Bayesian Tree Aggregation for Rare Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic classification methods, particularly random decision forests, face challenges in effectively detecting rare malware due to class imbalances, leading to reduced recall and precision in identifying malicious traffic amidst a predominantly benign traffic environment.
Innovation Solution
The implementation of a Bayesian tree aggregation mechanism in random decision forests, where weightings for classification label predictions are generated based on conditional probabilities estimated from out-of-bag datasets, allowing for improved handling of imbalanced classes and enhancing the detection of rare malware by adjusting the voting process to account for posterior prediction probabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If random decision forests are used for network traffic classification, then classification capability is provided, but detection of rare malware is reduced due to class imbalances
Solution Approach 1:
The patent changes the aggregation parameter from simple majority voting to Bayesian probability-based weighting. Each decision tree's prediction is weighted by its conditional probability P(y|t_i(x)), which is estimated from out-of-bag datasets. This parameter change allows the system to account for class imbalances and improve detection of rare malware while maintaining overall classification capability.
2Productivity
If standard voting mechanisms are used in decision forests, then classification speed is maintained, but recall of rare malware is reduced
Solution Approach 1:
The patent performs preliminary action by estimating conditional probabilities P(y|t_i(x)) for each decision tree during the training phase using out-of-bag datasets. These pre-computed probabilities are then used as weights during the prediction phase, allowing the system to improve rare malware recall without adding computational overhead during real-time classification, thus maintaining classification speed.
3Productivity
If decision trees are trained on imbalanced datasets, then training efficiency is maintained, but precision in identifying malicious traffic is reduced
Solution Approach 1:
The patent introduces an intermediary mechanism - the conditional probability P(y|t_i(x)) estimated from out-of-bag datasets - that mediates between the imbalanced training data and the final classification decision. This intermediary allows the system to train efficiently on imbalanced datasets while correcting for the imbalance during aggregation, thereby improving precision in identifying malicious traffic without sacrificing training efficiency.
Data Source
AI summary
In one embodiment, a computing device provides a feature vector as input to a random decision forest comprising a plurality of decision trees trained using a training dataset, each decision tree being configured to output a classification label prediction for the input feature vector. For each of the decision trees, the computing device determines a conditional probability of the decision tree based on a true classification label and the classification label prediction from the decision tree for the input feature vector. The computing device generates weightings for the classification label predictions from the decision trees based on the determined conditional probabilities. The computing device applies a final classification label to the feature vector based on the weightings for the classification label predictions from the decision trees.