Research Article
Optimizing Computer Worm Detection Using Ensembles
Algorithm 1
Extra Trees Algorithm.
Split a node(S) | |
Input: the local learning subset S corresponding to the node we want to | |
split | |
Output: a split [a < ] or nothing | |
(i) If Stop split(S) is TRUE then return nothing. | |
(ii) Otherwise select K attributes , …, among all non-constant (in S) | |
candidate attributes; | |
(iii) Draw K splits , …, , where = Pick a random split(S, ), ∀i = | |
1, …, K; | |
(iv) Return a split such that Score(, S) = Score(, S). | |
Pick a random split(S,a) | |
Inputs: a subset S and an attribute a | |
Output: a split | |
(i) Let | |
and | |
denote the maximal and minimal value of a in S; | |
(ii) Draw a random cut-point uniformly in [ | |
, | |
]; | |
(iii) Return the split [a <]. | |
Stop split(S) | |
Input: a subset S | |
Output: a boolean | |
(i) If |S| <, then return TRUE; | |
(ii) If all attributes are constant in S, then return TRUE; | |
(iii) If the output is constant in S, then return TRUE; | |
(iv) Otherwise, return FALSE. |