Ariel Bar

Improving Simple Collaborative Filtering Models Using Ensemble Methods

In this paper we examine the effect of applying ensemble learning to the performance of collaborative filtering methods. We present several systematic approaches for generating an ensemble of collaborative filtering models based on a single collaborative filtering algorithm (single-model or homogeneous ensemble). We present an adaptation of several popular ensemble techniques in machine learning for the collaborative filtering domain, including bagging, boosting, fusion and randomness injection. We evaluate the proposed approach on several types of collaborative filtering base models: k-NN, matrix factorization and a neighborhood matrix factorization model. Empirical evaluation shows a prediction improvement compared to all base CF algorithms. In particular, we show that the performance of an ensemble of simple (weak) CF models such as k-NN is competitive compared with a single strong CF model (such as matrix factorization) while requiring an order of magnitude less computational cost.

Towards latent context-aware recommendation systems

The emergence and penetration of smart mobile devices has given rise to the development of context-aware systems that utilize sensors to collect available data about users in order to improve various user services. Recently, the use of context-aware recommender systems (CARS) aimed at recommending items to users has expanded, particularly those that consider user context. Adding context to recommendation systems is challenging, because the addition of various environmental contexts to the recommendation process results in the expansion of its dimensionality, and thus increases sparsity. Therefore, existing CARS tend to incorporate a small set of pre-defined explicit contexts which do not necessary represent user context or reflect the optimal set of features for the recommendation process. We suggest a novel approach centered on representing environmental features as low dimensional unsupervised latent contexts. We extract data from a rich set of mobile sensors in order to infer unexplored user contexts in an unsupervised manner. The latent contexts are hidden context patterns modeled as numeric vectors which are efficiently extracted from raw sensor data. The latent contexts are automatically learned for each user utilizing unsupervised deep learning techniques and PCA on the data collected from the users mobile phone. Integrating the data extracted from high dimensional sensors into a new latent context-aware recommendation algorithm results in up to a 20% increase in recommendation accuracy.

Utilizing transfer learning for in-domain collaborative filtering

In recent years, transfer learning has been used successfully to improve the predictive performance of collaborative filtering (CF) for sparse data by transferring patterns across domains. In this work, we advance transfer learning (TL) in recommendation systems (RSs), facilitating improvement within a domain rather than across domains. Specifically, we utilize TL for in-domain usage. This reduces the need to obtain information from additional domains, while achieving stronger single domain results than other state-of-the-art CF methods. We present two new algorithms; the first utilizes different event data within the same domain and boosts recommendations of the target event (e.g., the buy event), and the second algorithm transfers patterns from dense subspaces of the dataset to sparse subspaces. Experiments on real-life and publically available datasets reveal that the proposed methods outperform existing state-of-the-art CF methods.

Unknown malware detection using network traffic classification

We present an end-to-end supervised based system for detecting malware by analyzing network traffic. The proposed method extracts 972 behavioral features across different protocols and network layers, and refers to different observation resolutions (transaction, session, flow and conversation windows). A feature selection method is then used to identify the most meaningful features and to reduce the data dimensionality to a tractable size. Finally, various supervised methods are evaluated to indicate whether traffic in the network is malicious, to attribute it to known malware “families” and to discover new threats. A comparative experimental study using real network traffic from various environments indicates that the proposed system outperforms existing state-of-the-art rule-based systems, such as Snort and Suricata. In particular, our chronological evaluation shows that many unknown malware incidents could have been detected at least a month before their static rules were introduced to either the Snort or Suricata systems.

Nesto - Network selection and traffic offloading system for android mobile devices

In this paper we present Nesto, a network selection and offloading system for android based mobile devices. Nesto chooses the best connectivity solution between available heterogeneous wireless networks using network switching. The suggested framework supports several configurable policies and addresses the following requirements: battery energy saving, bandwidth maximization, an offloading strategy for cellular operators and granting the best available network QoS to current running applications (e.g. minimizing delay and jitter for voip applications). Nesto is designed to support two primary connectivity modes: a traditional single connectivity mode and a full dual mode, where both the cellular and ad-hoc WiFi networks are used simultaneously. The full dual mode allows us to extend the always best connected definition from the device level to the application level, i.e.: selecting the best network for each application. This paper presents the architecture of Nesto and the different network selection optimization models. We evaluate our solution with simulated data and with real network traffic traces. Preliminary results indicate that: (1) energy efficient policies rely on the single connectivity operation mode, but they can be controlled to improve other networking QoS measures with minimum energy overhead, (2) using the full dual operation mode improves the overall networking performances of the device, (3) the full dual operation mode enables an efficient always best connected solution at the application level, optimizing the relevant measures for each application type.

Predict Demographic Information Using Word2vec on Spatial Trajectories

Inferring socio-demographic attributes of users is an important and challenging task that could help with personalization, recommendation, advertising, etc. Sensor data collected from mobile devices can be utilized for inferring such attributes. Previous works have focused on combining different types of sensors, such as applications, accelerometer, GPS, battery, and many others, to achieve this task. In this study, we were able to infer attributes, such as gender, age, marital status, and whether the user has children, using solely the GPS sensor. We suggest a novel inference technique, which learns an embedding representation of preprocessed spatial GPS trajectories using an adaption of the Word2vec approach. Based on the embedding representation, we later train multiple classification models to achieve the inference goals. Our empirical results indicate that the suggested embedding approach outperforms a classification approach which does not take into consideration the embedding patterns. Experiments on real datasets collected from Android devices show that the proposed method achieves over 80% accuracy for various demographic prediction tasks.

Scalable attack propagation model and algorithms for honeypot systems

Attack propagation models within honeypot systems aim at providing insights about attack strategies that target multiple honeypots, rather than analyzing attacks on each honeypot separately. Traditional attack propagation models focus on building a single probabilistic model. This modeling approach may be misleading, since it does not take into consideration contextual information such as the country from which the attack is initiated. In addition, with the massive increase in the magnitude of attacks on honeypots, a scalable modeling approach is required. In this work we present a novel attack propagation model that can utilize contextual information about the attacks by training multiple Markov Chain models. Moreover, we add additional layers of analysis: first, we present a likelihood estimation procedure that can identify new and evolving attack patterns; and second, we introduce a method for generating simulated attack sequences that can be used for training or sensitivity analysis. Lastly, we present, in details, a MapReduce design for all suggested algorithms in order to address scalability issues. We evaluate our methods on a massive dataset which includes approximately 170 million attacks on an operational honeypot system. Results indicate that contextual modeling is important for explaining attack propagation that may vary by country. In addition, we show the effectiveness of the suggested method for generating simulated sequences by comparing the attack propagation patterns we learned in the generated dataset and the original one. Finally, we demonstrate the scalability of all of the proposed algorithms on real and synthetic datasets that include over a billion records.