Multi-label classification for overlapping classes

• US 10,417,579 B2
• Filed: 09/25/2015
• Issued: 09/17/2019
• Est. Priority Date: 09/25/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Singh, Nidhi, Olinsky, Craig Philip
• Primary Examiner(s): Chen, Alan
• Application Number:
  US14/865,058
• Publication Number:
  US 20170091654A1
• Time in Patent Office: 1,453 Days
• Field of Search: None
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

In an example, there is disclosed a computing apparatus, including one or more logic elements comprising a classification engine operable to identify at least one overlapping class pair comprising at least two classes selected from a class group, wherein the overlapping class pair may be characterized by a substantial mutual false positive rate; and assign an object to at least one assigned class selected from the class group.

Claims

1. A computing apparatus, comprising:

one or more logic elements comprising a classification engine operable to;

build a universal hyperclassifier;

identify at least one overlapping class pair comprising at least two classes selected from a class group, wherein the overlapping class pair may be characterized by an at least approximately 50% mutual false positive rate; and

assign an object to at least one assigned class selected from the class group.

2. The computing apparatus of claim 1, wherein the at least one assigned class is selected from the overlapping class pair.

3. The computing apparatus of claim 1, wherein the classification engine is further operable to build at least one ensemble learning model, comprising at least two binomial experts.

4. The computing apparatus of claim 3, wherein the classification engine is further operable to:

assign the object a first match probability index for a first class;

assign the object a second match probability index for a second class;

determine that the difference between the first match probability index and second match probability index is less than a threshold α

; and

invoke the at least one ensemble learning model comprising applying a first binomial expert and a second binomial expert to the first and second classes.

5. The computing apparatus of claim 3, wherein the classification engine is further operable to compound predictions of the at least two binomial experts.

6. The computing apparatus of claim 1, wherein building a universal hyper-classifier comprises mapping an instance i of the object to a plurality of classes that can be associated with that instance.

7. The computing apparatus of claim 1, wherein the classification engine is further operable to build a multinominal classifier.

8. The computing apparatus of claim 7, wherein building the multinomial classifier comprises an L2 regularized logistic regression model of the form:

9. The computing apparatus of claim 1, wherein identifying at least one overlapping class pair comprises determining that a false positive rate exceeds a threshold T.

10. The computing apparatus of claim 1, wherein identifying at least one overlapping class pair comprises building a confusion matrix.

11. The computing apparatus of claim 1, wherein the object is a text object.

12. The computing apparatus of claim 1, wherein identifying overlapping class pairs comprises classifying a model according to:

13. The computing apparatus of claim 1, wherein identifying overlapping class pairs comprises classifying a model according to:

14. One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions for providing a classification engine operable to:

build a universal hyperclassifier;

identify at least one overlapping class pair comprising at least two classes selected from a class group, wherein the overlapping class pair may be characterized by an at least approximately 50% mutual false positive rate; and

assign an object to at least one assigned class selected from the class group.

15. The one or more tangible, non-transitory computer readable mediums of claim 14, wherein the at least one assigned class is selected from the overlapping class pair.

16. The one or more tangible, non-transitory computer readable mediums of claim 14, wherein the classification engine is further operable to build at least one ensemble learning model, comprising at least two binomial experts.

17. The one or more tangible, non-transitory computer readable mediums of claim 16, wherein the classification engine is further operable to:

assign the object a first match probability index for a first class;

assign the object a second match probability index for a second class;

determine that the difference between the first match probability index and second match probability index is less than a threshold α

; and

invoke the at least one ensemble learning model comprising applying a first binomial expert and a second binomial expert to the first and second classes.

18. The one or more tangible, non-transitory computer readable mediums of claim 16, wherein the classification engine is further operable to compound predictions of the at least two binomial experts.

19. The one or more tangible, non-transitory computer readable mediums of claim 14, wherein building a universal hyper-classifier comprises mapping an instance i of the object to a plurality of classes that can be associated with that instance.

20. The one or more tangible, non-transitory computer readable mediums of claim 14, wherein the classification engine is further operable to build a multinominal classifier.

21. The one or more tangible, non-transitory computer readable mediums of claim 20, wherein building the multinomial classifier comprises an L2 regularized logistic regression model of the form:

22. A computer-implemented method of providing a classification engine, comprising:

building a universal hyperclassifier;

identifying at least one overlapping class pair comprising at least two classes selected from a class group, wherein the overlapping class pair may be characterized by an at least approximately 50% mutual false positive rate; and

assigning an object to at least one assigned class selected from the class group.

23. The computer-implemented method of claim 22, wherein the at least one assigned class is selected from the overlapping class pair.

24. The computer-implemented method of claim 22, wherein the classification engine is further operable to build at least one ensemble learning model, comprising at least two binomial experts.

25. The computer-implemented method of claim 24, wherein the classification engine is further operable to:

assign the object a first match probability index for a first class;

assign the object a second match probability index for a second class;

determine that the difference between the first match probability index and second match probability index is less than a threshold α

; and

invoke the at least one ensemble learning model comprising applying a first binomial expert and a second binomial expert to the first and second classes.