Re: [Nmlrg] Machine Learning in network - solicitation for use cases

[Sheng Jiang <[e-mail]>]

>Especially for one-class systems that only learn models of normality, it is
>important to be able to track a change of normality. Otherwise, these systems
>render themselves useless over time / generate too much false alarms.  

The feedback-style learning could enhance the efficient and accuracy, I believe. The analysis results, either good or bad, after confirmed by human operators, could be fed back as new data. In these way, the quality of the data would be improved over time. However, this is general for machine learning. Security may be slightly different, and need to be continuously learn the new attacks, which may be invited by the attackers over the time.

Sheng

>As
>operator, you can only rely on the results if there are no (significant) baseline
>changes.  However, detecting this is probably not trivial and as far as I know
>this is not heavily researched by the network security community.  Some
>years ago, I read a paper that claimed that such baseline confidence checks
>are successfully employed in voice recognition systems and crucial for those
>system’s reliability.  Unfortunately, I don’t have this paper at hand.
>
>sebastian