In many interesting cases, the application of machine learning is hindered by
data having a complicated structure stimulated by a structured file-formats
like JSONs, XMLs, or ProtoBuffers, which is non-trivial to convert to a vector
/ matrix. Moreover, since the structure frequently carries a semantic meaning,
reflecting it in the machine learning model should improve the accuracy but
more importantly it facilitates the explanation of decisions and the model.
This paper demonstrates on the identification of infected computers in the
computer network from their HTTP traffic, how to achieve this reflection using
recent progress in multiple-instance learning. The proposed model is compared
to complementary approaches from the prior art, the first relying on
human-designed features and the second on automatically learned features
through convolution neural networks. In a challenging scenario measuring
accuracy only on unseen domains/malware families, the proposed model is
superior to the prior art while providing a valuable feedback to the security
researchers. We believe that the proposed framework will found applications
elsewhere even beyond the field of security.

本文介绍一种利用多实例学习从计算机网络的 HTTP 流量中识别感染计算机的模型，相较于基于人工设计特征以及基于卷积神经网络自动学习特征的方法，在未见数据的情况下更加准确地识别感染计算机，并为安全研究人员提供有价值的反馈。我们相信这种模型框架的应用不仅限于安全领域。

HTTP 网络流量建模中的嵌套多实例学习

Nested Multiple Instance Learning in Modelling of HTTP network traffic

Analysis of an organization's computer network activity is a key component of
early detection and mitigation of insider threat, a growing concern for many
organizations. Raw system logs are a prototypical example of streaming data
that can quickly scale beyond the cognitive power of a human analyst. As a
prospective filter for the human analyst, we present an online unsupervised
deep learning approach to detect anomalous network activity from system logs in
real time. Our models decompose anomaly scores into the contributions of
individual user behavior features for increased interpretability to aid
analysts reviewing potential cases of insider threat. Using the CERT Insider
Threat Dataset v6.2 and threat detection recall as our performance metric, our
novel deep and recurrent neural network models outperform Principal Component
Analysis, Support Vector Machine and Isolation Forest based anomaly detection
baselines. For our best model, the events labeled as insider threat activity in
our dataset had an average anomaly score in the 95.53 percentile, demonstrating
our approach's potential to greatly reduce analyst workloads.

提出了一种基于无监督深度学习的在线异常检测方法，通过分解异常得分，帮助分析员识别潜在的内部威胁活动，实现了减轻分析员负担的目标。在 CERT Insider Threat Dataset v6.2 上的表现证明，该方法可以显著提高威胁检测的召回率。