13. Linear Classifiers Slide Source: Andrew W. Moore f x y est denotes +1 denotes -1 f ( x , w ,b ) = sign( w . x - b ) How would you classify this data?
14. Linear Classifiers f x y est denotes +1 denotes -1 f ( x , w ,b ) = sign( w . x - b ) How would you classify this data? Slide Source: Andrew W. Moore
15. Linear Classifiers f x y est denotes +1 denotes -1 f ( x , w ,b ) = sign( w . x - b ) How would you classify this data? Slide Source: Andrew W. Moore
16. Linear Classifiers f x y est denotes +1 denotes -1 f ( x , w ,b ) = sign( w . x - b ) How would you classify this data? Slide Source: Andrew W. Moore
17. Linear Classifiers f x y est denotes +1 denotes -1 f ( x , w ,b ) = sign( w . x - b ) How would you classify this data? Slide Source: Andrew W. Moore
18. Classifier Margin f x y est denotes +1 denotes -1 f ( x , w ,b ) = sign( w . x - b ) Slide Source: Andrew W. Moore Define the margin of a linear classifier as the width that the boundary could be increased by before hitting a datapoint
19. Maximum Margin x y est denotes +1 denotes -1 f ( x , w ,b ) = sign( w . x - b ) Slide Source: Andrew W. Moore The maximum margin linear classifier is the linear classifier with the maximum margin. This is the simplest kind of SVM (Called an LSVM) Linear SVM f
20. Maximum Margin x y est denotes +1 denotes -1 f ( x , w ,b ) = sign( w . x - b ) Slide Source: Andrew W. Moore The maximum margin linear classifier is the linear classifier with the maximum margin. This is the simplest kind of SVM (Called an LSVM) Linear SVM f Support Vectors are those datapoints that the margin pushes up against
32. Two-Class SVM Results Experiment Workload Train on Abn1 Test on Abn2 Train on Abn2 Test on Abn1 Mixed Features SQL 0.90 0.96 Asterisk 0.81 0.81 Rate Features SQL 0.91 0.95 Asterisk 0.82 0.76 Correlation Features SQL 0.91 0.95 Asterisk 0.85 0.73
33. SQL Train on Abn1 and Test on Abn2: Time Series Plot
34. SQL Train : Train on Abn1 and Test on Abn2: (ROC Curve)
35. SQL Train on Abn2 and Test on Abn1: Time Series Plot
Reasons for decrease from 2004 to 2005: Anti-virus and anti-spyware companies improved their products. A lot of companies starting coming to the realization that they needed to have a strong IDS in place.
Reasons for decrease from 2004 to 2005: Anti-virus and anti-spyware companies improved their products. A lot of companies starting coming to the realization that they needed to have a strong IDS in place.
During training for OCSVMs, the data from the first class is transformed onto a feature space such that it is far away from the origin. Then during testing, the origin and data points that are close to it, and hence far away from points from the first class, are considered part of the second class.
General idea : the original feature space can always be mapped to some higher-dimensional feature space where the training set is separable: