Semantic Pattern Transformation

Transcription

1 Semantic Pattern Transformation IKNOW 2013 Peter Teufl, Herbert Leitold, Reinhard Posch

2 Our Background Topics Mobile device security Cloud security Security consulting for public insititutions (Austria) IT security research IT security lectures A-SIT e-government

3 Why does he talk about Knowledge Discovery? How does IT security relate to knowledge discovery? egov - eparticipation: document analysis, twitter etc. intrusion detection systems (network traffic analysis) malware detection (network traffic, mobile phones) mobile application analysis (metadata, market descriptions) mobile application security (hot topic, BYOD, etc.)

4 What to expect? Motivation for the Semantic Pattern Transformation Basic concepts, techniques How does it work? Evaluation? Applications, results, current topics!

5 Environment Arbitrary features No apriori knowledge Heteregenous domains Supervised learning Anomaly Detection Text analysis Android market descriptions Semantic search Clustering terms flexible histograms new numbers Visualization deployment domains Extracting knowledge

6 Process... Fayyad et al. Domain-specific data set Machine learning Different processing steps From defining the goals To extracting the desired knowledge Machine learning algorithms are often used within KDD KDT Knowledge discovery goals Target data set Preprocessing Data extraction Data mining method Data mining algorithm Data mining ML-KDT Machine learning goals Instance extraction Feature selection, construction Instance selection Machine learning algorithm Preprocessing Algorithm application However, the complete machine learning process is quite similar to KDD Knowledge extraction Knowledge processing Interpretation

7 Machine Learning ADAPTATION COMPLEXITY? Domain-specific data set Machine learning goals Instance extraction Feature selection, construction Instance selection Algorithm selection Preprocessing Algorithm application Interpretation Dependence on domain data and goals High Medium Low Assuming an arbitrary data-set (e-participation, Android Market applications) Further assuming: a knowledge discovery goal: e.g., unsupervised clustering Then: we need to adapt the steps on the left And: We need to adapt this setup when the data changes, even when the knowledge discovery goals remain the same! Android Market applications vs. text documents vs. network traffic vs. malware detection?

8 TOWARDS A SEMANTIC REPRESENTATION Finding a new representation... New representation is called Semantic Patterns Key properties: Still a vector representation (compatible to old representation) Not the feature values themselves, but their semantic relations are represented All values have the same meaning and feature type (activation) Transformation from raw data into Semantic Patterns: Semantic Pattern Transformation

9 SEMANTIC PATTERN TRANSFORMATION The Semantic Pattern Transformation is arranged in five layers Layer 1 Feature Extraction Data set Relation Instances Layer 1 - Feature extraction FROM TO TIME FROM TO TIME FROM TO TIME SF 2 Instance SF 1 SF 2 DF 1 SF 2 DF 2 Map Layer 2 - Associative network - Node generation Layer 2-3 Associative Network Generation SV MV SV SV MV Map Map Layer 3 - Associative network - Link generation Layer 4 Spreading Activation P 1 SV SV P 2 MV MV Layer 4 - Spreading activation (SA) P 3 P 4 Layer 5 - Analysis (machine learning, semantic search etc.) Layer 5 Analysis Semantic relations Semantic development over time Unsupervised clustering Feature value relevance Anomaly detection Pattern similarity Supervised learning

10 SPT: Layer 1 - Feature extraction Country Exports Unemployment rate Fertility rate C1 coffee 20% 5 C2 cacao 20% 5 C3 coffee, cacao 20% 5 C4 machinery 5% 2 C5 chemicals 5% 2 C6 chemicals, machinery 5% 2 C7 chemicals, cacao 20% missing data C8 missing data 20% 5 C9 coffee, cacao missing data missing data Extract features, their values and determine the type (categorical, distance-based) Categorical: Exports Distance-based: Unemployment rate, fertility rate

11 SPT: Layer 2 - Node generation Country Exports Unemployment rate Fertility rate C1 coffee 20% 5 C2 cacao 20% 5 C3 coffee, cacao 20% 5 C4 machinery 5% 2 C5 chemicals 5% 2 C6 chemicals, machinery 5% 2 C7 chemicals, cacao 20% missing data C8 missing data 20% 5 C9 coffee, cacao missing data missing data Distance-based feature values: map value ranges to single nodes 5% Categorical feature 20% values: Associative network one node for each value 5 coffee machinery 2 chemicals cocoa

12 SPT: Layer 3 - Link generation Country Exports Unemployment rate Fertility rate C1 coffee 20% 5 C2 cacao 20% 5 C3 coffee, cacao 20% 5 C4 machinery 5% 2 C5 chemicals 5% 2 C6 chemicals, machinery 5% 2 C7 chemicals, cacao 20% missing data C8 missing data 20% 5 C9 coffee, cacao missing data missing data coffee, 20%, 5 chemicals, cacao, 20% 5% 5 coffee 20% machinery 2 chemicals Link Weight cocoa

13 SPT: Layer 4 - Spreading activation Creating a Semantic Pattern: in this case for coffee and cacao Set activation value of the two nodes to 1.0 Spread this activation value to neighboring nodes via the weighted links 5% 5 20% 1.0 coffee machinery 2 chemicals cocoa 1.0

14 SPT: Layer 4 - Spreading activation Typically, one would create Semantic Patterns for all instances within the data set E.g. a pattern for C1 by activating coffee, 20% and 5 However, we can also create patterns for feature values: e.g. coffee Country Exports Unemployment rate Fertility rate C1 coffee 20% 5 C2 cacao 20% 5 C3 coffee, cacao 20% 5 C4 machinery 5% 2 C5 chemicals 5% 2 C6 chemicals, machinery 5% 2 C7 chemicals, cacao 20% missing data C8 missing data 20% 5 C9 coffee, cacao missing data missing data

15 SPT: Layer 4 - Spreading activation After SA: each node % % in the network has an activation value coffee cocoa chemicals 0.08 machinery By representing the 1.15 nodes and their activation values as a vector, we gain a Semantic Pattern coffee cocoa machinery chemicals 20% 5%

16 Export: Cacao Unsorted Semantic Pattern coffee cacao machinery chemicals 20% 5% 5 2 Country Exports Unemployment rate Fertility rate C1 coffee 20% 5 C2 cacao 20% 5 C3 coffee, cacao 20% 5 C4 machinery 5% 2 C5 chemicals 5% 2 C6 chemicals, machinery 5% 2 C7 chemicals, cacao 20% missing data C8 missing data 20% 5 C9 coffee, cacao missing data missing data Export: Coffee Unsorted Semantic Pattern Each feature value is represented by a semantic fingerprint coffee cacao machinery chemicals 20% 5% 5 2 Fertility: 2 Unsorted Semantic Pattern Allows for an instant analysis of semantic relations to other feature values 0.25 Sort, mean, variance, adding, 0 coffee cacao machinery chemicals 20% 5% 5 2 subtracting

17 SPT: Layer 5 - Analysis Calculating the distance between two patterns (Euclidean distance, Cosine similarity) For unsupervised clustering, semanticaware search algorithms Keyword search for coffee C1 coffee 20% 5 C3 coffee, cacao 20% 5 C9 coffee, cacao missing data missing data Semantic aware search for coffee C9 coffee, cacao missing data missing data C1 coffee 20% 5 C3 coffee, cacao 20% 5 C2 cacao 20% 5 C8 missing data 20% 5 C7 chemicals, cacao 20% missing data C5 chemicals 5% 2 C6 chemicals, machinery 5% 2 C4 machinery 5% 2

18 SPT: Layer 5 - Analysis Machine learning: apply any machine learning algorithm to the Semantic Patterns Unsupervised clustering Supervised learning Semantic-aware search Knowledge discovery: semantic relations, arbitrary procedures: mean, variance etc. Anomaly detection, feature relevance, simple operations (variance, mean, etc.) Visualization

19 Machine Learning Benefits? Domain-specific data set Machine learning goals Domain-specific data set Machine learning goals Application in heterogeneous domains regardless of the nature of the data Instance extraction Feature selection, construction Instance selection Algorithm selection Preprocessing Instance extraction Feature selection, construction Instance selection Algorithm selection Preprocessing Except for Layer 1, we do not need any manual setup for the layers Regardless of the analyzed data, the Semantic Patterns always use the same model Algorithm application Interpretation Algorithm application Interpretation Dependence on domain data and goals High Medium Low This means: Regardless of the deployed knowledge discovery method, we can always use the same methods for knowledge extraction!

20 Comparing the two models 2.00 Mean pattern: C1, C2, C3 Unsorted Semantic Pattern Semantic Patterns 1.00 Country Coffee Cacao Machinery Chemicals 20% 5% 5 2 C C C C C C C C C coffee cacao machinery chemicals 20% 5% 5 2 Mean pattern: C4, C5, C6 Unsorted Semantic Pattern Value-centric feature vectors 0 coffee cacao machinery chemicals 20% 5% 5 2 Country Coffee Cacao Machinery Chemicals Unemployment rate Fertility rate C % 5 C % 5 C % 5 C % 2 C % 2 C % 2 C % missing data C8 missing data 20% 5 C missing data missing data Same model: Android application, a country or a document... the activation values always have the same meaning

21 Evaluation 26 data sets from the UCI machine learning repository Supervised: SVM Unsupervised: EM and k-means Application to raw data and to Semantic Patterns Data set Label Inst DF SF Classes SVM (N) SVM (NN) SVM (P) KM (N) KM (NN) KM (P) EM (NN) EM (P) Breast Cancer Dermatology KR vs. KP Lymph Mushroom Soybean Splice Vote Zoo Anneal Colic Credit-A Credit-G Heart-C Heart-H Hepatitis Breast-w Diabetes Glass Heart-Statlog Ionosphere Iris Segment Sonar Vehicle Vowel BC DE KR LY MU SO SP VO ZO AN CO CA CG HC HH HE BW DI GL HS IO IR SE SO VE VO SVM K-Means EM SP-Parameters: D=0.5, Comb=E, Norm=L, MDL=1.5, σ = 0.2 Categorical Total Mixed Total Numerical Total

22 DOES IT WORK? Applications described in several publications, which analyze e-participation (Egyptian revolution, Fukoshima, Mitmachen): text documents Intrusion detection: event correlation RDF data analysis (semantic web) WiFi privacy (analyzing captured s) Android Market application analysis

23 Current Project Android application security Container applications for BYOD (require encryption, secure communication, key derivation functions, root checks etc.) Manual analysis is cumbersome Semantic Patterns Extract Dalvik VM code, features (opcodes, methods, local variables etc.) Apply Semantic Patterns technique Clustering, supervised learning, anomaly detection etc.

24 Current Project

25 Current Project Also works directly on the phone... Detecting SMS catchers/sniffers More fine grained detection assymmetric cryptography symmetric cryptography

26 Outlook Publish the Java API... basically a converter from arbitrary feature vectors to Semantic Patterns (e.g. in/out in ARFF format) Deep learning...

27 Thx!

28 Par N NN D 0.0 D 0.1 D 0.3 D 0.5 D 0.7 D 0.1 D 0.3 D 0.5 D 0.7 D 0.1 D 0.3 D 0.5 D 0.7 D 0.1 D 0.3 D 0.5 D 0.7 K-Means EM Total BC DE KR LY MU SO SP VO ZO Total BC DE KR LY MU SO SP VO ZO Raw Data Not available Semantic Patterns Comb=E Norm=L Comb=S Norm=L Comb=E Norm=S Comb=S Norm=S

29 Par N NN σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 K-Means EM Total AN CO CA CG HC HH HE Total AN CO CA CG HC HH HE Raw Data Not available Semantic Patterns D=0.0 MDL=2.0 D=0.0 MDL= D=0.5 MDL=1.0 D=0.7 MDL= D=0.5 MDL=1.5 D=0.7 MDL= D=0.5 MDL=2.0 D=0.7 MDL= D=0.5 MDL=3.0 D=0.7 MDL=

30 Par N NN σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 σ 0.0 σ 0.2 σ 0.4 σ 0.6 σ 0.8 K-Means EM Total BW DI GL HS IO IR SE SO VE VO Total BW DI GL HS IO IR SE SO VE VO Raw Data Not available Semantic Patterns D=0.0 MDL=1.5 D=0.0 MDL= D=0.5 MDL=1.0 D=0.7 MDL= D=0.5 MDL=1.5 D=0.7 MDL= D=0.5 MDL=2.0 D=0.7 MDL= D=0.5 MDL=3.0 D=0.7 MDL=

31 Distance Data Missing BC DE KR LY MU SO SP VO ZO Total AN CO CA CG HC HH HE Total BW DI GL HS IO IR SE SO VE VO Total Euc Cos Raw Semantic Patterns Raw Semantic Patterns 0% 10% 50% 90% 0% 10% 50% 90% 0% 10% 50% 90% 0% 10% 50% 90% Categorical Mixed Numerical

32 Data set EUC (N) EUC (NN) COS (NN) EUC (NN) COS (NN) EUC (NN) COS (NN) RAW Baseline Semantic Patterns Categorical BC DE KR LY MU SO SP VO ZO Total AN CO CA CG HC HH HE Total BW DI GL HS IO IR SE SO VE VO Total Mixed Numerical