BaggingRandomMiner is an ensemble of weak one-class classifiers based on dissimilarities. In the training phase, every weak classifier is built using Bagging and computing a threshold of dissimilarities. In the classification phase, the classification scores of the weak classifiers are averaged, and every weak classifier computes its score based on the dissimilarity to the nearest neighbor and the threshold computed in the training phase.

# Bagging Random Miner (BRM)

• Training phase:
• Input:
• T: training dataset;
• τ: number of classifiers in the ensemble;
• μ: size of training dataset to bootstrap.
• Output:
• P: the set of classifiers parameters (selected objects and dissimilarity thresholds).
• Training:
1. Set P initially empty; i.e., P ← {}.
2. for i= 1..τ do
1. Let Ti contains a sample with a replacement of μ objects from T.
2. Let δi contains the average dissimilarity between all the pairs of instances in Ti.
3. PPU{(Ti, δi )}
3. return P.
• Classification phase:
• Input:
• x: instance to be classified;
• P: the set of parameters computed in the training phase.
• Q: queue with past classification results;
• σ: number of past objects to consider in the current classification.
• Output:
• Anomaly score.
• Classification:
1. Let s←0 be the score computed by the classifiers.
2. for each (Ti, δi ) in P do
1. Let dmin be the dissimilarity between x and its nearest neighbor in Ti.
2. Update the score as follows ss+e^(-0.5(dminδi )^2 )
3. Average the score as follows ss∕|P|
4. Let s′ be the average of values in Q.
5. if |Q|=σ then
1. dequeue(Q)
6. enqueue(s, Q)
7. return (s′+s)/2

For more information: J. Benito Camiña, M.A. Medina-Pérez, R. Monroy, O. Loyola-González, L. A. Pereyra-Villanueva, L. C. González-Gurrola "Bagging-RandomMiner: A one-class classifier for file access-based masquerade detection," Machine Vision and Applications, vol. 30, no. 5, pp. 959-974, 2019.

## Project details

Uploaded Source
Uploaded Python 3