a model, M i;
4. Classify each example d in training data
D i and initialized the weight, W i for the
model, M i, based on the accuracies of
percentage of correctly classified example
in training data D i.
5. endfor
To use the bagged RBF model on a tuple, X:
1. if classification then
2. let each of the k models classify X and
return the majority vote;
3. if prediction then
4. let each of the k models predict a value for
X and return the average predicted
value;
IV.PERFORMANCE EVALUATION MEASURES
4.1 Cross Validation Technique
Cross-validation (Jiawei Han and Micheline Kamber, 2003) sometimes called rotation estimation, is a technique for assessing how the results of a statistical analysis will generalize to an independent data set. It is mainly used in settings where the goal is prediction, and one wants to estimate how accurately a predictive model
will perform in practice. 10-fold cross validation is commonly used. In stratified K-fold cross-validation, the folds are selected so that the mean response value is approximately equal in all the folds.
4.2 Criteria for Evaluation
The primary metric for evaluating classifier performance is classification Accuracy: the percentage of test samples that are correctly classified. The accuracy of a classifier refers to the ability of a given classifier to correctly predict the label of new or previously unseen data (i.e. tuples without class label information). Similarly, the accuracy of a predictor refers to how well a given predictor can guess the value of the predicted attribute for new or previously unseen data.
V.EXPERIMENTAL RESULTS AND
DISCUSSION
5.1 Intrusion Detection
5.1.1 Real world Dataset Description
The Acer07 dataset, being released for the first time is a real world data set collected from one of the sensors in Acer e-DC (Acer e-Enabling Data Center). The data used for evaluation is the inside packets from August 31, 2007 to September 7, 2007.
5.1.2 Bench Mark Dataset Description
The data used in classification is NSL-KDD, which is a new dataset for the evaluation of researches in network intrusion detection system. NSL-KDD consists of selected records of the complete KDD'99 dataset (Ira Cohen, et al., 2007). NSL-KDD dataset solve the issues of KDD'99 benchmark [KDD'99 dataset]. Each NSL-KDD connection record contains 41 features (e.g., protocol type, service, and ag) and is labeled as either normal or an attack, with one specific attack type.
5.2 Direct Marketing
5.2.1 Real world Dataset Description
The data is related with direct marketing campaigns of a Portuguese banking institution. The marketing campaigns were based on phone calls. Often, more than one contact to the same client was required, in order to access if the product (bank term deposit) would be (or not) subscribed. The classification goal is to predict if the client will subscribe a term deposit (variable y).
5.2.2 Bench Mark Dataset Description
The data includes all collective agreements reached in the business and personal services sector for locals with at least 500 members (teachers, nurses, university staff, police, etc) in Canada in 87 and first quarter of 88. Data was used to test 2 tier approach with learning from positive and negative examples.
5.3 Signature Verification
5.3.1 Real world Dataset Description
The dataset used to train and test the systems described in this paper was constructed from NIST's Special Database 3 and Special Database 1 which contain binary images of handwritten digits. NIST originally designated SD-3 as their training set and SD-1 as their test set. However, SD-3 is much cleaner and easier to recognize than SD-1. The reason for this can be found on the fact that SD-3 was collected among Census Bureau employees, while SD-1 was collected among high-school students. Drawing sensible conclusions from learning experiments requires that the result be independent of the choice of training set and test among the complete set of samples. Therefore it was necessary to build a new database by mixing NIST's datasets. 5.3.2 Bench Mark Dataset Description
The data used in classification is 10 % U.S. Zip code, which consists of selected records of the complete U.S. Zip code database. The database used to train and test the hybrid system consists of 4253 segmented numerals digitized from handwritten zip codes that appeared on U.S. mail passing through the Buffalo, NY post office. The digits were written by many different people, using a great variety of sizes, writing styles, and instruments, with widely varying amounts of care. 5.3 Experiments and Analysis 5.3.1 Intrusion Detection
5.3.1.1 Real world Dataset
The Acer07dataset is taken to evaluate the proposed bagged RBF for intrusion detection system.
TABLE 1: The Performance of Existing and Proposed Bagged
Classifier for real world dataset
Figure 1: Classification Accuracy of Existing and Proposed Bagged
RBF Classifier using Real Dataset
5.3.1.2 Bench Mark Dataset
The NSL- KDD dataset is taken to evaluate the proposed bagged RBF for intrusion detection system.
Table 2: The Performance of Existing and Proposed Bagged Classifier
for bench mark dataset
Figure 2: Classification Accuracy of Existing and Proposed Bagged
RBF Classifier using Benchmark Dataset
5.3.2 Direct Marketing
In this section, new ensemble classification method is proposed using bagging classifier and its performance is analyzed in terms of accuracy.
5.3.2.1 Real world Dataset
The bank marketing dataset is taken to evaluate the proposed bagged RBF classifier.
Table 3: The Performance of Existing and Proposed Bagged Classifier
for real world dataset
Figure 3: Classification Accuracy of Existing and Proposed Bagged
RBF Classifier using Real Dataset
Real Dataset Classifiers
Classification Accuracy
Acer07 dataset Existing RBF Classifier 99.53 % Proposed Bagged RBF Classifier
99.86 %
Bench Mark Dataset Classifiers
Classification Accuracy
NSL- KDD dataset
Existing RBF Classifier
84.74 % Proposed Bagged RBF Classifier
86.40 % Real Dataset
Classifiers
Classification Accuracy Bank Marketing
dataset
Existing RBF Classifier 71.16 % Proposed Bagged RBF 76.16 %
5.3.2.2 Bench Mark Dataset
The labor relations dataset is taken to evaluate the proposed bagged RBF classifier.
TABLE 4: The Performance of Existing and Proposed Bagged
Classifier for benchmark dataset
Figure 4: Classification Accuracy of Existing and Proposed Bagged
RBF Classifier using benchmark Dataset
5.3.3 Signature Verification
5.3.3.1 Real world Dataset
The NIST dataset are taken to evaluate the proposed bagged RBF for handwriting recognition system.
Table 5: The Performance of Existing and Proposed Bagged Classifier
for real world dataset
Real Dataset Classifiers Classification
Accuracy
NIST dataset Existing RBF Classifier
76.5 % Proposed Bagged RBF Classifier
91.8 %
Figure 5: Classification Accuracy of Existing and Proposed Bagged
RBF Classifier using Real Dataset
5.3.3.2 Bench Mark Dataset
The U.S. Zip code dataset are taken to evaluate the proposed bagged RBF for handwriting recognition system.
Table 6: Classification Accuracy of Existing and Proposed Bagged Classifier for bench mark dataset
Bench Mark Dataset Classifiers Classification Accuracy U.S. Zip
code
dataset Existing RBF Classifier 86.46 % Proposed Bagged RBF Classifier
97.74 %
Figure 6: Classification Accuracy of Existing and Proposed Bagged
RBF Classifier using benchmark Dataset
In this research work, new ensemble classification method is proposed using bagging classifier in conjunction with radial basis function classifier as the base learner and the performance is analyzed in terms of accuracy. Here, the base classifiers are constructed using radial basis function. 10-fold cross validation (Kohavi, R, 1995) technique is applied to the base classifier and evaluated classification accuracy. Bagging is performed with radial basis function classifier to obtain a very good classification performance. Table 1 to 6 shows classification performance for real and benchmark datasets of intrusion detection, direct marketing, signature verification using existing and proposed bagged radial basis function neural network. The analysis of results shows that the proposed bagged radial basis function are shown to be superior to individual approach for data mining applications in terms of classification accuracy. According to fig. 1 to 6 proposed combined model show significantly larger improvement of classification accuracy than the base classifier. This means that the combined method is more accurate than the individual method for the data mining applications.
The χ2 statistic is determined for the above approach and the critical value is found to be less than 0.455. Hence corresponding probability is p < 0.5. This is smaller than the conventionally accepted significance level of 0.05 or 5%. Thus examining a χ2 significance table, it is found that this value is significant with a degree of freedom of 1. In general, the result of χ2
Benchmark Dataset Classifiers
Classification Accuracy
Labor Relations Dataset Existing RBF Classifier
94.73 % Proposed Bagged RBF
96.34 %
statistic analysis shows that the proposed classifier is significant at p < 0.05 than the existing classifier.
VI.CONCLUSION
In this research work, a new combined classification method is proposed using bagging classifier in conjunction with radial basis function classifier as the base learner and the performance comparison has been demonstrated using real and benchmark dataset of intrusion detection, direct marketing, and signature verification in terms of accuracy. This research has clearly shown the importance of using ensemble approach for data mining applications like intrusion detection, direct marketing, and signature verification. An ensemble helps to indirectly combine the synergistic and complementary features of the different learning paradigms without any complex hybridization. Since all the considered performance measures could be optimized, such systems could be helpful in several real world data mining applications. The high classification accuracy has been achieved for the ensemble classifier compared to that of single classifier. The proposed bagged radial basis function is shown to be significantly higher improvement of classification accuracy than the base classifier. The real and benchmark dataset of intrusion detection, direct marketing, signature verification could be detected with high accuracy for homogeneous model. The future research will be directed towards developing more accurate base classifier particularly for the data mining applications.
ACKNOWLEDGMENT
Author gratefully acknowledges the authorities of Annamalai University for the facilities offered and encouragement to carry out this work.
REFERENCES
[1] A. Amin, H. B. Al-Sadoun, and S. Fischer, Hand-
printed Arabic Character Recognition System Using
An Artificial Network, Pattern Recognition, 1996,
29(4):663-675.
[2]J.P. Anderson, Computer security threat monitoring
and surveillance, Technical Report, James P.
Anderson Co., Fort Washington, PA, 1990.
[3]Bentz, Y., Merunkay, D. Neural Networks and the
Multinomial for Brand Choice Modeling, A Hybrid
Approach." Journal of Forcasting, 2000, 19(3): 177-
200.
[4] E. Biermann, E. Cloete and L.M. Venter, (2001), "A
comparison of intrusion detection Systems", Computer and Security, 2001, 20:676-683.
[5]Breiman, L. Stacked Regressions, Machine
Learning, 1996c, 24(1):49-64.
[6]Bounds, D., Ross, D. Forcasting Customer
Response with Neural Network, Handbook of
Neural Computation, 1997, G6.2: 1-7. [7]J. Cai, M. Ahmadi, and M. Shridhar, (1995),
“Recognition of Handwritten Numerals with
Multiple Feature and Multi-stage Classifier”,
Pattern Recognition, 1995, 28(2):153-160.
[8]Ghosh AK, Schwartzbard A. A study in using
neural networks for anomaly and misuse detection.
In: The proceeding on the 8th USENIX security
symposium,
https://www.doczj.com/doc/c812335628.html,/context/1170861/0,1999. [9]Ha, k., S. Cho, et al. Response Models Based on
Bagging Neural Networks, Journal of Interactive
Marketing, 2005,19: 17-30
[10]Heady R, Luger G, Maccabe A, Servilla M. The
architecture of a network level intrusion detection
system. Technical Report, Department of Computer
Science, University of New Mexico, 1990.
[11]T.K.Ho, J.J.Hull, and S.N.Srihari, Combination of
Structural Classifiers, in Proc. IAPR Workshop
Syntatic and Structural Pattern Recog., 1990, 123-
137.
[12]Hu, X. A data mining approach for retailing bank
customer attrition analysis, Applied Intelligence,
2005, 22(1):47-60.
[13]K. Ilgun, R.A. Kemmerer and P.A. Porras. State
transition analysis:A rule-based intrusion detection
approach, IEEE Trans. Software Eng, 1995, 21:181-
199.
[14]Ira Cohen, Qi Tian, Xiang Sean Zhou and Thoms
S.Huang, Feature Selection Using Principal Feature
Analysis, In Proceedings of the 15th international
conference on Multimedia, Augsburg, Germany,
September 2007, 25-29.
[15]Jiawei Han, Micheline Kamber. Data Mining –
Concepts and Techniques, Elsevier Publications,
2003.
[16]Kohavi, R. A study of cross-validation and
bootstrap for accuracy estimation and model
selection, Proceedings of International Joint
Conference on Artificial Intelligence, 1995, 1137–
1143.
[17]Li, W., Wu, X., Sun, Y. and Zhang, Q., Credit Card
Customer Segmentation and Target Marketing
Based on Data Mining, In Proceedings of
International Conference on Computational Intelligence and Security, 2010, 73-76.
[18]Ling, X. and Li, C., Data Mining for Direct
Marketing: Problems and Solutions. In Proceedings
of the 4th KDD conference, AAAI Press, 1998,
73–79.
[19]E. Lundin and E. Jonsson. Anomaly-based intrusion
detection: privacy concerns and other problems,
Computer Networks, 2002, 34: 623-640.
[20]D. Marchette. A statistical method for profiling
network traffic. In proceedings of the First USENIX
Workshop on Intrusion Detection and Network
Monitoring (Santa Clara), CA. 1999: 119-128. [21]Mukkamala S, Sung AH, Abraham A. Intrusion
detection using ensemble of soft computing
paradigms, third international conference on
intelligent systems design and applications,
intelligent systems design and applications, advances in soft computing. Germany: Springer; 2003:239–48.
[22] Mukkamala S, Sung AH, Abraham A. Modeling
intrusion detection systems using linear genetic programming approach, The 17th international conference on industrial & engineering applications of artificial intelligence and expert systems, innovations in applied artificial intelligence. In: Robert O., Chunsheng Y., Moonis A., editors. Lecture Notes in Computer Science, vol. 3029. Germany: Springer, 2004a: 633–42.
[23] Mukkamala S, Sung AH, Abraham A, Ramos V.
Intrusion detection systems using adaptive regression splines. In: Seruca I, Filipe J, Hammoudi S, Cordeiro J, editors. Proceedings of the 6th international conference on enterprise information systems, ICEIS’04, vol. 3, Portugal, 2004b: 26–33. [24] S. Mukkamala, G. Janoski and A.Sung. Intrusion
detection: support vector machines and neural networks, In proceedings of the IEEE International Joint Conference on Neural Networks (ANNIE), St. Louis, MO, 2002, 1702-1707.
[25] Oliver Buchtala, Manuel Klimek, and Bernhard
Sick, Member, IEEE , Evolutionary Optimization of Radial Basis Function Classifiers for Data Mining Applications, IEEE Transactions on systems, man, and cybernetics—part b: cybernetics, 2005, 35(5). [26] Schapire, R., Freund, Y., Bartlett, P., and Lee, W.
Boosting the margin: A new explanation for the effectives of voting methods. In proceedings of the fourteenth International Conference on Machine Learning, Nashville, TN, 1997, 322-330.
[27] Shah K, Dave N, Chavan S, Mukherjee S, Abraham
A, Sanyal S. Adaptive neuro-fuzzy intrusion detection system. IEEE International Conference on Information Technology: Coding and Computing (ITCC’04), USA: IEEE Computer Society, 2004, (1):70–74.
[28] T. Shon and J. Moon. A hybrid machine learning
approach to network anomaly detection, Information Sciences, 2007, (177):3799-3821.
[29] C.Y.Suen, C.Nadal, T.A.Mai, R.Legault, and https://www.doczj.com/doc/c812335628.html,m.
Recognition of totally unconstrained handwritten numerals based on the concept of multiple experts, Frontiers in Handwriting Recognition , C.Y.Suen, Ed., IN Proc.Int.Workshop on Frontiers in Handwriting Recognition, Montreal, Canada, Apr. 2-3, 1990, 131-143.
[30] C. Y. Suen, C. Nadal, R. Legault, T. A. Mai, and L.
Lam. Computer recognition of unconstrained handwritten numerals,” Proc. IEEE, 1992, (80):1162–1180.
[31] Summers RC. Secure computing: threats and
safeguards. New York, McGraw-Hill, 1997.
[32] Sundaram A. An introduction to intrusion detection.
ACM Cross Roads, 1996, 2(4).
[33] W. Stallings. Cryptography and network security
principles and practices, USA: Prentice Hall, 2006.
[34] Tang, Z. Improving Direct Marketing Profitability
with Neural Networks. International Journal of Computer Applications, 2011, 29(5): 13-18.
[35] C. Tsai, Y. Hsu, C. Lin and W. Lin. Intrusion
detection by machine learning: A review, Expert Systems with Applications, 2009, (36):11994-12000. [36] T. Verwoerd and R. Hunt. Intrusion detection
techniques and approaches, Computer Communications, 2002, (25):1356-1365.
[37] Viaene, S., B. Baesens, et al. Wrapped Input
Selection Using Multilayer Perceptrons for Repeat-Purchase Modeling in Direct Marketing, International Journal of Intelligent Systems in Accounting, Finance and Management, 2001, 10(2): 115-126.
[38] S. Wu and W. Banzhaf. The use of computational
intelligence in intrusion detection systems: A review, Applied Soft Computing, 2010, (10):1-35.
https://www.doczj.com/doc/c812335628.html,indarajan received the B.E and M.E and Ph.D Degree in Computer Science and Engineering from Annamalai University, Tamil Nadu, India in 2001 and 2005 and 2010 respectively. He did his post-doctoral research in the Department of Computing, Faculty of
Engineering and Physical Sciences, University of Surrey, Guildford, Surrey, United Kingdom in 2011 and pursuing Doctor of Science at Utkal University, orissa, India. He is currently an Assistant Professor at the Department of Computer Science and Engineering, Annamalai University, Tamil Nadu, India. He has presented and published more than 75 papers at Conferences and Journals and also received best paper awards. He has delivered invited talks at various national and international conferences. His current Research Interests include Data Mining and its applications, Web Mining, Text Mining, and Sentiment Mining. He was the recipient of the Achievement Award for the field and to the Conference Bio-Engineering, Computer science, Knowledge Mining (2006), Prague, Czech Republic, Career Award for Young Teachers (2006), All India Council for Technical Education, New Delhi, India and Young Scientist International Travel Award (2012), Department of Science and Technology, Government of India New Delhi. He is Young Scientists awardee under Fast Track Scheme (2013), Department of Science and Technology, Government of India, New Delhi and also granted Young Scientist Fellowship (2013), Tamil Nadu State Council for Science and Technology, Government of Tamil Nadu, Chennai. He has visited countries like Czech Republic, Austria, Thailand, United Kingdom, Malaysia, U.S.A, and Singapore. He is an active Member of various professional bodies and Editorial Board Member of various conferences and journals.
数据挖掘整理（熊熊整理-----献给梦中的天涯） 单选题 1．下面哪种分类方法是属于神经网络学习算法？（） A. 判定树归纳 B. 贝叶斯分类 C. 后向传播分类 D. 基于案例的推理 2．置信度(confidence)是衡量兴趣度度量（ A ）的指标。 A、简洁性 B、确定性 C.、实用性 D、新颖性 3．用户有一种感兴趣的模式并且希望在数据集中找到相似的模式，属于数据挖掘哪一类任务？(A) A. 根据内容检索 B. 建模描述 C. 预测建模 D. 寻找模式和规则 4．数据归约的目的是（） A、填补数据种的空缺值 B、集成多个数据源的数据 C、得到数据集的压缩表示 D、规范化数据 5．下面哪种数据预处理技术可以用来平滑数据，消除数据噪声？ A.数据清理 B.数据集成 C.数据变换 D.数据归约 6．假设12个销售价格记录组已经排序如下：5, 10, 11, 13, 15, 35, 50, 55, 72, 92, 204, 215 使用如下每种方法将它们划分成四个箱。等频（等深）划分时，15在第几个箱子内？(B) A 第一个 B 第二个 C 第三个 D 第四个 7．下面的数据操作中，（）操作不是多维数据模型上的OLAP操作。 A、上卷(roll-up) B、选择(select) C、切片(slice) D、转轴(pivot) 8．关于OLAP和OLTP的区别描述,不正确的是: (C) A. OLAP主要是关于如何理解聚集的大量不同的数据.它与OTAP应用程序不同. B. 与OLAP应用程序不同,OLTP应用程序包含大量相对简单的事务. C. OLAP的特点在于事务量大,但事务内容比较简单且重复率高. D. OLAP是以数据仓库为基础的,但其最终数据来源与OLTP一样均来自底层的数据库系统,两者面对的用户是相同的 9．下列哪个描述是正确的？（） A、分类和聚类都是有指导的学习 B、分类和聚类都是无指导的学习
数据挖掘分类算法比较 分类是数据挖掘、机器学习和模式识别中一个重要的研究领域。通过对当前数据挖掘中具有代表性的优秀分类算法进行分析和比较，总结出了各种算法的特性，为使用者选择算法或研究者改进算法提供了依据。 一、决策树（Decision Trees） 决策树的优点： 1、决策树易于理解和解释.人们在通过解释后都有能力去理解决策树所表达的意义。 2、对于决策树，数据的准备往往是简单或者是不必要的.其他的技术往往要求先把数据一般化，比如去掉多余的或者空白的属性。 3、能够同时处理数据型和常规型属性。其他的技术往往要求数据属性的单一。 4、决策树是一个白盒模型。如果给定一个观察的模型，那么根据所产生的决策树很容易推出相应的逻辑表达式。 5、易于通过静态测试来对模型进行评测。表示有可能测量该模型的可信度。 6、在相对短的时间内能够对大型数据源做出可行且效果良好的结果。 7、可以对有许多属性的数据集构造决策树。 8、决策树可很好地扩展到大型数据库中，同时它的大小独立于数据库的大小。 决策树的缺点： 1、对于那些各类别样本数量不一致的数据，在决策树当中,信息增益的结果偏向于那些具有更多数值的特征。 2、决策树处理缺失数据时的困难。 3、过度拟合问题的出现。 4、忽略数据集中属性之间的相关性。 二、人工神经网络 人工神经网络的优点：分类的准确度高,并行分布处理能力强,分布存储及学习能力强，对噪声神经有较强的鲁棒性和容错能力，能充分逼近复杂的非线性关系，具备联想记忆的功能等。 人工神经网络的缺点：神经网络需要大量的参数，如网络拓扑结构、权值和阈值的初始值；不能观察之间的学习过程，输出结果难以解释，会影响到结果的可信度和可接受程度；学习时间过长,甚至可能达不到学习的目的。
分类技术在很多领域都有应用，例如可以通过客户分类构造一个分类模型来对银行贷款进行风险评估；当前的市场营销中很重要的一个特点是强调客户细分。客户类别分析的功能也在于此，采用数据挖掘中的分类技术，可以将客户分成不同的类别，比如呼叫中心设计时可以分为：呼叫频繁的客户、偶然大量呼叫的客户、稳定呼叫的客户、其他，帮助呼叫中心寻找出这些不同种类客户之间的特征，这样的分类模型可以让用户了解不同行为类别客户的分布特征；其他分类应用如文献检索和搜索引擎中的自动文本分类技术；安全领域有基于分类技术的入侵检测等等。机器学习、专家系统、统计学和神经网络等领域的研究人员已经提出了许多具体的分类预测方法。下面对分类流程作个简要描述： 训练：训练集——>特征选取——>训练——>分类器 分类：新样本——>特征选取——>分类——>判决 最初的数据挖掘分类应用大多都是在这些方法及基于内存基础上所构造的算法。目前数据挖掘方法都要求具有基于外存以处理大规模数据集合能力且具有可扩展能力。 神经网络 神经网络是解决分类问题的一种行之有效的方法。神经网络是一组连接输入/输出单元的系统，每个连接都与一个权值相对应，在将简单的单元连接成较复杂的系统后，通过并行运算实现其功能，其中系统的知识存储于网络结构和各单元之间的连接权中。在学习阶段，通过调整神经网络的权值，达到对输入样本的正确分类。神经网络有对噪声数据的高承受能力和对未经训练数据的模式分类能力。神经网
络概括性强、分类精度高，可以实现有监督和无监督的分类任务，所以神经网络在分类中应用非常广泛。 在结构上，可以把一个神经网络划分为输入层、输出层和隐含层（见图4）。网络的每一个输入节点对应样本一个特征，而输出层节点数可以等于类别数，也可以只有一个，（输入层的每个节点对应一个个的预测变量。输出层的节点对应目标变量，可有多个）。在输入层和输出层之间是隐含层（对神经网络使用者来说不可见），隐含层的层数和每层节点的个数决定了神经网络的复杂度。 除了输入层的节点，神经网络的每个节点都与很多它前面的节点（称为此节点的输入节点）连接在一起，每个连接对应一个权重Wxy，此节点的值就是通过它所有输入节点的值与对应连接权重乘积的和作为一个函数的输入而得到，我们把这个函数称为活动函数或挤压函数。如图5中节点4输出到节点6的值可通过如下计算得到：
全面解析数据挖掘的分类及各种分析方法 1.数据挖掘能做以下六种不同事情（分析方法）： ?分类（Classification） ?估值（Estimation） ?预言（Prediction） ?相关性分组或关联规则（Affinitygroupingorassociationrules） ?聚集（Clustering） ?描述和可视化（DescriptionandVisualization） ?复杂数据类型挖掘(Text,Web,图形图像，视频，音频等) 2.数据挖掘分类 以上六种数据挖掘的分析方法可以分为两类：直接数据挖掘；间接数据挖掘?直接数据挖掘 目标是利用可用的数据建立一个模型，这个模型对剩余的数据，对一个特定的变量（可以理解成数据库中表的属性，即列）进行描述。 ?间接数据挖掘 目标中没有选出某一具体的变量，用模型进行描述；而是在所有的变量中建立起某种关系。 ?分类、估值、预言属于直接数据挖掘；后三种属于间接数据挖掘 3.各种分析方法的简介 ?分类（Classification） 首先从数据中选出已经分好类的训练集，在该训练集上运用数据挖掘分类的技术，建立分类模型，对于没有分类的数据进行分类。 例子： a.信用卡申请者，分类为低、中、高风险 b.分配客户到预先定义的客户分片 注意：类的个数是确定的，预先定义好的 ?估值（Estimation） 估值与分类类似，不同之处在于，分类描述的是离散型变量的输出，而估值处理连续值的输出；分类的类别是确定数目的，估值的量是不确定的。 例子： a.根据购买模式，估计一个家庭的孩子个数 b.根据购买模式，估计一个家庭的收入 c.估计realestate的价值
数据挖掘常用的方法 在大数据时代，数据挖掘是最关键的工作。大数据的挖掘是从海量、不完全的、有噪 声的、模糊的、随机的大型数据库中发现隐含在其中有价值的、潜在有用的信息和知 识的过程，也是一种决策支持过程。其主要基于人工智能，机器学习，模式学习，统 计学等。通过对大数据高度自动化地分析，做出归纳性的推理，从中挖掘出潜在的模式，可以帮助企业、商家、用户调整市场政策、减少风险、理性面对市场，并做出正 确的决策。目前，在很多领域尤其是在商业领域如银行、电信、电商等，数据挖掘可 以解决很多问题，包括市场营销策略制定、背景分析、企业管理危机等。大数据的挖 掘常用的方法有分类、回归分析、聚类、关联规则、神经网络方法、Web 数据挖掘等。这些方法从不同的角度对数据进行挖掘。 (1)分类。分类是找出数据库中的一组数据对象的共同特点并按照分类模式将其划分为不同的类，其目的是通过分类模型，将数据库中的数据项映射到摸个给定的类别中。 可以应用到涉及到应用分类、趋势预测中，如淘宝商铺将用户在一段时间内的购买情 况划分成不同的类，根据情况向用户推荐关联类的商品，从而增加商铺的销售量。 (2)回归分析。回归分析反映了数据库中数据的属性值的特性，通过函数表达数据映射的关系来发现属性值之间的依赖关系。它可以应用到对数据序列的预测及相关关系的 研究中去。在市场营销中，回归分析可以被应用到各个方面。如通过对本季度销售的 回归分析，对下一季度的销售趋势作出预测并做出针对性的营销改变。 (3)聚类。聚类类似于分类，但与分类的目的不同，是针对数据的相似性和差异性将一组数据分为几个类别。属于同一类别的数据间的相似性很大，但不同类别之间数据的 相似性很小，跨类的数据关联性很低。 (4)关联规则。关联规则是隐藏在数据项之间的关联或相互关系，即可以根据一个数据项的出现推导出其他数据项的出现。关联规则的挖掘过程主要包括两个阶段：第一阶 段为从海量原始数据中找出所有的高频项目组;第二极端为从这些高频项目组产生关联规则。关联规则挖掘技术已经被广泛应用于金融行业企业中用以预测客户的需求，各 银行在自己的ATM 机上通过捆绑客户可能感兴趣的信息供用户了解并获取相应信息来改善自身的营销。 (5)神经网络方法。神经网络作为一种先进的人工智能技术，因其自身自行处理、分布存储和高度容错等特性非常适合处理非线性的以及那些以模糊、不完整、不严密的知 识或数据为特征的处理问题，它的这一特点十分适合解决数据挖掘的问题。典型的神 经网络模型主要分为三大类：第一类是以用于分类预测和模式识别的前馈式神经网络 模型，其主要代表为函数型网络、感知机;第二类是用于联想记忆和优化算法的反馈式神经网络模型，以Hopfield 的离散模型和连续模型为代表。第三类是用于聚类的自组
《数据挖掘分类实验报告》 信息安全科学与工程学院 1120362066 尹雪蓉数据挖掘分类过程 （1）数据分析介绍 本次实验为典型的分类实验，为了便于说明问题，弄清数据挖掘具体流程，我们小组选择了最经典的决策树算法进行具体挖掘实验。 （2）数据准备与预处理 在进行数据挖掘之前，我们首先要对需要挖掘的样本数据进行预处理，预处理包括以下步骤： 1、数据准备，格式统一。将样本转化为等维的数据特征（特征提取），让所有的样 本具有相同数量的特征，同时兼顾特征的全面性和独立性 2、选择与类别相关的特征（特征选择） 3、建立数据训练集和测试集 4、对数据集进行数据清理 在本次实验中，我们选择了ILPD (Indian Liver Patient Dataset) 这个数据集，该数据集已经具有等维的数据特征，主要包括Age、Gender、TB、DB、Alkphos、Sgpt、Sgot、TP、ALB、A/G、classical，一共11个维度的数据特征，其中与分类类别相关的特征为classical，它的类别有1,2两个值。 详见下表： 本实验的主要思路是将该数据集分成训练集和测试集，对训练集进行训练生成模型，然后再根据模型对测试集进行预测。 数据集处理实验详细过程：
●CSV数据源处理 由于下载的原始数据集文件Indian Liver Patient Dataset (ILPD).csv（见下图）中间并不包含属性项，这不利于之后分类的实验操作，所以要对该文件进行处理，使用Notepad文件，手动将属性行添加到文件首行即可。 ●平台数据集格式转换 在后面数据挖掘的实验过程中，我们需要借助开源数据挖掘平台工具软件weka，该平台使用的数据集格式为arff，因此为了便于实验，在这里我们要对csv文件进行格式转换，转换工具为weka自带工具。转换过程为： 1、打开weka平台，点击”Simple CLI“，进入weka命令行界面，如下图所示： 2、输入命令将csv文件导成arff文件，如下图所示: 3、得到arff文件如下图所示： 内容如下：
朴素贝叶斯： 有以下几个地方需要注意： 1. 如果给出的特征向量长度可能不同，这是需要归一化为通长度的向量（这里以文本分类为例），比如说是句子单词的话，则长度为整个词汇量的长度，对应位置是该单词出现的次数。 2. 计算公式如下： 其中一项条件概率可以通过朴素贝叶斯条件独立展开。要注意一点就是的计算方法，而由朴素贝叶斯的前提假设可知， = ，因此一般有两种，一种是在类别为ci的那些样本集中，找到wj出现次数的总和，然后除以该样本的总和；第二种方法是类别为ci的那些样本集中，找到wj出现次数的总和，然后除以该样本中所有特征出现次数的总和。 3. 如果中的某一项为0，则其联合概率的乘积也可能为0，即2中公式的分子为0，为了避免这种现象出现，一般情况下会将这一项初始化为1，当然为了保证概率相等，分母应对应初始化为2（这里因为是2类，所以加2，如果是k类就需要加k，术语上叫做laplace 光滑, 分母加k的原因是使之满足全概率公式）。 朴素贝叶斯的优点： 对小规模的数据表现很好，适合多分类任务，适合增量式训练。 缺点： 对输入数据的表达形式很敏感。 决策树： 决策树中很重要的一点就是选择一个属性进行分枝，因此要注意一下信息增益的计算公式，并深入理解它。 信息熵的计算公式如下:
其中的n代表有n个分类类别（比如假设是2类问题，那么n=2）。分别计算这2类样本在总样本中出现的概率p1和p2，这样就可以计算出未选中属性分枝前的信息熵。 现在选中一个属性xi用来进行分枝，此时分枝规则是：如果xi=vx的话，将样本分到树的一个分支；如果不相等则进入另一个分支。很显然，分支中的样本很有可能包括2个类别，分别计算这2个分支的熵H1和H2,计算出分枝后的总信息熵H’=p1*H1+p2*H2.，则此时的信息增益ΔH=H-H’。以信息增益为原则，把所有的属性都测试一边，选择一个使增益最大的属性作为本次分枝属性。 决策树的优点： 计算量简单，可解释性强，比较适合处理有缺失属性值的样本，能够处理不相关的特征； 缺点： 容易过拟合（后续出现了随机森林，减小了过拟合现象）； Logistic回归： Logistic是用来分类的，是一种线性分类器，需要注意的地方有： 1. logistic函数表达式为： 其导数形式为： 2. logsitc回归方法主要是用最大似然估计来学习的，所以单个样本的后验概率为： 到整个样本的后验概率：
国际权威的学术组织the IEEE International Conference on Data Mining (ICDM) 2006年12月评选出了数据挖掘领域的十大经典算法：C4.5, k-Means, SVM, Apriori, EM, PageRank, AdaBoost, kNN, Naive Bayes, and CART. 不仅仅是选中的十大算法，其实参加评选的18种算法，实际上随便拿出一种来都可以称得上是经典算法，它们在数据挖掘领域都产生了极为深远的影响。 1. C4.5 C4.5算法是机器学习算法中的一种分类决策树算法,其核心算法是ID3算法. C4.5算法继承了ID3算法的优点，并在以下几方面对ID3算法进行了改进： 1) 用信息增益率来选择属性，克服了用信息增益选择属性时偏向选择取值多的属性的不足； 2) 在树构造过程中进行剪枝； 3) 能够完成对连续属性的离散化处理； 4) 能够对不完整数据进行处理。 C4.5算法有如下优点：产生的分类规则易于理解，准确率较高。其缺点是：在构造树的过程中，需要对数据集进行多次的顺序扫描和排序，因而导致算法的低效。 2. The k-means algorithm 即K-Means算法 k-means algorithm算法是一个聚类算法，把n的对象根据他们的属性分为k个分割，k < n。它与处理混合正态分布的最大期望算法很相似，因为他们都试图找到数据中自然聚类的中心。它假设对象属性来自于空间向量，并且目标是使各个群组内部的均方误差总和最小。 3. Support vector machines 支持向量机，英文为Support Vector Machine，简称SV机（论文中一般简称SVM）。它是一种監督式學習的方法，它广泛的应用于统计分类以及回归分析中。支持向量机将向量映射到一个更高维的空间里，在这个空间里建立有一个最大间隔超平面。在分开数据的超平面的两边建有两个互相平行的超平面。分隔超平面使两个平行超平面的距离最大化。假定平行超平面间的距离或差距越大，分类器的总误差越小。一个极好的指南是C.J.C Burges的《模式识别支持向量机指南》。van der Walt 和 Barnard 将支持向量机和其他分类器进行了
一、实验目的 使用数据挖掘中的分类算法，对数据集进行分类训练并测试。应用不同的分类算法，比较他们之间的不同。与此同时了解Weka平台的基本功能与使用方法。 二、实验环境 实验采用Weka 平台，数据使用Weka安装目录下data文件夹下的默认数据集。 Weka是怀卡托智能分析系统的缩写，该系统由新西兰怀卡托大学开发。Weka使用Java 写成的，并且限制在GNU通用公共证书的条件下发布。它可以运行于几乎所有操作平台，是一款免费的，非商业化的机器学习以及数据挖掘软件。Weka提供了一个统一界面，可结合预处理以及后处理方法，将许多不同的学习算法应用于任何所给的数据集，并评估由不同的学习方案所得出的结果。 三、数据预处理 Weka平台支持ARFF格式和CSV格式的数据。由于本次使用平台自带的ARFF格式数据，所以不存在格式转换的过程。实验所用的ARFF格式数据集如图1所示 图1 ARFF格式数据集 对于iris数据集，它包含了150个实例（每个分类包含50个实例），共有sepal length、
sepal width、petal length、petal width和class五种属性。期中前四种属性为数值类型，class属性为分类属性，表示实例所对应的的类别。该数据集中的全部实例共可分为三类：Iris Setosa、Iris Versicolour和Iris Virginica。 实验数据集中所有的数据都是实验所需的，因此不存在属性筛选的问题。若所采用的数据集中存在大量的与实验无关的属性，则需要使用weka平台的Filter(过滤器)实现属性的筛选。 实验所需的训练集和测试集均为。 四、实验过程及结果 应用iris数据集，分别采用LibSVM、决策树分类器和朴素贝叶斯分类器进行测试和评价，分别在训练数据上训练出分类模型，找出各个模型最优的参数值，并对三个模型进行全面评价比较，得到一个最好的分类模型以及该模型所有设置的最优参数。最后使用这些参数以及训练集和校验集数据一起构造出一个最优分类器，并利用该分类器对测试数据进行预测。 1、LibSVM分类 Weka 平台内部没有集成libSVM分类器，要使用该分类器，需要下载并导入到Weka中。 用“Explorer”打开数据集“”，并在Explorer中将功能面板切换到“Classify”。点“Choose”按钮选择“functions，选择LibSVM分类算法。 在Test Options 面板中选择Cross-Validatioin folds=10，即十折交叉验证。然后点击“start”按钮：
数据挖掘中的文本挖掘的分类算法综述 摘要 随着Internet上文档信息的迅猛发展，文本分类成为处理和组织大量文档数据的关键技术。本文首先对数据挖掘进行了概述包括数据挖掘的常用方法、功能以及存在的主要问题；其次对数据挖掘领域较为活跃的文本挖掘的历史演化、研究现状、主要内容、相关技术以及热点难点问题进行了探讨；在第三章先分析了文本分类的现状和相关问题，随后详细介绍了常用的文本分类算法，包括KNN 文本分类算法、特征选择方法、支持向量机文本分类算法和朴素贝叶斯文本分类算法；；第四章对KNN文本分类算法进行深入的研究，包括基于统计和LSA降维的KNN文本分类算法；第五章对数据挖掘、文本挖掘和文本分类的在信息领域以及商业领域的应用做了详细的预测分析；最后对全文工作进行了总结和展望。 关键词：数据挖掘，文本挖掘，文本分类算法 ABSTRACT With the development of Web 2.0, the number of documents on the Internet increases exponentially. One important research focus on how to deal with these great capacity of online documents. Text classification is one crucial part of information management. In this paper we first introduce the basic information of data mining, including the methods, contents and the main existing problems in data mining fields; then we discussed the text mining, one active field of data mining, to provide a basic foundation for text classification. And several common algorithms are analyzed in Chapter 3. In chapter 4 thorough research of KNN text classification algorithms are illustrated including the statistical and dimension reduction based on LSA and in chapter 5 we make some predictions for data mining, text mining and text classification and finally we conclude our work. KEYWORDS： data mining, text mining, text classification algorithms，KNN 目录 摘要 (1) ABSTRACT (1) 目录 (1)
数据挖掘之七种常用的方法 利用数据挖掘进行数据分析常用的方法主要有分类、回归分析、聚类、关联规则、特征、变化和偏差分析、Web页挖掘等，它们分别从不同的角度对数据 进行挖掘。 1.分类 分类是找出数据库中一组数据对象的共同特点并按照分类模式将其划分为 不同的类，其目的是通过分类模型，将数据库中的数据项映射到某个给定的类别。 它可以应用到客户的分类、客户的属性和特征分析、客户满意度分析、客户的购买趋势预测等，如一个汽车零售商将客户按照对汽车的喜好划分成不同的类，这样营销人员就可以将新型汽车的广告手册直接邮寄到有这种喜好的客户手中，从而大大增加了商业机会。 2.回归分析 回归分析方法反映的是事务数据库中属性值在时间上的特征，产生一个将数据项映射到一个实值预测变量的函数，发现变量或属性间的依赖关系，其主要研究问题包括数据序列的趋势特征、数据序列的预测以及数据间的相关关系等。 它可以应用到市场营销的各个方面，如客户寻求、保持和预防客户流失活动、产品生命周期分析、销售趋势预测及有针对性的促销活动等。 3.聚类 聚类分析是把一组数据按照相似性和差异性分为几个类别，其目的是使得属于同一类别的数据间的相似性尽可能大，不同类别中的数据间的相似性尽可能小。 它可以应用到客户群体的分类、客户背景分析、客户购买趋势预测、市场的细分等。 4.关联规则 关联规则是描述数据库中数据项之间所存在的关系的规则，即根据一个事务中某些项的出现可导出另一些项在同一事务中也出现，即隐藏在数据间的关联或相互关系。 在客户关系管理中，通过对企业的客户数据库里的大量数据进行挖掘，可以从大量的记录中发现有趣的关联关系，找出影响市场营销效果的关键因素，为产品定位、定价与定制客户群，客户寻求、细分与保持，市场营销与推销，营销风险评估和诈骗预测等决策支持提供参考依据。 5.特征 特征分析是从数据库中的一组数据中提取出关于这些数据的特征式，这些特征式表达了该数据集的总体特征。如营销人员通过对客户流失因素的特征提取，可以得到导致客户流失的一系列原因和主要特征，利用这些特征可以有效地预防客户的流失。
《数据挖掘》总复习题 1．数据挖掘系统可以根据什么标准进行分类？ 答：根据挖掘的数据库类型分类、根据挖掘的知识类型分类、根据挖掘所用的技术分类、根据应用分类 2．知识发现过程包括哪些步骤？ 答：数据清理、数据集成、数据选择、数据变换、数据挖掘、模式评估、知识表示 3．什么是概念分层？ 答：一个映射序列，将低层概念映射到更一般的较高层概念。 4．多维数据模型上的 OLAP 操作包括哪些？ 答：上卷、下钻、切片和切块、转轴 / 旋转、其他OLAP操作5．OLAP 服务器类型有哪几种？ 答：关系OLAP 服务器(ROLAP)、多维OLAP 服务器(MOLAP)、混合 OLAP 服务器 (HOLAP)、特殊的 SQL 服务器 6．数据预处理技术包括哪些？ 答：聚集、抽样、维规约、特征子集选择、特征创建、离散化和二元化、变量变换。 7．什么是数据清理？ 答：填写缺失的值，平滑噪声数据，识别、删除离群点，解决不一致性 8．什么是数据集成？ 答：集成多个数据库、数据立方体或文件 9．什么是数据归约？ 答：得到数据集的压缩表示，它小得多，但可以得到相同或相近的结果 10．数据清理的内容包括哪些？ 答：缺失值、噪声数据、数据平滑、聚类、回归 11.将下列缩略语复原 OLAP——on-line analytical processing DM——data mining KDD——knowledge discovery in databases OLTP——on-line transaction processing DBMS——database management system DWT——discrete wavelet transform （DMQL）－－Data Mining Query Language 12．什么是数据挖掘？ 答：简单地说，数据挖掘是从大量数据中提取或挖掘知识。具体地
大数据理论与技术读书报告 -----K最近邻分类算法 指导老师 : 陈莉 学生姓名 : 李阳帆 学号 : 201531467 专业 : 计算机技术 日期 : 2016年8月31日
摘要 数据挖掘是机器学习领域内广泛研究的知识领域，是将人工智能技术和数据库技术紧密结合，让计算机帮助人们从庞大的数据中智能地、自动地提取出有价值的知识模式，以满足人们不同应用的需要。K 近邻算法（KNN）是基于统计的分类方法，是大数据理论与分析的分类算法中比较常用的一种方法。该算法具有直观、无需先验统计知识、无师学习等特点，目前已经成为数据挖掘技术的理论和应用研究方法之一。本文主要研究了 K 近邻分类算法，首先简要地介绍了数据挖掘中的各种分类算法，详细地阐述了K 近邻算法的基本原理和应用领域，最后在matlab环境里仿真实现，并对实验结果进行分析，提出了改进的方法。 关键词：K 近邻，聚类算法，权重，复杂度，准确度
1.引言 (1) 2.研究目的与意义 (1) 3.算法思想 (2) 4.算法实现 (2) 4.1 参数设置 (2) 4.2数据集 (2) 4.3实验步骤 (3) 4.4实验结果与分析 (3) 5.总结与反思 (4) 附件1 (6)
1.引言 随着数据库技术的飞速发展，人工智能领域的一个分支—— 机器学习的研究自 20 世纪 50 年代开始以来也取得了很大进展。用数据库管理系统来存储数据，用机器学习的方法来分析数据，挖掘大量数据背后的知识，这两者的结合促成了数据库中的知识发现（Knowledge Discovery in Databases，简记 KDD）的产生，也称作数据挖掘（Data Ming，简记 DM）。 数据挖掘是信息技术自然演化的结果。信息技术的发展大致可以描述为如下的过程：初期的是简单的数据收集和数据库的构造；后来发展到对数据的管理，包括：数据存储、检索以及数据库事务处理；再后来发展到对数据的分析和理解， 这时候出现了数据仓库技术和数据挖掘技术。数据挖掘是涉及数据库和人工智能等学科的一门当前相当活跃的研究领域。 数据挖掘是机器学习领域内广泛研究的知识领域，是将人工智能技术和数据库技术紧密结合，让计算机帮助人们从庞大的数据中智能地、自动地抽取出有价值的知识模式，以满足人们不同应用的需要[1]。目前，数据挖掘已经成为一个具有迫切实现需要的很有前途的热点研究课题。 2.研究目的与意义 近邻方法是在一组历史数据记录中寻找一个或者若干个与当前记录最相似的历史纪录的已知特征值来预测当前记录的未知或遗失特征值[14]。近邻方法是数据挖掘分类算法中比较常用的一种方法。K 近邻算法（简称 KNN）是基于统计的分类方法[15]。KNN 分类算法根据待识样本在特征空间中 K 个最近邻样本中的多数样本的类别来进行分类，因此具有直观、无需先验统计知识、无师学习等特点，从而成为非参数分类的一种重要方法。 大多数分类方法是基于向量空间模型的。当前在分类方法中，对任意两个向量： x= ) ,..., , ( 2 1x x x n和) ,..., , (' ' 2 ' 1 'x x x x n 存在 3 种最通用的距离度量：欧氏距离、余弦距 离[16]和内积[17]。有两种常用的分类策略：一种是计算待分类向量到所有训练集中的向量间的距离：如 K 近邻选择K个距离最小的向量然后进行综合，以决定其类别。另一种是用训练集中的向量构成类别向量，仅计算待分类向量到所有类别向量的距离，选择一个距离最小的类别向量决定类别的归属。很明显，距离计算在分类中起关键作用。由于以上 3 种距离度量不涉及向量的特征之间的关系，这使得距离的计算不精确，从而影响分类的效果。
《数据挖掘论文》 数据挖掘分类方法及其应用 课程名称：数据挖掘概念与技术 姓名 学号： 指导教师： 数据挖掘分类方法及其应用 作者：来煜 摘要：社会的发展进入了网络信息时代，各种形式的数据海量产生，在这些数据的背后隐藏这许多重要的信息，如何从这些数据中找出某种规律，发现有用信息，越来越受到关注。为了适应信息处理新需求和社会发展各方面的迫切需要而发展起来一种新的信息分析技术，这种局势称为数据挖掘。分类技术是数据挖掘中应用领域极其广泛的重要技术之一。各种分类算法有其自身的优劣，适合于不同的领域。目前随着新技术和新领域的不断出现，对分类方法提出了新的要求。 。 关键字：数据挖掘；分类方法；数据分析 引言 数据是知识的源泉。但是，拥有大量的数据与拥有许多有用的知识完全是两回事。过去几年中，从数据库中发现知识这一领域发展的很快。广阔的市场和研究利益促使这一领域的飞速发展。计算机技术和数据收集技术的进步使人们可以从更加广泛的范围和几年前不可想象的速度收集和存储信息。收集数据是为了得到信息，然而大量的数据本身并不意味信息。尽管现代的数据库技术使我们很容易存储大量的数据流，但现在还没有一种成熟的技术帮助我们分析、理解并使数据以可理解的信息表示出来。在过去，我们常用的知识获取方法是由知识工程师把专家经验知识经过分析、筛选、比较、综合、再提取出知识和规则。然而，由于知识工程师所拥有知识的有局限性，所以对于获得知识的可信度就应该打个折扣。目前，传统的知识获取技术面对巨型数据仓库无能为力，数据挖掘技术就应运而生。 数据的迅速增加与数据分析方法的滞后之间的矛盾越来越突出，人们希望在对已有的大量数据分析的基础上进行科学研究、商业决策或者企业管理，但是目前所拥有的数据分析工具很难对数据进行深层次的处理，使得人们只能望“数”兴叹。数据挖掘正是
数据挖掘分类算法研究综述 程建华 (九江学院信息科学学院软件教研室九江332005 ) 摘要：随着数据库应用的不断深化,数据库的规模急剧膨胀,数据挖掘已成为当今研究的热点。特别是其中的分类问题,由于其使用的广泛性,现已引起了越来越多的关注。对数据挖掘中的核心技术分类算法的内容及其研究现状进行综述。认为分类算法大体可分为传统分类算法和基于软计算的分类法两类。通过论述以上算法优缺点和应用范围，研究者对已有算法的改进有所了解，以便在应用中选择相应的分类算法。 关键词：数据挖掘；分类；软计算；算法 1引言 1989年8月，在第11届国际人工智能联合会议的专题研讨会上，首次提出基于数据库的知识发现(KDD，Knowledge DiscoveryDatabase)技术[1]。该技术涉及机器学习、模式识别、统计学、智能数据库、知识获取、专家系统、数据可视化和高性能计算等领域，技术难度较大，一时难以应付信息爆炸的实际需求。到了1995年，在美国计算机年会(ACM)上，提出了数据挖掘[2](DM，Data Mining)的概念，由于数据挖掘是KDD过程中最为关键的步骤，在实践应用中对数据挖掘和KDD这2个术语往往不加以区分。 基于人工智能和信息系统，抽象层次上的分类是推理、学习、决策的关键，是一种基础知识。因而数据分类技术可视为数据挖掘中的基础和核心技术。其实，该技术在很多数据挖掘中被广泛使用，比如关联规则挖掘和时间序列挖掘等。因此，在数据挖掘技术的研究中，分类技术的研究应当处在首要和优先的地位。目前，数据分类技术主要分为基于传统技术和基于软计算技术两种。 2传统的数据挖掘分类方法 分类技术针对数据集构造分类器，从而对未知类别样本赋予类别标签。在其学习过程中和无监督的聚类相比，一般而言，分类技术假定存在具备环境知识和输入输出样本集知识的老师，但环境及其特性、模型参数等却是未知的。 2.1判定树的归纳分类 判定树是一个类似流程图的树结构，其中每个内部节点表示在一个属性上的测试，每个分支代表一个测试输出，而每个树叶节点代表类或类分布。树的最顶层节点是根节点。由判定树可以很容易得到“IFTHEN”形式的分类规则。方法是沿着由根节点到树叶节点的路径，路径上的每个属性-值对形成“IF”部分的一个合取项，树叶节点包含类预测，形成“THEN”部分。一条路径创建一个规则。 判定树归纳的基本算法是贪心算法，它是自顶向下递归的各个击破方式构造判定树。其中一种著名的判定树归纳算法是建立在推理系统和概念学习系统基础上的ID3算法。 2.2贝叶斯分类 贝叶斯分类是统计学的分类方法，基于贝叶斯公式即后验概率公式。朴素贝叶斯分类的分类过程是首先令每个数据样本用一个N维特征向量X={X1，X2，?X n}表示，其中X k是属性A k的值。所有的样本分为m类：C1，C2，?，C n。对于一个类别的标记未知的数据记录而言，若P(C i/X)>P(C j/X)，1≤ j≤m，j≠i，也就是说，如果条件X下，数据记录属于C i类的概率大于属于其他类的概率的话，贝叶斯分类将把这条记录归类为C i类。 建立贝叶斯信念网络可以被分为两个阶段。第一阶段网络拓扑学习，即有向非循环图的——————————————————— 作者简介：程建华（1982-），女，汉族，江西九江，研究生，主要研究方向为数据挖掘、信息安全。
数据挖掘分类方法 数据仓库，数据库或者其它信息库中隐藏着许多可以为商业、科研等活动的决策提供所需要的知识。分类与预测是两种数据分析形式，它们可以用来抽取能够描述重要数据集合或预测未来数据趋势的模型。分类方法（Classification）用于预测数据对象的离散类别（Categorical Label）；预测方法（Prediction ）用于预测数据对象的连续取值。 分类技术在很多领域都有应用，例如可以通过客户分类构造一个分类模型来对银行贷款进行风险评估；当前的市场营销中很重要的一个特点是强调客户细分。客户类别分析的功能也在于此，采用数据挖掘中的分类技术，可以将客户分成不同的类别，比如呼叫中心设计时可以分为：呼叫频繁的客户、偶然大量呼叫的客户、稳定呼叫的客户、其他，帮助呼叫中心寻找出这些不同种类客户之间的特征，这样的分类模型可以让用户了解不同行为类别客户的分布特征；其他分类应用如文献检索和搜索引擎中的自动文本分类技术；安全领域有基于分类技术的入侵检测等等。机器学习、专家系统、统计学和神经网络等领域的研究人员已经提出了许多具体的分类预测方法。下面对分类流程作个简要描述： 训练：训练集——>特征选取——>训练——>分类器 分类：新样本——>特征选取——>分类——>判决 最初的数据挖掘分类应用大多都是在这些方法及基于内存基础上所构造的算法。目前数据挖掘方法都要求具有基于外存以处理大规模数据集合能力且具有可扩展能力。下面对几种主要的分类方法做个简要介绍： （1）决策树 决策树归纳是经典的分类算法。它采用自顶向下递归的各个击破方式构造决策树。树的每一个结点上使用信息增益度量选择测试属性。可以从生成的决策树中提取规则。 (2) KNN法(K-Nearest Neighbor) KNN法即K最近邻法，最初由Cover和Hart于1968年提出的，是一个理论上比较成熟的方法。该方法的思路非常简单直观：如果一个样本在特征空间中的k 个最相似(即特征空间中最邻近)的样本中的大多数属于某一个类别，则该样本也属于这个类别。该方法在定类决策上只依据最邻近的一个或者几个样本的类别来决定待分样本所属的类别。 KNN方法虽然从原理上也依赖于极限定理，但在类别决策时，只与极少量的相邻
什么是数据挖掘 数据挖掘(Data Mining)，又称为数据库中的知识发现(Knowledge Discovery in Database, KDD)，就是从大量数据中获取有效的、新颖的、潜在有用的、最终可理解的模式的非平凡过程，简单的说，数据挖掘就是从大量数据中提取或“挖掘”知识。 并非所有的信息发现任务都被视为数据挖掘。例如，使用数据库管理系统查找个别的记录，或通过因特网的搜索引擎查找特定的Web页面，则是信息检索（information retrieval）领域的任务。虽然这些任务是重要的，可能涉及使用复杂的算法和数据结构，但是它们主要依赖传统的计算机科学技术和数据的明显特征来创建索引结构，从而有效地组织和检索信息。尽管如此，数据挖掘技术也已用来增强信息检索系统的能力。 数据挖掘的起源 为迎接前一节中的这些挑战，来自不同学科的研究者汇集到一起，开始着手开发可以处理不同数据类型的更有效的、可伸缩的工具。这些工作建立在研究者先前使用的方法学和算法之上，在数据挖掘领域达到高潮。特别地，数据挖掘利用了来自如下一些领域的思想：(1) 来自统计学的抽样、估计和假设检验，(2) 人工智能、模式识别和机器学习的搜索算法、建模技术和学习理论。数据挖掘也迅速地接纳了来自其他领域的思想，这些领域包括最优化、进化计算、信息论、信号处理、可视化和信息检索。 一些其他领域也起到重要的支撑作用。特别地，需要数据库系统提供有效的存储、索引和查询处理支持。源于高性能（并行）计算的技术在处理海量数据集方面常常是重要的。分布式技术也能帮助处理海量数据，并且当数据不能集中到一起处理时更是至关重要。 数据挖掘能做什么 1)数据挖掘能做以下六种不同事情（分析方法）： ·分类（Classification） ·估值（Estimation） ·预言（Prediction） ·相关性分组或关联规则（Affinity grouping or association rules） ·聚集（Clustering） ·描述和可视化（Des cription and Visualization） ·复杂数据类型挖掘(Text, Web ,图形图像，视频，音频等) 2)数据挖掘分类