Skip to content
Snippets Groups Projects
Unverified Commit 44fbba61 authored by Lani Jung's avatar Lani Jung Committed by GitHub
Browse files

Merge pull request #2 from lani009/rnf 

add Rnf branch experimental results
parents b18da7c9 a9c099d3
No related branches found
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
Showing
with 1233 additions and 4837 deletions
experiment/decision tree classifier/DecisionTree.ipynb
+ 189
− 113
View file @ 44fbba61
Source diff could not be displayed: it is too large. Options to address this: view the blob.
experiment/decision tree classifier/output/decision tree 0 → 100644
+ 293
− 0
View file @ 44fbba61
digraph Tree {
node [shape=box, style="filled, rounded", color="black", fontname=helvetica] ;
edge [fontname=helvetica] ;
0 [label=<src_bytes &le; 28.5<br/>entropy = 0.997<br/>samples = 17634<br/>value = [9396, 8238]<br/>class = Normal>, fillcolor="#fcefe7"] ;
1 [label=<count &le; 8.5<br/>entropy = 0.393<br/>samples = 8156<br/>value = [632, 7524]<br/>class = Abnormal>, fillcolor="#4aa5e7"] ;
0 -> 1 [labeldistance=2.5, labelangle=45, headlabel="True"] ;
2 [label=<service &le; 16.5<br/>entropy = 0.928<br/>samples = 1775<br/>value = [610, 1165]<br/>class = Abnormal>, fillcolor="#a1d0f3"] ;
1 -> 2 ;
3 [label=<service &le; 1.5<br/>entropy = 0.377<br/>samples = 1028<br/>value = [75, 953]<br/>class = Abnormal>, fillcolor="#49a5e7"] ;
2 -> 3 ;
4 [label=<src_bytes &le; 4.5<br/>entropy = 0.781<br/>samples = 95<br/>value = [73, 22]<br/>class = Normal>, fillcolor="#eda775"] ;
3 -> 4 ;
5 [label=<flag &le; 5.5<br/>entropy = 0.797<br/>samples = 29<br/>value = [7, 22]<br/>class = Abnormal>, fillcolor="#78bced"] ;
4 -> 5 ;
6 [label=<entropy = 0.0<br/>samples = 15<br/>value = [0, 15]<br/>class = Abnormal>, fillcolor="#399de5"] ;
5 -> 6 ;
7 [label=<dst_host_count &le; 19.0<br/>entropy = 1.0<br/>samples = 14<br/>value = [7, 7]<br/>class = Normal>, fillcolor="#ffffff"] ;
5 -> 7 ;
8 [label=<entropy = 0.0<br/>samples = 7<br/>value = [0, 7]<br/>class = Abnormal>, fillcolor="#399de5"] ;
7 -> 8 ;
9 [label=<entropy = 0.0<br/>samples = 7<br/>value = [7, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
7 -> 9 ;
10 [label=<entropy = 0.0<br/>samples = 66<br/>value = [66, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
4 -> 10 ;
11 [label=<serror_rate &le; 0.835<br/>entropy = 0.022<br/>samples = 933<br/>value = [2, 931]<br/>class = Abnormal>, fillcolor="#399de5"] ;
3 -> 11 ;
12 [label=<entropy = 0.0<br/>samples = 891<br/>value = [0, 891]<br/>class = Abnormal>, fillcolor="#399de5"] ;
11 -> 12 ;
13 [label=<dst_host_same_srv_rate &le; 0.44<br/>entropy = 0.276<br/>samples = 42<br/>value = [2, 40]<br/>class = Abnormal>, fillcolor="#43a2e6"] ;
11 -> 13 ;
14 [label=<entropy = 0.0<br/>samples = 40<br/>value = [0, 40]<br/>class = Abnormal>, fillcolor="#399de5"] ;
13 -> 14 ;
15 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
13 -> 15 ;
16 [label=<dst_host_same_srv_rate &le; 0.535<br/>entropy = 0.861<br/>samples = 747<br/>value = [535, 212]<br/>class = Normal>, fillcolor="#efb387"] ;
2 -> 16 ;
17 [label=<src_bytes &le; 5.5<br/>entropy = 0.963<br/>samples = 326<br/>value = [126, 200]<br/>class = Abnormal>, fillcolor="#b6dbf5"] ;
16 -> 17 ;
18 [label=<dst_host_same_src_port_rate &le; 0.135<br/>entropy = 0.598<br/>samples = 227<br/>value = [33, 194]<br/>class = Abnormal>, fillcolor="#5baee9"] ;
17 -> 18 ;
19 [label=<dst_host_serror_rate &le; 0.955<br/>entropy = 0.878<br/>samples = 111<br/>value = [33, 78]<br/>class = Abnormal>, fillcolor="#8dc6f0"] ;
18 -> 19 ;
20 [label=<dst_host_rerror_rate &le; 0.605<br/>entropy = 0.947<br/>samples = 52<br/>value = [33, 19]<br/>class = Normal>, fillcolor="#f4caab"] ;
19 -> 20 ;
21 [label=<srv_diff_host_rate &le; 0.15<br/>entropy = 0.782<br/>samples = 43<br/>value = [33, 10]<br/>class = Normal>, fillcolor="#eda775"] ;
20 -> 21 ;
22 [label=<dst_host_srv_count &le; 1.5<br/>entropy = 0.619<br/>samples = 39<br/>value = [33, 6]<br/>class = Normal>, fillcolor="#ea985d"] ;
21 -> 22 ;
23 [label=<dst_host_count &le; 131.5<br/>entropy = 0.991<br/>samples = 9<br/>value = [4, 5]<br/>class = Abnormal>, fillcolor="#d7ebfa"] ;
22 -> 23 ;
24 [label=<entropy = 0.0<br/>samples = 4<br/>value = [4, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
23 -> 24 ;
25 [label=<entropy = 0.0<br/>samples = 5<br/>value = [0, 5]<br/>class = Abnormal>, fillcolor="#399de5"] ;
23 -> 25 ;
26 [label=<protocol_type &le; 0.5<br/>entropy = 0.211<br/>samples = 30<br/>value = [29, 1]<br/>class = Normal>, fillcolor="#e68540"] ;
22 -> 26 ;
27 [label=<entropy = 0.0<br/>samples = 29<br/>value = [29, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
26 -> 27 ;
28 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
26 -> 28 ;
29 [label=<entropy = 0.0<br/>samples = 4<br/>value = [0, 4]<br/>class = Abnormal>, fillcolor="#399de5"] ;
21 -> 29 ;
30 [label=<entropy = 0.0<br/>samples = 9<br/>value = [0, 9]<br/>class = Abnormal>, fillcolor="#399de5"] ;
20 -> 30 ;
31 [label=<entropy = 0.0<br/>samples = 59<br/>value = [0, 59]<br/>class = Abnormal>, fillcolor="#399de5"] ;
19 -> 31 ;
32 [label=<entropy = 0.0<br/>samples = 116<br/>value = [0, 116]<br/>class = Abnormal>, fillcolor="#399de5"] ;
18 -> 32 ;
33 [label=<dst_host_srv_count &le; 1.5<br/>entropy = 0.33<br/>samples = 99<br/>value = [93, 6]<br/>class = Normal>, fillcolor="#e78946"] ;
17 -> 33 ;
34 [label=<dst_host_diff_srv_rate &le; 0.65<br/>entropy = 0.65<br/>samples = 6<br/>value = [1, 5]<br/>class = Abnormal>, fillcolor="#61b1ea"] ;
33 -> 34 ;
35 [label=<entropy = 0.0<br/>samples = 5<br/>value = [0, 5]<br/>class = Abnormal>, fillcolor="#399de5"] ;
34 -> 35 ;
36 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
34 -> 36 ;
37 [label=<count &le; 7.0<br/>entropy = 0.086<br/>samples = 93<br/>value = [92, 1]<br/>class = Normal>, fillcolor="#e5823b"] ;
33 -> 37 ;
38 [label=<entropy = 0.0<br/>samples = 92<br/>value = [92, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
37 -> 38 ;
39 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
37 -> 39 ;
40 [label=<dst_host_srv_count &le; 11.0<br/>entropy = 0.187<br/>samples = 421<br/>value = [409, 12]<br/>class = Normal>, fillcolor="#e6853f"] ;
16 -> 40 ;
41 [label=<dst_bytes &le; 2.0<br/>entropy = 0.994<br/>samples = 22<br/>value = [10, 12]<br/>class = Abnormal>, fillcolor="#deeffb"] ;
40 -> 41 ;
42 [label=<dst_host_rerror_rate &le; 0.355<br/>entropy = 0.811<br/>samples = 16<br/>value = [4, 12]<br/>class = Abnormal>, fillcolor="#7bbeee"] ;
41 -> 42 ;
43 [label=<dst_host_same_src_port_rate &le; 0.265<br/>entropy = 0.592<br/>samples = 14<br/>value = [2, 12]<br/>class = Abnormal>, fillcolor="#5aade9"] ;
42 -> 43 ;
44 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
43 -> 44 ;
45 [label=<src_bytes &le; 19.0<br/>entropy = 0.391<br/>samples = 13<br/>value = [1, 12]<br/>class = Abnormal>, fillcolor="#49a5e7"] ;
43 -> 45 ;
46 [label=<entropy = 0.0<br/>samples = 11<br/>value = [0, 11]<br/>class = Abnormal>, fillcolor="#399de5"] ;
45 -> 46 ;
47 [label=<entropy = 1.0<br/>samples = 2<br/>value = [1, 1]<br/>class = Normal>, fillcolor="#ffffff"] ;
45 -> 47 ;
48 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
42 -> 48 ;
49 [label=<entropy = 0.0<br/>samples = 6<br/>value = [6, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
41 -> 49 ;
50 [label=<entropy = 0.0<br/>samples = 399<br/>value = [399, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
40 -> 50 ;
51 [label=<dst_host_same_srv_rate &le; 0.835<br/>entropy = 0.033<br/>samples = 6381<br/>value = [22, 6359]<br/>class = Abnormal>, fillcolor="#3a9de5"] ;
1 -> 51 ;
52 [label=<srv_diff_host_rate &le; 0.46<br/>entropy = 0.002<br/>samples = 6350<br/>value = [1, 6349]<br/>class = Abnormal>, fillcolor="#399de5"] ;
51 -> 52 ;
53 [label=<entropy = 0.0<br/>samples = 6348<br/>value = [0, 6348]<br/>class = Abnormal>, fillcolor="#399de5"] ;
52 -> 53 ;
54 [label=<diff_srv_rate &le; 0.08<br/>entropy = 1.0<br/>samples = 2<br/>value = [1, 1]<br/>class = Normal>, fillcolor="#ffffff"] ;
52 -> 54 ;
55 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
54 -> 55 ;
56 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
54 -> 56 ;
57 [label=<dst_host_srv_count &le; 66.5<br/>entropy = 0.907<br/>samples = 31<br/>value = [21, 10]<br/>class = Normal>, fillcolor="#f1bd97"] ;
51 -> 57 ;
58 [label=<entropy = 0.0<br/>samples = 8<br/>value = [0, 8]<br/>class = Abnormal>, fillcolor="#399de5"] ;
57 -> 58 ;
59 [label=<dst_host_same_src_port_rate &le; 0.54<br/>entropy = 0.426<br/>samples = 23<br/>value = [21, 2]<br/>class = Normal>, fillcolor="#e78d4c"] ;
57 -> 59 ;
60 [label=<entropy = 0.0<br/>samples = 21<br/>value = [21, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
59 -> 60 ;
61 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
59 -> 61 ;
62 [label=<protocol_type &le; 1.5<br/>entropy = 0.386<br/>samples = 9478<br/>value = [8764, 714]<br/>class = Normal>, fillcolor="#e78b49"] ;
0 -> 62 [labeldistance=2.5, labelangle=-45, headlabel="False"] ;
63 [label=<hot &le; 0.5<br/>entropy = 0.219<br/>samples = 8883<br/>value = [8572, 311]<br/>class = Normal>, fillcolor="#e68640"] ;
62 -> 63 ;
64 [label=<dst_bytes &le; 2.0<br/>entropy = 0.108<br/>samples = 8542<br/>value = [8420, 122]<br/>class = Normal>, fillcolor="#e5833c"] ;
63 -> 64 ;
65 [label=<dst_host_same_srv_rate &le; 0.825<br/>entropy = 0.541<br/>samples = 911<br/>value = [798, 113]<br/>class = Normal>, fillcolor="#e99355"] ;
64 -> 65 ;
66 [label=<service &le; 1.5<br/>entropy = 0.142<br/>samples = 746<br/>value = [731, 15]<br/>class = Normal>, fillcolor="#e6843d"] ;
65 -> 66 ;
67 [label=<duration &le; 8.0<br/>entropy = 0.06<br/>samples = 575<br/>value = [571, 4]<br/>class = Normal>, fillcolor="#e5823a"] ;
66 -> 67 ;
68 [label=<src_bytes &le; 353.5<br/>entropy = 0.047<br/>samples = 574<br/>value = [571, 3]<br/>class = Normal>, fillcolor="#e5823a"] ;
67 -> 68 ;
69 [label=<src_bytes &le; 326.5<br/>entropy = 0.161<br/>samples = 127<br/>value = [124, 3]<br/>class = Normal>, fillcolor="#e6843e"] ;
68 -> 69 ;
70 [label=<entropy = 0.0<br/>samples = 124<br/>value = [124, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
69 -> 70 ;
71 [label=<entropy = 0.0<br/>samples = 3<br/>value = [0, 3]<br/>class = Abnormal>, fillcolor="#399de5"] ;
69 -> 71 ;
72 [label=<entropy = 0.0<br/>samples = 447<br/>value = [447, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
68 -> 72 ;
73 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
67 -> 73 ;
74 [label=<service &le; 9.5<br/>entropy = 0.344<br/>samples = 171<br/>value = [160, 11]<br/>class = Normal>, fillcolor="#e78a47"] ;
66 -> 74 ;
75 [label=<src_bytes &le; 102.5<br/>entropy = 0.998<br/>samples = 17<br/>value = [8, 9]<br/>class = Abnormal>, fillcolor="#e9f4fc"] ;
74 -> 75 ;
76 [label=<entropy = 0.0<br/>samples = 9<br/>value = [0, 9]<br/>class = Abnormal>, fillcolor="#399de5"] ;
75 -> 76 ;
77 [label=<entropy = 0.0<br/>samples = 8<br/>value = [8, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
75 -> 77 ;
78 [label=<dst_host_srv_rerror_rate &le; 0.25<br/>entropy = 0.1<br/>samples = 154<br/>value = [152, 2]<br/>class = Normal>, fillcolor="#e5833c"] ;
74 -> 78 ;
79 [label=<dst_host_count &le; 5.5<br/>entropy = 0.057<br/>samples = 153<br/>value = [152, 1]<br/>class = Normal>, fillcolor="#e5823a"] ;
78 -> 79 ;
80 [label=<src_bytes &le; 239.5<br/>entropy = 0.918<br/>samples = 3<br/>value = [2, 1]<br/>class = Normal>, fillcolor="#f2c09c"] ;
79 -> 80 ;
81 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
80 -> 81 ;
82 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
80 -> 82 ;
83 [label=<entropy = 0.0<br/>samples = 150<br/>value = [150, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
79 -> 83 ;
84 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
78 -> 84 ;
85 [label=<dst_host_srv_diff_host_rate &le; 0.06<br/>entropy = 0.974<br/>samples = 165<br/>value = [67, 98]<br/>class = Abnormal>, fillcolor="#c0e0f7"] ;
65 -> 85 ;
86 [label=<dst_host_srv_diff_host_rate &le; 0.005<br/>entropy = 0.918<br/>samples = 99<br/>value = [66, 33]<br/>class = Normal>, fillcolor="#f2c09c"] ;
85 -> 86 ;
87 [label=<src_bytes &le; 189.5<br/>entropy = 0.998<br/>samples = 61<br/>value = [29, 32]<br/>class = Abnormal>, fillcolor="#ecf6fd"] ;
86 -> 87 ;
88 [label=<entropy = 0.0<br/>samples = 14<br/>value = [14, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
87 -> 88 ;
89 [label=<src_bytes &le; 358.5<br/>entropy = 0.903<br/>samples = 47<br/>value = [15, 32]<br/>class = Abnormal>, fillcolor="#96cbf1"] ;
87 -> 89 ;
90 [label=<num_root &le; 0.5<br/>entropy = 0.206<br/>samples = 31<br/>value = [1, 30]<br/>class = Abnormal>, fillcolor="#40a0e6"] ;
89 -> 90 ;
91 [label=<entropy = 0.0<br/>samples = 30<br/>value = [0, 30]<br/>class = Abnormal>, fillcolor="#399de5"] ;
90 -> 91 ;
92 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
90 -> 92 ;
93 [label=<src_bytes &le; 32877.5<br/>entropy = 0.544<br/>samples = 16<br/>value = [14, 2]<br/>class = Normal>, fillcolor="#e99355"] ;
89 -> 93 ;
94 [label=<entropy = 0.0<br/>samples = 14<br/>value = [14, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
93 -> 94 ;
95 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
93 -> 95 ;
96 [label=<duration &le; 7.0<br/>entropy = 0.176<br/>samples = 38<br/>value = [37, 1]<br/>class = Normal>, fillcolor="#e6843e"] ;
86 -> 96 ;
97 [label=<entropy = 0.0<br/>samples = 37<br/>value = [37, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
96 -> 97 ;
98 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
96 -> 98 ;
99 [label=<num_root &le; 2.5<br/>entropy = 0.113<br/>samples = 66<br/>value = [1, 65]<br/>class = Abnormal>, fillcolor="#3c9fe5"] ;
85 -> 99 ;
100 [label=<entropy = 0.0<br/>samples = 65<br/>value = [0, 65]<br/>class = Abnormal>, fillcolor="#399de5"] ;
99 -> 100 ;
101 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
99 -> 101 ;
102 [label=<dst_host_rerror_rate &le; 0.025<br/>entropy = 0.013<br/>samples = 7631<br/>value = [7622, 9]<br/>class = Normal>, fillcolor="#e58139"] ;
64 -> 102 ;
103 [label=<dst_host_srv_serror_rate &le; 0.3<br/>entropy = 0.005<br/>samples = 7367<br/>value = [7364, 3]<br/>class = Normal>, fillcolor="#e58139"] ;
102 -> 103 ;
104 [label=<entropy = 0.0<br/>samples = 7321<br/>value = [7321, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
103 -> 104 ;
105 [label=<logged_in &le; 0.5<br/>entropy = 0.348<br/>samples = 46<br/>value = [43, 3]<br/>class = Normal>, fillcolor="#e78a47"] ;
103 -> 105 ;
106 [label=<dst_host_serror_rate &le; 0.675<br/>entropy = 0.811<br/>samples = 4<br/>value = [1, 3]<br/>class = Abnormal>, fillcolor="#7bbeee"] ;
105 -> 106 ;
107 [label=<entropy = 0.0<br/>samples = 3<br/>value = [0, 3]<br/>class = Abnormal>, fillcolor="#399de5"] ;
106 -> 107 ;
108 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
106 -> 108 ;
109 [label=<entropy = 0.0<br/>samples = 42<br/>value = [42, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
105 -> 109 ;
110 [label=<dst_host_srv_count &le; 1.5<br/>entropy = 0.156<br/>samples = 264<br/>value = [258, 6]<br/>class = Normal>, fillcolor="#e6843e"] ;
102 -> 110 ;
111 [label=<srv_count &le; 1.5<br/>entropy = 0.918<br/>samples = 3<br/>value = [1, 2]<br/>class = Abnormal>, fillcolor="#9ccef2"] ;
110 -> 111 ;
112 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
111 -> 112 ;
113 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
111 -> 113 ;
114 [label=<src_bytes &le; 1695.0<br/>entropy = 0.114<br/>samples = 261<br/>value = [257, 4]<br/>class = Normal>, fillcolor="#e5833c"] ;
110 -> 114 ;
115 [label=<entropy = 0.0<br/>samples = 230<br/>value = [230, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
114 -> 115 ;
116 [label=<dst_host_srv_count &le; 123.5<br/>entropy = 0.555<br/>samples = 31<br/>value = [27, 4]<br/>class = Normal>, fillcolor="#e99456"] ;
114 -> 116 ;
117 [label=<entropy = 0.0<br/>samples = 25<br/>value = [25, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
116 -> 117 ;
118 [label=<dst_host_count &le; 145.0<br/>entropy = 0.918<br/>samples = 6<br/>value = [2, 4]<br/>class = Abnormal>, fillcolor="#9ccef2"] ;
116 -> 118 ;
119 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
118 -> 119 ;
120 [label=<entropy = 0.0<br/>samples = 4<br/>value = [0, 4]<br/>class = Abnormal>, fillcolor="#399de5"] ;
118 -> 120 ;
121 [label=<src_bytes &le; 6052.0<br/>entropy = 0.991<br/>samples = 341<br/>value = [152, 189]<br/>class = Abnormal>, fillcolor="#d8ecfa"] ;
63 -> 121 ;
122 [label=<duration &le; 4.5<br/>entropy = 0.813<br/>samples = 203<br/>value = [152, 51]<br/>class = Normal>, fillcolor="#eeab7b"] ;
121 -> 122 ;
123 [label=<dst_host_srv_count &le; 152.0<br/>entropy = 0.993<br/>samples = 80<br/>value = [36, 44]<br/>class = Abnormal>, fillcolor="#dbedfa"] ;
122 -> 123 ;
124 [label=<dst_bytes &le; 2522.0<br/>entropy = 0.262<br/>samples = 45<br/>value = [2, 43]<br/>class = Abnormal>, fillcolor="#42a2e6"] ;
123 -> 124 ;
125 [label=<entropy = 0.0<br/>samples = 43<br/>value = [0, 43]<br/>class = Abnormal>, fillcolor="#399de5"] ;
124 -> 125 ;
126 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
124 -> 126 ;
127 [label=<num_access_files &le; 0.5<br/>entropy = 0.187<br/>samples = 35<br/>value = [34, 1]<br/>class = Normal>, fillcolor="#e6853f"] ;
123 -> 127 ;
128 [label=<entropy = 0.0<br/>samples = 34<br/>value = [34, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
127 -> 128 ;
129 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
127 -> 129 ;
130 [label=<duration &le; 97.5<br/>entropy = 0.315<br/>samples = 123<br/>value = [116, 7]<br/>class = Normal>, fillcolor="#e78945"] ;
122 -> 130 ;
131 [label=<entropy = 0.0<br/>samples = 106<br/>value = [106, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
130 -> 131 ;
132 [label=<dst_host_diff_srv_rate &le; 0.035<br/>entropy = 0.977<br/>samples = 17<br/>value = [10, 7]<br/>class = Normal>, fillcolor="#f7d9c4"] ;
130 -> 132 ;
133 [label=<dst_bytes &le; 25291.5<br/>entropy = 0.544<br/>samples = 8<br/>value = [1, 7]<br/>class = Abnormal>, fillcolor="#55abe9"] ;
132 -> 133 ;
134 [label=<entropy = 0.0<br/>samples = 7<br/>value = [0, 7]<br/>class = Abnormal>, fillcolor="#399de5"] ;
133 -> 134 ;
135 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
133 -> 135 ;
136 [label=<entropy = 0.0<br/>samples = 9<br/>value = [9, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
132 -> 136 ;
137 [label=<entropy = 0.0<br/>samples = 138<br/>value = [0, 138]<br/>class = Abnormal>, fillcolor="#399de5"] ;
121 -> 137 ;
138 [label=<src_bytes &le; 351.5<br/>entropy = 0.907<br/>samples = 595<br/>value = [192, 403]<br/>class = Abnormal>, fillcolor="#97ccf1"] ;
62 -> 138 ;
139 [label=<dst_host_diff_srv_rate &le; 0.33<br/>entropy = 0.047<br/>samples = 193<br/>value = [192, 1]<br/>class = Normal>, fillcolor="#e5823a"] ;
138 -> 139 ;
140 [label=<entropy = 0.0<br/>samples = 190<br/>value = [190, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
139 -> 140 ;
141 [label=<dst_host_diff_srv_rate &le; 0.72<br/>entropy = 0.918<br/>samples = 3<br/>value = [2, 1]<br/>class = Normal>, fillcolor="#f2c09c"] ;
139 -> 141 ;
142 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
141 -> 142 ;
143 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
141 -> 143 ;
144 [label=<entropy = 0.0<br/>samples = 402<br/>value = [0, 402]<br/>class = Abnormal>, fillcolor="#399de5"] ;
138 -> 144 ;
}
experiment/decision tree classifier/output/decision tree max depth.png 0 → 100644
+ 0
− 0
View file @ 44fbba61
experiment/decision tree classifier/output/decision tree max depth.png

15.5 KiB

experiment/decision tree classifier/output/decision tree.jpg 0 → 100644
+ 0
− 0
View file @ 44fbba61
experiment/decision tree classifier/output/decision tree.jpg

1.18 MiB

experiment/decision tree classifier/output/default decision tree.svg deleted 100644 → 0
+ 0
− 3830
View file @ b18da7c9
Source diff could not be displayed: it is too large. Options to address this: view the blob.
experiment/decision tree classifier/output/entropy decision tree.png deleted 100644 → 0
+ 0
− 0
View file @ b18da7c9
experiment/decision tree classifier/output/entropy decision tree.png

3.89 MiB

experiment/decision tree classifier/output/roc.png 0 → 100644
+ 0
− 0
View file @ 44fbba61
experiment/decision tree classifier/output/roc.png

9.82 KiB

experiment/random forest/RandomForest.ipynb
+ 186
− 88
View file @ 44fbba61
Source diff could not be displayed: it is too large. Options to address this: view the blob.
experiment/random forest/output.svg deleted 100644 → 0
+ 0
− 806
View file @ b18da7c9
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<!-- Generated by graphviz version 2.38.0 (20140413.2041)
-->
<!-- Title: Tree Pages: 1 -->
<svg width="3640pt" height="671pt"
viewBox="0.00 0.00 3640.00 671.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 667)">
<title>Tree</title>
<polygon fill="white" stroke="none" points="-4,4 -4,-667 3636,-667 3636,4 -4,4"/>
<!-- 0 -->
<g id="node1" class="node"><title>0</title>
<path fill="#fbeee4" stroke="black" d="M1784,-663C1784,-663 1653,-663 1653,-663 1647,-663 1641,-657 1641,-651 1641,-651 1641,-592 1641,-592 1641,-586 1647,-580 1653,-580 1653,-580 1784,-580 1784,-580 1790,-580 1796,-586 1796,-592 1796,-592 1796,-651 1796,-651 1796,-657 1790,-663 1784,-663"/>
<text text-anchor="start" x="1665.5" y="-647.8" font-family="Helvetica,sans-Serif" font-size="14.00">src_bytes ≤ 28.5</text>
<text text-anchor="start" x="1681" y="-632.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.497</text>
<text text-anchor="start" x="1662.5" y="-617.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 12824</text>
<text text-anchor="start" x="1649" y="-602.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [10818, 9335]</text>
<text text-anchor="start" x="1689.5" y="-587.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 1 -->
<g id="node2" class="node"><title>1</title>
<path fill="#4ba6e7" stroke="black" d="M1409.5,-544C1409.5,-544 1267.5,-544 1267.5,-544 1261.5,-544 1255.5,-538 1255.5,-532 1255.5,-532 1255.5,-473 1255.5,-473 1255.5,-467 1261.5,-461 1267.5,-461 1267.5,-461 1409.5,-461 1409.5,-461 1415.5,-461 1421.5,-467 1421.5,-473 1421.5,-473 1421.5,-532 1421.5,-532 1421.5,-538 1415.5,-544 1409.5,-544"/>
<text text-anchor="start" x="1263.5" y="-528.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_count ≤ 240.5</text>
<text text-anchor="start" x="1301" y="-513.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.153</text>
<text text-anchor="start" x="1287" y="-498.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 5953</text>
<text text-anchor="start" x="1277.5" y="-483.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [775, 8512]</text>
<text text-anchor="start" x="1309.5" y="-468.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 0&#45;&gt;1 -->
<g id="edge1" class="edge"><title>0&#45;&gt;1</title>
<path fill="none" stroke="black" d="M1640.68,-596.541C1580.07,-577.877 1495.71,-551.905 1431.53,-532.143"/>
<polygon fill="black" stroke="black" points="1432.4,-528.749 1421.81,-529.151 1430.34,-535.439 1432.4,-528.749"/>
<text text-anchor="middle" x="1433.5" y="-547.548" font-family="Helvetica,sans-Serif" font-size="14.00">True</text>
</g>
<!-- 28 -->
<g id="node29" class="node"><title>28</title>
<path fill="#e78b49" stroke="black" d="M2160.5,-544C2160.5,-544 2038.5,-544 2038.5,-544 2032.5,-544 2026.5,-538 2026.5,-532 2026.5,-532 2026.5,-473 2026.5,-473 2026.5,-467 2032.5,-461 2038.5,-461 2038.5,-461 2160.5,-461 2160.5,-461 2166.5,-461 2172.5,-467 2172.5,-473 2172.5,-473 2172.5,-532 2172.5,-532 2172.5,-538 2166.5,-544 2160.5,-544"/>
<text text-anchor="start" x="2050.5" y="-528.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_bytes ≤ 0.5</text>
<text text-anchor="start" x="2066" y="-513.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.14</text>
<text text-anchor="start" x="2048" y="-498.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 6871</text>
<text text-anchor="start" x="2034.5" y="-483.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [10043, 823]</text>
<text text-anchor="start" x="2070.5" y="-468.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 0&#45;&gt;28 -->
<g id="edge28" class="edge"><title>0&#45;&gt;28</title>
<path fill="none" stroke="black" d="M1796.06,-596.682C1860.11,-577.013 1950.82,-549.157 2016.36,-529.03"/>
<polygon fill="black" stroke="black" points="2017.72,-532.276 2026.25,-525.994 2015.66,-525.584 2017.72,-532.276"/>
<text text-anchor="middle" x="2014.54" y="-544.382" font-family="Helvetica,sans-Serif" font-size="14.00">False</text>
</g>
<!-- 2 -->
<g id="node3" class="node"><title>2</title>
<path fill="#a8d4f4" stroke="black" d="M844.5,-425C844.5,-425 730.5,-425 730.5,-425 724.5,-425 718.5,-419 718.5,-413 718.5,-413 718.5,-354 718.5,-354 718.5,-348 724.5,-342 730.5,-342 730.5,-342 844.5,-342 844.5,-342 850.5,-342 856.5,-348 856.5,-354 856.5,-354 856.5,-413 856.5,-413 856.5,-419 850.5,-425 844.5,-425"/>
<text text-anchor="start" x="742.5" y="-409.8" font-family="Helvetica,sans-Serif" font-size="14.00">service ≤ 16.5</text>
<text text-anchor="start" x="754" y="-394.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.46</text>
<text text-anchor="start" x="736" y="-379.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 1258</text>
<text text-anchor="start" x="726.5" y="-364.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [707, 1261]</text>
<text text-anchor="start" x="758.5" y="-349.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 1&#45;&gt;2 -->
<g id="edge2" class="edge"><title>1&#45;&gt;2</title>
<path fill="none" stroke="black" d="M1255.41,-483.857C1150.23,-461.524 970.325,-423.321 866.919,-401.364"/>
<polygon fill="black" stroke="black" points="867.358,-397.879 856.849,-399.226 865.904,-404.727 867.358,-397.879"/>
</g>
<!-- 17 -->
<g id="node18" class="node"><title>17</title>
<path fill="#3b9ee5" stroke="black" d="M1391.5,-425C1391.5,-425 1285.5,-425 1285.5,-425 1279.5,-425 1273.5,-419 1273.5,-413 1273.5,-413 1273.5,-354 1273.5,-354 1273.5,-348 1279.5,-342 1285.5,-342 1285.5,-342 1391.5,-342 1391.5,-342 1397.5,-342 1403.5,-348 1403.5,-354 1403.5,-354 1403.5,-413 1403.5,-413 1403.5,-419 1397.5,-425 1391.5,-425"/>
<text text-anchor="start" x="1289.5" y="-409.8" font-family="Helvetica,sans-Serif" font-size="14.00">src_bytes ≤ 6.5</text>
<text text-anchor="start" x="1301" y="-394.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.018</text>
<text text-anchor="start" x="1287" y="-379.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 4695</text>
<text text-anchor="start" x="1281.5" y="-364.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [68, 7251]</text>
<text text-anchor="start" x="1309.5" y="-349.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 1&#45;&gt;17 -->
<g id="edge17" class="edge"><title>1&#45;&gt;17</title>
<path fill="none" stroke="black" d="M1338.5,-460.907C1338.5,-452.649 1338.5,-443.864 1338.5,-435.302"/>
<polygon fill="black" stroke="black" points="1342,-435.021 1338.5,-425.021 1335,-435.021 1342,-435.021"/>
</g>
<!-- 3 -->
<g id="node4" class="node"><title>3</title>
<path fill="#45a3e7" stroke="black" d="M456.5,-306C456.5,-306 350.5,-306 350.5,-306 344.5,-306 338.5,-300 338.5,-294 338.5,-294 338.5,-235 338.5,-235 338.5,-229 344.5,-223 350.5,-223 350.5,-223 456.5,-223 456.5,-223 462.5,-223 468.5,-229 468.5,-235 468.5,-235 468.5,-294 468.5,-294 468.5,-300 462.5,-306 456.5,-306"/>
<text text-anchor="start" x="355" y="-290.8" font-family="Helvetica,sans-Serif" font-size="14.00">srv_count ≤ 2.5</text>
<text text-anchor="start" x="366" y="-275.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.111</text>
<text text-anchor="start" x="356" y="-260.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 744</text>
<text text-anchor="start" x="346.5" y="-245.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [69, 1103]</text>
<text text-anchor="start" x="374.5" y="-230.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 2&#45;&gt;3 -->
<g id="edge3" class="edge"><title>2&#45;&gt;3</title>
<path fill="none" stroke="black" d="M718.405,-361.448C650.659,-340.806 547.693,-309.434 478.11,-288.233"/>
<polygon fill="black" stroke="black" points="479.106,-284.877 468.52,-285.311 477.066,-291.574 479.106,-284.877"/>
</g>
<!-- 10 -->
<g id="node11" class="node"><title>10</title>
<path fill="#eba06a" stroke="black" d="M888.5,-306C888.5,-306 686.5,-306 686.5,-306 680.5,-306 674.5,-300 674.5,-294 674.5,-294 674.5,-235 674.5,-235 674.5,-229 680.5,-223 686.5,-223 686.5,-223 888.5,-223 888.5,-223 894.5,-223 900.5,-229 900.5,-235 900.5,-235 900.5,-294 900.5,-294 900.5,-300 894.5,-306 888.5,-306"/>
<text text-anchor="start" x="682.5" y="-290.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_same_srv_rate ≤ 0.645</text>
<text text-anchor="start" x="750" y="-275.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.318</text>
<text text-anchor="start" x="740" y="-260.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 514</text>
<text text-anchor="start" x="730.5" y="-245.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [638, 158]</text>
<text text-anchor="start" x="758.5" y="-230.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 2&#45;&gt;10 -->
<g id="edge10" class="edge"><title>2&#45;&gt;10</title>
<path fill="none" stroke="black" d="M787.5,-341.907C787.5,-333.649 787.5,-324.864 787.5,-316.302"/>
<polygon fill="black" stroke="black" points="791,-316.021 787.5,-306.021 784,-316.021 791,-316.021"/>
</g>
<!-- 4 -->
<g id="node5" class="node"><title>4</title>
<path fill="#66b3eb" stroke="black" d="M268.5,-187C268.5,-187 116.5,-187 116.5,-187 110.5,-187 104.5,-181 104.5,-175 104.5,-175 104.5,-116 104.5,-116 104.5,-110 110.5,-104 116.5,-104 116.5,-104 268.5,-104 268.5,-104 274.5,-104 280.5,-110 280.5,-116 280.5,-116 280.5,-175 280.5,-175 280.5,-181 274.5,-187 268.5,-187"/>
<text text-anchor="start" x="112.5" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_srv_count ≤ 3.5</text>
<text text-anchor="start" x="155" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.302</text>
<text text-anchor="start" x="145" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 235</text>
<text text-anchor="start" x="139.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [66, 290]</text>
<text text-anchor="start" x="163.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 3&#45;&gt;4 -->
<g id="edge4" class="edge"><title>3&#45;&gt;4</title>
<path fill="none" stroke="black" d="M338.471,-227.441C318.341,-216.279 295.893,-203.831 274.755,-192.11"/>
<polygon fill="black" stroke="black" points="276.229,-188.926 265.786,-187.137 272.834,-195.048 276.229,-188.926"/>
</g>
<!-- 7 -->
<g id="node8" class="node"><title>7</title>
<path fill="#3a9de5" stroke="black" d="M448,-187C448,-187 359,-187 359,-187 353,-187 347,-181 347,-175 347,-175 347,-116 347,-116 347,-110 353,-104 359,-104 359,-104 448,-104 448,-104 454,-104 460,-110 460,-116 460,-116 460,-175 460,-175 460,-181 454,-187 448,-187"/>
<text text-anchor="start" x="355" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">srv_count ≤ 3.5</text>
<text text-anchor="start" x="366" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.007</text>
<text text-anchor="start" x="356" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 509</text>
<text text-anchor="start" x="355" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [3, 813]</text>
<text text-anchor="start" x="374.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 3&#45;&gt;7 -->
<g id="edge7" class="edge"><title>3&#45;&gt;7</title>
<path fill="none" stroke="black" d="M403.5,-222.907C403.5,-214.649 403.5,-205.864 403.5,-197.302"/>
<polygon fill="black" stroke="black" points="407,-197.021 403.5,-187.021 400,-197.021 407,-197.021"/>
</g>
<!-- 5 -->
<g id="node6" class="node"><title>5</title>
<path fill="#399de5" stroke="black" d="M101,-68C101,-68 12,-68 12,-68 6,-68 0,-62 0,-56 0,-56 0,-12 0,-12 0,-6 6,-0 12,-0 12,-0 101,-0 101,-0 107,-0 113,-6 113,-12 113,-12 113,-56 113,-56 113,-62 107,-68 101,-68"/>
<text text-anchor="start" x="27.5" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="9" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 115</text>
<text text-anchor="start" x="8" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [0, 163]</text>
<text text-anchor="start" x="27.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 4&#45;&gt;5 -->
<g id="edge5" class="edge"><title>4&#45;&gt;5</title>
<path fill="none" stroke="black" d="M141.859,-103.726C130.077,-94.2406 117.551,-84.1551 105.827,-74.7159"/>
<polygon fill="black" stroke="black" points="107.843,-71.8448 97.8584,-68.2996 103.453,-77.2972 107.843,-71.8448"/>
</g>
<!-- 6 -->
<g id="node7" class="node"><title>6</title>
<path fill="#a0d0f3" stroke="black" d="M241.5,-68C241.5,-68 143.5,-68 143.5,-68 137.5,-68 131.5,-62 131.5,-56 131.5,-56 131.5,-12 131.5,-12 131.5,-6 137.5,-0 143.5,-0 143.5,-0 241.5,-0 241.5,-0 247.5,-0 253.5,-6 253.5,-12 253.5,-12 253.5,-56 253.5,-56 253.5,-62 247.5,-68 241.5,-68"/>
<text text-anchor="start" x="159" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.45</text>
<text text-anchor="start" x="145" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 120</text>
<text text-anchor="start" x="139.5" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [66, 127]</text>
<text text-anchor="start" x="163.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 4&#45;&gt;6 -->
<g id="edge6" class="edge"><title>4&#45;&gt;6</title>
<path fill="none" stroke="black" d="M192.5,-103.726C192.5,-95.5175 192.5,-86.8595 192.5,-78.56"/>
<polygon fill="black" stroke="black" points="196,-78.2996 192.5,-68.2996 189,-78.2996 196,-78.2996"/>
</g>
<!-- 8 -->
<g id="node9" class="node"><title>8</title>
<path fill="#46a4e7" stroke="black" d="M365,-68C365,-68 284,-68 284,-68 278,-68 272,-62 272,-56 272,-56 272,-12 272,-12 272,-6 278,-0 284,-0 284,-0 365,-0 365,-0 371,-0 377,-6 377,-12 377,-12 377,-56 377,-56 377,-62 371,-68 365,-68"/>
<text text-anchor="start" x="287" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.117</text>
<text text-anchor="start" x="281" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 17</text>
<text text-anchor="start" x="280" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [2, 30]</text>
<text text-anchor="start" x="295.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 7&#45;&gt;8 -->
<g id="edge8" class="edge"><title>7&#45;&gt;8</title>
<path fill="none" stroke="black" d="M374.083,-103.726C367.7,-94.879 360.941,-85.51 354.535,-76.6303"/>
<polygon fill="black" stroke="black" points="357.214,-74.3615 348.524,-68.2996 351.537,-78.4571 357.214,-74.3615"/>
</g>
<!-- 9 -->
<g id="node10" class="node"><title>9</title>
<path fill="#399de5" stroke="black" d="M496,-68C496,-68 407,-68 407,-68 401,-68 395,-62 395,-56 395,-56 395,-12 395,-12 395,-6 401,-0 407,-0 407,-0 496,-0 496,-0 502,-0 508,-6 508,-12 508,-12 508,-56 508,-56 508,-62 502,-68 496,-68"/>
<text text-anchor="start" x="414" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.003</text>
<text text-anchor="start" x="404" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 492</text>
<text text-anchor="start" x="403" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [1, 783]</text>
<text text-anchor="start" x="422.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 7&#45;&gt;9 -->
<g id="edge9" class="edge"><title>7&#45;&gt;9</title>
<path fill="none" stroke="black" d="M421.373,-103.726C425.092,-95.2439 429.02,-86.2819 432.769,-77.7312"/>
<polygon fill="black" stroke="black" points="436.094,-78.8635 436.903,-68.2996 429.683,-76.0531 436.094,-78.8635"/>
</g>
<!-- 11 -->
<g id="node12" class="node"><title>11</title>
<path fill="#f3f9fd" stroke="black" d="M752.5,-187C752.5,-187 646.5,-187 646.5,-187 640.5,-187 634.5,-181 634.5,-175 634.5,-175 634.5,-116 634.5,-116 634.5,-110 640.5,-104 646.5,-104 646.5,-104 752.5,-104 752.5,-104 758.5,-104 764.5,-110 764.5,-116 764.5,-116 764.5,-175 764.5,-175 764.5,-181 758.5,-187 752.5,-187"/>
<text text-anchor="start" x="664.5" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">count ≤ 2.5</text>
<text text-anchor="start" x="662" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.499</text>
<text text-anchor="start" x="652" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 180</text>
<text text-anchor="start" x="642.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [135, 144]</text>
<text text-anchor="start" x="670.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 10&#45;&gt;11 -->
<g id="edge11" class="edge"><title>10&#45;&gt;11</title>
<path fill="none" stroke="black" d="M756.969,-222.907C750.211,-213.923 742.985,-204.315 736.016,-195.05"/>
<polygon fill="black" stroke="black" points="738.785,-192.909 729.977,-187.021 733.191,-197.116 738.785,-192.909"/>
</g>
<!-- 14 -->
<g id="node15" class="node"><title>14</title>
<path fill="#e6853f" stroke="black" d="M956,-187C956,-187 795,-187 795,-187 789,-187 783,-181 783,-175 783,-175 783,-116 783,-116 783,-110 789,-104 795,-104 795,-104 956,-104 956,-104 962,-104 968,-110 968,-116 968,-116 968,-175 968,-175 968,-181 962,-187 956,-187"/>
<text text-anchor="start" x="791" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_srv_count ≤ 10.5</text>
<text text-anchor="start" x="838" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.053</text>
<text text-anchor="start" x="828" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 334</text>
<text text-anchor="start" x="822.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [503, 14]</text>
<text text-anchor="start" x="846.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 10&#45;&gt;14 -->
<g id="edge14" class="edge"><title>10&#45;&gt;14</title>
<path fill="none" stroke="black" d="M818.031,-222.907C824.789,-213.923 832.015,-204.315 838.984,-195.05"/>
<polygon fill="black" stroke="black" points="841.809,-197.116 845.023,-187.021 836.215,-192.909 841.809,-197.116"/>
</g>
<!-- 12 -->
<g id="node13" class="node"><title>12</title>
<path fill="#eca16b" stroke="black" d="M636.5,-68C636.5,-68 538.5,-68 538.5,-68 532.5,-68 526.5,-62 526.5,-56 526.5,-56 526.5,-12 526.5,-12 526.5,-6 532.5,-0 538.5,-0 538.5,-0 636.5,-0 636.5,-0 642.5,-0 648.5,-6 648.5,-12 648.5,-12 648.5,-56 648.5,-56 648.5,-62 642.5,-68 636.5,-68"/>
<text text-anchor="start" x="550" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.323</text>
<text text-anchor="start" x="540" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 108</text>
<text text-anchor="start" x="534.5" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [130, 33]</text>
<text text-anchor="start" x="558.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 11&#45;&gt;12 -->
<g id="edge12" class="edge"><title>11&#45;&gt;12</title>
<path fill="none" stroke="black" d="M657.795,-103.726C648.373,-94.5142 638.372,-84.7364 628.96,-75.5343"/>
<polygon fill="black" stroke="black" points="631.157,-72.7878 621.56,-68.2996 626.264,-77.7931 631.157,-72.7878"/>
</g>
<!-- 13 -->
<g id="node14" class="node"><title>13</title>
<path fill="#42a1e6" stroke="black" d="M768,-68C768,-68 679,-68 679,-68 673,-68 667,-62 667,-56 667,-56 667,-12 667,-12 667,-6 673,-0 679,-0 679,-0 768,-0 768,-0 774,-0 780,-6 780,-12 780,-12 780,-56 780,-56 780,-62 774,-68 768,-68"/>
<text text-anchor="start" x="686" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.082</text>
<text text-anchor="start" x="680" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 72</text>
<text text-anchor="start" x="675" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [5, 111]</text>
<text text-anchor="start" x="694.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 11&#45;&gt;13 -->
<g id="edge13" class="edge"><title>11&#45;&gt;13</title>
<path fill="none" stroke="black" d="M708.437,-103.726C710.256,-95.4263 712.176,-86.6671 714.013,-78.2834"/>
<polygon fill="black" stroke="black" points="717.479,-78.8171 716.201,-68.2996 710.642,-77.3184 717.479,-78.8171"/>
</g>
<!-- 15 -->
<g id="node16" class="node"><title>15</title>
<path fill="#aad5f4" stroke="black" d="M891,-68C891,-68 810,-68 810,-68 804,-68 798,-62 798,-56 798,-56 798,-12 798,-12 798,-6 804,-0 810,-0 810,-0 891,-0 891,-0 897,-0 903,-6 903,-12 903,-12 903,-56 903,-56 903,-62 897,-68 891,-68"/>
<text text-anchor="start" x="813" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.463</text>
<text text-anchor="start" x="807" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 16</text>
<text text-anchor="start" x="806" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [8, 14]</text>
<text text-anchor="start" x="821.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 14&#45;&gt;15 -->
<g id="edge15" class="edge"><title>14&#45;&gt;15</title>
<path fill="none" stroke="black" d="M866.191,-103.726C864.296,-95.4263 862.296,-86.6671 860.382,-78.2834"/>
<polygon fill="black" stroke="black" points="863.741,-77.2697 858.103,-68.2996 856.916,-78.8278 863.741,-77.2697"/>
</g>
<!-- 16 -->
<g id="node17" class="node"><title>16</title>
<path fill="#e58139" stroke="black" d="M1022,-68C1022,-68 933,-68 933,-68 927,-68 921,-62 921,-56 921,-56 921,-12 921,-12 921,-6 927,-0 933,-0 933,-0 1022,-0 1022,-0 1028,-0 1034,-6 1034,-12 1034,-12 1034,-56 1034,-56 1034,-62 1028,-68 1022,-68"/>
<text text-anchor="start" x="948.5" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="930" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 318</text>
<text text-anchor="start" x="929" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [495, 0]</text>
<text text-anchor="start" x="948.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 14&#45;&gt;16 -->
<g id="edge16" class="edge"><title>14&#45;&gt;16</title>
<path fill="none" stroke="black" d="M913.481,-103.726C921.977,-94.6054 930.99,-84.93 939.487,-75.8078"/>
<polygon fill="black" stroke="black" points="942.226,-78.0025 946.481,-68.2996 937.104,-73.2312 942.226,-78.0025"/>
</g>
<!-- 18 -->
<g id="node19" class="node"><title>18</title>
<path fill="#3a9de5" stroke="black" d="M1335,-306C1335,-306 1166,-306 1166,-306 1160,-306 1154,-300 1154,-294 1154,-294 1154,-235 1154,-235 1154,-229 1160,-223 1166,-223 1166,-223 1335,-223 1335,-223 1341,-223 1347,-229 1347,-235 1347,-235 1347,-294 1347,-294 1347,-300 1341,-306 1335,-306"/>
<text text-anchor="start" x="1162" y="-290.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_srv_count ≤ 228.5</text>
<text text-anchor="start" x="1213" y="-275.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.006</text>
<text text-anchor="start" x="1199" y="-260.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 4580</text>
<text text-anchor="start" x="1193.5" y="-245.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [23, 7114]</text>
<text text-anchor="start" x="1221.5" y="-230.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 17&#45;&gt;18 -->
<g id="edge18" class="edge"><title>17&#45;&gt;18</title>
<path fill="none" stroke="black" d="M1307.97,-341.907C1301.21,-332.923 1293.98,-323.315 1287.02,-314.05"/>
<polygon fill="black" stroke="black" points="1289.79,-311.909 1280.98,-306.021 1284.19,-316.116 1289.79,-311.909"/>
</g>
<!-- 23 -->
<g id="node24" class="node"><title>23</title>
<path fill="#7abdee" stroke="black" d="M1475.5,-306C1475.5,-306 1377.5,-306 1377.5,-306 1371.5,-306 1365.5,-300 1365.5,-294 1365.5,-294 1365.5,-235 1365.5,-235 1365.5,-229 1371.5,-223 1377.5,-223 1377.5,-223 1475.5,-223 1475.5,-223 1481.5,-223 1487.5,-229 1487.5,-235 1487.5,-235 1487.5,-294 1487.5,-294 1487.5,-300 1481.5,-306 1475.5,-306"/>
<text text-anchor="start" x="1373.5" y="-290.8" font-family="Helvetica,sans-Serif" font-size="14.00">src_bytes ≤ 27.0</text>
<text text-anchor="start" x="1389" y="-275.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.372</text>
<text text-anchor="start" x="1379" y="-260.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 115</text>
<text text-anchor="start" x="1373.5" y="-245.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [45, 137]</text>
<text text-anchor="start" x="1397.5" y="-230.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 17&#45;&gt;23 -->
<g id="edge23" class="edge"><title>17&#45;&gt;23</title>
<path fill="none" stroke="black" d="M1369.03,-341.907C1375.79,-332.923 1383.02,-323.315 1389.98,-314.05"/>
<polygon fill="black" stroke="black" points="1392.81,-316.116 1396.02,-306.021 1387.21,-311.909 1392.81,-316.116"/>
</g>
<!-- 19 -->
<g id="node20" class="node"><title>19</title>
<path fill="#399de5" stroke="black" d="M1173.5,-187C1173.5,-187 1075.5,-187 1075.5,-187 1069.5,-187 1063.5,-181 1063.5,-175 1063.5,-175 1063.5,-116 1063.5,-116 1063.5,-110 1069.5,-104 1075.5,-104 1075.5,-104 1173.5,-104 1173.5,-104 1179.5,-104 1185.5,-110 1185.5,-116 1185.5,-116 1185.5,-175 1185.5,-175 1185.5,-181 1179.5,-187 1173.5,-187"/>
<text text-anchor="start" x="1076" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">srv_count ≤ 3.5</text>
<text text-anchor="start" x="1087" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.003</text>
<text text-anchor="start" x="1073" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 4572</text>
<text text-anchor="start" x="1071.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [9, 7114]</text>
<text text-anchor="start" x="1095.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 18&#45;&gt;19 -->
<g id="edge19" class="edge"><title>18&#45;&gt;19</title>
<path fill="none" stroke="black" d="M1206.78,-222.907C1196.72,-213.56 1185.93,-203.538 1175.58,-193.929"/>
<polygon fill="black" stroke="black" points="1177.85,-191.261 1168.14,-187.021 1173.08,-196.39 1177.85,-191.261"/>
</g>
<!-- 22 -->
<g id="node23" class="node"><title>22</title>
<path fill="#e58139" stroke="black" d="M1297,-179.5C1297,-179.5 1216,-179.5 1216,-179.5 1210,-179.5 1204,-173.5 1204,-167.5 1204,-167.5 1204,-123.5 1204,-123.5 1204,-117.5 1210,-111.5 1216,-111.5 1216,-111.5 1297,-111.5 1297,-111.5 1303,-111.5 1309,-117.5 1309,-123.5 1309,-123.5 1309,-167.5 1309,-167.5 1309,-173.5 1303,-179.5 1297,-179.5"/>
<text text-anchor="start" x="1227.5" y="-164.3" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="1217" y="-149.3" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 8</text>
<text text-anchor="start" x="1212" y="-134.3" font-family="Helvetica,sans-Serif" font-size="14.00">value = [14, 0]</text>
<text text-anchor="start" x="1227.5" y="-119.3" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 18&#45;&gt;22 -->
<g id="edge22" class="edge"><title>18&#45;&gt;22</title>
<path fill="none" stroke="black" d="M1252.58,-222.907C1253.13,-212.204 1253.72,-200.615 1254.28,-189.776"/>
<polygon fill="black" stroke="black" points="1257.78,-189.833 1254.8,-179.667 1250.79,-189.475 1257.78,-189.833"/>
</g>
<!-- 20 -->
<g id="node21" class="node"><title>20</title>
<path fill="#3a9de5" stroke="black" d="M1162.5,-68C1162.5,-68 1064.5,-68 1064.5,-68 1058.5,-68 1052.5,-62 1052.5,-56 1052.5,-56 1052.5,-12 1052.5,-12 1052.5,-6 1058.5,-0 1064.5,-0 1064.5,-0 1162.5,-0 1162.5,-0 1168.5,-0 1174.5,-6 1174.5,-12 1174.5,-12 1174.5,-56 1174.5,-56 1174.5,-62 1168.5,-68 1162.5,-68"/>
<text text-anchor="start" x="1080" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.01</text>
<text text-anchor="start" x="1062" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 1179</text>
<text text-anchor="start" x="1060.5" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [9, 1801]</text>
<text text-anchor="start" x="1084.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 19&#45;&gt;20 -->
<g id="edge20" class="edge"><title>19&#45;&gt;20</title>
<path fill="none" stroke="black" d="M1120.4,-103.726C1119.57,-95.4263 1118.69,-86.6671 1117.85,-78.2834"/>
<polygon fill="black" stroke="black" points="1121.33,-77.8997 1116.85,-68.2996 1114.36,-78.5994 1121.33,-77.8997"/>
</g>
<!-- 21 -->
<g id="node22" class="node"><title>21</title>
<path fill="#399de5" stroke="black" d="M1302.5,-68C1302.5,-68 1204.5,-68 1204.5,-68 1198.5,-68 1192.5,-62 1192.5,-56 1192.5,-56 1192.5,-12 1192.5,-12 1192.5,-6 1198.5,-0 1204.5,-0 1204.5,-0 1302.5,-0 1302.5,-0 1308.5,-0 1314.5,-6 1314.5,-12 1314.5,-12 1314.5,-56 1314.5,-56 1314.5,-62 1308.5,-68 1302.5,-68"/>
<text text-anchor="start" x="1224.5" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="1202" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 3393</text>
<text text-anchor="start" x="1200.5" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [0, 5313]</text>
<text text-anchor="start" x="1224.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 19&#45;&gt;21 -->
<g id="edge21" class="edge"><title>19&#45;&gt;21</title>
<path fill="none" stroke="black" d="M1172.53,-103.726C1183.6,-94.3318 1195.36,-84.349 1206.39,-74.9883"/>
<polygon fill="black" stroke="black" points="1208.91,-77.4393 1214.27,-68.2996 1204.38,-72.1026 1208.91,-77.4393"/>
</g>
<!-- 24 -->
<g id="node25" class="node"><title>24</title>
<path fill="#e78946" stroke="black" d="M1496.5,-187C1496.5,-187 1344.5,-187 1344.5,-187 1338.5,-187 1332.5,-181 1332.5,-175 1332.5,-175 1332.5,-116 1332.5,-116 1332.5,-110 1338.5,-104 1344.5,-104 1344.5,-104 1496.5,-104 1496.5,-104 1502.5,-104 1508.5,-110 1508.5,-116 1508.5,-116 1508.5,-175 1508.5,-175 1508.5,-181 1502.5,-187 1496.5,-187"/>
<text text-anchor="start" x="1340.5" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_srv_count ≤ 1.5</text>
<text text-anchor="start" x="1383" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.117</text>
<text text-anchor="start" x="1377" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 33</text>
<text text-anchor="start" x="1376" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [45, 3]</text>
<text text-anchor="start" x="1391.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 23&#45;&gt;24 -->
<g id="edge24" class="edge"><title>23&#45;&gt;24</title>
<path fill="none" stroke="black" d="M1424.42,-222.907C1423.99,-214.558 1423.53,-205.671 1423.09,-197.02"/>
<polygon fill="black" stroke="black" points="1426.59,-196.828 1422.58,-187.021 1419.59,-197.187 1426.59,-196.828"/>
</g>
<!-- 27 -->
<g id="node28" class="node"><title>27</title>
<path fill="#399de5" stroke="black" d="M1628,-179.5C1628,-179.5 1539,-179.5 1539,-179.5 1533,-179.5 1527,-173.5 1527,-167.5 1527,-167.5 1527,-123.5 1527,-123.5 1527,-117.5 1533,-111.5 1539,-111.5 1539,-111.5 1628,-111.5 1628,-111.5 1634,-111.5 1640,-117.5 1640,-123.5 1640,-123.5 1640,-167.5 1640,-167.5 1640,-173.5 1634,-179.5 1628,-179.5"/>
<text text-anchor="start" x="1554.5" y="-164.3" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="1540" y="-149.3" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 82</text>
<text text-anchor="start" x="1535" y="-134.3" font-family="Helvetica,sans-Serif" font-size="14.00">value = [0, 134]</text>
<text text-anchor="start" x="1554.5" y="-119.3" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 23&#45;&gt;27 -->
<g id="edge27" class="edge"><title>23&#45;&gt;27</title>
<path fill="none" stroke="black" d="M1480.97,-222.907C1497.11,-210.88 1514.75,-197.735 1530.78,-185.791"/>
<polygon fill="black" stroke="black" points="1533.07,-188.449 1538.99,-179.667 1528.88,-182.836 1533.07,-188.449"/>
</g>
<!-- 25 -->
<g id="node26" class="node"><title>25</title>
<path fill="#bddef6" stroke="black" d="M1418,-68C1418,-68 1345,-68 1345,-68 1339,-68 1333,-62 1333,-56 1333,-56 1333,-12 1333,-12 1333,-6 1339,-0 1345,-0 1345,-0 1418,-0 1418,-0 1424,-0 1430,-6 1430,-12 1430,-12 1430,-56 1430,-56 1430,-62 1424,-68 1418,-68"/>
<text text-anchor="start" x="1348" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.48</text>
<text text-anchor="start" x="1342" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 2</text>
<text text-anchor="start" x="1341" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [2, 3]</text>
<text text-anchor="start" x="1352.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 24&#45;&gt;25 -->
<g id="edge25" class="edge"><title>24&#45;&gt;25</title>
<path fill="none" stroke="black" d="M1405.98,-103.726C1402.96,-95.2439 1399.76,-86.2819 1396.72,-77.7312"/>
<polygon fill="black" stroke="black" points="1400.01,-76.5456 1393.36,-68.2996 1393.42,-78.8943 1400.01,-76.5456"/>
</g>
<!-- 26 -->
<g id="node27" class="node"><title>26</title>
<path fill="#e58139" stroke="black" d="M1541,-68C1541,-68 1460,-68 1460,-68 1454,-68 1448,-62 1448,-56 1448,-56 1448,-12 1448,-12 1448,-6 1454,-0 1460,-0 1460,-0 1541,-0 1541,-0 1547,-0 1553,-6 1553,-12 1553,-12 1553,-56 1553,-56 1553,-62 1547,-68 1541,-68"/>
<text text-anchor="start" x="1471.5" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="1457" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 31</text>
<text text-anchor="start" x="1456" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [43, 0]</text>
<text text-anchor="start" x="1471.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 24&#45;&gt;26 -->
<g id="edge26" class="edge"><title>24&#45;&gt;26</title>
<path fill="none" stroke="black" d="M1450.29,-103.726C1456.75,-94.879 1463.6,-85.51 1470.09,-76.6303"/>
<polygon fill="black" stroke="black" points="1473.1,-78.439 1476.17,-68.2996 1467.45,-74.3095 1473.1,-78.439"/>
</g>
<!-- 29 -->
<g id="node30" class="node"><title>29</title>
<path fill="#f2c2a0" stroke="black" d="M2156.5,-425C2156.5,-425 2042.5,-425 2042.5,-425 2036.5,-425 2030.5,-419 2030.5,-413 2030.5,-413 2030.5,-354 2030.5,-354 2030.5,-348 2036.5,-342 2042.5,-342 2042.5,-342 2156.5,-342 2156.5,-342 2162.5,-342 2168.5,-348 2168.5,-354 2168.5,-354 2168.5,-413 2168.5,-413 2168.5,-419 2162.5,-425 2156.5,-425"/>
<text text-anchor="start" x="2042" y="-409.8" font-family="Helvetica,sans-Serif" font-size="14.00">src_bytes ≤ 205.0</text>
<text text-anchor="start" x="2066" y="-394.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.45</text>
<text text-anchor="start" x="2048" y="-379.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 1109</text>
<text text-anchor="start" x="2038.5" y="-364.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [1145, 593]</text>
<text text-anchor="start" x="2070.5" y="-349.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 28&#45;&gt;29 -->
<g id="edge29" class="edge"><title>28&#45;&gt;29</title>
<path fill="none" stroke="black" d="M2099.5,-460.907C2099.5,-452.649 2099.5,-443.864 2099.5,-435.302"/>
<polygon fill="black" stroke="black" points="2103,-435.021 2099.5,-425.021 2096,-435.021 2103,-435.021"/>
</g>
<!-- 44 -->
<g id="node45" class="node"><title>44</title>
<path fill="#e6843e" stroke="black" d="M2948.5,-425C2948.5,-425 2818.5,-425 2818.5,-425 2812.5,-425 2806.5,-419 2806.5,-413 2806.5,-413 2806.5,-354 2806.5,-354 2806.5,-348 2812.5,-342 2818.5,-342 2818.5,-342 2948.5,-342 2948.5,-342 2954.5,-342 2960.5,-348 2960.5,-354 2960.5,-354 2960.5,-413 2960.5,-413 2960.5,-419 2954.5,-425 2948.5,-425"/>
<text text-anchor="start" x="2814.5" y="-409.8" font-family="Helvetica,sans-Serif" font-size="14.00">srv_rerror_rate ≤ 0.16</text>
<text text-anchor="start" x="2846" y="-394.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.049</text>
<text text-anchor="start" x="2832" y="-379.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 5762</text>
<text text-anchor="start" x="2822.5" y="-364.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [8898, 230]</text>
<text text-anchor="start" x="2854.5" y="-349.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 28&#45;&gt;44 -->
<g id="edge44" class="edge"><title>28&#45;&gt;44</title>
<path fill="none" stroke="black" d="M2172.55,-490.598C2317.43,-468.977 2640.57,-420.753 2796.3,-397.514"/>
<polygon fill="black" stroke="black" points="2796.93,-400.957 2806.31,-396.02 2795.9,-394.034 2796.93,-400.957"/>
</g>
<!-- 30 -->
<g id="node31" class="node"><title>30</title>
<path fill="#e6843e" stroke="black" d="M2109.5,-306C2109.5,-306 1873.5,-306 1873.5,-306 1867.5,-306 1861.5,-300 1861.5,-294 1861.5,-294 1861.5,-235 1861.5,-235 1861.5,-229 1867.5,-223 1873.5,-223 1873.5,-223 2109.5,-223 2109.5,-223 2115.5,-223 2121.5,-229 2121.5,-235 2121.5,-235 2121.5,-294 2121.5,-294 2121.5,-300 2115.5,-306 2109.5,-306"/>
<text text-anchor="start" x="1869.5" y="-290.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_same_src_port_rate ≤ 0.195</text>
<text text-anchor="start" x="1954" y="-275.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.049</text>
<text text-anchor="start" x="1944" y="-260.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 318</text>
<text text-anchor="start" x="1938.5" y="-245.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [470, 12]</text>
<text text-anchor="start" x="1962.5" y="-230.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 29&#45;&gt;30 -->
<g id="edge30" class="edge"><title>29&#45;&gt;30</title>
<path fill="none" stroke="black" d="M2062.03,-341.907C2053.57,-332.742 2044.51,-322.927 2035.8,-313.489"/>
<polygon fill="black" stroke="black" points="2038.26,-310.995 2028.9,-306.021 2033.11,-315.743 2038.26,-310.995"/>
</g>
<!-- 37 -->
<g id="node38" class="node"><title>37</title>
<path fill="#fbede3" stroke="black" d="M2260.5,-306C2260.5,-306 2154.5,-306 2154.5,-306 2148.5,-306 2142.5,-300 2142.5,-294 2142.5,-294 2142.5,-235 2142.5,-235 2142.5,-229 2148.5,-223 2154.5,-223 2154.5,-223 2260.5,-223 2260.5,-223 2266.5,-223 2272.5,-229 2272.5,-235 2272.5,-235 2272.5,-294 2272.5,-294 2272.5,-300 2266.5,-306 2260.5,-306"/>
<text text-anchor="start" x="2166.5" y="-290.8" font-family="Helvetica,sans-Serif" font-size="14.00">service ≤ 1.5</text>
<text text-anchor="start" x="2170" y="-275.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.497</text>
<text text-anchor="start" x="2160" y="-260.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 791</text>
<text text-anchor="start" x="2150.5" y="-245.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [675, 581]</text>
<text text-anchor="start" x="2178.5" y="-230.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 29&#45;&gt;37 -->
<g id="edge37" class="edge"><title>29&#45;&gt;37</title>
<path fill="none" stroke="black" d="M2136.97,-341.907C2145.43,-332.742 2154.49,-322.927 2163.2,-313.489"/>
<polygon fill="black" stroke="black" points="2165.89,-315.743 2170.1,-306.021 2160.74,-310.995 2165.89,-315.743"/>
</g>
<!-- 31 -->
<g id="node32" class="node"><title>31</title>
<path fill="#e68743" stroke="black" d="M1853,-187C1853,-187 1676,-187 1676,-187 1670,-187 1664,-181 1664,-175 1664,-175 1664,-116 1664,-116 1664,-110 1670,-104 1676,-104 1676,-104 1853,-104 1853,-104 1859,-104 1865,-110 1865,-116 1865,-116 1865,-175 1865,-175 1865,-181 1859,-187 1853,-187"/>
<text text-anchor="start" x="1672" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_serror_rate ≤ 0.005</text>
<text text-anchor="start" x="1731" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.09</text>
<text text-anchor="start" x="1717" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 149</text>
<text text-anchor="start" x="1711.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [202, 10]</text>
<text text-anchor="start" x="1735.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 30&#45;&gt;31 -->
<g id="edge31" class="edge"><title>30&#45;&gt;31</title>
<path fill="none" stroke="black" d="M1912.74,-222.907C1893.2,-212.834 1872.13,-201.977 1852.19,-191.698"/>
<polygon fill="black" stroke="black" points="1853.61,-188.491 1843.12,-187.021 1850.4,-194.713 1853.61,-188.491"/>
</g>
<!-- 34 -->
<g id="node35" class="node"><title>34</title>
<path fill="#e5823a" stroke="black" d="M2085,-187C2085,-187 1898,-187 1898,-187 1892,-187 1886,-181 1886,-175 1886,-175 1886,-116 1886,-116 1886,-110 1892,-104 1898,-104 1898,-104 2085,-104 2085,-104 2091,-104 2097,-110 2097,-116 2097,-116 2097,-175 2097,-175 2097,-181 2091,-187 2085,-187"/>
<text text-anchor="start" x="1894" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_diff_srv_rate ≤ 0.495</text>
<text text-anchor="start" x="1954" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.015</text>
<text text-anchor="start" x="1944" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 169</text>
<text text-anchor="start" x="1943" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [268, 2]</text>
<text text-anchor="start" x="1962.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 30&#45;&gt;34 -->
<g id="edge34" class="edge"><title>30&#45;&gt;34</title>
<path fill="none" stroke="black" d="M1991.5,-222.907C1991.5,-214.649 1991.5,-205.864 1991.5,-197.302"/>
<polygon fill="black" stroke="black" points="1995,-197.021 1991.5,-187.021 1988,-197.021 1995,-197.021"/>
</g>
<!-- 32 -->
<g id="node33" class="node"><title>32</title>
<path fill="#e78845" stroke="black" d="M1681.5,-68C1681.5,-68 1583.5,-68 1583.5,-68 1577.5,-68 1571.5,-62 1571.5,-56 1571.5,-56 1571.5,-12 1571.5,-12 1571.5,-6 1577.5,-0 1583.5,-0 1583.5,-0 1681.5,-0 1681.5,-0 1687.5,-0 1693.5,-6 1693.5,-12 1693.5,-12 1693.5,-56 1693.5,-56 1693.5,-62 1687.5,-68 1681.5,-68"/>
<text text-anchor="start" x="1595" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.106</text>
<text text-anchor="start" x="1585" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 125</text>
<text text-anchor="start" x="1579.5" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [168, 10]</text>
<text text-anchor="start" x="1603.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 31&#45;&gt;32 -->
<g id="edge32" class="edge"><title>31&#45;&gt;32</title>
<path fill="none" stroke="black" d="M1715.35,-103.726C1703.91,-94.2406 1691.76,-84.1551 1680.38,-74.7159"/>
<polygon fill="black" stroke="black" points="1682.57,-71.9905 1672.64,-68.2996 1678.1,-77.3781 1682.57,-71.9905"/>
</g>
<!-- 33 -->
<g id="node34" class="node"><title>33</title>
<path fill="#e58139" stroke="black" d="M1805,-68C1805,-68 1724,-68 1724,-68 1718,-68 1712,-62 1712,-56 1712,-56 1712,-12 1712,-12 1712,-6 1718,-0 1724,-0 1724,-0 1805,-0 1805,-0 1811,-0 1817,-6 1817,-12 1817,-12 1817,-56 1817,-56 1817,-62 1811,-68 1805,-68"/>
<text text-anchor="start" x="1735.5" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="1721" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 24</text>
<text text-anchor="start" x="1720" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [34, 0]</text>
<text text-anchor="start" x="1735.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 31&#45;&gt;33 -->
<g id="edge33" class="edge"><title>31&#45;&gt;33</title>
<path fill="none" stroke="black" d="M1764.5,-103.726C1764.5,-95.5175 1764.5,-86.8595 1764.5,-78.56"/>
<polygon fill="black" stroke="black" points="1768,-78.2996 1764.5,-68.2996 1761,-78.2996 1768,-78.2996"/>
</g>
<!-- 35 -->
<g id="node36" class="node"><title>35</title>
<path fill="#e58139" stroke="black" d="M1936,-68C1936,-68 1847,-68 1847,-68 1841,-68 1835,-62 1835,-56 1835,-56 1835,-12 1835,-12 1835,-6 1841,-0 1847,-0 1847,-0 1936,-0 1936,-0 1942,-0 1948,-6 1948,-12 1948,-12 1948,-56 1948,-56 1948,-62 1942,-68 1936,-68"/>
<text text-anchor="start" x="1862.5" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="1844" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 134</text>
<text text-anchor="start" x="1843" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [215, 0]</text>
<text text-anchor="start" x="1862.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 34&#45;&gt;35 -->
<g id="edge35" class="edge"><title>34&#45;&gt;35</title>
<path fill="none" stroke="black" d="M1954.26,-103.726C1945.93,-94.6054 1937.1,-84.93 1928.77,-75.8078"/>
<polygon fill="black" stroke="black" points="1931.24,-73.3235 1921.91,-68.2996 1926.07,-78.044 1931.24,-73.3235"/>
</g>
<!-- 36 -->
<g id="node37" class="node"><title>36</title>
<path fill="#e68640" stroke="black" d="M2059,-68C2059,-68 1978,-68 1978,-68 1972,-68 1966,-62 1966,-56 1966,-56 1966,-12 1966,-12 1966,-6 1972,-0 1978,-0 1978,-0 2059,-0 2059,-0 2065,-0 2071,-6 2071,-12 2071,-12 2071,-56 2071,-56 2071,-62 2065,-68 2059,-68"/>
<text text-anchor="start" x="1985" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.07</text>
<text text-anchor="start" x="1975" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 35</text>
<text text-anchor="start" x="1974" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [53, 2]</text>
<text text-anchor="start" x="1989.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 34&#45;&gt;36 -->
<g id="edge36" class="edge"><title>34&#45;&gt;36</title>
<path fill="none" stroke="black" d="M2001.55,-103.726C2003.6,-95.4263 2005.76,-86.6671 2007.83,-78.2834"/>
<polygon fill="black" stroke="black" points="2011.29,-78.8467 2010.29,-68.2996 2004.5,-77.1709 2011.29,-78.8467"/>
</g>
<!-- 38 -->
<g id="node39" class="node"><title>38</title>
<path fill="#e99356" stroke="black" d="M2256.5,-187C2256.5,-187 2158.5,-187 2158.5,-187 2152.5,-187 2146.5,-181 2146.5,-175 2146.5,-175 2146.5,-116 2146.5,-116 2146.5,-110 2152.5,-104 2158.5,-104 2158.5,-104 2256.5,-104 2256.5,-104 2262.5,-104 2268.5,-110 2268.5,-116 2268.5,-116 2268.5,-175 2268.5,-175 2268.5,-181 2262.5,-187 2256.5,-187"/>
<text text-anchor="start" x="2180" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">hot ≤ 0.5</text>
<text text-anchor="start" x="2170" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.223</text>
<text text-anchor="start" x="2160" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 467</text>
<text text-anchor="start" x="2154.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [636, 93]</text>
<text text-anchor="start" x="2178.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 37&#45;&gt;38 -->
<g id="edge38" class="edge"><title>37&#45;&gt;38</title>
<path fill="none" stroke="black" d="M2207.5,-222.907C2207.5,-214.649 2207.5,-205.864 2207.5,-197.302"/>
<polygon fill="black" stroke="black" points="2211,-197.021 2207.5,-187.021 2204,-197.021 2211,-197.021"/>
</g>
<!-- 41 -->
<g id="node42" class="node"><title>41</title>
<path fill="#49a5e7" stroke="black" d="M2506.5,-187C2506.5,-187 2304.5,-187 2304.5,-187 2298.5,-187 2292.5,-181 2292.5,-175 2292.5,-175 2292.5,-116 2292.5,-116 2292.5,-110 2298.5,-104 2304.5,-104 2304.5,-104 2506.5,-104 2506.5,-104 2512.5,-104 2518.5,-110 2518.5,-116 2518.5,-116 2518.5,-175 2518.5,-175 2518.5,-181 2512.5,-187 2506.5,-187"/>
<text text-anchor="start" x="2300.5" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">dst_host_same_srv_rate ≤ 0.015</text>
<text text-anchor="start" x="2368" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.137</text>
<text text-anchor="start" x="2358" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 324</text>
<text text-anchor="start" x="2352.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [39, 488]</text>
<text text-anchor="start" x="2376.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 37&#45;&gt;41 -->
<g id="edge41" class="edge"><title>37&#45;&gt;41</title>
<path fill="none" stroke="black" d="M2272.61,-225.028C2290.33,-214.553 2309.71,-203.105 2328.05,-192.269"/>
<polygon fill="black" stroke="black" points="2330.12,-195.106 2336.95,-187.005 2326.56,-189.079 2330.12,-195.106"/>
</g>
<!-- 39 -->
<g id="node40" class="node"><title>39</title>
<path fill="#e89153" stroke="black" d="M2199.5,-68C2199.5,-68 2101.5,-68 2101.5,-68 2095.5,-68 2089.5,-62 2089.5,-56 2089.5,-56 2089.5,-12 2089.5,-12 2089.5,-6 2095.5,-0 2101.5,-0 2101.5,-0 2199.5,-0 2199.5,-0 2205.5,-0 2211.5,-6 2211.5,-12 2211.5,-12 2211.5,-56 2211.5,-56 2211.5,-62 2205.5,-68 2199.5,-68"/>
<text text-anchor="start" x="2113" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.204</text>
<text text-anchor="start" x="2103" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 459</text>
<text text-anchor="start" x="2097.5" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [636, 83]</text>
<text text-anchor="start" x="2121.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 38&#45;&gt;39 -->
<g id="edge39" class="edge"><title>38&#45;&gt;39</title>
<path fill="none" stroke="black" d="M2186.28,-103.726C2181.76,-95.0615 2176.99,-85.8962 2172.46,-77.1802"/>
<polygon fill="black" stroke="black" points="2175.56,-75.5537 2167.83,-68.2996 2169.35,-78.7859 2175.56,-75.5537"/>
</g>
<!-- 40 -->
<g id="node41" class="node"><title>40</title>
<path fill="#399de5" stroke="black" d="M2323,-68C2323,-68 2242,-68 2242,-68 2236,-68 2230,-62 2230,-56 2230,-56 2230,-12 2230,-12 2230,-6 2236,-0 2242,-0 2242,-0 2323,-0 2323,-0 2329,-0 2335,-6 2335,-12 2335,-12 2335,-56 2335,-56 2335,-62 2329,-68 2323,-68"/>
<text text-anchor="start" x="2253.5" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="2243" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 8</text>
<text text-anchor="start" x="2238" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [0, 10]</text>
<text text-anchor="start" x="2253.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 38&#45;&gt;40 -->
<g id="edge40" class="edge"><title>38&#45;&gt;40</title>
<path fill="none" stroke="black" d="M2235.43,-103.726C2241.49,-94.879 2247.9,-85.51 2253.99,-76.6303"/>
<polygon fill="black" stroke="black" points="2256.93,-78.5277 2259.69,-68.2996 2251.15,-74.5721 2256.93,-78.5277"/>
</g>
<!-- 42 -->
<g id="node43" class="node"><title>42</title>
<path fill="#ea9b62" stroke="black" d="M2446,-68C2446,-68 2365,-68 2365,-68 2359,-68 2353,-62 2353,-56 2353,-56 2353,-12 2353,-12 2353,-6 2359,-0 2365,-0 2365,-0 2446,-0 2446,-0 2452,-0 2458,-6 2458,-12 2458,-12 2458,-56 2458,-56 2458,-62 2452,-68 2446,-68"/>
<text text-anchor="start" x="2368" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.283</text>
<text text-anchor="start" x="2362" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 22</text>
<text text-anchor="start" x="2361" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [34, 7]</text>
<text text-anchor="start" x="2376.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 41&#45;&gt;42 -->
<g id="edge42" class="edge"><title>41&#45;&gt;42</title>
<path fill="none" stroke="black" d="M2405.5,-103.726C2405.5,-95.5175 2405.5,-86.8595 2405.5,-78.56"/>
<polygon fill="black" stroke="black" points="2409,-78.2996 2405.5,-68.2996 2402,-78.2996 2409,-78.2996"/>
</g>
<!-- 43 -->
<g id="node44" class="node"><title>43</title>
<path fill="#3b9ee5" stroke="black" d="M2577,-68C2577,-68 2488,-68 2488,-68 2482,-68 2476,-62 2476,-56 2476,-56 2476,-12 2476,-12 2476,-6 2482,-0 2488,-0 2488,-0 2577,-0 2577,-0 2583,-0 2589,-6 2589,-12 2589,-12 2589,-56 2589,-56 2589,-62 2583,-68 2577,-68"/>
<text text-anchor="start" x="2499" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.02</text>
<text text-anchor="start" x="2485" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 302</text>
<text text-anchor="start" x="2484" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [5, 481]</text>
<text text-anchor="start" x="2503.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 41&#45;&gt;43 -->
<g id="edge43" class="edge"><title>41&#45;&gt;43</title>
<path fill="none" stroke="black" d="M2452.79,-103.726C2463.69,-94.3318 2475.26,-84.349 2486.12,-74.9883"/>
<polygon fill="black" stroke="black" points="2488.59,-77.4804 2493.88,-68.2996 2484.02,-72.1789 2488.59,-77.4804"/>
</g>
<!-- 45 -->
<g id="node46" class="node"><title>45</title>
<path fill="#e5833d" stroke="black" d="M2943.5,-306C2943.5,-306 2823.5,-306 2823.5,-306 2817.5,-306 2811.5,-300 2811.5,-294 2811.5,-294 2811.5,-235 2811.5,-235 2811.5,-229 2817.5,-223 2823.5,-223 2823.5,-223 2943.5,-223 2943.5,-223 2949.5,-223 2955.5,-229 2955.5,-235 2955.5,-235 2955.5,-294 2955.5,-294 2955.5,-300 2949.5,-306 2943.5,-306"/>
<text text-anchor="start" x="2819.5" y="-290.8" font-family="Helvetica,sans-Serif" font-size="14.00">is_guest_login ≤ 0.5</text>
<text text-anchor="start" x="2846" y="-275.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.035</text>
<text text-anchor="start" x="2832" y="-260.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 5665</text>
<text text-anchor="start" x="2822.5" y="-245.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [8820, 160]</text>
<text text-anchor="start" x="2854.5" y="-230.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 44&#45;&gt;45 -->
<g id="edge45" class="edge"><title>44&#45;&gt;45</title>
<path fill="none" stroke="black" d="M2883.5,-341.907C2883.5,-333.649 2883.5,-324.864 2883.5,-316.302"/>
<polygon fill="black" stroke="black" points="2887,-316.021 2883.5,-306.021 2880,-316.021 2887,-316.021"/>
</g>
<!-- 52 -->
<g id="node53" class="node"><title>52</title>
<path fill="#fcf2eb" stroke="black" d="M3297,-306C3297,-306 3208,-306 3208,-306 3202,-306 3196,-300 3196,-294 3196,-294 3196,-235 3196,-235 3196,-229 3202,-223 3208,-223 3208,-223 3297,-223 3297,-223 3303,-223 3309,-229 3309,-235 3309,-235 3309,-294 3309,-294 3309,-300 3303,-306 3297,-306"/>
<text text-anchor="start" x="3217.5" y="-290.8" font-family="Helvetica,sans-Serif" font-size="14.00">count ≤ 1.5</text>
<text text-anchor="start" x="3215" y="-275.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.499</text>
<text text-anchor="start" x="3209" y="-260.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 97</text>
<text text-anchor="start" x="3204" y="-245.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [78, 70]</text>
<text text-anchor="start" x="3223.5" y="-230.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 44&#45;&gt;52 -->
<g id="edge52" class="edge"><title>44&#45;&gt;52</title>
<path fill="none" stroke="black" d="M2960.85,-357.973C3027.45,-336.856 3122.56,-306.701 3185.85,-286.634"/>
<polygon fill="black" stroke="black" points="3187.25,-289.862 3195.72,-283.503 3185.13,-283.189 3187.25,-289.862"/>
</g>
<!-- 46 -->
<g id="node47" class="node"><title>46</title>
<path fill="#e5833c" stroke="black" d="M2869,-187C2869,-187 2746,-187 2746,-187 2740,-187 2734,-181 2734,-175 2734,-175 2734,-116 2734,-116 2734,-110 2740,-104 2746,-104 2746,-104 2869,-104 2869,-104 2875,-104 2881,-110 2881,-116 2881,-116 2881,-175 2881,-175 2881,-181 2875,-187 2869,-187"/>
<text text-anchor="start" x="2742" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">src_bytes ≤ 49664.0</text>
<text text-anchor="start" x="2770" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.025</text>
<text text-anchor="start" x="2756" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 5546</text>
<text text-anchor="start" x="2746.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [8679, 113]</text>
<text text-anchor="start" x="2778.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 45&#45;&gt;46 -->
<g id="edge46" class="edge"><title>45&#45;&gt;46</title>
<path fill="none" stroke="black" d="M2857.13,-222.907C2851.41,-214.105 2845.31,-204.703 2839.4,-195.612"/>
<polygon fill="black" stroke="black" points="2842.2,-193.5 2833.82,-187.021 2836.33,-197.313 2842.2,-193.5"/>
</g>
<!-- 49 -->
<g id="node50" class="node"><title>49</title>
<path fill="#eeab7b" stroke="black" d="M3009.5,-187C3009.5,-187 2911.5,-187 2911.5,-187 2905.5,-187 2899.5,-181 2899.5,-175 2899.5,-175 2899.5,-116 2899.5,-116 2899.5,-110 2905.5,-104 2911.5,-104 2911.5,-104 3009.5,-104 3009.5,-104 3015.5,-104 3021.5,-110 3021.5,-116 3021.5,-116 3021.5,-175 3021.5,-175 3021.5,-181 3015.5,-187 3009.5,-187"/>
<text text-anchor="start" x="2928.5" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">hot ≤ 26.0</text>
<text text-anchor="start" x="2923" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.375</text>
<text text-anchor="start" x="2913" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 119</text>
<text text-anchor="start" x="2907.5" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [141, 47]</text>
<text text-anchor="start" x="2931.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 45&#45;&gt;49 -->
<g id="edge49" class="edge"><title>45&#45;&gt;49</title>
<path fill="none" stroke="black" d="M2910.21,-222.907C2916.01,-214.105 2922.2,-204.703 2928.18,-195.612"/>
<polygon fill="black" stroke="black" points="2931.26,-197.298 2933.83,-187.021 2925.41,-193.45 2931.26,-197.298"/>
</g>
<!-- 47 -->
<g id="node48" class="node"><title>47</title>
<path fill="#e58139" stroke="black" d="M2725.5,-68C2725.5,-68 2619.5,-68 2619.5,-68 2613.5,-68 2607.5,-62 2607.5,-56 2607.5,-56 2607.5,-12 2607.5,-12 2607.5,-6 2613.5,-0 2619.5,-0 2619.5,-0 2725.5,-0 2725.5,-0 2731.5,-0 2737.5,-6 2737.5,-12 2737.5,-12 2737.5,-56 2737.5,-56 2737.5,-62 2731.5,-68 2725.5,-68"/>
<text text-anchor="start" x="2635" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.003</text>
<text text-anchor="start" x="2621" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 5472</text>
<text text-anchor="start" x="2615.5" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [8666, 12]</text>
<text text-anchor="start" x="2643.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 46&#45;&gt;47 -->
<g id="edge47" class="edge"><title>46&#45;&gt;47</title>
<path fill="none" stroke="black" d="M2757.23,-103.726C2745.54,-94.2406 2733.1,-84.1551 2721.46,-74.7159"/>
<polygon fill="black" stroke="black" points="2723.53,-71.8808 2713.55,-68.2996 2719.12,-77.3173 2723.53,-71.8808"/>
</g>
<!-- 48 -->
<g id="node49" class="node"><title>48</title>
<path fill="#52aae8" stroke="black" d="M2865.5,-68C2865.5,-68 2767.5,-68 2767.5,-68 2761.5,-68 2755.5,-62 2755.5,-56 2755.5,-56 2755.5,-12 2755.5,-12 2755.5,-6 2761.5,-0 2767.5,-0 2767.5,-0 2865.5,-0 2865.5,-0 2871.5,-0 2877.5,-6 2877.5,-12 2877.5,-12 2877.5,-56 2877.5,-56 2877.5,-62 2871.5,-68 2865.5,-68"/>
<text text-anchor="start" x="2779" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.202</text>
<text text-anchor="start" x="2773" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 74</text>
<text text-anchor="start" x="2763.5" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [13, 101]</text>
<text text-anchor="start" x="2787.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 46&#45;&gt;48 -->
<g id="edge48" class="edge"><title>46&#45;&gt;48</title>
<path fill="none" stroke="black" d="M2810.85,-103.726C2811.53,-95.4263 2812.25,-86.6671 2812.94,-78.2834"/>
<polygon fill="black" stroke="black" points="2816.43,-78.5527 2813.76,-68.2996 2809.46,-77.9793 2816.43,-78.5527"/>
</g>
<!-- 50 -->
<g id="node51" class="node"><title>50</title>
<path fill="#e78845" stroke="black" d="M2997,-68C2997,-68 2908,-68 2908,-68 2902,-68 2896,-62 2896,-56 2896,-56 2896,-12 2896,-12 2896,-6 2902,-0 2908,-0 2908,-0 2997,-0 2997,-0 3003,-0 3009,-6 3009,-12 3009,-12 3009,-56 3009,-56 3009,-62 3003,-68 2997,-68"/>
<text text-anchor="start" x="2915" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.104</text>
<text text-anchor="start" x="2909" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 66</text>
<text text-anchor="start" x="2904" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [103, 6]</text>
<text text-anchor="start" x="2923.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 49&#45;&gt;50 -->
<g id="edge50" class="edge"><title>49&#45;&gt;50</title>
<path fill="none" stroke="black" d="M2957.52,-103.726C2956.91,-95.4263 2956.27,-86.6671 2955.66,-78.2834"/>
<polygon fill="black" stroke="black" points="2959.15,-78.018 2954.93,-68.2996 2952.17,-78.5281 2959.15,-78.018"/>
</g>
<!-- 51 -->
<g id="node52" class="node"><title>51</title>
<path fill="#f1f8fd" stroke="black" d="M3128,-68C3128,-68 3039,-68 3039,-68 3033,-68 3027,-62 3027,-56 3027,-56 3027,-12 3027,-12 3027,-6 3033,-0 3039,-0 3039,-0 3128,-0 3128,-0 3134,-0 3140,-6 3140,-12 3140,-12 3140,-56 3140,-56 3140,-62 3134,-68 3128,-68"/>
<text text-anchor="start" x="3046" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.499</text>
<text text-anchor="start" x="3040" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 53</text>
<text text-anchor="start" x="3035" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [38, 41]</text>
<text text-anchor="start" x="3054.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 49&#45;&gt;51 -->
<g id="edge51" class="edge"><title>49&#45;&gt;51</title>
<path fill="none" stroke="black" d="M3006.3,-103.726C3016.85,-94.3318 3028.07,-84.349 3038.58,-74.9883"/>
<polygon fill="black" stroke="black" points="3040.95,-77.5631 3046.09,-68.2996 3036.3,-72.3347 3040.95,-77.5631"/>
</g>
<!-- 53 -->
<g id="node54" class="node"><title>53</title>
<path fill="#ea975c" stroke="black" d="M3293,-187C3293,-187 3212,-187 3212,-187 3206,-187 3200,-181 3200,-175 3200,-175 3200,-116 3200,-116 3200,-110 3206,-104 3212,-104 3212,-104 3293,-104 3293,-104 3299,-104 3305,-110 3305,-116 3305,-116 3305,-175 3305,-175 3305,-181 3299,-187 3293,-187"/>
<text text-anchor="start" x="3225" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">hot ≤ 0.5</text>
<text text-anchor="start" x="3215" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.256</text>
<text text-anchor="start" x="3209" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 34</text>
<text text-anchor="start" x="3208" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [45, 8]</text>
<text text-anchor="start" x="3223.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 52&#45;&gt;53 -->
<g id="edge53" class="edge"><title>52&#45;&gt;53</title>
<path fill="none" stroke="black" d="M3252.5,-222.907C3252.5,-214.649 3252.5,-205.864 3252.5,-197.302"/>
<polygon fill="black" stroke="black" points="3256,-197.021 3252.5,-187.021 3249,-197.021 3256,-197.021"/>
</g>
<!-- 56 -->
<g id="node57" class="node"><title>56</title>
<path fill="#a2d1f3" stroke="black" d="M3528,-187C3528,-187 3377,-187 3377,-187 3371,-187 3365,-181 3365,-175 3365,-175 3365,-116 3365,-116 3365,-110 3371,-104 3377,-104 3377,-104 3528,-104 3528,-104 3534,-104 3540,-110 3540,-116 3540,-116 3540,-175 3540,-175 3540,-181 3534,-187 3528,-187"/>
<text text-anchor="start" x="3373" y="-171.8" font-family="Helvetica,sans-Serif" font-size="14.00">num_compromised ≤ 0.5</text>
<text text-anchor="start" x="3415" y="-156.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.453</text>
<text text-anchor="start" x="3409" y="-141.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 63</text>
<text text-anchor="start" x="3404" y="-126.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [33, 62]</text>
<text text-anchor="start" x="3423.5" y="-111.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 52&#45;&gt;56 -->
<g id="edge56" class="edge"><title>52&#45;&gt;56</title>
<path fill="none" stroke="black" d="M3309.01,-230.442C3329.21,-218.623 3352.36,-205.083 3374.08,-192.377"/>
<polygon fill="black" stroke="black" points="3376.1,-195.251 3382.96,-187.18 3372.56,-189.209 3376.1,-195.251"/>
</g>
<!-- 54 -->
<g id="node55" class="node"><title>54</title>
<path fill="#e58139" stroke="black" d="M3251,-68C3251,-68 3170,-68 3170,-68 3164,-68 3158,-62 3158,-56 3158,-56 3158,-12 3158,-12 3158,-6 3164,-0 3170,-0 3170,-0 3251,-0 3251,-0 3257,-0 3263,-6 3263,-12 3263,-12 3263,-56 3263,-56 3263,-62 3257,-68 3251,-68"/>
<text text-anchor="start" x="3181.5" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.0</text>
<text text-anchor="start" x="3167" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 27</text>
<text text-anchor="start" x="3166" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [42, 0]</text>
<text text-anchor="start" x="3181.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 53&#45;&gt;54 -->
<g id="edge54" class="edge"><title>53&#45;&gt;54</title>
<path fill="none" stroke="black" d="M3236.86,-103.726C3233.61,-95.2439 3230.17,-86.2819 3226.89,-77.7312"/>
<polygon fill="black" stroke="black" points="3230.12,-76.3829 3223.27,-68.2996 3223.59,-78.8898 3230.12,-76.3829"/>
</g>
<!-- 55 -->
<g id="node56" class="node"><title>55</title>
<path fill="#83c2ef" stroke="black" d="M3366,-68C3366,-68 3293,-68 3293,-68 3287,-68 3281,-62 3281,-56 3281,-56 3281,-12 3281,-12 3281,-6 3287,-0 3293,-0 3293,-0 3366,-0 3366,-0 3372,-0 3378,-6 3378,-12 3378,-12 3378,-56 3378,-56 3378,-62 3372,-68 3366,-68"/>
<text text-anchor="start" x="3292" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.397</text>
<text text-anchor="start" x="3290" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 7</text>
<text text-anchor="start" x="3289" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [3, 8]</text>
<text text-anchor="start" x="3300.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 53&#45;&gt;55 -->
<g id="edge55" class="edge"><title>53&#45;&gt;55</title>
<path fill="none" stroke="black" d="M3281.17,-103.726C3287.39,-94.879 3293.98,-85.51 3300.23,-76.6303"/>
<polygon fill="black" stroke="black" points="3303.19,-78.4929 3306.08,-68.2996 3297.47,-74.4664 3303.19,-78.4929"/>
</g>
<!-- 57 -->
<g id="node58" class="node"><title>57</title>
<path fill="#fbeee4" stroke="black" d="M3497,-68C3497,-68 3408,-68 3408,-68 3402,-68 3396,-62 3396,-56 3396,-56 3396,-12 3396,-12 3396,-6 3402,-0 3408,-0 3408,-0 3497,-0 3497,-0 3503,-0 3509,-6 3509,-12 3509,-12 3509,-56 3509,-56 3509,-62 3503,-68 3497,-68"/>
<text text-anchor="start" x="3415" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.497</text>
<text text-anchor="start" x="3409" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 33</text>
<text text-anchor="start" x="3404" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [29, 25]</text>
<text text-anchor="start" x="3423.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 0</text>
</g>
<!-- 56&#45;&gt;57 -->
<g id="edge57" class="edge"><title>56&#45;&gt;57</title>
<path fill="none" stroke="black" d="M3452.5,-103.726C3452.5,-95.5175 3452.5,-86.8595 3452.5,-78.56"/>
<polygon fill="black" stroke="black" points="3456,-78.2996 3452.5,-68.2996 3449,-78.2996 3456,-78.2996"/>
</g>
<!-- 58 -->
<g id="node59" class="node"><title>58</title>
<path fill="#4ea8e8" stroke="black" d="M3620,-68C3620,-68 3539,-68 3539,-68 3533,-68 3527,-62 3527,-56 3527,-56 3527,-12 3527,-12 3527,-6 3533,-0 3539,-0 3539,-0 3620,-0 3620,-0 3626,-0 3632,-6 3632,-12 3632,-12 3632,-56 3632,-56 3632,-62 3626,-68 3620,-68"/>
<text text-anchor="start" x="3542" y="-52.8" font-family="Helvetica,sans-Serif" font-size="14.00">gini = 0.176</text>
<text text-anchor="start" x="3536" y="-37.8" font-family="Helvetica,sans-Serif" font-size="14.00">samples = 30</text>
<text text-anchor="start" x="3535" y="-22.8" font-family="Helvetica,sans-Serif" font-size="14.00">value = [4, 37]</text>
<text text-anchor="start" x="3550.5" y="-7.8" font-family="Helvetica,sans-Serif" font-size="14.00">class = 1</text>
</g>
<!-- 56&#45;&gt;58 -->
<g id="edge58" class="edge"><title>56&#45;&gt;58</title>
<path fill="none" stroke="black" d="M3499.79,-103.726C3510.69,-94.3318 3522.26,-84.349 3533.12,-74.9883"/>
<polygon fill="black" stroke="black" points="3535.59,-77.4804 3540.88,-68.2996 3531.02,-72.1789 3535.59,-77.4804"/>
</g>
</g>
</svg>
experiment/random forest/output/random forest 0 → 100644
+ 565
− 0
View file @ 44fbba61
digraph Tree {
node [shape=box, style="filled, rounded", color="black", fontname=helvetica] ;
edge [fontname=helvetica] ;
0 [label=<src_bytes &le; 28.5<br/>entropy = 0.994<br/>samples = 11238<br/>value = [9597, 8037]<br/>class = Normal>, fillcolor="#fbebdf"] ;
1 [label=<dst_host_count &le; 243.0<br/>entropy = 0.399<br/>samples = 5132<br/>value = [627, 7309]<br/>class = Abnormal>, fillcolor="#4aa5e7"] ;
0 -> 1 [labeldistance=2.5, labelangle=45, headlabel="True"] ;
2 [label=<protocol_type &le; 1.5<br/>entropy = 0.928<br/>samples = 1043<br/>value = [552, 1054]<br/>class = Abnormal>, fillcolor="#a1d0f3"] ;
1 -> 2 ;
3 [label=<dst_host_same_srv_rate &le; 0.625<br/>entropy = 0.998<br/>samples = 674<br/>value = [552, 493]<br/>class = Normal>, fillcolor="#fcf2ea"] ;
2 -> 3 ;
4 [label=<dst_host_serror_rate &le; 0.07<br/>entropy = 0.779<br/>samples = 393<br/>value = [140, 467]<br/>class = Abnormal>, fillcolor="#74baed"] ;
3 -> 4 ;
5 [label=<dst_host_rerror_rate &le; 0.09<br/>entropy = 0.983<br/>samples = 215<br/>value = [140, 190]<br/>class = Abnormal>, fillcolor="#cbe5f8"] ;
4 -> 5 ;
6 [label=<count &le; 4.5<br/>entropy = 0.729<br/>samples = 107<br/>value = [129, 33]<br/>class = Normal>, fillcolor="#eca16c"] ;
5 -> 6 ;
7 [label=<dst_host_srv_count &le; 2.5<br/>entropy = 0.231<br/>samples = 86<br/>value = [128, 5]<br/>class = Normal>, fillcolor="#e68641"] ;
6 -> 7 ;
8 [label=<dst_host_serror_rate &le; 0.005<br/>entropy = 0.98<br/>samples = 9<br/>value = [7, 5]<br/>class = Normal>, fillcolor="#f8dbc6"] ;
7 -> 8 ;
9 [label=<dst_host_diff_srv_rate &le; 0.04<br/>entropy = 0.863<br/>samples = 6<br/>value = [2, 5]<br/>class = Abnormal>, fillcolor="#88c4ef"] ;
8 -> 9 ;
10 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
9 -> 10 ;
11 [label=<dst_host_srv_rerror_rate &le; 0.5<br/>entropy = 0.65<br/>samples = 5<br/>value = [1, 5]<br/>class = Abnormal>, fillcolor="#61b1ea"] ;
9 -> 11 ;
12 [label=<num_root &le; 0.5<br/>entropy = 1.0<br/>samples = 2<br/>value = [1, 1]<br/>class = Normal>, fillcolor="#ffffff"] ;
11 -> 12 ;
13 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
12 -> 13 ;
14 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
12 -> 14 ;
15 [label=<entropy = 0.0<br/>samples = 3<br/>value = [0, 4]<br/>class = Abnormal>, fillcolor="#399de5"] ;
11 -> 15 ;
16 [label=<entropy = 0.0<br/>samples = 3<br/>value = [5, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
8 -> 16 ;
17 [label=<entropy = 0.0<br/>samples = 77<br/>value = [121, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
7 -> 17 ;
18 [label=<same_srv_rate &le; 0.185<br/>entropy = 0.216<br/>samples = 21<br/>value = [1, 28]<br/>class = Abnormal>, fillcolor="#40a0e6"] ;
6 -> 18 ;
19 [label=<count &le; 20.0<br/>entropy = 1.0<br/>samples = 2<br/>value = [1, 1]<br/>class = Normal>, fillcolor="#ffffff"] ;
18 -> 19 ;
20 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
19 -> 20 ;
21 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
19 -> 21 ;
22 [label=<entropy = 0.0<br/>samples = 19<br/>value = [0, 27]<br/>class = Abnormal>, fillcolor="#399de5"] ;
18 -> 22 ;
23 [label=<dst_host_diff_srv_rate &le; 0.04<br/>entropy = 0.349<br/>samples = 108<br/>value = [11, 157]<br/>class = Abnormal>, fillcolor="#47a4e7"] ;
5 -> 23 ;
24 [label=<entropy = 0.0<br/>samples = 2<br/>value = [4, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
23 -> 24 ;
25 [label=<logged_in &le; 0.5<br/>entropy = 0.254<br/>samples = 106<br/>value = [7, 157]<br/>class = Abnormal>, fillcolor="#42a1e6"] ;
23 -> 25 ;
26 [label=<rerror_rate &le; 0.975<br/>entropy = 0.203<br/>samples = 102<br/>value = [5, 153]<br/>class = Abnormal>, fillcolor="#3fa0e6"] ;
25 -> 26 ;
27 [label=<entropy = 0.0<br/>samples = 16<br/>value = [0, 24]<br/>class = Abnormal>, fillcolor="#399de5"] ;
26 -> 27 ;
28 [label=<service &le; 52.0<br/>entropy = 0.23<br/>samples = 86<br/>value = [5, 129]<br/>class = Abnormal>, fillcolor="#41a1e6"] ;
26 -> 28 ;
29 [label=<entropy = 0.0<br/>samples = 71<br/>value = [0, 109]<br/>class = Abnormal>, fillcolor="#399de5"] ;
28 -> 29 ;
30 [label=<dst_host_srv_count &le; 2.5<br/>entropy = 0.722<br/>samples = 15<br/>value = [5, 20]<br/>class = Abnormal>, fillcolor="#6ab6ec"] ;
28 -> 30 ;
31 [label=<entropy = 0.0<br/>samples = 9<br/>value = [0, 15]<br/>class = Abnormal>, fillcolor="#399de5"] ;
30 -> 31 ;
32 [label=<dst_host_srv_diff_host_rate &le; 0.5<br/>entropy = 1.0<br/>samples = 6<br/>value = [5, 5]<br/>class = Normal>, fillcolor="#ffffff"] ;
30 -> 32 ;
33 [label=<srv_count &le; 3.5<br/>entropy = 0.954<br/>samples = 5<br/>value = [5, 3]<br/>class = Normal>, fillcolor="#f5cdb0"] ;
32 -> 33 ;
34 [label=<entropy = 0.0<br/>samples = 4<br/>value = [5, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
33 -> 34 ;
35 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 3]<br/>class = Abnormal>, fillcolor="#399de5"] ;
33 -> 35 ;
36 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
32 -> 36 ;
37 [label=<dst_host_srv_count &le; 109.5<br/>entropy = 0.918<br/>samples = 4<br/>value = [2, 4]<br/>class = Abnormal>, fillcolor="#9ccef2"] ;
25 -> 37 ;
38 [label=<entropy = 0.0<br/>samples = 3<br/>value = [0, 4]<br/>class = Abnormal>, fillcolor="#399de5"] ;
37 -> 38 ;
39 [label=<entropy = 0.0<br/>samples = 1<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
37 -> 39 ;
40 [label=<entropy = 0.0<br/>samples = 178<br/>value = [0, 277]<br/>class = Abnormal>, fillcolor="#399de5"] ;
4 -> 40 ;
41 [label=<dst_host_srv_diff_host_rate &le; 0.005<br/>entropy = 0.325<br/>samples = 281<br/>value = [412, 26]<br/>class = Normal>, fillcolor="#e78945"] ;
3 -> 41 ;
42 [label=<dst_host_count &le; 22.5<br/>entropy = 0.918<br/>samples = 38<br/>value = [40, 20]<br/>class = Normal>, fillcolor="#f2c09c"] ;
41 -> 42 ;
43 [label=<protocol_type &le; 0.5<br/>entropy = 0.938<br/>samples = 21<br/>value = [11, 20]<br/>class = Abnormal>, fillcolor="#a6d3f3"] ;
42 -> 43 ;
44 [label=<srv_count &le; 2.5<br/>entropy = 0.929<br/>samples = 19<br/>value = [10, 19]<br/>class = Abnormal>, fillcolor="#a1d1f3"] ;
43 -> 44 ;
45 [label=<service &le; 50.5<br/>entropy = 0.991<br/>samples = 12<br/>value = [10, 8]<br/>class = Normal>, fillcolor="#fae6d7"] ;
44 -> 45 ;
46 [label=<entropy = 0.0<br/>samples = 6<br/>value = [0, 7]<br/>class = Abnormal>, fillcolor="#399de5"] ;
45 -> 46 ;
47 [label=<dst_host_same_src_port_rate &le; 0.32<br/>entropy = 0.439<br/>samples = 6<br/>value = [10, 1]<br/>class = Normal>, fillcolor="#e88e4d"] ;
45 -> 47 ;
48 [label=<entropy = 0.0<br/>samples = 4<br/>value = [9, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
47 -> 48 ;
49 [label=<srv_serror_rate &le; 0.5<br/>entropy = 1.0<br/>samples = 2<br/>value = [1, 1]<br/>class = Normal>, fillcolor="#ffffff"] ;
47 -> 49 ;
50 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
49 -> 50 ;
51 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
49 -> 51 ;
52 [label=<entropy = 0.0<br/>samples = 7<br/>value = [0, 11]<br/>class = Abnormal>, fillcolor="#399de5"] ;
44 -> 52 ;
53 [label=<dst_host_same_src_port_rate &le; 0.375<br/>entropy = 1.0<br/>samples = 2<br/>value = [1, 1]<br/>class = Normal>, fillcolor="#ffffff"] ;
43 -> 53 ;
54 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
53 -> 54 ;
55 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
53 -> 55 ;
56 [label=<entropy = 0.0<br/>samples = 17<br/>value = [29, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
42 -> 56 ;
57 [label=<service &le; 9.0<br/>entropy = 0.118<br/>samples = 243<br/>value = [372, 6]<br/>class = Normal>, fillcolor="#e5833c"] ;
41 -> 57 ;
58 [label=<dst_host_diff_srv_rate &le; 0.015<br/>entropy = 0.792<br/>samples = 11<br/>value = [16, 5]<br/>class = Normal>, fillcolor="#eda877"] ;
57 -> 58 ;
59 [label=<entropy = 0.0<br/>samples = 3<br/>value = [0, 5]<br/>class = Abnormal>, fillcolor="#399de5"] ;
58 -> 59 ;
60 [label=<entropy = 0.0<br/>samples = 8<br/>value = [16, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
58 -> 60 ;
61 [label=<rerror_rate &le; 0.165<br/>entropy = 0.028<br/>samples = 232<br/>value = [356, 1]<br/>class = Normal>, fillcolor="#e5813a"] ;
57 -> 61 ;
62 [label=<land &le; 0.5<br/>entropy = 0.169<br/>samples = 28<br/>value = [39, 1]<br/>class = Normal>, fillcolor="#e6843e"] ;
61 -> 62 ;
63 [label=<entropy = 0.0<br/>samples = 27<br/>value = [39, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
62 -> 63 ;
64 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
62 -> 64 ;
65 [label=<entropy = 0.0<br/>samples = 204<br/>value = [317, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
61 -> 65 ;
66 [label=<entropy = 0.0<br/>samples = 369<br/>value = [0, 561]<br/>class = Abnormal>, fillcolor="#399de5"] ;
2 -> 66 ;
67 [label=<dst_host_srv_serror_rate &le; 0.955<br/>entropy = 0.093<br/>samples = 4089<br/>value = [75, 6255]<br/>class = Abnormal>, fillcolor="#3b9ee5"] ;
1 -> 67 ;
68 [label=<diff_srv_rate &le; 0.005<br/>entropy = 0.244<br/>samples = 1189<br/>value = [75, 1787]<br/>class = Abnormal>, fillcolor="#41a1e6"] ;
67 -> 68 ;
69 [label=<dst_host_same_srv_rate &le; 0.015<br/>entropy = 0.648<br/>samples = 255<br/>value = [66, 332]<br/>class = Abnormal>, fillcolor="#60b0ea"] ;
68 -> 69 ;
70 [label=<dst_host_srv_rerror_rate &le; 0.665<br/>entropy = 0.069<br/>samples = 155<br/>value = [2, 239]<br/>class = Abnormal>, fillcolor="#3b9ee5"] ;
69 -> 70 ;
71 [label=<src_bytes &le; 5.5<br/>entropy = 0.764<br/>samples = 7<br/>value = [2, 7]<br/>class = Abnormal>, fillcolor="#72b9ec"] ;
70 -> 71 ;
72 [label=<entropy = 0.0<br/>samples = 4<br/>value = [0, 6]<br/>class = Abnormal>, fillcolor="#399de5"] ;
71 -> 72 ;
73 [label=<protocol_type &le; 0.5<br/>entropy = 0.918<br/>samples = 3<br/>value = [2, 1]<br/>class = Normal>, fillcolor="#f2c09c"] ;
71 -> 73 ;
74 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
73 -> 74 ;
75 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
73 -> 75 ;
76 [label=<entropy = 0.0<br/>samples = 148<br/>value = [0, 232]<br/>class = Abnormal>, fillcolor="#399de5"] ;
70 -> 76 ;
77 [label=<src_bytes &le; 26.0<br/>entropy = 0.975<br/>samples = 100<br/>value = [64, 93]<br/>class = Abnormal>, fillcolor="#c1e0f7"] ;
69 -> 77 ;
78 [label=<protocol_type &le; 0.5<br/>entropy = 0.82<br/>samples = 51<br/>value = [64, 22]<br/>class = Normal>, fillcolor="#eeac7d"] ;
77 -> 78 ;
79 [label=<dst_host_diff_srv_rate &le; 0.045<br/>entropy = 0.235<br/>samples = 32<br/>value = [50, 2]<br/>class = Normal>, fillcolor="#e68641"] ;
78 -> 79 ;
80 [label=<entropy = 0.0<br/>samples = 23<br/>value = [40, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
79 -> 80 ;
81 [label=<service &le; 50.5<br/>entropy = 0.65<br/>samples = 9<br/>value = [10, 2]<br/>class = Normal>, fillcolor="#ea9a61"] ;
79 -> 81 ;
82 [label=<dst_host_serror_rate &le; 0.365<br/>entropy = 0.918<br/>samples = 3<br/>value = [1, 2]<br/>class = Abnormal>, fillcolor="#9ccef2"] ;
81 -> 82 ;
83 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
82 -> 83 ;
84 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
82 -> 84 ;
85 [label=<entropy = 0.0<br/>samples = 6<br/>value = [9, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
81 -> 85 ;
86 [label=<srv_count &le; 6.0<br/>entropy = 0.977<br/>samples = 19<br/>value = [14, 20]<br/>class = Abnormal>, fillcolor="#c4e2f7"] ;
78 -> 86 ;
87 [label=<dst_host_same_src_port_rate &le; 0.39<br/>entropy = 0.696<br/>samples = 8<br/>value = [13, 3]<br/>class = Normal>, fillcolor="#eb9e67"] ;
86 -> 87 ;
88 [label=<entropy = 0.0<br/>samples = 6<br/>value = [13, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
87 -> 88 ;
89 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 3]<br/>class = Abnormal>, fillcolor="#399de5"] ;
87 -> 89 ;
90 [label=<dst_host_serror_rate &le; 0.065<br/>entropy = 0.31<br/>samples = 11<br/>value = [1, 17]<br/>class = Abnormal>, fillcolor="#45a3e7"] ;
86 -> 90 ;
91 [label=<dst_host_rerror_rate &le; 0.025<br/>entropy = 0.323<br/>samples = 10<br/>value = [1, 16]<br/>class = Abnormal>, fillcolor="#45a3e7"] ;
90 -> 91 ;
92 [label=<dst_host_same_src_port_rate &le; 0.5<br/>entropy = 0.469<br/>samples = 6<br/>value = [1, 9]<br/>class = Abnormal>, fillcolor="#4fa8e8"] ;
91 -> 92 ;
93 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
92 -> 93 ;
94 [label=<entropy = 0.0<br/>samples = 5<br/>value = [0, 9]<br/>class = Abnormal>, fillcolor="#399de5"] ;
92 -> 94 ;
95 [label=<entropy = 0.0<br/>samples = 4<br/>value = [0, 7]<br/>class = Abnormal>, fillcolor="#399de5"] ;
91 -> 95 ;
96 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
90 -> 96 ;
97 [label=<entropy = 0.0<br/>samples = 49<br/>value = [0, 71]<br/>class = Abnormal>, fillcolor="#399de5"] ;
77 -> 97 ;
98 [label=<dst_host_rerror_rate &le; 0.005<br/>entropy = 0.054<br/>samples = 934<br/>value = [9, 1455]<br/>class = Abnormal>, fillcolor="#3a9ee5"] ;
68 -> 98 ;
99 [label=<protocol_type &le; 0.5<br/>entropy = 0.495<br/>samples = 54<br/>value = [9, 74]<br/>class = Abnormal>, fillcolor="#51a9e8"] ;
98 -> 99 ;
100 [label=<diff_srv_rate &le; 0.3<br/>entropy = 0.684<br/>samples = 9<br/>value = [9, 2]<br/>class = Normal>, fillcolor="#eb9d65"] ;
99 -> 100 ;
101 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
100 -> 101 ;
102 [label=<same_srv_rate &le; 0.415<br/>entropy = 0.469<br/>samples = 8<br/>value = [9, 1]<br/>class = Normal>, fillcolor="#e88f4f"] ;
100 -> 102 ;
103 [label=<duration &le; 3.5<br/>entropy = 0.811<br/>samples = 3<br/>value = [3, 1]<br/>class = Normal>, fillcolor="#eeab7b"] ;
102 -> 103 ;
104 [label=<entropy = 0.0<br/>samples = 2<br/>value = [3, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
103 -> 104 ;
105 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
103 -> 105 ;
106 [label=<entropy = 0.0<br/>samples = 5<br/>value = [6, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
102 -> 106 ;
107 [label=<entropy = 0.0<br/>samples = 45<br/>value = [0, 72]<br/>class = Abnormal>, fillcolor="#399de5"] ;
99 -> 107 ;
108 [label=<entropy = 0.0<br/>samples = 880<br/>value = [0, 1381]<br/>class = Abnormal>, fillcolor="#399de5"] ;
98 -> 108 ;
109 [label=<entropy = 0.0<br/>samples = 2900<br/>value = [0, 4468]<br/>class = Abnormal>, fillcolor="#399de5"] ;
67 -> 109 ;
110 [label=<dst_bytes &le; 2.0<br/>entropy = 0.385<br/>samples = 6106<br/>value = [8970, 728]<br/>class = Normal>, fillcolor="#e78b49"] ;
0 -> 110 [labeldistance=2.5, labelangle=-45, headlabel="False"] ;
111 [label=<service &le; 58.0<br/>entropy = 0.927<br/>samples = 987<br/>value = [1011, 526]<br/>class = Normal>, fillcolor="#f3c3a0"] ;
110 -> 111 ;
112 [label=<dst_host_diff_srv_rate &le; 0.015<br/>entropy = 0.594<br/>samples = 567<br/>value = [768, 129]<br/>class = Normal>, fillcolor="#e9965a"] ;
111 -> 112 ;
113 [label=<count &le; 3.5<br/>entropy = 0.985<br/>samples = 142<br/>value = [129, 97]<br/>class = Normal>, fillcolor="#f9e0ce"] ;
112 -> 113 ;
114 [label=<protocol_type &le; 1.5<br/>entropy = 1.0<br/>samples = 124<br/>value = [98, 97]<br/>class = Normal>, fillcolor="#fffefd"] ;
113 -> 114 ;
115 [label=<service &le; 9.5<br/>entropy = 0.916<br/>samples = 91<br/>value = [48, 97]<br/>class = Abnormal>, fillcolor="#9bcdf2"] ;
114 -> 115 ;
116 [label=<dst_host_srv_count &le; 51.0<br/>entropy = 0.871<br/>samples = 86<br/>value = [40, 97]<br/>class = Abnormal>, fillcolor="#8bc5f0"] ;
115 -> 116 ;
117 [label=<dst_host_same_srv_rate &le; 0.15<br/>entropy = 0.544<br/>samples = 58<br/>value = [11, 77]<br/>class = Abnormal>, fillcolor="#55abe9"] ;
116 -> 117 ;
118 [label=<entropy = 0.0<br/>samples = 5<br/>value = [6, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
117 -> 118 ;
119 [label=<dst_host_srv_count &le; 8.5<br/>entropy = 0.331<br/>samples = 53<br/>value = [5, 77]<br/>class = Abnormal>, fillcolor="#46a3e7"] ;
117 -> 119 ;
120 [label=<srv_count &le; 1.5<br/>entropy = 1.0<br/>samples = 5<br/>value = [4, 4]<br/>class = Normal>, fillcolor="#ffffff"] ;
119 -> 120 ;
121 [label=<src_bytes &le; 2568776.0<br/>entropy = 0.985<br/>samples = 4<br/>value = [4, 3]<br/>class = Normal>, fillcolor="#f8e0ce"] ;
120 -> 121 ;
122 [label=<protocol_type &le; 0.5<br/>entropy = 0.722<br/>samples = 3<br/>value = [4, 1]<br/>class = Normal>, fillcolor="#eca06a"] ;
121 -> 122 ;
123 [label=<entropy = 0.0<br/>samples = 2<br/>value = [4, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
122 -> 123 ;
124 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
122 -> 124 ;
125 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
121 -> 125 ;
126 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
120 -> 126 ;
127 [label=<hot &le; 0.5<br/>entropy = 0.103<br/>samples = 48<br/>value = [1, 73]<br/>class = Abnormal>, fillcolor="#3c9ee5"] ;
119 -> 127 ;
128 [label=<srv_count &le; 1.5<br/>entropy = 0.113<br/>samples = 43<br/>value = [1, 65]<br/>class = Abnormal>, fillcolor="#3c9fe5"] ;
127 -> 128 ;
129 [label=<dst_host_srv_diff_host_rate &le; 0.105<br/>entropy = 0.172<br/>samples = 26<br/>value = [1, 38]<br/>class = Abnormal>, fillcolor="#3ea0e6"] ;
128 -> 129 ;
130 [label=<src_bytes &le; 414.5<br/>entropy = 0.391<br/>samples = 7<br/>value = [1, 12]<br/>class = Abnormal>, fillcolor="#49a5e7"] ;
129 -> 130 ;
131 [label=<entropy = 0.0<br/>samples = 6<br/>value = [0, 12]<br/>class = Abnormal>, fillcolor="#399de5"] ;
130 -> 131 ;
132 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
130 -> 132 ;
133 [label=<entropy = 0.0<br/>samples = 19<br/>value = [0, 26]<br/>class = Abnormal>, fillcolor="#399de5"] ;
129 -> 133 ;
134 [label=<entropy = 0.0<br/>samples = 17<br/>value = [0, 27]<br/>class = Abnormal>, fillcolor="#399de5"] ;
128 -> 134 ;
135 [label=<entropy = 0.0<br/>samples = 5<br/>value = [0, 8]<br/>class = Abnormal>, fillcolor="#399de5"] ;
127 -> 135 ;
136 [label=<service &le; 1.5<br/>entropy = 0.976<br/>samples = 28<br/>value = [29, 20]<br/>class = Normal>, fillcolor="#f7d8c2"] ;
116 -> 136 ;
137 [label=<entropy = 0.0<br/>samples = 13<br/>value = [23, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
136 -> 137 ;
138 [label=<srv_count &le; 1.5<br/>entropy = 0.779<br/>samples = 15<br/>value = [6, 20]<br/>class = Abnormal>, fillcolor="#74baed"] ;
136 -> 138 ;
139 [label=<dst_host_srv_count &le; 210.5<br/>entropy = 0.286<br/>samples = 10<br/>value = [1, 19]<br/>class = Abnormal>, fillcolor="#43a2e6"] ;
138 -> 139 ;
140 [label=<entropy = 0.0<br/>samples = 9<br/>value = [0, 19]<br/>class = Abnormal>, fillcolor="#399de5"] ;
139 -> 140 ;
141 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
139 -> 141 ;
142 [label=<dst_host_same_src_port_rate &le; 0.42<br/>entropy = 0.65<br/>samples = 5<br/>value = [5, 1]<br/>class = Normal>, fillcolor="#ea9a61"] ;
138 -> 142 ;
143 [label=<entropy = 0.0<br/>samples = 4<br/>value = [5, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
142 -> 143 ;
144 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
142 -> 144 ;
145 [label=<entropy = 0.0<br/>samples = 5<br/>value = [8, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
115 -> 145 ;
146 [label=<entropy = 0.0<br/>samples = 33<br/>value = [50, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
114 -> 146 ;
147 [label=<entropy = 0.0<br/>samples = 18<br/>value = [31, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
113 -> 147 ;
148 [label=<dst_host_same_srv_rate &le; 0.85<br/>entropy = 0.277<br/>samples = 425<br/>value = [639, 32]<br/>class = Normal>, fillcolor="#e68743"] ;
112 -> 148 ;
149 [label=<duration &le; 8.0<br/>entropy = 0.164<br/>samples = 401<br/>value = [608, 15]<br/>class = Normal>, fillcolor="#e6843e"] ;
148 -> 149 ;
150 [label=<service &le; 1.5<br/>entropy = 0.147<br/>samples = 399<br/>value = [608, 13]<br/>class = Normal>, fillcolor="#e6843d"] ;
149 -> 150 ;
151 [label=<dst_host_srv_diff_host_rate &le; 0.155<br/>entropy = 0.035<br/>samples = 351<br/>value = [546, 2]<br/>class = Normal>, fillcolor="#e5813a"] ;
150 -> 151 ;
152 [label=<dst_host_diff_srv_rate &le; 0.065<br/>entropy = 0.019<br/>samples = 349<br/>value = [545, 1]<br/>class = Normal>, fillcolor="#e58139"] ;
151 -> 152 ;
153 [label=<entropy = 0.0<br/>samples = 244<br/>value = [382, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
152 -> 153 ;
154 [label=<dst_host_serror_rate &le; 0.005<br/>entropy = 0.054<br/>samples = 105<br/>value = [163, 1]<br/>class = Normal>, fillcolor="#e5823a"] ;
152 -> 154 ;
155 [label=<entropy = 0.0<br/>samples = 83<br/>value = [132, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
154 -> 155 ;
156 [label=<dst_host_diff_srv_rate &le; 0.075<br/>entropy = 0.201<br/>samples = 22<br/>value = [31, 1]<br/>class = Normal>, fillcolor="#e6853f"] ;
154 -> 156 ;
157 [label=<flag &le; 6.0<br/>entropy = 0.503<br/>samples = 7<br/>value = [8, 1]<br/>class = Normal>, fillcolor="#e89152"] ;
156 -> 157 ;
158 [label=<entropy = 0.0<br/>samples = 1<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
157 -> 158 ;
159 [label=<dst_host_srv_count &le; 52.5<br/>entropy = 0.592<br/>samples = 6<br/>value = [6, 1]<br/>class = Normal>, fillcolor="#e9965a"] ;
157 -> 159 ;
160 [label=<entropy = 0.0<br/>samples = 5<br/>value = [6, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
159 -> 160 ;
161 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
159 -> 161 ;
162 [label=<entropy = 0.0<br/>samples = 15<br/>value = [23, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
156 -> 162 ;
163 [label=<dst_host_same_src_port_rate &le; 0.43<br/>entropy = 1.0<br/>samples = 2<br/>value = [1, 1]<br/>class = Normal>, fillcolor="#ffffff"] ;
151 -> 163 ;
164 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
163 -> 164 ;
165 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
163 -> 165 ;
166 [label=<dst_host_count &le; 135.0<br/>entropy = 0.612<br/>samples = 48<br/>value = [62, 11]<br/>class = Normal>, fillcolor="#ea975c"] ;
150 -> 166 ;
167 [label=<srv_count &le; 1.5<br/>entropy = 0.768<br/>samples = 30<br/>value = [38, 11]<br/>class = Normal>, fillcolor="#eda572"] ;
166 -> 167 ;
168 [label=<service &le; 9.5<br/>entropy = 0.863<br/>samples = 4<br/>value = [2, 5]<br/>class = Abnormal>, fillcolor="#88c4ef"] ;
167 -> 168 ;
169 [label=<dst_host_srv_count &le; 11.5<br/>entropy = 0.65<br/>samples = 3<br/>value = [1, 5]<br/>class = Abnormal>, fillcolor="#61b1ea"] ;
168 -> 169 ;
170 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 5]<br/>class = Abnormal>, fillcolor="#399de5"] ;
169 -> 170 ;
171 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
169 -> 171 ;
172 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
168 -> 172 ;
173 [label=<count &le; 1.5<br/>entropy = 0.592<br/>samples = 26<br/>value = [36, 6]<br/>class = Normal>, fillcolor="#e9965a"] ;
167 -> 173 ;
174 [label=<entropy = 0.0<br/>samples = 17<br/>value = [31, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
173 -> 174 ;
175 [label=<src_bytes &le; 95.5<br/>entropy = 0.994<br/>samples = 9<br/>value = [5, 6]<br/>class = Abnormal>, fillcolor="#deeffb"] ;
173 -> 175 ;
176 [label=<entropy = 0.0<br/>samples = 4<br/>value = [5, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
175 -> 176 ;
177 [label=<entropy = 0.0<br/>samples = 5<br/>value = [0, 6]<br/>class = Abnormal>, fillcolor="#399de5"] ;
175 -> 177 ;
178 [label=<entropy = 0.0<br/>samples = 18<br/>value = [24, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
166 -> 178 ;
179 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
149 -> 179 ;
180 [label=<dst_host_diff_srv_rate &le; 0.035<br/>entropy = 0.938<br/>samples = 24<br/>value = [31, 17]<br/>class = Normal>, fillcolor="#f3c6a6"] ;
148 -> 180 ;
181 [label=<protocol_type &le; 1.5<br/>entropy = 0.619<br/>samples = 5<br/>value = [2, 11]<br/>class = Abnormal>, fillcolor="#5dafea"] ;
180 -> 181 ;
182 [label=<dst_host_diff_srv_rate &le; 0.025<br/>entropy = 0.414<br/>samples = 4<br/>value = [1, 11]<br/>class = Abnormal>, fillcolor="#4ba6e7"] ;
181 -> 182 ;
183 [label=<dst_host_same_src_port_rate &le; 0.44<br/>entropy = 0.65<br/>samples = 2<br/>value = [1, 5]<br/>class = Abnormal>, fillcolor="#61b1ea"] ;
182 -> 183 ;
184 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
183 -> 184 ;
185 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 5]<br/>class = Abnormal>, fillcolor="#399de5"] ;
183 -> 185 ;
186 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 6]<br/>class = Abnormal>, fillcolor="#399de5"] ;
182 -> 186 ;
187 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
181 -> 187 ;
188 [label=<dst_host_same_src_port_rate &le; 0.99<br/>entropy = 0.661<br/>samples = 19<br/>value = [29, 6]<br/>class = Normal>, fillcolor="#ea9b62"] ;
180 -> 188 ;
189 [label=<entropy = 0.0<br/>samples = 15<br/>value = [29, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
188 -> 189 ;
190 [label=<entropy = 0.0<br/>samples = 4<br/>value = [0, 6]<br/>class = Abnormal>, fillcolor="#399de5"] ;
188 -> 190 ;
191 [label=<count &le; 37.5<br/>entropy = 0.958<br/>samples = 420<br/>value = [243, 397]<br/>class = Abnormal>, fillcolor="#b2d9f5"] ;
111 -> 191 ;
192 [label=<src_bytes &le; 258.5<br/>entropy = 0.566<br/>samples = 179<br/>value = [241, 37]<br/>class = Normal>, fillcolor="#e99457"] ;
191 -> 192 ;
193 [label=<srv_count &le; 2.5<br/>entropy = 0.079<br/>samples = 128<br/>value = [203, 2]<br/>class = Normal>, fillcolor="#e5823b"] ;
192 -> 193 ;
194 [label=<entropy = 0.0<br/>samples = 98<br/>value = [155, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
193 -> 194 ;
195 [label=<dst_host_same_src_port_rate &le; 0.66<br/>entropy = 0.242<br/>samples = 30<br/>value = [48, 2]<br/>class = Normal>, fillcolor="#e68641"] ;
193 -> 195 ;
196 [label=<entropy = 0.0<br/>samples = 29<br/>value = [48, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
195 -> 196 ;
197 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
195 -> 197 ;
198 [label=<dst_host_same_srv_rate &le; 0.03<br/>entropy = 0.999<br/>samples = 51<br/>value = [38, 35]<br/>class = Normal>, fillcolor="#fdf5ef"] ;
192 -> 198 ;
199 [label=<src_bytes &le; 1623.0<br/>entropy = 0.292<br/>samples = 24<br/>value = [37, 2]<br/>class = Normal>, fillcolor="#e68844"] ;
198 -> 199 ;
200 [label=<same_srv_rate &le; 0.625<br/>entropy = 1.0<br/>samples = 3<br/>value = [2, 2]<br/>class = Normal>, fillcolor="#ffffff"] ;
199 -> 200 ;
201 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
200 -> 201 ;
202 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
200 -> 202 ;
203 [label=<entropy = 0.0<br/>samples = 21<br/>value = [35, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
199 -> 203 ;
204 [label=<srv_serror_rate &le; 0.2<br/>entropy = 0.191<br/>samples = 27<br/>value = [1, 33]<br/>class = Abnormal>, fillcolor="#3fa0e6"] ;
198 -> 204 ;
205 [label=<entropy = 0.0<br/>samples = 26<br/>value = [0, 33]<br/>class = Abnormal>, fillcolor="#399de5"] ;
204 -> 205 ;
206 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
204 -> 206 ;
207 [label=<src_bytes &le; 299.0<br/>entropy = 0.049<br/>samples = 241<br/>value = [2, 360]<br/>class = Abnormal>, fillcolor="#3a9ee5"] ;
191 -> 207 ;
208 [label=<entropy = 0.0<br/>samples = 2<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
207 -> 208 ;
209 [label=<entropy = 0.0<br/>samples = 239<br/>value = [0, 360]<br/>class = Abnormal>, fillcolor="#399de5"] ;
207 -> 209 ;
210 [label=<dst_host_srv_count &le; 181.5<br/>entropy = 0.167<br/>samples = 5119<br/>value = [7959, 202]<br/>class = Normal>, fillcolor="#e6843e"] ;
110 -> 210 ;
211 [label=<src_bytes &le; 49282.0<br/>entropy = 0.399<br/>samples = 1212<br/>value = [1767, 152]<br/>class = Normal>, fillcolor="#e78c4a"] ;
210 -> 211 ;
212 [label=<hot &le; 0.5<br/>entropy = 0.21<br/>samples = 1149<br/>value = [1751, 60]<br/>class = Normal>, fillcolor="#e68540"] ;
211 -> 212 ;
213 [label=<dst_bytes &le; 603675.0<br/>entropy = 0.053<br/>samples = 1054<br/>value = [1652, 10]<br/>class = Normal>, fillcolor="#e5823a"] ;
212 -> 213 ;
214 [label=<dst_host_rerror_rate &le; 0.025<br/>entropy = 0.044<br/>samples = 1052<br/>value = [1651, 8]<br/>class = Normal>, fillcolor="#e5823a"] ;
213 -> 214 ;
215 [label=<dst_host_serror_rate &le; 0.385<br/>entropy = 0.02<br/>samples = 974<br/>value = [1539, 3]<br/>class = Normal>, fillcolor="#e58139"] ;
214 -> 215 ;
216 [label=<entropy = 0.0<br/>samples = 923<br/>value = [1461, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
215 -> 216 ;
217 [label=<src_bytes &le; 1316.5<br/>entropy = 0.229<br/>samples = 51<br/>value = [78, 3]<br/>class = Normal>, fillcolor="#e68641"] ;
215 -> 217 ;
218 [label=<entropy = 0.0<br/>samples = 28<br/>value = [42, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
217 -> 218 ;
219 [label=<dst_host_count &le; 130.0<br/>entropy = 0.391<br/>samples = 23<br/>value = [36, 3]<br/>class = Normal>, fillcolor="#e78c49"] ;
217 -> 219 ;
220 [label=<dst_bytes &le; 24132.5<br/>entropy = 0.971<br/>samples = 2<br/>value = [2, 3]<br/>class = Abnormal>, fillcolor="#bddef6"] ;
219 -> 220 ;
221 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 3]<br/>class = Abnormal>, fillcolor="#399de5"] ;
220 -> 221 ;
222 [label=<entropy = 0.0<br/>samples = 1<br/>value = [2, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
220 -> 222 ;
223 [label=<entropy = 0.0<br/>samples = 21<br/>value = [34, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
219 -> 223 ;
224 [label=<dst_host_srv_rerror_rate &le; 0.01<br/>entropy = 0.255<br/>samples = 78<br/>value = [112, 5]<br/>class = Normal>, fillcolor="#e68742"] ;
214 -> 224 ;
225 [label=<src_bytes &le; 79.5<br/>entropy = 0.469<br/>samples = 31<br/>value = [45, 5]<br/>class = Normal>, fillcolor="#e88f4f"] ;
224 -> 225 ;
226 [label=<srv_count &le; 1.5<br/>entropy = 0.954<br/>samples = 4<br/>value = [5, 3]<br/>class = Normal>, fillcolor="#f5cdb0"] ;
225 -> 226 ;
227 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 3]<br/>class = Abnormal>, fillcolor="#399de5"] ;
226 -> 227 ;
228 [label=<entropy = 0.0<br/>samples = 2<br/>value = [5, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
226 -> 228 ;
229 [label=<dst_host_same_srv_rate &le; 0.315<br/>entropy = 0.276<br/>samples = 27<br/>value = [40, 2]<br/>class = Normal>, fillcolor="#e68743"] ;
225 -> 229 ;
230 [label=<entropy = 0.0<br/>samples = 23<br/>value = [37, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
229 -> 230 ;
231 [label=<dst_host_same_srv_rate &le; 0.44<br/>entropy = 0.971<br/>samples = 4<br/>value = [3, 2]<br/>class = Normal>, fillcolor="#f6d5bd"] ;
229 -> 231 ;
232 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
231 -> 232 ;
233 [label=<entropy = 0.0<br/>samples = 2<br/>value = [3, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
231 -> 233 ;
234 [label=<entropy = 0.0<br/>samples = 47<br/>value = [67, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
224 -> 234 ;
235 [label=<flag &le; 6.0<br/>entropy = 0.918<br/>samples = 2<br/>value = [1, 2]<br/>class = Abnormal>, fillcolor="#9ccef2"] ;
213 -> 235 ;
236 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
235 -> 236 ;
237 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
235 -> 237 ;
238 [label=<logged_in &le; 0.5<br/>entropy = 0.921<br/>samples = 95<br/>value = [99, 50]<br/>class = Normal>, fillcolor="#f2c19d"] ;
212 -> 238 ;
239 [label=<entropy = 0.0<br/>samples = 6<br/>value = [0, 9]<br/>class = Abnormal>, fillcolor="#399de5"] ;
238 -> 239 ;
240 [label=<src_bytes &le; 948.0<br/>entropy = 0.872<br/>samples = 89<br/>value = [99, 41]<br/>class = Normal>, fillcolor="#f0b58b"] ;
238 -> 240 ;
241 [label=<dst_host_same_srv_rate &le; 0.53<br/>entropy = 0.276<br/>samples = 38<br/>value = [60, 3]<br/>class = Normal>, fillcolor="#e68743"] ;
240 -> 241 ;
242 [label=<src_bytes &le; 357.5<br/>entropy = 0.122<br/>samples = 36<br/>value = [59, 1]<br/>class = Normal>, fillcolor="#e5833c"] ;
241 -> 242 ;
243 [label=<entropy = 0.0<br/>samples = 24<br/>value = [40, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
242 -> 243 ;
244 [label=<src_bytes &le; 428.5<br/>entropy = 0.286<br/>samples = 12<br/>value = [19, 1]<br/>class = Normal>, fillcolor="#e68843"] ;
242 -> 244 ;
245 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 1]<br/>class = Abnormal>, fillcolor="#399de5"] ;
244 -> 245 ;
246 [label=<entropy = 0.0<br/>samples = 11<br/>value = [19, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
244 -> 246 ;
247 [label=<srv_diff_host_rate &le; 0.5<br/>entropy = 0.918<br/>samples = 2<br/>value = [1, 2]<br/>class = Abnormal>, fillcolor="#9ccef2"] ;
241 -> 247 ;
248 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
247 -> 248 ;
249 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
247 -> 249 ;
250 [label=<dst_host_diff_srv_rate &le; 0.025<br/>entropy = 1.0<br/>samples = 51<br/>value = [39, 38]<br/>class = Normal>, fillcolor="#fefcfa"] ;
240 -> 250 ;
251 [label=<dst_bytes &le; 2968.0<br/>entropy = 0.801<br/>samples = 24<br/>value = [10, 31]<br/>class = Abnormal>, fillcolor="#79bded"] ;
250 -> 251 ;
252 [label=<entropy = 0.0<br/>samples = 17<br/>value = [0, 27]<br/>class = Abnormal>, fillcolor="#399de5"] ;
251 -> 252 ;
253 [label=<duration &le; 75.5<br/>entropy = 0.863<br/>samples = 7<br/>value = [10, 4]<br/>class = Normal>, fillcolor="#efb388"] ;
251 -> 253 ;
254 [label=<entropy = 0.0<br/>samples = 5<br/>value = [10, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
253 -> 254 ;
255 [label=<entropy = 0.0<br/>samples = 2<br/>value = [0, 4]<br/>class = Abnormal>, fillcolor="#399de5"] ;
253 -> 255 ;
256 [label=<duration &le; 13.0<br/>entropy = 0.711<br/>samples = 27<br/>value = [29, 7]<br/>class = Normal>, fillcolor="#eb9f69"] ;
250 -> 256 ;
257 [label=<dst_host_diff_srv_rate &le; 0.325<br/>entropy = 0.65<br/>samples = 4<br/>value = [1, 5]<br/>class = Abnormal>, fillcolor="#61b1ea"] ;
256 -> 257 ;
258 [label=<entropy = 0.0<br/>samples = 3<br/>value = [0, 5]<br/>class = Abnormal>, fillcolor="#399de5"] ;
257 -> 258 ;
259 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
257 -> 259 ;
260 [label=<dst_host_count &le; 216.0<br/>entropy = 0.353<br/>samples = 23<br/>value = [28, 2]<br/>class = Normal>, fillcolor="#e78a47"] ;
256 -> 260 ;
261 [label=<entropy = 0.0<br/>samples = 18<br/>value = [21, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
260 -> 261 ;
262 [label=<num_file_creations &le; 10.5<br/>entropy = 0.764<br/>samples = 5<br/>value = [7, 2]<br/>class = Normal>, fillcolor="#eca572"] ;
260 -> 262 ;
263 [label=<entropy = 0.0<br/>samples = 4<br/>value = [7, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
262 -> 263 ;
264 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
262 -> 264 ;
265 [label=<dst_host_diff_srv_rate &le; 0.01<br/>entropy = 0.605<br/>samples = 63<br/>value = [16, 92]<br/>class = Abnormal>, fillcolor="#5baeea"] ;
211 -> 265 ;
266 [label=<entropy = 0.0<br/>samples = 55<br/>value = [0, 92]<br/>class = Abnormal>, fillcolor="#399de5"] ;
265 -> 266 ;
267 [label=<entropy = 0.0<br/>samples = 8<br/>value = [16, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
265 -> 267 ;
268 [label=<dst_host_count &le; 212.5<br/>entropy = 0.067<br/>samples = 3907<br/>value = [6192, 50]<br/>class = Normal>, fillcolor="#e5823b"] ;
210 -> 268 ;
269 [label=<entropy = 0.0<br/>samples = 1936<br/>value = [3046, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
268 -> 269 ;
270 [label=<dst_bytes &le; 7254.0<br/>entropy = 0.116<br/>samples = 1971<br/>value = [3146, 50]<br/>class = Normal>, fillcolor="#e5833c"] ;
268 -> 270 ;
271 [label=<entropy = 0.0<br/>samples = 1790<br/>value = [2907, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
270 -> 271 ;
272 [label=<src_bytes &le; 21866.0<br/>entropy = 0.665<br/>samples = 181<br/>value = [239, 50]<br/>class = Normal>, fillcolor="#ea9b62"] ;
270 -> 272 ;
273 [label=<hot &le; 1.5<br/>entropy = 0.069<br/>samples = 152<br/>value = [239, 2]<br/>class = Normal>, fillcolor="#e5823b"] ;
272 -> 273 ;
274 [label=<entropy = 0.0<br/>samples = 147<br/>value = [234, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
273 -> 274 ;
275 [label=<srv_count &le; 2.5<br/>entropy = 0.863<br/>samples = 5<br/>value = [5, 2]<br/>class = Normal>, fillcolor="#efb388"] ;
273 -> 275 ;
276 [label=<srv_rerror_rate &le; 0.25<br/>entropy = 0.918<br/>samples = 2<br/>value = [1, 2]<br/>class = Abnormal>, fillcolor="#9ccef2"] ;
275 -> 276 ;
277 [label=<entropy = 0.0<br/>samples = 1<br/>value = [1, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
276 -> 277 ;
278 [label=<entropy = 0.0<br/>samples = 1<br/>value = [0, 2]<br/>class = Abnormal>, fillcolor="#399de5"] ;
276 -> 278 ;
279 [label=<entropy = 0.0<br/>samples = 3<br/>value = [4, 0]<br/>class = Normal>, fillcolor="#e58139"] ;
275 -> 279 ;
280 [label=<entropy = 0.0<br/>samples = 29<br/>value = [0, 48]<br/>class = Abnormal>, fillcolor="#399de5"] ;
272 -> 280 ;
}
experiment/random forest/output/random forest max depth.png 0 → 100644
+ 0
− 0
View file @ 44fbba61
experiment/random forest/output/random forest max depth.png

14.4 KiB

experiment/random forest/output/random forest.jpg 0 → 100644
+ 0
− 0
View file @ 44fbba61
experiment/random forest/output/random forest.jpg

2.32 MiB

experiment/random forest/output/roc.png 0 → 100644
+ 0
− 0
View file @ 44fbba61
experiment/random forest/output/roc.png

8.97 KiB

0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment

feedback to tooltime@ajou.ac.kr or hwan@ajou.ac.kr