1
$\begingroup$

I am reading the paper "A new approach to intrusion detection using Artificial Neural Networks and fuzzy clustering" by Gang Wang, Jinxing Hao, Jian Ma and Lihua Huang (Expert Systems with Applications, 37(9):6225–6232, 2010, available at Science Direct). I don't understand the term "detection stability". What does that mean?

The context is that existing intrusion detection systems are claimed to have poor "detection stability" when it comes to rare attacks.

|cite|improve this question
$\endgroup$
  • 1
    $\begingroup$ I suggest you keep reading the paper without understanding this phrase. Probably your understanding of the paper will be unharmed. $\endgroup$ – Yuval Filmus Oct 12 '15 at 12:25
  • $\begingroup$ The paper you cite has a citation right after it first uses the phrase "detection stability". Did you read the cited papers to see whether they use that phrase, and whether they define it? Did you read through to the end of this paper and try to decipher what "detection stability" means from context? What is the context? You should include the context in the question, and include what research you've done. We expect you to do a significant amount of research before asking, and to show us in the question what research you've done. $\endgroup$ – D.W.♦ Oct 12 '15 at 22:37
  • $\begingroup$ Also, from a quick glance at the paper, it looks like the paper isn't written by folks who speak English as a first language, as there are some awkward/unclear phrasings in the paper. So if you see an unfamiliar phrase you should always keep in the back of your mind the possibility that the authors might have used a phrase that they thought would be clear, but they just misjudged their audience. It's usually better to focus on the substance of the paper and to read prior work that establishes a foundation this paper builds on, rather than getting tripped up by specific phrases/terminology. $\endgroup$ – D.W.♦ Oct 12 '15 at 22:39
1
$\begingroup$

Detection stability is about consistency of detection, in this case rare events are classified independent of small changes. One might think of detector having smooth function when it is stable and chaos-like, heavily discontinous when it is not.

Detection stability in the case of rare events (rare attacks) is about consistency and fluctuation. The lack of stability means that similar events, that differ marginaly will not be detected, becase the techniques are very prone to fluctuations - that is a very bad property, malicious query with e.g. $99\%$ classification when changed slightly might drop below detection threshold. Another outcome is that slight changes to the rest of population will influence rare queries.

|cite|improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.