0
$\begingroup$

I have a behaviours vector representing some identity. I need to binary classify [malicious or benign] each instance [ideally with a normalised severity score].

For that I can use a variety of linear classifiers/kernelized SVM/Random Forest etc...

The issue is that once the classifier has been trained I'd like to allow the user the ability to configure which behaviours are more (or less) critical.

For example, one behaviour might be encryption done by some process and a user fearing ransomware might want to make this behaviour more significant.

Given linear classifier (which I'd like to avoid) simply multiplying the given W with the given configuration would do the trick. What can be done in kernelized SVM/Random Forest/DNN etc for equivalent result?

$\endgroup$

1 Answer 1

0
$\begingroup$

From the description of your problem, it sounds like applying a weight to the input prior to sending the data to the classifier might do the trick and would be easy to implement. The weight could be positive or negative.

$\endgroup$
3
  • $\begingroup$ IMHO that would not work for my case. Simply applying weights on the training set would yield a single weights configuration. while I'd like to allow it dynamically, post training. $\endgroup$
    – orialz
    Oct 28, 2018 at 6:26
  • $\begingroup$ I was thinking that you would train the model on un-adjusted data to get a neutral model with the appropriate inputs. When classifying a new instance, you have the new behavior vector as input and you would get your neutral binary output. You could simply multiply the behavior of concern in the new vector by a factor (e.g. 1.5) prior to evaluating it with the model. Hopefully this was clear. If not, I cannot think of any hyperparameters in the models you mentioned that could be adjusted without retraining which I assume you do not want to do. $\endgroup$
    – Skiddles
    Oct 30, 2018 at 18:01
  • $\begingroup$ I probably didn't understand your idea in the beginning. It does sound relatively straight forward. appreciate that. I had another idea (specifically for random forest) to re adjust the decision boundary for the weighted features. [for each relevant decision node (with children) adjust the threshold e.g given 20% weight increase if the decision is q<some_value -> q<some_value*1.2 or q>some_value -> q>some_value*0.8]. I'll try out both though. thanks! $\endgroup$
    – orialz
    Oct 31, 2018 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.