Robust Representation for Domain Adaptation in Network Security

The goal of domain adaptation is to solve the problem of di↵erent joint distribution of observation and labels in the training and testing data sets. This problem happens in many practical situations such as when a malware detector is trained from labeled datasets at certain time point but later evolves to evade detection. We solve the problem by introducing a new representation which ensures that a conditional distribution of the observation given labels is the same. The representation is computed for bags of samples (network tra c logs) and is designed to be invariant under shifting and scaling of the feature values extracted from the logs and under permutation and size changes of the bags. The invariance of the representation is achieved by relying on a self-similarity matrix computed for each bag. In our experiments, we will show that the representation is e↵ective for training detector of malicious tra c in large corporate networks. Compared to the case without domain adaptati...

• Type: Journal
• Year: 2015
• Where: PKDD
• Authors: Karel Bartos, Michal Sofka
• Keywords: Data Mining, PKDD 2015