Boolean Combination of Classifiers in the ROC Space

Using Boolean AND and OR functions to combine the responses of multiple one- or two-class classifiers in the ROC space may significantly improve performance of a detection system over a single best classifier. However, techniques found in literature assume that the classifiers are conditionally independent, and that their ROC curves are convex. These assumptions are not valid in most real-world applications, where classifiers are designed using limited and imbalanced training data. A new Iterative Boolean Combination (IBC) technique applies all Boolean functions to combine the ROC curves produced by multiple classifiers without prior assumptions, and its time complexity is linear according to the number of classifiers. The results of computer simulations conducted on synthetic and real-world host-based intrusion detection data indicate that combining the responses from multiple HMMs with IBC can achieve a significantly higher level of performance than with the AND and OR combinations, especially when training data is limited and imbalanced.