Evaluating an Obstacle Avoidance Strategy to Ant Colony Optimization Algorithm for Classification in Event Logs

Classification using ant colony optimization (ACO) algorithm provides a very good technique for users to understand the data obtained from event log files, which can further help in building a system profile and determining whether intrusions have taken place in the system. To evaluate the obstacle avoidance strategy, the parameters used are along the lines of simplicity of rules formed, number of terms present in the rules and also the predictive accuracy of the test data on the training set using the rules obtained. We have tried to analyze changes in the rule formation process for different thresholds, and for different times within the process of generating rules. We show through our evaluation that the obstacle avoidance strategy to ACO performs better than the popular ant-miner algorithm by building simple rules with an improved predictive accuracy.