Filtering Techniques for Rapid User Classi cation

In the computer security task of anomaly detection, we wish to measure not only the classi cation accuracy of a detector but also the average time to detection. This quantity represents either the average time between false alarms (for a valid user) or the average time until a hostile user is detected. We examine the use of noise suppression lters as componants of a learning classi cation system for this domain. We empirically evalute the behaviors of a trailing window mean value lter and a trailing window median value lter in terms of both accuracy and time to detection. We nd that the median lter is generally to be preferred for this domain.