Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama

[Jérôme François <[e-mail]>]

Hi Bing,

Le 13/10/2015 04:38, Liubing (Leo) a écrit :
>
>
> We actually build a method to aggregate multi-dimensional data within a
> single tree structure without assuming any order between dimensions and
> with variable granularity. 
> [Bing] I guess most of the raw data is more or less mix-dimensional. Orthogonal data should be a fine-tuned result most of the time.
> So, I guess your aggregation method should be common in some degree, that not only applied to your fingerprinting use case?
Yes, it is a generic method. We actually did not apply for
fingerprinting (yet). Actually, once you are able to define a hierarchy
over a dimension, you can use it. We apply on domain names, IP
addresses, port taxonomy and geographical positions.
>> It is a kind of mix between k-dimensional tree and density-based clustering. 
>> For example, we applied it to DNS answers
>> aggregating both domain names and IP address in a single data structure to
>> be analyzed rather than an individual record inspection to first identify time
>> period where some divergent behavior appears.
> [Bing] This sounds interesting. An naive question: can this algorithm be applied to network traffic N-tuples analysis, and is there any limitation to the number of "N"?
The number of N is not limited. It is basically what we do, we just
represent network traces or trafic recors as N-tuples and then aggregate
them.
For performance reason, the maximal size of tree is set and then
aggregation is invoked when the tree starts to be too large.
More details can be found here:
https://www.usenix.org/system/files/conference/lisa12/lisa12-final-26.pdf
We have been inspired by Aguri
(http://www.wide.ad.jp/news/event/stanford2002/documents/Measurement/aguri.pdf)

>
>> I know that it is not ML itself but we used it is fully in the scope of data
>> representation and pre-processing of ML.
> [Bing] Pre-processing might not be the key factor in ML theory/methodology perspective; but it is curtail in ML engineering perspective. So I'd like to hear it in your presentation.
Great!

Best,
jerome