A Neyman–Pearson Approach to Statistical Learning

Scott, Clayton; Nowak, Robert

doi:10.1109/tit.2005.856955

Cited by 118 publications

(105 citation statements)

References 32 publications

Supporting

Mentioning

105

Contrasting

Order By: Relevance

“…We use multi-class versions of Neyman-Pearson (NP) classification [4][5][6][7][8] and the Learning to Satisfy (LSAT) [9] framework for Internet traffic classification and a binary LSAT classifier for the large flow detector. The rest of the chapter is organized as follows.…”

Section: Methodsmentioning

confidence: 99%

“…The two performance guarantees that we focus on are the False Alarm Rate (FAR) and the False Discovery Rate (FDR). Our classifier that controls the FAR is based on a multi-class generalization of Neyman-Pearson (NP) classification [4][5][6][7][8] while our classifier that controls the FDR is based on the Learning to Satisfy framework [9]. These performance guarantees can be applied to a single class against all the other classes or between two specific classes.…”

Section: Motivationmentioning

confidence: 99%

“…The primary contribution of this work is the proposal of two novel online classifiers that provide classspecific performance guarantees. The first classifier controls false alarm rates, and is based on a multi-class generalization of Neyman-Pearson (NP) classification [4][5][6][7][8]. The second controls false discovery rates, and is based on a multi-class generalization of the Learning Satisfiability framework (LSAT) [9].…”

Section: Our Contributionmentioning

confidence: 99%

“…We provide background for the two algorithms we use to solve our three problems -Neyman-Pearson classification [4][5][6][7][8] and the Learning to Satisfy framework [9]. Since both algorithms use Support Vector Machines (SVM) (and more specifically the 2ν-SVM [8,78]) as their foundation, we describe what SVMs are and how they are implemented.…”

Section: Chapter 3 Backgroundmentioning

confidence: 99%

“…Minimizing the overall misclassification rate while setting a maximum allowable threshold on the false alarm rate is known as Neyman-Pearson (NP) classification [4][5][6][7]. Two advantages of NP-classification are that it is more intuitive to deal with false alarm constraints than to arbitrarily assign penalties to a class (or data point) as is done with other classification methods.…”

Section: ν-Svmmentioning

confidence: 99%

See 4 more Smart Citations

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

2009

View full text Add to dashboard Cite

Classifying Internet traffic flows online into applications or broader classes without inspecting the packet payloads or without relying on port numbers has become a necessity for network operators. The operators can use this information to monitor their networks and provide per-class quality of service. There has been a great deal of research done on Internet traffic classification recently and numerous techniques have been proposed. While the current techniques can obtain a high accuracy classifying Internet traffic, providing performance guarantees for particular classes of interest has never been addressed. In this thesis, we provide two novel types of online Internet traffic classifiers that can provide performance guarantees on the false alarm and false discovery rates, respectively. These guarantees can be for an entire class (class-wise) or between two classes (pair-wise). Controlling false alarm rates is well-suited for application prioritization (i.e. prioritizing time-sensitive applications like VoIP over HTTP) whereas controlling false discovery rates is better suited for blocking or rate-limiting a targeted class of traffic (i.e. Peer-to-Peer). The classifier that provides false alarm rate guarantees is based on a Neyman-Pearson classification framework while the classifier that provides false discovery rate guarantees is based on the Learning to Satisfy (LSAT) framework. Both of these classifiers are implemented using a machine learning technique, namely, the 2-nu Support Vector Machine (SVM). Moreover, all previous work done with these two statistical methodologies focused on binary classification only; we extend these statistical methodologies to a multi-class setting. In addition to the regular application classification problem, we also present preliminary work on a binary LSAT classifier that can detect, after the reception of only a handful of packets, whether a flow will be large, as defined by a network operator. This large flow detector can act as a preprocessor for regular application classifiers. By allowing only large flows to pass to the classifier, this allows the classifier to focus on the more resource-intensive flows. We validated our Internet traffic classifiers by testing our approaches using data provided by an ISP.ii Abrégé Identifier l'application (ou autre classe plus générale) qui génère un flux de trafic Internet, sans compter sur le numéro du port ou inspecter la charge des paquets, est devenu une nécessité pour les opérateurs de réseau. Les opérateurs peuvent utiliser cette information pour surveiller leurs réseaux et fournir une qualité de service propreà chaque classe. Il y a eu beaucoup de travaux de recherche portant sur la classification du trafic Internet effectué récemment et de nombreuses techniques ontété proposées. Bien que les techniques actuelles puissent obtenir une grande précision pour classer le trafic Internet, offrir des garanties de performance pour des catégories particulières est un problème encore inexploré.Dans ce mémoire, nous proposons deu...

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Motivationmentioning

confidence: 99%

Section: Our Contributionmentioning

confidence: 99%

Section: Chapter 3 Backgroundmentioning

confidence: 99%

Section: ν-Svmmentioning

confidence: 99%

See 3 more Smart Citations

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

2009

View full text Add to dashboard Cite

show abstract

Spectrum Mobility in Cognitive Radio Networks Using Spectrum Prediction and Monitoring Techniques

2021

Spectrum Sharing in Cognitive Radio Networks

View full text Add to dashboard Cite

E-LDAT: a lightweight system for DDoS flooding attack detection and IP traceback using extended entropy metric

Bhuyan

Bhattacharyya

Kalita

2016

Security Comm. Networks

View full text Add to dashboard Cite

Distributed denial‐of‐service (DDoS) attacks cause havoc by exploiting threats to Internet services. In this paper, we propose E‐LDAT, a lightweight extended‐entropy metric‐based system for both DDoS flooding attack detection and IP (Internet Protocol) traceback. It aims to identify DDoS attacks effectively by measuring the metric difference between legitimate traffic and attack traffic. IP traceback is performed using the metric values for an attack sample detected by the detection scheme. The method uses a generalized entropy metric with packet intensity computation on the sampled network traffic with respect to time. The E‐LDAT system has been evaluated using several real‐world DDoS datasets and outperforms competing methods when detecting four classes of DDoS flooding attacks, including constant rate, pulsing rate, increasing rate and subgroup attacks. The IP traceback model is also evaluated using NetFlow data in near real‐time and performs well in large‐scale attack networks with zombies. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

A Neyman–Pearson Approach to Statistical Learning

Cited by 118 publications

References 32 publications

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

Controlling False Alarm/Discovery Rates in Online Internet Traffic Flow Classification

Spectrum Mobility in Cognitive Radio Networks Using Spectrum Prediction and Monitoring Techniques

E-LDAT: a lightweight system for DDoS flooding attack detection and IP traceback using extended entropy metric

Contact Info

Product

Resources

About