Is a Decision Tree a good model for an intrusion detection system? I am trying to implement an Intrusion detection system. I can't use the KDD dataset because it is so far from my real data.
I know my network data very well, I mean by that all packets exchanged, when and how to send them. For example, when sending a TCP-Packet, we must have an ACK-TCP-Packet in order to justify its reception.
So I've been think about using a Decision Tree. 
Is it a good solution? Are there any examples that looks like this idea? 
 A: A single Decision Tree (CART) would probably be a bad idea. It's an outdated model which is very prone to overfitting (though pruning can help against that). Still, an ensemble of trees, such as Random Forest or Gradient Tree Boosting, would probably be a good way to start.
Generally speaking, there is no free lunch in machine learning, and you are advised to try out different things. If your scenario falls under Anomaly Detection (sounds like it does) then you should also look into more specialised approaches.
A: Intrusion detection sounds like an Anamoly detection. 
You can try One Class SVM as one of the options.
A: To elaborate on the one-class SVM approach: There is this paper from a Google Scholarship recipient that uses one-class SVMs for intrusion detection, achieving significantly better performance than rule-based methods: https://www.sec.cs.tu-bs.de/pubs/2009-diss.pdf.
Even if you used DTs (which almost noone does nowadays), it could still be helpful for the feature extraction step. 
Decision trees are limited in their modelling of the domains, see



But just try out a few different classifiers, and see which yields good results. (It seems as though XGBoost has won several of Kaggle's competitions recently, and it's based on decision trees).
