proof

DSD/qrs/acronyms.tex

@@ -15,3 +15,4 @@
 \newabbreviation{ids}{IDS}{Intrusion Detection Systems}
 \newabbreviation{nilm}{NILM}{Nonintrusive Load Monitoring}
 \newabbreviation{it}{IT}{Information Technology}
+\newabbreviation{dtw}{DTW}{Dynamic Time Warping}

DSD/qrs/biblio.bib

@@ -649,3 +649,21 @@ year={2023},
       archivePrefix={arXiv},
       primaryClass={cs.LG}
 }
+
+@misc{keras,
+author = {François Chollet },
+title = {keras},
+year = {2015},
+publisher = {GitHub},
+journal = {GitHub repository},
+howpublished = {https://github.com/fchollet/keras},
+}
+
+@article{sklearn,
+ title={Scikit-learn: Machine Learning in {P}ython},
+ author={Pedregosa, F. et al.},
+ journal={Journal of Machine Learning Research},
+ volume={12},
+ pages={2825--2830},
+ year={2011}
+}

DSD/qrs/main.tex

@@ -550,6 +550,9 @@ The alternative detectors are not meant to handle variable-size time series as i
 For the \gls{svm} and \gls{mlp} detectors, the window size is shorter than the shortest pattern.
 The training sample extraction algorithm slides the window along all patterns to extract all possible substrings.
 These substrings constitute the training dataset with multiple samples per pattern.
+The \gls{mlp} is implemented using \cite{keras} and composed of a single layer with 100 neurones.
+The number of neurone was chosen after evaluating the accuracy of the \gls{mlp} on one of the dataset (NUCPC\_1) with varying number of neurones.
+Similarily, the \gls{svm} detector is implemeted using \cite{sklearn} with the default parameters.
 The \gls{1nn} considers one window per pattern length around each sample.
 Every window is compared to its pattern, and the normalized Euclidean distance is considered for the decision.
 Overall, it is possible to adapt the methods to work with variable length patterns, but \gls{mad} is the only pattern-length-agnostic method by design.
@@ -686,19 +689,36 @@ This leads to believe that \gls{mad} balances the tradeoff between simple, expla
 \section{Discussion}\label{sec:discussion}
 In this section we highlight specific aspects of the proposed solution.
 
-%\textbf{}
-%Side-channel based state detection enables a more robust security policy enforcement.
-%Let us consider the classic case of some security policies in a company.
-%The office hours are set between 8 am and 8 pm.
-%Outside of office hours, a security policy specifies that no computer should be on --- or should not be awake.
-%The traditional way of enforcing such policies would be to have a server evaluates the state of each computer remotely (via a PING command, for example) or to have an agent on each computer sending the state to a server.
-%Both cases are highly susceptible to bypass.
-%A local attacker could boot a system on a secondary OS and immediately disable all agents on the machine.
-%A remote attacker could infect the machine and forge the reported data.
-%Any attacker that can disable the network connection would make the activities invisible to the policy enforcement system.
-%All of these methods have no impact on a side-channel intrusion detection system.
-%Whatever the motivations of the attacker, there are no malicious operations that do not require the machine to consume power.
-%The capability to detect the state of the system independently of the willingness of the system itself is a major step forward in enabling robust security policies enforcement on computing devices.
+\textbf{Dynamic Window Placement vs Fixed Windows: }
+One of the core mechanism of \gls{mad} is the ability to choose the best fitting window to calssify each sample.
+This mechanism is crucial to overcome some of the shortcomings of a traditional \gls{1nn}.
+It is important to understand the advantages of this dynamic window placement to fully appreciate the performances of \gls{mad}
+Figure~\ref{fig:proof} illustrates test case that focuses on the comarison between the two methodes.
+In this figure, the top graph represent the near-perfect classification of the trace into different classes by \gls{mad}.
+To make the results more comparables, the $\alpha$ parameter of \gls{mad} was set to $\infty$ to avoid the distance threshold mechanism and focuse on the dynamic window placement.
+The bottom graph represent the classification by a \gls{1nn} and it illustrates the three types of errors that \gls{mad} aims to overcome.
+
+\begin{itemize}
+    \item Transition Bleeding Error: Around transitions, tends to miss the exact transition timing and miss-classify samples. This si explained by the rigidity of the window around the sample. At the transition time, the two halfs of the window are competing to match different states. Depending on the shape of the states involved, it may require much more than half of the window to prefer the new state, leading to miss-classified samples around the transition. In contrast, \gls{mad} will always choose a window that fully matches either of the states and that is not across the transition, avoiding the transition error.
+    \item Out-of-phase Error: When a states is describe by multiple iterations of a periodic pattern, the match between a window and the trace varies dramatically every half-period. When the window is in phase with the pattern, the match is maximal and \gls{1nn} perfectly fills its role. However, when the window and the pattern are out of phase, the match is minimal and the nearest neighbor may be a flat pattern at the average level of the pattern. \gls{mad} avoids this error by moving the window by, at most, half a period to ensure a perfect match with the periodic pattern.
+    \item Unknown-Edges Error: Because of the fixed nature of the window of a \gls{1nn}, every sample that is less than a half window away from either end cannot be classified. This error is not so important in most cases where edge sample are less important and many solutions are available to solve this issue. However, \gls{mad} naturally solve this issue by shifting the window in the valid range until the edge. \agd{check figure to make DSD go to the end}
+\end{itemize}
+
+There surely are other methods than \gls{mad} to sovle these issues.
+However, this illustrates how \gls{mad} leverages at its core the dynamic window placement to dramatically improve the accuracy of the classification.
+The dynamic window placement is a simple mechanism that does not involve complex and computationally expensive distance metrics like \gls{dtw} to improve matchs.
+This leave the choice of the distance metric open for specific applciations.
+The dynamic window placement also avoid increased complexity by requiring the same number of distance computation as \gls{1nn}.
+
+\begin{figure*}
+\centering
+\includegraphics[width=0.9\textwidth]{images/proof.pdf}
+    \caption{Classification comparison between MAD and 1-NN.}
+\label{fig:proof}
+\end{figure*}
+\agd{make figure better. Add rects around types of errors}
+
+
 
 \textbf{Limitations: }
 The proposed method have some limitations that are important to acknowledge.