Optimizing Computer Worm Detection Using Ensembles

Algorithm 1

Extra Trees Algorithm.

Split a node(S)

Input: the local learning subset S corresponding to the node we want to

split

Output: a split [a < ] or nothing

(i) If Stop split(S) is TRUE then return nothing.

(ii) Otherwise select K attributes , …, among all non-constant (in S)

candidate attributes;

(iii) Draw K splits , …, , where = Pick a random split(S, ), ∀i =

1, …, K;

(iv) Return a split such that Score(, S) = Score(, S).

Pick a random split(S,a)

Inputs: a subset S and an attribute a

Output: a split

(i) Let

and

denote the maximal and minimal value of a in S;

(ii) Draw a random cut-point uniformly in [

,

];

(iii) Return the split [a <].

Stop split(S)

Input: a subset S

Output: a boolean

(i) If |S| <, then return TRUE;

(ii) If all attributes are constant in S, then return TRUE;

(iii) If the output is constant in S, then return TRUE;

(iv) Otherwise, return FALSE.