Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
A softmax algorithm for multi-armed bandit problems
This implementation is based on Bandit Algorithms for Website Optimization and related empirical research in "Algorithms for the multi-armed bandit problem". In addition, this module conforms to the BanditLab/2.0 specification.
Install with npm
(or yarn
):
npm install softmax --save
This implementation often encounters extended floating point numbers. Arm selection is therefore subject to JavaScript's floating point precision limitations. For general information about floating point issues see the floating point guide.
Create an optimizer with 3
arms and default annealing:
const Algorithm = require('softmax');
const algorithm = new Algorithm({
arms: 3
});
Select an arm (exploits or explores, determined by the algorithm):
algorithm.select().then((arm) => {
// do something based on the chosen arm
});
Report the reward earned from a chosen arm:
algorithm.reward(arm, value);
Algorithm(config)
Create a new optimization algorithm.
config
(Object): algorithm instance parametersThe config
object supports three optional parameters:
arms
(Number
, Integer): The number of arms over which the optimization will operate; defaults to 2
gamma
(Number
, Float, 0
to Infinity
): Annealing factor, higher leads to less exploration; defaults to 1e-7
(0.0000001
)tau
(Number
, Float, 0
to Infinity
): Fixed temperature, higher leads to more explorationBy default, gamma
is set to 1e-7
which causes the algorithm to reduce exploration as more information is received. That is, the "temperature cools" slightly with each iteration. In contrast, tau
represents a "constant temperature" wherein the influence of random search is fixed across all iterations. If tau
is provided then gamma
is ignored.
Alternatively, the state
object resolved from Algorithm#serialize
can be passed as config
.
An instance of the softmax optimization algorithm.
const Algorithm = require('softmax');
const algorithm = new Algorithm();
assert.equal(algorithm.arms, 3);
assert.equal(algorithm.gamma, 0.0000001);
Or, with a passed config
:
const Algorithm = require('softmax');
const algorithm = new Algorithm({ arms: 4, tau: 0.000005 });
assert.equal(algorithm.arms, 4);
assert.equal(algorithm.tau, 0.000005);
Algorithm#select()
Choose an arm to play, according to the optimization algorithm.
None
A Promise
that resolves to a Number
corresponding to the associated arm index.
const Algorithm = require('softmax');
const algorithm = new Algorithm();
algorithm.select().then(arm => console.log(arm));
Algorithm#reward(arm, reward)
Inform the algorithm about the payoff from a given arm.
arm
(Number
, Integer): the arm index (provided from Algorithm#select()
)reward
(Number
): the observed reward value (which can be 0 to indicate no reward)A Promise
that resolves to an updated instance of the algorithm. (The original instance is mutated as well.)
const Algorithm = require('softmax');
const algorithm = new Algorithm();
algorithm.reward(0, 1).then(updatedAlgorithm => console.log(updatedAlgorithm));
Algorithm#serialize()
Obtain a plain object representing the internal state of the algorithm.
None
A Promise
that resolves to a stringify-able Object
with parameters needed to reconstruct algorithm state.
const Algorithm = require('softmax');
const algorithm = new Algorithm();
algorithm.serialize().then(state => console.log(state));
PRs are welcome! For bugs, please include a failing test which passes when your PR is applied. Travis CI provides on-demand testing for commits and pull requests.
To enable a git hook that runs npm test
prior to pushing, cd
into the local repo and run:
touch .git/hooks/pre-push
chmod +x .git/hooks/pre-push
echo "npm test" > .git/hooks/pre-push
To run the unit test suite:
npm test
Or, to run the test suite and view test coverage:
npm run coverage
Note: Tests against stochastic methods (e.g. Algorithm#select
) are inherently tricky to test with deterministic assertions. The approach here is to iterate across a semi-random set of conditions to verify that each run produces valid output. As a result, each test suite run encounters slightly different execution state. In the future, the test suite should be expanded to include a more robust test of the distribution's properties – though because of the number of runs required, should be triggered with an optional flag.
FAQs
A softmax multi-armed bandit algorithm
The npm package softmax receives a total of 1 weekly downloads. As such, softmax popularity was classified as not popular.
We found that softmax demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.