Discover data最新文献

Global sensitivity analysis seeks to detect influential input factors contributing to a black-box model's specific decisions. This aligns with a key objective of AI explainability: Clarifying and interpreting the behavior of machine learning algorithms by identifying the features that influence their decisions-a significant approach for mitigating the computational burden associated with processing high-dimensional data. Various techniques are proposed for sensitivity analysis; however, each of these methods focuses on different mathematical aspects, which can lead to varying conclusions about the impact or importance of each feature. Therefore, it remains unclear which of these algorithms are most suitable for machine learning models and, in particular, deep learning models. Our goal is to examine the influential features identified by each sensitivity analysis algorithm and evaluate their role in helping deep learning models make accurate decisions. In this article, first, we present the mathematical foundations underlying Global Sensitivity algorithms and explain the rationale behind selecting the important features identified by each method. We then provide a comparative case study on global sensitivity analysis methods and propose a methodology to evaluate the efficacy of these methods by conducting a case study on MNIST digit dataset classification. Our study highlights the most effective global sensitivity analysis methods for detecting the key factors influencing the digit data classification.

In Machine Learning, the datasets used to build models are one of the main factors limiting what these models can achieve and how good their predictive performance is. Machine Learning applications for cyber-security or computer security are numerous including cyber threat mitigation and security infrastructure enhancement through pattern recognition, real-time attack detection, and in-depth penetration testing. Therefore, for these applications in particular, the datasets used to build the models must be carefully thought to be representative of real-world data. However, because of the scarcity of labelled data and the cost of manually labelling positive examples, there is a growing corpus of literature utilizing Semi-Supervised Learning with cyber-security data repositories. In this work, we provide a comprehensive overview of publicly available data repositories and datasets used for building computer security or cyber-security systems based on Semi-Supervised Learning, where only a few labels are necessary or available for building strong models. We highlight the strengths and limitations of the data repositories and sets and provide an analysis of the performance assessment metrics used to evaluate the built models. Finally, we discuss open challenges and provide future research directions for using cyber-security datasets and evaluating models built upon them.

Research into Intrusion and Anomaly Detectors at the Host level typically pays much attention to extracting attributes from system call traces. These include window-based, Hidden Markov Models, and sequence-model-based attributes. Recently, several works have been focusing on sequence-model-based feature extractors, specifically Word2Vec and GloVe, to extract embeddings from the system call traces due to their ability to capture semantic relationships among system calls. However, due to the nature of the data, these extractors introduce inconsistencies in the extracted features, causing the Machine Learning models built on them to yield inaccurate and potentially misleading results. In this paper, we first highlight the research challenges posed by these extractors. Then, we conduct experiments with new feature sets assessing their suitability to address the detected issues. Our experiments show that Word2Vec is prone to introducing more duplicated samples than GloVe. Regarding the solutions proposed, we found that concatenating the embedding vectors generated by Word2Vec and GloVe yields the overall best balanced accuracy. In addition to resolving the challenge of data leakage, this approach enables an improvement in performance relative to other alternatives.