0
$\begingroup$

I have a behaviours vector representing some identity. I need to binary classify [malicious or benign] each instance [ideally with a normalised severity score].

For that I can use a variety of linear classifiers/kernelized SVM/Random Forest etc...

The issue is that once the classifier has been trained I'd like to allow the user the ability to configure which behaviours are more (or less) critical.

For example, one behaviour might be encryption done by some process and a user fearing ransomware might want to make this behaviour more significant.

Given linear classifier (which I'd like to avoid) simply multiplying the given W with the given configuration would do the trick. What can be done in kernelized SVM/Random Forest/DNN etc for equivalent result?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
0
$\begingroup$

From the description of your problem, it sounds like applying a weight to the input prior to sending the data to the classifier might do the trick and would be easy to implement. The weight could be positive or negative.

Improve this answer
$\endgroup$
3
  • $\begingroup$ IMHO that would not work for my case. Simply applying weights on the training set would yield a single weights configuration. while I'd like to allow it dynamically, post training. $\endgroup$ Commented Oct 28, 2018 at 6:26
  • $\begingroup$ I was thinking that you would train the model on un-adjusted data to get a neutral model with the appropriate inputs. When classifying a new instance, you have the new behavior vector as input and you would get your neutral binary output. You could simply multiply the behavior of concern in the new vector by a factor (e.g. 1.5) prior to evaluating it with the model. Hopefully this was clear. If not, I cannot think of any hyperparameters in the models you mentioned that could be adjusted without retraining which I assume you do not want to do. $\endgroup$ Commented Oct 30, 2018 at 18:01
  • $\begingroup$ I probably didn't understand your idea in the beginning. It does sound relatively straight forward. appreciate that. I had another idea (specifically for random forest) to re adjust the decision boundary for the weighted features. [for each relevant decision node (with children) adjust the threshold e.g given 20% weight increase if the decision is q<some_value -> q<some_value*1.2 or q>some_value -> q>some_value*0.8]. I'll try out both though. thanks! $\endgroup$ Commented Oct 31, 2018 at 8:22

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.