I have a bunch of tuples like this; [SourceIP, DestinationIP, Port, TimeStamp]

If a destination IP recorded 21, 22, 23 and 80 port (set of 5 tuples) then I will decide something, if it has set of 4 tuples I will decide something if less than 4 I will decide another thing...

I have already handled it with SQL rules but I need to use the decision tree algorithm.

Any idea?

An important thing that I forgot to write is a single tuple has no meaning, I should check timestamps and ports that group of tuple became meaningful...

etc: A set of tuples that is in 5 min and includes ports that 21,22,23,25


If you know what you will decide based on the length of the tuple, then you can probably just hard-code your rules! Did the SQL version not work for you? Or are you just experimenting with decision trees?

You can of course use a decision tree. You data can be split based on the features you provide, so you can look at more than the length of the tuple e.g. look at the values of the DestinationIP and your other variables in the tuple.

It could look something like this:

from sklearn import tree
from sklearn.model_selection import train_test_split

Create a train-test split from your data, assuming you have some input tuples and the response that you want to predict:

X = your_tuple_data
y = corresponding_responses_to_predict

# Split dataset into training set and test set
X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.3, random_state=1) # 70% training and 30% test

Create Decision Tree classifer object

clf = DecisionTreeClassifier()    
# Train Decision Tree Classifer
clf = clf.fit(X_train,y_train)

Predict the response for test dataset

y_pred = clf.predict(X_test)

Have a look at the SciKit-Learn documentation for more information. Here is a tutorial with more ideas behind why this could work.

| improve this answer | |

What you are trying to do here is called a rule based approach, which is essentially a decision tree but the model does not learn anything from the data as the rules are pre-defined. But to create the decision tree model, you will need a training dataset. To create this dataset, use the rule-based approach which in your case will be simple if or case conditions. By doing this, you will have [SourceIP, DestinationIP, Port, TimeStamp] as your training data and the outcome of rules as labels.

Once you are done with this, all you will have to do is to train a decision tree model on this data, which @n1k31t4 has already explained in the answer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.