Feature transformation and missing values
A behavior detection module receives a training database and applies a transformation to the attributes that improves the uniformity of the values associated with each attribute. The transformed training database is used to construct a random forest classifier (RFC). The RFC includes a plurality of decision trees and generates a classification label estimate for a data entry with a plurality of attributes. The classification label estimate is determined based on classification estimates from the plurality of decision trees. Each parent node of a decision tree is associated with a condition of a transformed attribute that directs the data entry to a corresponding child node depending on whether the condition is satisfied or not. The data entry is directed through the tree to one out of a set of leaf nodes, and a classification label associated with the leaf node.
1. A method comprising:
accessing, by at least one processor, an external data entry comprising a set of external values, each external value associated with a corresponding attribute from a set of attributes relating to fraudulent behavior in a web application;
accessing, by the at least one processor, a classifier trained using entries of a training database, wherein each entry is associated with a classification label from a set of two or more classification labels,
wherein each entry comprises a set of transformed values, each transformed value being associated with a corresponding transformed attribute from a set of transformed attributes;
wherein each of the transformed values of a given entry was generated from a transformation and interpolation applied to values associated with an attribute from the set of attributes of that given entry to decluster the values, wherein a majority of the values are clustered by being concentrated within a sub-range of a range of the values, the sub-range range being smaller than the range and constituting a percentage of the range, and wherein the transformed values are declustered by being distributed across a new range, a majority of the transformed values not being within a sub-range of the new range that constitutes the percentage of the new range, the transformed values including a same number of values as a number of the values prior to transformation;
applying, by the at least one processor, the transformation to an external value associated with the attribute in the external data entry to generate a transformed external data entry;
applying, by the at least one processor, the classifier to the transformed external data entry to generate a classification label estimate configured to indicate whether a user is engaging in fraudulent behavior; and
storing, by the at least one processor, the classification label estimate in association with the external data entry in a data store, the stored classification label estimate used to determine whether the user's use of a web site is fraudulent.
2. The method of claim 1 , wherein the transformation is invertible.
3. The method of claim 1 , wherein units of the transformed values associated with the transformed attribute are different from units of the values associated with the attribute.
4. The method of claim 1 , wherein at least one of the entries in the training database includes an interpolated value associated with a transformed attribute, wherein the interpolated value is determined based on an interpolation function associated with the interpolation applied to a subset of transformed values associated with the transformed attribute.
5. The method of claim 4 , wherein an interpolation function of the interpolation is a median, mode, or weighted average of the subset of transformed values.
6. The method of claim 4 , wherein a distance metric between the entry comprising the interpolated value and each entry associated with the subset of transformed values is below a predetermined threshold.
7. The method of claim 1 , wherein the set of external values are numerical or categorical.
8. A non-transitory computer readable storage medium comprising instructions configured to be executed by a processor, the instructions, when executed by the processor, causing the processor to perform operations comprising:
accessing an external data entry comprising a set of external values, each external value associated with a corresponding attribute from a set of attributes relating to fraudulent behavior in a web application;
accessing a classifier trained using entries of a training database, wherein each entry is associated with a classification label from a set of two or more classification labels;
wherein each entry comprises a set of transformed values, each transformed value being associated with a corresponding transformed attribute from a set of transformed attributes;
wherein each of the transformed values of a given entry was generated from a transformation and interpolation applied to values associated with an attribute from the set of attributes of that given entry to decluster the values, wherein a majority of the values are clustered by being concentrated within a sub-range of a range of the values, the sub-range range being smaller than the range and constituting a percentage of the range, and wherein the transformed values are declustered by being distributed across a new range, a majority of the transformed values not being within a sub-range of the new range that constitutes the percentage of the new range, the transformed values including a same number of values as a number of the values prior to transformation;
applying the transformation to an external value associated with the attribute in the external data entry to generate a transformed external data entry;
applying the classifier to the transformed external data entry to generate to a classification label estimate configured to indicate whether a user is engaging in fraudulent behavior; and
storing the classification label estimate in association with the external data entry in a data store, the stored classification label estimate used to determine whether the user's use of a website is fraudulent.
9. The non-transitory computer readable storage medium of claim 8 , wherein the transformation is invertible.
10. The non-transitory computer readable storage medium of claim 8 , wherein units of the transformed values associated with the transformed attribute are different from units of the values associated with the attribute.
11. The non-transitory computer readable storage medium of claim 8 , wherein at least one of the entries in the training database includes an interpolated value associated with a transformed attribute, wherein the interpolated value is determined based on an interpolation function associated with the interpolation applied to a subset of transformed values associated with the transformed attribute.
12. The non-transitory computer readable storage medium of claim 11 , wherein an interpolation function of the interpolation is a median, mode, or weighted average of the subset of transformed values.
13. The non-transitory computer readable storage medium of claim 11 , wherein a distance metric between the entry comprising the interpolated value and each entry associated with the subset of transformed values is below a predetermined threshold.
14. The non-transitory computer readable storage medium of claim 8 , wherein the set of external values are numerical or categorical.
15. A system comprising:
a processor configured to execute instructions;
a computer-readable medium containing instructions for execution on the processor, the instructions, when executed, causing the processor to perform operations comprising:
accessing an external data entry comprising a set of external values, each external value associated with a corresponding attribute from a set of attributes relating to fraudulent behavior in a web application;
accessing a classifier trained using entries of a training database, wherein each entry is associated with a classification label from a set of two or more classification labels;
wherein each entry comprises a set of transformed values, each transformed value being associated with a corresponding transformed attribute from a set of transformed attributes;
wherein each of the transformed values of a given entry was generated from a transformation and interpolation applied to values associated with an attribute from the set of attributes of that given entry to decluster the values, wherein a majority of the values are clustered by being concentrated within a sub-range of a range of the values, the sub-range range being smaller than the range and constituting a percentage of the range, and wherein the transformed values are declustered by being distributed across a new range, a majority of the transformed values not being within a sub-range of the new range that constitutes the percentage of the new range, the transformed values including a same number of values as a number of the values prior to transformation;
applying the transformation to an external value associated with the attribute in the external data entry to generate a transformed external data entry;
applying the classifier to the transformed external data entry to generate a classification label estimate configured to indicate whether a user is engaging in fraudulent behavior; and
storing the classification label estimate in association with the external data entry in a data store, the stored classification label estimate used to determine whether the user's use of a website is fraudulent.
16. The system of claim 15 , wherein the transformation is invertible.
17. The system of claim 15 , wherein units of the transformed values associated with the transformed attribute are different from units of the values associated with the attribute.
18. The system of claim 15 , wherein at least one of the entries in the training database includes an interpolated value associated with a transformed attribute, wherein the interpolated value is determined based on an interpolation function associated with the interpolation applied to a subset of transformed values associated with the transformed attribute.
19. The system of claim 18 , wherein an interpolation function of the interpolation is a median, mode, or weighted average of the subset of transformed values.
20. The system of claim 18 , wherein a distance metric between the entry comprising the interpolated value and each entry associated with the subset of transformed values is below a predetermined threshold.