Methods for multi-class cost-sensitive learning

A computer implemented method for multi-class, cost-sensitive learning based on an example weighting scheme applied to a chosen data set comprising the steps of:

• a) obtaining a data set from a data storage module, said data set comprising an original data set enhanced with additional data points corresponding in number to a number of labels for a single instance;
• b) iteratively applying weighted sampling from said data set, using a dynamically changing weighting scheme involving both positive and negative weights obtained from an example weights storage module;
• c) calling a classification learning algorithm on a modified binary classification problem in which each example is itself already a labeled pair, and its label is 1 or 0 depending on whether the example weight in the above weighting scheme is positive or negative, respectively, and obtains a hypothesis representing a classifier;
• d) outputting all representations obtained through the iterations and representing an average over them, each of which is an arbitrary representation of the classifier, wherein the computer implemented method is a network intrusion detection method and each one of the representations is a decision tree that specifies a set of conditions on various attributes of a network connection event, which together signal certain types of network intrusion.

A computer implemented method for multi-class, cost-sensitive learning based on an example weighting scheme applied to a chosen data set comprising the steps of:

• a) obtaining a data set from a data storage module, said data set comprising an original data set enhanced with additional data points corresponding in number to a number of labels for a single instance;
• b) iteratively applying weighted sampling from said data set, using a dynamically changing weighting scheme involving both positive and negative weights obtained from an example weights storage module;
• c) calling a classification learning algorithm on a modified binary classification problem in which each example is itself already a labeled pair, and its label is 1 or 0 depending on whether the example weight in the above weighting scheme is positive or negative, respectively, and obtains a hypothesis representing a classifier;
• d) outputting all representations obtained through the iterations and representing an average over them, each of which is an arbitrary representation of the classifier, wherein the representations are further applied on a new network connection to output judgment whether or not the connection is to be suspected to be some type of an intrusion attempt with reasonable likelihood, and further comprising the step of denying service to the network connection.