In the below figure, we plotted some data of sensors in normal condition and under attack(outlier): 1. Green points are normal samples in the training dataset. 2. Cyan and red points are normal samples in the test dataset. 3. Black and blue points are attack samples in the test dataset. We wish to classify attack from normal samples in the test phase by using only the information we extract from the training dataset (the green points). I highly appreciate any suggestions for this purpose.

Thanks. enter image description here


1 Answer 1


First of all please ignore my previous answer. I did not understand you properly.

The difficulty of the your problem goes back to the distribution of normal points in train and test. The distribution of new normal points are so different than what your model can learn from only green points (training set) so I assume any model will have a relatively poor performance on it. Anyways, having a look at scikit-learn documentation is good if you did not.

About Clustering as you asked I have an idea. An active are in Graph Analysis and Network Science is Community Detection (which is simply the clustering of graph nodes). The idea is that, assume all your points in this figure are nodes of a graph and based on their Euclidean distance in PC space, you put an edge between them (either binary or weighted). Then you can use Modularity-based algorithms to find dense subgraphs. I assume if you apply it to your data it will work. Also a similar idea is Spectral Clustering which internally uses the idea of graph partitioning.

According to the density of clusters, I would also propose to use density-based clustering approaches. They might be able to distinguish between those overlapping clusters "a little bit" (e.g. this paper). This paper has an approach to find the peaks of densities. Sounds compatible with your data. Please note that those overlapping clusters are anyways difficult to distinguish.

My apologies for the first misunderstanding and hope it helps.

Good Luck!

  • $\begingroup$ Thanks, Kasra. Actually, I want to propose a one class classification method and this figure is after some preprocessing. That's why I don't have an attack in training dataset. Now, do you think there can be a method to address this issue? Thanks. $\endgroup$
    – Arkan
    Jan 20, 2018 at 18:20
  • $\begingroup$ Dear arkan, the term "one class classification" can be discussed itself. You probably mean that you have a data and you want to detect "attacks" in it which is one class. But in ML terminology we say you want to have a model who responses to each new sample if they are "attack" or "non-attack". This is called bainary (2 class) classification which is the most minimal. There is no one-class classification in supervised manner. $\endgroup$ Jan 21, 2018 at 12:10
  • $\begingroup$ So here is how i would go: 1) split into train/test while respecting the balance of attack/non-attack in both splits. 2) train different models on train abd see the result on test. If you need help on cross validation setup just drop me a line. 3) choose the model with best performance 4) if it worked then accept or/and upvote the answer :))) $\endgroup$ Jan 21, 2018 at 12:11
  • $\begingroup$ Thank you very much, Kasra. When I'm talking about the one class classification, I mean we have just a normal class in train dataset and there is no attack in it (green points). So splitting it does not make sense. But in test dataset, we have attacks and also normal samples. Now, using that train dataset I want to label the incoming test record. However, my question is about differentiating between clusters is in the figure. ` $\endgroup$
    – Arkan
    Jan 21, 2018 at 16:12
  • $\begingroup$ @Arkan I was wrong in my first answer so will edit it. $\endgroup$ Jan 23, 2018 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.