Support vector machine

That's fascinating.

But if we pivot back to supervised learning for a second, there is another algorithm that is incredibly vital for security professionals, right? Support vector machines or SVM.

SVM is a massive one.

Let's talk about that.

If you were handed a perfectly labeled historical data set, which supervised algorithm discussed today would you deploy to draw a clear boundary between the threats and the safe traffic?

Good question.

Conversely, if you were flying totally blind on a new network and just needed to find hidden anomalies, which unsupervised algorithm would you rely on? Think deeply about the fundamental mechanical differences between how support vector machines separate known data and how K-means clustering searches for the unknown.

And as you think through that, I want to leave you with a lingering security dilemma.

Maybe you also have g.

And if you do the new right work, I think we have claimed that neural network is the same as L1 SVM in a kernel space.

So then the corresponding thing would be you minimize the L1 norm of A such that the sum of Ai, Vi, Xj is equal to Yj.

So in some sense, when you do the neural networks, you have a lot of features, and you're choosing a subset of features, a sparse subset of features.

And in contrast, regularizing network only need Neuronuts only need n is equal to all of the samples.

Any questions about this? I think this part is a little bit kind of like hand-wavy, because I didn't want to go into all the details.

And also, this depends a little bit on what we discussed in the past, right? So L1-SVM connections to the connection between L1-SVM and writeworks.

Any questions? So I guess maybe just to wrap up this once again.

Yes.

They then take this vast phase space data and feed it into a machine learning tool called a support vector machine or an SVM.

I want to guess how this SVM works.

Sure.

Try it.

In a simple 2D graph, you draw a line.

But

in face space, which has many dimensions, the SVM calculates a complex multidimensional boundary called a hyperplane.

You know, it's, it's interesting, right? 'Cause general- generalized predictive models are...

So, uh, we've been writing predictive models forever, right? S- whether they're SVM, whether they're neural nets, their heavy use cases are always in analytics, right? When you've got a crap ton of data that you've got to go through and come up with something that's useful-

Yeah

...

Sixteen plus routers in five categories.

Single round, which covers KNN, SVM, MLP, matrix factorization, ELO, Router DC, AutoMix, Hybrid LLM, Graph Router, Causal LM.

Multi-round, which is Router R1.

Multimodal, agentic, and personalized, which is GMT Router and personalized router.

Well, you can view SMO as a almost like stochastic gradient descent where it was trying to be what's the minimal change, which way it goes uphill, given that you have this quadratic program.

But of course, the quadratic program is very particular to the mathematical structure of SVMs.

You can view fundamentally SVMs as loss function hacking because instead of okay so if you map for example consider a binary for the simplest case a sigmoid output unit so it's so it's using a cross entropy you know t times log p plus one minus t times log of log one minus p the usual And then you have a sigmoid unit, which is sort of the matched link function to that loss function.

If you map that back to the logit, it looks like a kind of like a ramp.

So asymptotically, it looks linear like this and it's flat.