{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/discriminative-models-for-multi-instance","title":"Discriminative models for multi-instance problems with tree-structure","arxiv_id":"1703.02868","date":"2017-03-07","proceeding":null,"authors":["Tomas Pevny","Petr Somol"],"abstract":"Modeling network traffic is gaining importance in order to counter modern\nthreats of ever increasing sophistication. It is though surprisingly difficult\nand costly to construct reliable classifiers on top of telemetry data due to\nthe variety and complexity of signals that no human can manage to interpret in\nfull. Obtaining training data with sufficiently large and variable body of\nlabels can thus be seen as prohibitive problem. The goal of this work is to\ndetect infected computers by observing their HTTP(S) traffic collected from\nnetwork sensors, which are typically proxy servers or network firewalls, while\nrelying on only minimal human input in model training phase. We propose a\ndiscriminative model that makes decisions based on all computer's traffic\nobserved during predefined time window (5 minutes in our case). The model is\ntrained on collected traffic samples over equally sized time window per large\nnumber of computers, where the only labels needed are human verdicts about the\ncomputer as a whole (presumed infected vs. presumed clean). As part of training\nthe model itself recognizes discriminative patterns in traffic targeted to\nindividual servers and constructs the final high-level classifier on top of\nthem. We show the classifier to perform with very high precision, while the\nlearned traffic patterns can be interpreted as Indicators of Compromise. In the\nfollowing we implement the discriminative model as a neural network with\nspecial structure reflecting two stacked multi-instance problems. The main\nadvantages of the proposed configuration include not only improved accuracy and\nability to learn from gross labels, but also automatic learning of server types\n(together with their detectors) which are typically visited by infected\ncomputers.","url_abs":"http://arxiv.org/abs/1703.02868v1","url_pdf":"http://arxiv.org/pdf/1703.02868v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"discriminative-models-for-multi-instance","repo_url":"https://github.com/UnofficialJuliaMirror/Mill.jl-1d0525e4-8992-11e8-313c-e310e1f6ddea","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"discriminative-models-for-multi-instance","repo_url":"https://github.com/UnofficialJuliaMirrorSnapshots/Mill.jl-1d0525e4-8992-11e8-313c-e310e1f6ddea","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"discriminative-models-for-multi-instance","repo_url":"https://github.com/pevnak/Mill.jl","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}