System and method for determining device attributes using a classifier hierarchy
A system and method for determining device attributes using a classifier hierarchy. The method includes: sequentially applying a plurality of sub-models of a hierarchy to a plurality of features extracted from device activity data, wherein the sequential application ends with applying a last sub-model of the plurality of sub-models, wherein each sub-model includes a plurality of classifiers, wherein each sub-model outputs a class when applied to at least a portion of the plurality of features, wherein each class is a classifier output representing a device attribute, wherein applying the plurality of sub-models further comprises iteratively determining a next sub-model to apply based on the class output by a most recently applied sub-model and the hierarchy; and determining a device attribute based on the class output by the last sub-model.
1. A method for determining device attributes using a classifier hierarchy, comprising:
extracting a plurality of features from device activity data;
applying a first sub-model of a plurality of sub-models of a hierarchy, wherein each sub-model of the plurality of sub-models comprises a set of classifiers, and wherein each sub-model of the plurality of sub-models is configured to output a class for a device attribute when applied to the plurality of features based on its respective set of classifiers;
iteratively traversing the hierarchy until a termination condition occurs, wherein each iteration of traversing the hierarchy comprises:
determining a next sub-model at a next level in the hierarchy, wherein the next sub-model is specifically associated with the class output by a previous sub-model; and
applying the next sub-model to the plurality of features;
upon the termination condition occurring, determining a device attribute based on the class output by a last-applied sub-model.
2. The method of claim 1 , wherein the device activity data comprises network activity data.
3. The method of claim 2 , wherein the network activity data comprises at least one of: amount of traffic sent, amount of traffic received, domains used, ports used, a number of sessions, and a number of hosts that are talked to.
4. The method of claim 1 , wherein each classifier of a sub-model is trained to output a class and a confidence score, and wherein the class output by each sub-model of the plurality of sub-models is based on the class and the confidence score output by each classifier of the set of classifiers of the respective sub-model.
5. The method of claim 4 , wherein the class output by each sub-model is a first class output of a first classifier of the respective sub-model, wherein a first confidence score output by the first classifier is above a threshold.
6. The method of claim 4 , wherein the termination condition occurs when a confidence score below a threshold is output.
7. The method of claim 4 , wherein the termination condition occurs when a confidence score above a threshold is output.
8. The method of claim 1 , wherein the termination condition occurs when one branch of the hierarchy has been fully traversed.
9. The method of claim 1 , wherein the termination condition occurs when a predetermined level in the hierarchy is reached.
10. A system for determining device attributes using a classifier hierarchy, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
extract a plurality of features from device activity data;
apply a first sub-model of a plurality of sub-models of a hierarchy, wherein each sub-model of the plurality of sub-models comprises a set of classifiers, and wherein each sub-model of the plurality of sub-models is configured to output a class for a device attribute when applied to the plurality of features based on its respective set of classifiers;
iteratively traverse the hierarchy until a termination condition occurs, wherein each iteration of traversing the hierarchy comprises:
determining a next sub-model at a next level in the hierarchy, wherein the next sub-model is specifically associated with the class output by a previous sub-model; and
applying the next sub-model to the plurality of features;
upon the termination condition occurring, determine a device attribute based on the class output by a last-applied sub-model.
11. The system of claim 10 , wherein the device activity data comprises network activity data.
12. The system of claim 11 , wherein the network activity data comprises at least one of: amount of traffic sent, amount of traffic received, domains used, ports used, a number of sessions, and a number of hosts that are talked to.
13. The system of claim 10 , wherein each classifier of a sub-model is trained to output a class and a confidence score, and wherein the class output by each sub-model of the plurality of sub-models is based on the class and the confidence score output by each classifier of the set of classifiers of the respective sub-model.
14. The system of claim 13 , wherein the class output by each sub-model is a first class output of a first classifier of the respective sub-model, wherein a first confidence score output by the first classifier is above a threshold.
15. The system of claim 13 , wherein the termination condition occurs when a confidence score below a threshold is output.
16. The system of claim 13 , wherein the termination condition occurs when a confidence score above a threshold is output.
17. The system of claim 10 , wherein the termination condition occurs when one branch of the hierarchy has been fully traversed.
18. The system of claim 10 , wherein the termination condition occurs when a predetermined level in the hierarchy is reached.
19. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
extracting a plurality of features from device activity data;
applying a first sub-model of a plurality of sub-models of a hierarchy, wherein each sub-model of the plurality of sub-models comprises a set of classifiers, and wherein each sub-model of the plurality of sub-models is configured to output a class for a device attribute when applied to the plurality of features based on its respective set of classifiers;
iteratively traversing the hierarchy until a termination condition occurs, wherein each iteration of traversing the hierarchy comprises:
determining a next sub-model at a next level in the hierarchy, wherein the next sub-model is specifically associated with the class output by a previous sub-model; and
applying the next sub-model to the plurality of features;
upon the termination condition occurring, determining a device attribute based on the class output by a last-applied sub-model.
20. The non-transitory computer readable medium of claim 19 , wherein the termination condition occurs when one branch of the hierarchy has been fully traversed.