5
$\begingroup$

I am looking at time series security attack data where a given IP can either be labeled as (1) attack or (0) no attack. In total we will have thousands of IPs and roughly an equal number of attacks and non attacks. The data is rather noisy and every time series sequence can have a different length.

I am looking for advise on state of the art approaches to time series classification. I am past the stage of simple things like moving averages and I am looking for ways to improve my current methods or new things to try.

I have currently implemented a few different techniques:

  1. K-nearest neighbor with DTW. I am successfully using http://www.cs.ucr.edu/~eamonn/UCRsuite.html which provides state of the art performance.
  2. Logical shapelets (http://www.cs.ucr.edu/~mueen/LogicalShapelet/). This seems promising but have not been able to get any existing code base to work.

Can anyone suggest different technique to try? I have seen papers about discords and motifs but still need to investigate if they are relevant for my problem.

$\endgroup$
2
  • $\begingroup$ Since you've had some success with k-nearest neighbor and KNN is the simplest of the analogue based classifiers and is usually significantly outperformed by SVM (i.e. the best analogue based classifier), have you considered just changing the KNN to an SVM? $\endgroup$
    – AN6U5
    Dec 29, 2015 at 23:12
  • $\begingroup$ I can help you if you provide some details? What is your time-series exactly? and you want to classify different time-series or different part of a single time-series? $\endgroup$ Dec 30, 2015 at 11:40

2 Answers 2

1
$\begingroup$

I would suggest Recurrent Neural Nets. They are good for time series, however they need a huge dataset to get good performance. Here you can find an implementation in torch.

$\endgroup$
1
$\begingroup$

I would suggest "Generalized Alignment Kernels" by Marco Suturi for time-series classification. The idea is to use the well known DTW distance in the SVM. The problem which was solved in the paper is that the DTW distance does not result in a valid SVM kernel; there are some tricks employed by the authors to enable that.

I ran this algorithm on some popular time-series datasets and noticed:

  1. The algorithm is very fast
  2. The performances are very good on the respective datasets with respect to the published test sets (UCR Time Series)

Finally, the source code is available.

$\endgroup$
2
  • $\begingroup$ The first link is broken. $\endgroup$
    – M-T-A
    Feb 23, 2017 at 13:22
  • $\begingroup$ @M-T-A The link to the paper has been updated. Sorry! $\endgroup$ Feb 23, 2017 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.