Re: [Nmlrg] Machine Learning in network - solicitation for use cases

["Liubing (Leo)" <[e-mail]>]

> >> Hi, Brian,
> >>
> >> I believe there is feedback-style training in spam processing. But
> >> what do
> >you mean by "human" training? Do you mean the feedback is decided and
> >feed by human administrators? I believe this could be done by machine
> >learning mechanisms.
> >
> >In the spam case it is definitely a real live human who must detect an
> >error by the classifier. In my case I estimate that maybe 0.5% of the
> >messages in my Gmail spam folder are not spam, and maybe 1% in my
> Gmail
> >Inbox are actually spam.
> >
> >I think that for real-time DDOS protection, the solution has to include
> >real-time input from an operator for both cases: "This is not an
> >attack" and "You missed an attack". I think that means that the
> >machine-learning system will always run in training mode, even if
> >training is only needed in 1% of cases.
> 
> The automatic in DDoS scenarios may be more critic than the SPAM
> scenarios. In the worst case, the time of waiting human input/feedback may
> already be enough for attackers to make significant damage. 

[Bing] For SPAM machine learning case, I guess the human feedback is only the source of labeled training data. All the Gmail users (I read there were 900M users) are together training the SPAM filter. So, the filter might not directly response to one single feedback.
If DDoS is the similar approach, then I guess the human feedback won't make the learning program react either? 

But I'm curious about what is the item that could be labeled as "This is not an attack " or " You missed an attack ". E.g., the item is an packet, a stream, or any other kind of N-tuple things.

Best regards,
Bing

> However, this may not be directly relative to machine learning. The programs that react
> according to machine learning results may be if-else style. It may also
> potentially be another machine learning mechanism.
> 
> Sheng
> 
> >> Actually, spam filtering was one of the earliest network-relevant
> >> area that
> >starts to use machine learning. It would worth to study the machine
> >learning applications in spam filtering. Or we could invite some expert
> >in this area to join nmlrg discussion.
> >
> >Agreed
> >  Brian
> >
> >>
> >> Best regards,
> >>
> >> Sheng
> >>
> >>> How can
> >>> human training be achieved for a real-time case like DDOS?
> >>>
> >>>   Brian
> >>>
> >>>>
> >>>> Best regards,
> >>>>
> >>>> Sheng
> >>>>
> >>>>> There were some related discussions in Dots. If you are
> >>>>> interested, I could find them out later.
> >>>>>
> >>>>> _______________________________________________
> >>>>> nmlrg mailing list
> >>>>> [e-mail]
> >>>>> https://www.irtf.org/mailman/listinfo/nmlrg
> >>>> _______________________________________________
> >>>> nmlrg mailing list
> >>>> [e-mail]
> >>>> https://www.irtf.org/mailman/listinfo/nmlrg
> >>>>
> >
> >_______________________________________________
> >nmlrg mailing list
> >[e-mail]
> >https://www.irtf.org/mailman/listinfo/nmlrg
> _______________________________________________
> nmlrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/nmlrg