Fuzzy Logic Course Project Fuzzy Roc Curves for the One-class Svm: Application to Intrusion Detection

A novel method for receiver operating characteristic (ROC) curve analysis and anomaly detection is proposed. The ROC curve provides a measure of effectiveness for binary classification problems, and this paper specifically addresses unbalanced, unsupervised, binary classification problems. Furthermore, this work explores techniques in fusing decision values from classifiers and using ROC curves to illustrate the effectiveness of the fusion techniques. In describing an unbalanced classification problem, I am addressing a problem that has a low occurrence of the positive class (generally less than 10%). Since the problem is unsupervised, the one-class SVM is utilized. I discuss the curse of dimensionality experienced with the oneclass SVM, and to overcome this problem I create subspaces of our variables. For each subspace created, the one class SVM produces a decision value. The aggregation of the decision values occurs through the use of fuzzy logic, creating the fuzzy ROC curve. The primary source of data for this research is a host based computer intrusion detection dataset. Experimental results supported with theoretical discussion of ROC curves and fuzzy logic indicates that synergistic ROC curves emerge when subspaces are orthogonal and T-conorms are utilized for fusion.