I am from information security field, and have some introductory level understanding of machine learning field. My problem is to identify behavioural patterns from network traffic. If I use supervised learning ( classification ) the results are very promising but I encounter of a problem of missing out a pattern with slight change in behaviour. And If I use clustering then i need to do a much work on manual tuning of centroids position to get better clusters.

I am thinking to ensemble classification and clustering and use classification output to tune cluster centroids. Is this is a good idea to address the problem?

  • $\begingroup$ Are you trying to detect anomalous behavior? It would help if you elaborate what exactly are you trying to achieve here. $\endgroup$ – Sidhha Mar 17 '15 at 6:03
  • $\begingroup$ Yes we can say it anomalous, Actually the idea is to capture some specific malware behaviour. $\endgroup$ – nahraf Mar 17 '15 at 7:13
  • $\begingroup$ You should be looking for Outlier analysis in that case. $\endgroup$ – Sidhha Mar 17 '15 at 7:18
  • $\begingroup$ The question is not about how to find outliers, The question is how to tune outliers detection system performance in terms of detection. $\endgroup$ – nahraf Mar 17 '15 at 8:35
  • $\begingroup$ Would that not translate to using different kernels (linear, rbf, sigmoid) and tuning parameters for one-class SVM? Correct me if I understand this wrongly. $\endgroup$ – Sidhha Mar 17 '15 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.