DECISION TREE CONSTRUCTION METHOD, EQUIPMENT, AND STATUS DETERMINATION EQUIPMENT

摘要

PROBLEM TO BE SOLVED: To prevent the status of a communication traffic from being erroneously decided as intrusion to a host although any intrusion is absent when deciding whether the status of a communication traffic is intrusion to a host or a normal status excluding intrusion. SOLUTION: This tree structure construction device is provided with a mechanism for increasing/decreasing the status probability of a specific status when calculating an information gain for constructing a tree structure in estimating the status of a communication traffic by using a tree structure, and the sensitivity of the information gain is changed according to statuses to be erroneously decided, and when attributes to be assigned to the internal nodes of a decision tree are determined, the attributes for decreasing any much more significant decision error are selected. COPYRIGHT: (C)2008,JPO&INPIT