Bayesian networks are important knowledge representation tools for handling uncertain pieces of information. The success of these models is strongly related to their capacity to represent and handle (in) dependence relations. A simple form of Bayesian networks, called naive Bayes has been successfully applied in many classification tasks. In particular, naive Bayes have been used for intrusion detection. Unfortunately, naive Bayes are based on a strong independence assumption that limits its application scope. This paper considers the well-known Tree Augmented Naive Bayes (TAN) classifiers in the context of intrusion detection. In particular, we study how additional expert information such that "it is expected that 80% of traffic will be normal" can be integrated in classification tasks. Experimental results show that our approach improves existing results.
展开▼
