document: Weighting versus pruning in rule validation for detecting network and host anomalies For intrusion detection , the LERAD algorithm learns a succinct set of comprehensible rules for detecting anomalies , which could be novel attacks . LERAD validates the learned rules on a separate held-out validation set and removes rules that cause false alarms . However , removing rules with possible high coverage can lead to missed detections . We propose to retain these rules and associate weights to them . We present three weighting schemes and our empirical results indicate that , for LERAD , rule weighting can detect more attacks than pruning with minimal computational overhead .
doc_bio_tags: O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O