Attribute normalization techniques and performance of intrusion classifiers: a comparative analysis

Abstract

Network traffic have several attributes with different range of values. These attributes can be qualitative or quantitative in nature. Attributes with large values significantly influence the performance of intrusion classifier making it bias towards them. Attribute normalization eliminates such dominance of the attributes by scaling the values of all the attributes within a specific range. The paper discusses various normalization techniques and their influence on intrusion classifiers such as Random Forest, Bayes Net, Naive Bayes, NB Tree and Decision Tree. Furthermore, the concept of hybrid normalization is applied by normalizing the qualitative and quantitative attributes differently. Experiments on KDD Cup 99 suggests that the hybrid normalization can achieve better results as compared to conventional normalization.