One class Classification

Masqueraders are users who take control of a machine and perform malicious activities such as data exfiltration or system misuse on behalf of legitimate users. In the literature, there are various approaches for detecting masqueraders by modeling legitimate users' behavior during their daily tasks and automatically determine whether they are doing something suspicious. Usually, these techniques model user behavior using features extracted from various sources, such as file system, network activities, system calls, etc. In this work, we propose a one-class anomaly detection approach that measures similarities between a history of a user and events recorded in a time-window of the user's session which is to be classified. The idea behind our solution is the application of a graph partitioning technique on weighted oriented graphs generated from such event sequences, while considering that strongly connected nodes have to belong into the same cluster. First, a history of vertex clusters is build per each user and then this history is compared to a new input by using a similarity function, which leads either to the acceptance or rejection of a new input. This makes our approach substantially different from existing general graph-based approaches that consider graphs as a single entity. The approach can be applied for different kinds of homogeneous event sequences, however successful application of the approach will be demonstrated on file system access events only. The linear time complexity of the approach was demonstrated in the experiments and the performance evaluation was done using two state-of-the-art datasets-WUIL and TWOS-both of them containing file system access logs of legitimate users and masquerade attackers; for WUIL dataset we achieved an average per-user AUC of 0.94, a TPR over 95%, and a FPR less than 10%, while for TWOS dataset we achieved an average per-user AUC of 0.851, a TPR over 91% and a FPR around 11%.

In this paper, we associate an applicability domain (AD) of QSAR/QSPR models with the area in the input (descriptor) space in which the density of training data points exceeds a certain threshold. It could be proved that the predictive performance of the models (built on the training set) is larger for the test compounds inside the high density area, than for those outside this area. Instead of searching a decision surface separating high and low density areas in the input space, the one-class classification 1-SVM approach looks for a hyperplane in the associated feature space. Unlike other reported in the literature AD definitions, this approach: (i) is purely “data-based”, i.e. it assigns the same AD to all models built on the same training set, (ii) provides results that depend only on the initial descriptors pool generated for the training set, (iii) can be used for the huge number of descriptors, as well as in the framework of structured kernel-based approaches, e.g., chemical graph kernels. The developed approach has been applied to improve the performance of QSPR models for stability constants of the complexes of organic ligands with alkaline-earth metals in water.

Speaker verification might be considered a binary classification problem in that the objective is to determine whether or not an utterance is from the individual whose identity is claimed. Several factors make speaker verification different from a standard binary problem. Speaker verification is challenging because of the open nature of the problem, if the utterances of an individual are examples of the class to be recognised then the non- class examples cover everything else. It is also challenging due to the the format of the data to be classified, the data consists of sentences whose lengths depend on its phonetic content and the speaking rate of the underlying speaker.
One class classifiers have emerged as a set of techniques for situations where labelled data exists for only one of the classes in a two-class problem. A related problem arises where non-class examples exist, but the non-class distribution cannot be characterised as in speaker verification. The approach taken by one class classifiers is to develop a classifier that characterises the target class, and thus can distinguish it from all counter-examples.
Traditional speaker verification systems relied on one class classifiers in order to make a decision on the validity of the claim. A popular approach used Gaussian mixture models to create a score for variable length utterances which could then be thresholded. More recently these underlying one class classifiers have been successfully used to either project variable length utterances into a fixed dimensional space or provide a characterisation which can be compared against. This thesis investigates the use of one class classifiers in speaker verification, first by casting the problem as a one class problem and then by using one class classifiers to pre-process variable length utterances so that they can be used by any standard binary classifier.
This thesis has found that by using one class classifiers not in their traditional setting but as tool to model or characterise utterances they can be harnessed to enable binary learners to perform discriminative learning of variable length utterances.

Speaker verification is a challenging problem in speaker recognition where the objective is to determine whether a segment of speech in fact comes from a specific individual. In supervised machine learning terms this is a challenging problem as, while examples belonging to the target class are easy to gather, the set of counter-examples is completely open. In this paper we cast this as a one-class classification problem and evaluate a variety of state-of-the-art one-class classification techniques on a benchmark speech recognition dataset. We show that of the one-class classification techniques, Gaussian Mixture Models shows the best performance on this task.

In open set speaker identification it is important to built
an alternative model against which to compare scores from
the ‘target’ speaker model. Two alternative strategies for
the building an alternative model are to build a single
global model by sampling from a pool of training data, the
Universal Background (UBM), or to build a cohort of models
from selected individuals in the training data for the
target speaker. The main contribution in this paper is to
show that these approaches can be unified by using a Support
Vector Machine (SVM) to learn a decision rule in the
score space made up of the output scores of the client, cohort
and UBM model.

Detecting instances of unknown categories is an important task for a multitude of problems such as object recognition, event detection, and defect localization. This paper investigates the use of Gaussian process (GP) priors for this area of research. Focusing on the task of one-class classification for visual object recognition, we analyze different measures derived from GP regression and approximate GP classification. Experiments are performed using a large set of categories and different image kernel functions. Our findings show that the well-known Support Vector Data Description is significantly outperformed by at least two GP measures which indicates high potential of Gaussian processes for one-class classification.

... against the embedded image and manipulates nearby DCT blocks to maintain DCT histogram. ... DCT as well as some commonly used wavelet decompositions used in image processing. ... The features are then generated by calculating the difference between a target coefficient in ...

This paper presents a semi-supervised one-class support vector machine classifier for remote sensing applications. In one-class image classification, one tries to detect pixels belonging to one class and reject the others. When few labeled target pixels and no labeled outlier ...

Даны два видео файла или потока. Нужно выяснить являются ли они дубликатами друг друга. Здесь, под словом дубликат понимается не формализуемое условие: «На этих файлах изображено одно и то же?».  Возможна, и другая постановка этой задачи. Дан набор видео, для нового добавляемого в этот набор видео нужно определить,  есть ли дубликат этого нового видео в наборе или нет. Понятие «нечеткий дубликат» является устоявшимся термином в задачах информационного поиска и обычно употребляется применительно к документам и изображениям. Нечеткость в данном случае интерпретируется как неполное или частичное совпадение документов или изображений.

In this paper we aim to investigate the trade off in selection of an accurate, robust and cost-effective classification model for binary classification problem. With empirical observation we present the evaluation of one-class and two-class classification model. We have experimented with four two-class and one-class classifier models on five UCI datasets. We have evaluated the classification models with Receiver Operating Curve (ROC), Cross validation Error and pair-wise measure Q statistics. Our finding is that in the presence of large amount of relevant training data the two-class classifiers perform better than one-class classifiers for binary classification problem. It is due to the ability of the two class classifier to use negative data samples in its decision. In scenarios when sufficient training data is not available the one-class classification model performs better.

We implemented versions of the SVM appropriate for one-class classification in the context of information retrieval. The experiments were conducted on the standard Reuters data set. For the SVM implementation we used both a version of Schölkopf et al. and a somewhat ...

Urban areas are one of the most important components of human society. Their extents have been continuously growing during the last few decades. Accurate and timely measurements of the extents of urban areas can help in analyzing population densities and urban sprawls and in studying environmental issues related to urbanization. Urban extents detected from remotely sensed data are usually a by-product of land use classification results, and their interpretation requires a full understanding of land cover types. In this study, for the first time, we mapped urban extents in the continental United States using a novel one-class classification method, i.e., positive and unlabeled learning (PUL), with multi-temporal Moderate Resolution Imaging Spectroradiometer (MODIS) data for the year 2010. The Defense Meteorological Satellite Program Operational Linescan System (DMSP-OLS) night stable light data were used to calibrate the urban extents obtained from the one-class classification scheme. Our results demonstrated the effectiveness of the use of the PUL algorithm in mapping large-scale urban areas from coarse remote-sensing images, for the first time. The total accuracy of mapped urban areas was 92.9% and the kappa coefficient was 0.85. The use of DMSP-OLS night stable light data can significantly reduce false detection rates from bare land and cropland far from cities. Compared with traditional supervised classification methods, the one-class classification scheme can greatly reduce the effort involved in collecting training datasets, without losing predictive accuracy.

Classification is a data mining task that allocated similar data to categories or classes. One of the most general methods for classification is ensemble method which refers supervised learning. After generating classification rules we can apply those rules on unidentified data and achieve the results. In one-class classification it is supposed that only information of one of the classes, the target class, is available. In an ensemble classification system, different base classifiers are combined in order to obtain a classifier with higher performance. In this work, a new one-class classification ensemble strategy called Approximate Polytope Ensemble is presented. The geometrical theory of convex hull is used to define the boundary of the target class defining the problem. The most widely used ensemble learning algorithms are AdaBoost and Bagging. The process of ensemble learning method can be divided into three phases: the generation phase, in which a set of candidate models is induced, the pruning phase, to select of a subset of those models and the integration phase, in which the output of the models is combined to generate a prediction.

We implemented versions of the SVM appropriate for one-class classification in the context of information retrieval. The experiments were conducted on the standard Reuters data set. For the SVM implementation we used both a version of Schoelkopf et al. and a somewhat different version of one-class SVM based on identifying "outlier" data as representative of the second-class. We report on experiments with different kernels for both of these implementations and with different representations of the data, including binary vectors, tf-idf representation and a modification called "Hadamard" representation. Then we compared it with one-class versions of the algorithms prototype (Rocchio), nearest neighbor, naive Bayes, and finally a natural one-class neural network classification method based on "bottleneck" compression generated filters.The SVM approach as represented by Schoelkopf was superior to all the methods except the neural network one, where it was, ...

We implement a Liquid State Machine composed from a pool of chaotic spiking neurons. Furthermore, a synaptic plasticity mechanism operates on the connection weights between the neurons inside the pool. A special feature of the system’s classification capability is that it can learn the class of a set of time varying inputs when trained from positive examples only, thus, it is a one class classifier. To demonstrate the applicability of this novel neurocomputing architecture, we apply it for Online Signature Verification.

Extreme Value Theory (EVT) describes the distribution of data considered extreme with respect to some generative distribution, effectively modelling the tails of that distribution. In novelty detection, or one-class classification, we wish to determine if data are ldquonormalrdquo with respect to some model of normality. If that model consists of generative distributions, then EVT is appropriate for describing the behaviour of extremes generated from the model, and can be used to determine the location of decision boundaries that separate ldquonormalrdquo areas of data space from ldquoabnormalrdquo areas in a principled manner. This paper introduces existing work in the use of EVT for novelty detection, shows that existing work does not accurately describe the extrema of multivariate, multimodal generative distributions, and proposes a novel method for overcoming such problems. The method is numerical, and provides optimal solutions for generative multivariate, multimodal distributions of arbitrary complexity. In a companion paper, we present analytical closed-form solutions which are currently limited to unimodal, multivariate generative distributions.

In this thesis a new approach for automatic road database verification based on remote sensing images is presented. In contrast to existing approaches, the applicability of the new approach is not restricted to specific road types, context areas or geographic regions. The general applicability of
the approach is achieved by combining several state-of-the-art road detection and road verification approaches that can deal well with different road types, context areas and geographic regions. Each road detection or verification approach is realized as an independent module representing a unique road model and a specific processing strategy. All modules provide independent solutions for the verification problem of each road object stored in the database. Statistical reasoning is applied to the outputs of the individual modules in order to find the optimal combined solution. Each module provides a solution consisting of two parts. The first part is a probability distribution with respect to the two possible states of a database object, correct and incorrect. This part is based on the developments of the original state-of-the-art approaches. The second part is a probability distribution with respect to the two states of a particular model, applicable and not applicable. This part is a specific contribution of this thesis. It is always based on an assessment of the assumptions implicitly made for the particular model, and only if all assumptions are fulfilled a model is considered as applicable. In accordance with the original literature, such model assumptions refer to the presence of specific road types, context areas or geographic regions, but also to the visibility of features and the availability of representative training samples in case of statistically defined models. Consequently, each module provides probabilities with respect to two state spaces (correct, incorrect and applicable, not applicable). In accordance with the Dempster-Shafer Theory both probability distributions are mapped to a new state space that includes correct, incorrect and unknown as the possible states of a database object. Combination and classification are realized in the new state space, whose outcome is considered to be the starting point for manual post-processing.
Experiments with real cartographic datasets provided by three national mapping agencies, showing 7742 correct and 669 incorrect road objects, are used to reveal the potential and the limitations of the proposed approach. If a human operator investigates all database objects assigned to the states
incorrect or unknown and edits them if necessary, a database quality of 97.5–100% is achieved,
while the human operator must look at 25–33% of the road objects in the database. If a human
operator concentrates only on database objects assigned to the state incorrect, the database quality is reduced by approximately 5%, but the human operator must investigate not more than 9% of the road objects. Additionally, a comparison with other state-of-the-art road detection approaches using benchmark datasets shows that in general the proposed approach provides better results than other state-of-the-art approaches.

In this paper we aim to investigate the trade off in selection of an accurate, robust and cost-effective classification model for binary classification problem. With empirical observation we present the evaluation of one-class and two-class classification model. We have experimented with four two-class and one-class classifier models on five UCI datasets. We have evaluated the classification models with Receiver Operating Curve (ROC), Cross validation Error and pair-wise measure Q statistics. Our finding is that in the presence of large amount of relevant training data the two-class classifiers perform better than one-class classifiers for binary classification problem. It is due to the ability of the two class classifier to use negative data samples in its decision. In scenarios when sufficient training data is not available the one-class classification model performs better.

A number of important applied problems in engineering , finance and medicine can be formulated as a problem of anomaly detection. A classical approach to the problem is to describe a normal state using a one-class support vector machine. Then to detect anomalies we quantify a distance from a new observation to the constructed description of the normal class. In this paper we present a new approach to the one-class classification. We formulate a new problem statement and a corresponding algorithm that allow taking into account a privileged information during the training phase. We evaluate performance of the proposed approach using a synthetic dataset, as well as the publicly available Microsoft Malware Classification Challenge dataset.

This paper studies a specific one-class classification problem where the training data are corrupted by significant outliers. Specifically, we are interested in the one-class support vector machine (OCSVM) approach that normally requires good training data. However, perfect training data are usually hard to obtain in most real-world applications due to the inherent data variability and uncertainty. To address this issue, we propose an OCSVM-based data editing and classification method that can iteratively purify the training data and learn an appropriate classifier from the trimmed training set. The proposed method is compared with a general OCSVM approach trained from two types of bootstrap samples, and applied to the mapping and compliance monitoring tasks for the U.S. Department of Agriculture's Conservation Reserve Program using remotely sensed imagery. Experimental results show that the proposed method outperforms the general OCSVM using bootstrap samples at a lower computational load.