Back

IT, Security

Spam detection with Machine Learning

spam-base.jpg

Machine Learning can help us detect spams and classify our e-mails.

Our professional inboxes are stuffed with e-mails: conversations with our colleagues, negotiations with third-party professionals but also newsletters or spams are the daily bread of millions of people all around the world.

This never-ending flow of information must be classified according to its importance, its emergency and other factors. Such tasks are very time-consuming and divert us from priorities.

Predictive models can help workers to classify automatically their e-mails and reduce their processing time so that they can focus on actual important tasks.

Problems to solve

  • How to detect spam ?
  • How to set up your inbox to avoid spam ?
  • How can predictive models be helpful in classifying automatically your e-mails?

Benefits of TADA

Most professionals around the world have an e-mail address and receive e-mails daily. However, most of them are not data scientists and don’t have the right Machine Learning and code skills to create models.

Moreover, even if it seems big for the e-mail receiver, the quantity of e-mails is limited and makes a Small Data set that can’t be handled by traditional Machine Learning tools.

To answer these issues, MyDataModels offers TADA, a solution designed for Small Data to help professionals build predictive models out of their Small Data sets.

Professionals don’t need data science training to use TADA. Domain experts can use their own Small Data sets without normalization or preprocessing.

A self-service solution for domain experts with no data science knowledge, TADA provides them with convincing results in less than a minute on a laptop.

Conclusion

A more efficient classification of professionals’ e-mails can improve their productivity by allowing them to focus on their most important tasks. Most notably, TADA can improve spam detection and limit fraud, phishing or computer virus’s proliferation.

Professionals can use TADA predictive models to complete their expertise and decide efficiently which e-mails must be treated in priority.

Case Study

Solution

Automated Machine Learning tools help users to predict the future thanks to historical data. To predict a future result, you must compile your descriptive data and the past results obtained.

TADA allows you to easily create a relevant predictive model from your data and apply it to future data.

Here, descriptive data comes from a sample of received e-mails. TADA must determine if the e-mail is or isn’t spam, this is a binary classification.

This example can be expanded to various e-mail categories, which would make the prediction a multi-classification.

You can generate a model in just 4 steps: 

  • Step 1: create your project and upload your data as a CSV file (with data in rows and variables in column).

  • Step 2: Select the variable you want to predict, called “Goal”. In this use case, the goal is the “Spam” variable.

  • Step 3: Select your data for the model generation. This step is called "Creating the Variable set" and allows you to manually select the descriptive variables you want to use. By default, they are all selected.

TADA identifies the relevant descriptive variables by itself which affects the calculation time required to create the model.

The fewer variables selected the faster the model creation.

  • Step 4: Create your model. When creating your model, some default values are proposed for the name of the model, the size of the population and the number of iterations.

You can start your model generation by validating the default values or editing them according to your preferences. You’ll find best practices at your disposal to guide you in the choice of these parameters in the TADA UI.

According to the size of the file, this step can take between a few seconds and ten minutes. Once the model created, you have access to metrics and graphs to evaluate its relevance.

How can we go further?

You have various options to put your model into practice:

  • Use the « Predict » feature of TADA: upload a CSV file with the data to predict. In return, TADA will generate a CSV file with the calculated predictions.

  • Retrieve the associated mathematical formula and apply it (for instance on Excel).

  • Retrieve the source code of the mathematical formula and use it on your own apps. The source code is available in R, Java, C++ and Python soon. (This option is only available in TADA Premium and Pro).


Dataset Information

The below screenshot is an extract of the dataset. Each line is an e-mail and each column is a variable that can be used by the model.

dataset.png

The dataset is made of 48 continuous variables whose value is comprised between 0 and 100. They are of “word_freq_WORD” type and represent the percentage of occurrence of a word in the e-mail text.

A “word” is defined as a chain of alphanumeric characters limited by non-alphanumeric characters or an end of chain.

Model type: binary classification

Number of rows: 2972

Number of columns: 48

Goal : Spam class (with values 1,0)

Class balance: positive class (0) 57%, negative class (1) 43%

Results

The results show how the predictive model performs.

The predictive model type and its metrics are linked to the Goal and its values. The model type is shown on the model results display.

Three types of prediction can be done according to the Goal data. Here, our goal is “Spam”:

  1. Binary classification: a discrete value taking only two values, such as Yes/No.

  2. Multiclass classification: a discrete value with more than two values, such as status of state with values like “On”, “At Risk”, “Down”, etc.

  3. Regression: a continuous value that can take an infinite number of values, such as a temperature, a pressure, a turnover or the price of a house.

When generating the model and according to the state of the art of Machine Learning, your data will be divided in three parts by TADA:

  • Part 1: A Training part which represents 40% of the data and is used to train a certain number of models,
  • Part 2: A Validation part which represents 30% of the data and is used to validate and select the best models found in the previous step,
  • Part 3: A Test part which represents 30% of the data and is used to test the model approved during the validation step. 

The performance measurement and the model evaluation must be done on the Test part (according to Machine Learning standards) as the data used during this phase was not used to build the model and is just used to measure its performance.

metrics.png

Here, different metrics show that the model has good results.

First, we can see thanks to Accuracy (ACC) that the model is right in 91% of the predictions.

Moreover, TADA separates well negative classes (True Negative Rate of 88.98%) and positive classes (True Positive Rate of 93.55%). These results are confirmed by the Matthew’s Correlation Coefficient (MCC) of 0.82 that shows the good allocation among classes.

Confusion matrix

Confusion_matrix.png

The confusion matrix is a visual way to read the metrics.

Here, TADA predicted 521 times that an incoming e-mail was not a spam. Among these predictions, 479 e-mails were not spam (True Positive) while 42 of them were (False Positive).

Meanwhile, TADA predicted 372 times that an incoming e-mail was spam. Among these predictions, 339 e-mails were spam (True Negative) while 33 of them were not (False Negative).

Glossary

Accuracy (ACC) is the overall accuracy rate of the model: it is the percentage of classes that are well distributed (here, 91.6% predictions are correct)

Recall or True Positive Rate (TPR) represents the accuracy rate of the prediction of the positive class

Specificity or True Negative Rate (TNR) represents the accuracy rate of the prediction of the negative class

Matthew’s correlation coefficient (MCC) is an indicator of the general quality of the model and shows the quality of the allocation of the values among the two classes.

Ready to use TADA?

You don't have immediate data?

No problem, data are available to make your trial as relevant as possible!

Try it now!

Detailed informations

General

Artificial intelligence: Theories and techniques aiming to simulate intelligence (human, animal or other).

Binary Classification: It is the problem type when you are trying to predict one of two states, e.g. yes/no, true/ false, A/B, 0/1, red/green, etc. This kind of analysis requires that the Goal variable type is of type CLASS. Binary Classification analysis also requires that there be only 2 different values in the Goal column. Otherwise, it is not a binary problem (two choices and no more).

Convolutional Neural Network: This type of network is dedicated to object recognition. They are generally composed of several layers of convolutions + pooling followed by one or more FC layers. A convolutional layer can be seen as a filter. Thus, the first layer of a CNN make it possible to filter the corners, curves and segments and the following ones, more and more complex forms.

Data Mining: Field of data science aimed at extracting knowledge and / or information from a body of data.

Deep Learning: Deep Learning is a category of so-called "layered" machine learning algorithms. A deep learning algorithm is a neural network with a large number of layers. The main interest of these networks is their ability to learn models from raw data, thus reducing pre-processing (often important in the case of classical algorithms).

Fully Convolutional Networks: An FCN is a CNN with the last FC layers removed. This type of network is currently not used much but can be very useful if it is succeeded by an RNN network allowing integration of the time dimension in a visual recognition analysis.

GRU (Gated Recurrent Unit): A GRU network is a simplified LSTM invented recently (2014) and allowing better predictions and easier parameterization.

LSTM (Long Short-Term Memory): An LSTM is an RNN to which a system has been added to control access to memory cells. We speak of "Gated Activation Function". LSTMs perform better than conventional RNNs.

Machine learning : Subfield of Artificial Intelligence (AI), Machine Learning is the scientific study of algorithms and statistical models that provides systems the ability to learn and improve any specific tasks without explicit programming.

Multi Classification: Classification when there is more than two classes in the goal variable, e.g. A/B/C/D, red/orange/green, etc.

Multilayer perceptron: This is a classic neural network. Generally, all the neurons of a layer are connected to all the neurons of the next layer. We are talking about Fully Connected (FC) layers.

RCNN (Regional CNN): This type of network compensates for the shortcomings of a classic CNN and answers the question: what to do when an image contains several objects to recognize? An RCNN makes it possible to extract several labels (each associated with a bounding box) of an image.

Regression: Set of statistical processes to predict a specific number or value. Regression analysis requires the type of Goal variable to be numeric (INTEGER or DOUBLE).

Reinforcement learning: Reinforcement learning is about supervised learning. It involves using new predicted data to improve the learning model (calculated upstream).

RNN (Recurrent Neural Networks): Recurrent networks are a set of networks integrating the temporal dimension. Thus, from one prediction to another, information is shared. These networks are mainly used for the recognition of activities or actions via video or other sensors.

Semi supervised learning: Semi-supervised learning is a special case of supervised learning. Semi-supervised learning is when training data is incomplete. The interest is to learn a model with little labeled data.

Stratified sampling: It is a method of sampling such that the distribution of goal observations in each stratum of the sample is the same as the distribution of goal observations in the population. TADA uses this method to shuffle the data set from binary and multi classification projects.

Simple random sampling: It is a method of sampling in which each observation is equally likely to be chosen randomly. TADA uses this method to shuffle the data set from regression projects.

Supervised learning: Sub-domain of machine learning, supervised learning aims to generalize and extract rules from labeled data. All this in order to make predictions (to predict the label associated with a data without label).

Transfer learning: Brought up to date by deep learning, transfer learning consists of reusing pre-learned learning models in order not to reinvent the wheel at each learning.

Unsupervised learning: Sub-domain of machine learning, unsupervised learning aims to group data that are similar and divide/separate different data. We talk about minimizing intra-class variance and maximizing inter-class variance.


Metrics

Binary

ACC (Accuracy): Percentage of samples in the test set correctly classified by the model.

Actual Negative: Number of samples of negative case in the raw source data subset.

Actual Positive: Number of samples of positive case in the raw source data subset.

AUC: Area Under the Curve (AUC) of the Receiver Operating characteristic (ROC) curve. It is in the interval [0;1]. A perfect predictive model gives an AUC score of 1. A predictive model which makes random guesses has an AUC score of 0.5.

F1 score: Single value metric that gives an indication of a Binary Classification model's efficiency at predicting both True and False predictions. It is computed using the harmonic mean of PPV and TPR.

False Negative: Number of positive class samples in the source data subset that were incorrectly predicted as negative.

False Positive: Number of negative class samples in the source data subset that were incorrectly predicted as positive.

MCC (Matthews Correlation Coefficient): Single value metric that gives an indication of a Binary Classification model's efficacy at predicting both classes. This value ranges between -1 to +1 with +1 being a perfect classifier.

PPV (Positive Predictive Value/Precision): Number of a model's True Positive predictions divided by the number of (True Positives + False Positives) in the test set.

Predicted Positive: Number of samples in the source data subset predicted as the positive case by the model.

Predicted Negative: Number of samples in the source data subset predicted as the negative case by the model.

True Positive: Number of positive class samples in the source data subset accurately predicted by the model.

True Negative: Number of negative class samples in the source data subset accurately predicted by the model.

TPR (True Positive Rate/Sensitivity/Recall): Ratio of True Positive predictions to actual positives with respect to the test set. It is calculated by dividing the true positive count by the actual positive count.

TNR (True Negative Rate/Specificity): Ratio of True Negative predictions to actual negatives with respect to the test set. It is calculated by dividing the True Negative count by the actual negative count.

 

Multi classification

ACC (Accuracy): Ratio of the correctly classified samples over all the samples.

Actual Total: Total number of samples in the source data subset that were of the given class.

Cohen’s Kappa (K): Coefficient that measures inter-rater agreement for categorical items, it tells how much better a classifier is performing over the performance of a classifier that simply guesses at random according to the frequency of each class. It is in the interval [-1:1]. A coefficient of +1 represents a perfect prediction, 0 no better than random prediction and −1 indicates total disagreement.

False Negative: Number of positive class samples in the source data subset that were incorrectly predicted as negative.

False Positive: Number of negative class samples in the source data subset that were incorrectly predicted as positive.

Macro-PPV (Positive Predictive Value/Precision): The mean of the computed PPV within each class (independently of the other classes). Each PPV is the number of True Positive (TP) predictions divided by the total number of positive predictions (TP+FP, with FP for False Positive) within each class. PPV is in the interval [0;1]. The higher this value, the better the confidence that positive results are true.

Macro-TPR (True Positive Rate/Recall): The mean of the computed TPR within each class (independently of the other classes). Each TPR is the proportion of samples predicted Truly Positive (TP) out of all the samples that actually are positive (TP+FN, with FN for False Negative). TPR is in the interval [0;1]. The higher this value, the fewer actual samples of positive class are labeled as negative.

Macro F1 score: Harmonic mean of macro-average PPV and TPR. F1 Score is in the interval [0;1]. The F1 Score can be interpreted as a weighted average of the PPV and TPR values. It reaches its best value at 1 and worst value at 0.

MCC (Matthews Correlation Coefficient): Represents the multi class confusion matrix with a single value. Precision and recall for all the classes are computed and averaged into a single real number within the interval [-1;1]. However, in the multiclass case, its minimum value lies between -1 (total disagreement between prediction and truth) and 0 (no better than random) depending on the data distribution.

Predicted Total: Total number of samples in the source data subset that were predicted of the given class.

True Positive: Number of positive class samples in the source data subset accurately predicted by the model.

True Negative: Number of negative class samples in the source data subset accurately predicted by the model.

 

Regression

MAE (Mean Absolute Error): represents the average magnitude of the errors in a set of predictions, without considering their direction. It’s the average over the test sample of the absolute differences between prediction and actual observation where all individual differences have equal weight. MAE is in the intervall [0;+∞]. A coefficient of 0 represents a perfect prediction, the higher this value is the more error (relative error) the model have.

MAPE (Mean Absolute Percentage Error): MAPE is computed as the average of the absolute values of the deviations of the predicted versus actual values.

Max-Error: Maximum Error. The application considers here the magnitude (absolute error when identifying the maximum error. Thus -1.5 would be consider the maximum error over +1.3. The sign of the error however is still reported in this column in case it has domain significance for the user.

R2 (R Squared): also known as the Coefficient of Determination. The application computes the R2 statistic as 1 - (SSres / SStot) where SSres is the residual sum of squares and SStot is the total sum of squares.

RMSE: Root Mean Square Error against the Dataset partition selected. RMSE is computed as the square root of the mean of the squared deviations of the predicted from actual values.

SD-ERROR (Standard Deviation Error): Standard statistical measure used to quantify the amount of variation of a set of data values.