Search

In countries where the economy relies mostly on agricultural-livestock activities, such as Argentina, droughts cause significant economic losses. Currently, the most-used drought indices by the Argentinian National Meteorological and Hydrological Services are based on field precipitation data, such as the standardized precipitation index (SPI) and the standardized precipitation evapotranspiration index (SPEI). In this article, we explored the performance of the satellite-based soil moisture agricultural drought index (SMADI) for agricultural drought detection in Argentina during 2010-2015, and compared it with the one from the standardized soil moisture anomalies (SSMA), SPI and SPEI (at one-month and three-month temporal scales), using the Agricultural Ministry's drought emergency database as a benchmark. The performances were analyzed in terms of the suitability of each index to be included in an early warning system for agricultural droughts, including true positive rate (TPR), and both false positive and false negative rates. In our experiments, SMADI showed the best overall performance, with the highest TPR and F1-score, and the second best false positive rate (FPR), positive predictive value, and overall accuracy. SMADI also showed the largest difference between TPR and FPR. SSMA showed the lowest FPR, but also the lowest TPR, making it not useful for an alert system. Furthermore, field precipitation-based indices, yet simple and widely used, showed not to be suitable indicators for detection of agricultural drought for Argentina, neither in the one-month nor in the three-month scale.

It is difficult for existing deep learning-based satellite on-orbit anomaly detection methods to define the residual-based detection threshold and identify false anomalies. To solve the above problems, this paper proposes both a detection threshold determination and dynamic correction method and a causality-based false anomaly identification and pruning method. We use the GRU (Gated Recurrent Unit) to model and predict the telemetry parameters to obtain the residual vector; determine and dynamically correct the threshold according to the prescribed false positive rate; propose an improved multivariate transfer entropy method to identify the causal relationships between the telemetry parameters; and, based on the causality, determine whether the detected parameter anomalies are false. Experiments show that the precision, recall, and F1-score of the method proposed in this paper are superior to the current typical method, and the false positive rate is significantly reduced, demonstrating the effectiveness of the proposed method.

To identify suitable merging methods to improve regional precipitation estimates using multiple sources of precipitation data, this study applied four different approaches (multiple linear regression (MLR), feedforward neural network (FNN), random forest (RF) and long short-term memory network (LSTM)) to merge four satellite precipitation products and one reanalysis data in the Jiangsu, Zhejiang and Shanghai of China. The pros and cons of the merging approaches are analyzed comprehensively, using correlation coefficient (CC), root mean square error (RMSE), relative bias (RB), probability of detection (POD), false alarm ratio (FAR), and critical success index (CSI) as evaluation indexes. Our results show that: (1) All merging approaches can improve the accuracy of precipitation estimations, but only RF and LSTM can improve the daily precipitation event detection capacity. These approaches can significantly reduce errors in moderate precipitation scenarios, but do not effectively improve accuracy in light and heavy precipitation scenarios. (2) MLR was the least expensive computing cost method in our study and performed better than the other three methods when gauge density was low. However, MLR had the worst daily precipitation event detection capacity (CSI = 0.67). (3) FNN performed moderately in most experiments (CC = 0.87, RMSE = 4.65 mm/day, RB = 1.19 %, POD = 0.94, FAR = 0.29, CSI = 0.70). (4) The merged data generated by RF was the most accurate and had the best daily precipitation event detection capacity (CC = 0.87, RMSE = 4.61 mm/day, RB = − 0.33 %, POD = 0.97, FAR = 0.20, CSI = 0.78). RF performed best in moderate precipitation scenarios. However, it performed worse than other methods when gauge density was low. (5) LSTM was the most robust methods and performed best in light precipitation scenarios. The FAR of the LSTM-generated data was the smallest (0.15) among four fusion methods. However, LSTM had the most expensive computing cost and the worst accuracy of the merged data (CC = 0.86, RMSE = 4.68 mm/day, RB = − 9.36 %).

There has been much recent work on fraud and Anti Money Laundering (AML) detection using machine learning techniques. However, most algorithms are based on supervised techniques. Studies show that supervised techniques often have the limitation of not adapting well to new irregular fraud patterns when the dataset is highly imbalanced. Instead, unsupervised learning can have a better capability to find anomalous and irregular patterns in new transaction. Despite this, unsupervised techniques also have the disadvantage of not being able to give state-of-the-art detection results. We propose a suite of unsupervised and deep learning techniques to implement an anti-money laundering and fraud detection system to resolve this limitation. The system leverages three deep learning models: autoencoder (AE), variational autoencoder (VAE), and a generative adversarial network. We preprocess the given dataset to separate the Transaction Date attribute into its base components to capture time-related fraud patterns. Also, Wasserstein Generative Adversarial Network (WGAN) is used to generate fraud transactions, which are then mixed with the base dataset to form a more balanced mixed dataset. These two datasets are used to train the AE and VAE models. We built two versions of the AE model (single-loss and multi-loss) besides a novel method of calculating the anomaly score threshold, called Recall-First Threshold (RFT), which helps enhance the model’s performance. Experimental results demonstrated that the False Positive Rate (FPR) drops down to as low as 7% in the proposed multi-loss AE model. In comparison, we achieved an accuracy of 93%, with 100% of the fraud transactions recalled successfully.

In this paper we evaluate a system based on the Microsoft Kinect™ sensor, aimed at the automatic detection of risk postures during human work activities. We first introduce a pick and place task, where three different lateral standing subjects move light cardboard boxes from the various levels of a bookcase to its top, and then putting them back to their original places. They repeat the task over several work cycles and we capture all their natural movements in a continuous way using Kinect, storing the joint positions and the color images. Secondly, from the joint positions, our system detects specific risk postures following the definitions of the Rapid Upper Limb Assessment (RULA) method. Finally, we compare the posture detections by our system with the baseline detections made by a panel of five experts who used the captured color images. In our study we find that the experts have problems to distinguish among some RULA postures during a work cycle because of the narrow detection margin and the difficulty to perceive if a limb reached a certain position; which is particularly true for the cases of wrist and neck. This leads to a larger false positive rate and to a lower general accuracy, with our system detecting postures that experts do not. After applying a ±1° of relaxation to our system, which in negligible for human perception, we are able to reach an accuracy of 0.93 in the comparison with the baseline. Our results show the suitability of Kinect for lateral risk posture detection in pick and place activities.

Distance metric learning aims to find the most appropriate distance metric parameters to improve similarity-based models such as $k$ -Nearest Neighbors or $k$ -Means. In this paper, we apply distance metric learning to the problem of malware detection. We focus on two tasks: (1) to classify malware and benign files with a minimal error rate, (2) to detect as much malware as possible while maintaining a low false positive rate. We propose a malware detection system using Particle Swarm Optimization that finds the feature weights to optimize the similarity measure. We compare the performance of the approach with three state-of-the-art distance metric learning techniques. We find that metrics trained in this way lead to significant improvements in the $k$ -Nearest Neighbors classification. We conducted and evaluated experiments with more than 150,000 Windows-based malware and benign samples. Features consisted of metadata contained in the headers of executable files in the portable executable file format. Our experimental results show that our malware detection system based on distance metric learning achieves a 1.09 % error rate at 0.74 % false positive rate (FPR) and outperforms all machine learning algorithms considered in the experiment. Considering the second task related to keeping minimal FPR, we achieved a 1.15 % error rate at only 0.13 % FPR.

Malicious software threats and their detection have been gaining importance as a subdomain of information security due to the expansion of ICT applications in daily settings. A major challenge in designing and developing anti-malware systems is the coverage of the detection, particularly the development of dynamic analysis methods that can detect polymorphic and metamorphic malware efficiently. In the present study, we propose a methodological framework for detecting malicious code by analyzing run trace outputs by Long Short-Term Memory (LSTM). We developed models of run traces of malicious and benign Portable Executable (PE) files. We created our dataset from run trace outputs obtained from dynamic analysis of PE files. The obtained dataset was in the instruction format as a sequence and was called Instruction as a Sequence Model (ISM). By splitting the first dataset into basic blocks, we obtained the second one called Basic Block as a Sequence Model (BSM). The experiments showed that the ISM achieved an accuracy of 87.51% and a false positive rate of 18.34%, while BSM achieved an accuracy of 99.26% and a false positive rate of 2.62%., Comment: 11 pages, 5 figures, 5 tables, accepted to IEEE Access

A network intrusion detection (NID) system plays a critical role in cybersecurity. However, the existing machine learning-based NID research has a vital issue that their experimental settings do not reflect real-world situations where unknown attacks are constantly emerging. In particular, their train and test sets are from a single data set, which inevitably overestimates the detection power since all test attack types are known in training, and test cases will have similar characteristics to the training data. This paper introduces a new strategy to constitute test data with updated traffic with attack types not included in training data. In the proposed setting, the prediction accuracy of the existing detectors is dropped by about 20% compared to what has been reported. Also, in- depth analysis of detection performance by attack types has revealed that the existing models have strength at certain attack types but struggle to detect the other attack types such as DoS, DDoS, web attack, and port scan. To overcome the issues, we propose a new neural detector, called MHSA, based on a multi-head self-attention mechanism whose architecture suits better to capture scattered pieces of evidence in network traffic. Our model improved the overall detection performance by 29% in false positive rate at the true positive rate of 0.9 and by 9% in AUC over the current state-of-the-art models, successfully detecting the attacks that are not well captured before. Furthermore, we show that our proposed MHSA model even outperforms the best ensemble detector constructed by joining the state-of-the-art classifiers.

Diabetic Retinopathy (DR) is considered as the complication of Diabetes Mellitus that damages the blood vessels in the retina. This is characterized as a serious vision-threatening problem in most of the diabetic subjects. Effective automatic classification of diabetic retinopathy is a challenging task in the medical field. The feature extraction plays an eminent role in the effective classification of disease. The proposed work focuses on the extraction of Haralick and Anisotropic Dual-Tree Complex Wavelet Transform (ADTCWT) features that can perform reliable DR classification from retinal fundus images. The Haralick features are based on second-order statistics and ADTCWT reliably extracts the directional features in images. The proposed work concentrates on both binary classification as well as multiclass classification of DR. The system is evaluated across various classifiers such as Support Vector Machine (SVM), Random Forest, Random Tree, J48 classifiers by giving input image features extracted from the MESSIDOR, KAGGLE and DIARETDB0 databases. The performances of the classifiers are analyzed by comparing specificity, precision, recall, False Positive Rate (FPR) and accuracy values for each classifier. The evaluation results show that by applying the proposed feature extraction method, Random Forest outperforms all the other classifiers with an average accuracy of 99.7% and 99.82% for binary and multiclass classification respectively.

Security Incident and Event Manager (SIEM) is a security management approach designed to identify possible threats within a real-time enterprise environment. The main challenge for SIEM is to find critical security incidents among a huge number of less critical alerts coming from separate security products. The continuously growing number of internet-connected devices has led to the alert fatigue problem, which is defined as the inability of security operators to investigate each incoming alert from intrusion detection systems. This fatigue can lead to human errors and leave many alerts being not investigated. Aiming at reducing the number of less important threat alerts presented to security operators, this paper presents a new method for highlighting critical alerts with a minimal number of false negatives. The proposed method employs isolation forest to ensure unsupervised performance and adaptability to different types of networks. Furthermore, it takes the advantage of day-forward-chaining analysis to ensure the detection of highly important alerts in real time. The number of false positive cases is reduced by employing an autoencoder. The proposed method achieved a recall score of 95.89% and a false positive rate of 5.86% on a dataset comprising more than half a million alerts collected in a real-world enterprise environment over ten months. This study highlights the importance of addressing the alert fatigue problem and validates the effectiveness of unsupervised learning in filtering out less important threat alerts.

Lung cancer is one of the leading causes of death over the world. Detecting and identifying malignant nodules on chest computed tomography (CT) plays an important role in the diagnosis and treatment of lung cancer. Computer-aided diagnosis (CAD) systems have been developed to identify lung nodules. However, the problem of a high false positive rate is still not well solved. In this paper, we propose a novel multi-task convolutional neural network (MT-CNN) framework to identify malignant nodules from benign nodules on chest CT scans. MT-CNN learns three-dimensional (3-D) lung nodule characteristics from nine two-dimensional (2-D) views, which are decomposed from different angles of each nodule. Each of 2-D MT-CNN model consists of two branches, one is the nodule classification branch (main task) and the other is the image reconstruction branch (auxiliary task). The motivation of the auxiliary task is to preserve more microscopic information in the hierarchical structure of CNN, which is beneficial to malignant nodule identification. The final classification result is obtained by integrating nine 2-D models. We test our method on the benchmark LUNA-16 and LIDC-IDRI datasets and compare it with state-of-the-art models. MT-CNN achieves the lowest false positive rate (3.2%) and highest AUC (97.3%) in LUNA-16 dataset and achieves an AUC of 95.59% in LIDC-IDRI. These results demonstrate the advantage of our method.

While disk encryption is suitable for use in most situations where confidentiality of disks is required, stronger guarantees are required in situations where adversaries may employ coercive tactics to gain access to cryptographic keys. Deniable volumes are one such solution in which the security goal is to prevent an adversary from discovering that there is an encrypted volume. Multiple snapshot attacks, where an adversary is able to gain access to two or more images of a disk, have often been proposed in the deniable storage system literature; however, there have been no concrete attacks proposed or carried out. We present the first multiple snapshot attack, and we find that it is applicable to most, if not all, implemented deniable storage systems. Our attack leverages the pattern of consecutive block changes an adversary would have access to with two snapshots, and demonstrate that with high probability it detects moderately sized and large hidden volumes, while maintaining a low false positive rate., Comment: Submitted to MASCOTS 2021

In recent years, the development of deep learning has brought new ideas to internal threat detection. In this paper, three common deep learning algorithms for threat detection are optimized and innovated, and feature embedding, drift detection and sample weighting are introduced into FCNN. Adaptive multi-iteration method is introduced into Support Vector Data Description (SVDD). A dynamic threshold adjustment mechanism is introduced in VAE. In threat detection, three methods are used to detect the abnormal behavior of users, and the intersection of output results is taken as the final threat judgment basis. Experiments on cert r6.2 data set show that this method can significantly reduce the false positive rate.

The difference between rail fastener defect images is very subtle, and the existing classification model has the problem of high false positive rate (FPR)and false negative rate (FNR). We proposed a multimodal bilinear convolutional neural network (MB-CNN) model. The new model uses two different networks, VGG16 network and ResNet-50 network, to form a multi-mode bilinear structure. In VGG16 network, multi-scale feature fusion operation is added to increase the diversity of features extracted from the model. The attention mechanism was added in two different networks to enhance the model’s ability to pay attention to the rail fastener area. The experimental results show that the classification accuracy of the MB-CNN model is 99.67%, and the FPR of normal classification of coupler is 0%. Compared with the bilinear convolutional neural network (B-CNN) model, the FNR of normal category was reduced by 0.98%, and the FNR of missing category was reduced by 0.99%. The experimental results show that the MB-CNN model is superior to the general classification network and has better performance in each category classification, which verifies the effectiveness of the improved model.

Glaucoma is the most common reason for permanent blindness and disability in the universe. Despite this, the vast majority of people are unaware that they have the infection, and detecting glaucoma progression with current technology continues to be a challenge in clinical research. The implementation of a machine-learning algorithm to the retinal fundus image gives a solution. In this research, 250 glaucomatous and 250 healthy retinal fundus images from the ACRIMA. For cleaning the data some pre-processing techniques are used. The feature extraction techniques such as Gray-Level Co-occurrence Matrix (GLCM), Gray Level Run-Length Matrix (GLRM), and Histogram of Oriented Gradients (HOG) are applied to the clean data. This process helps to retrieve beneficial information from the data. Finally, the retrieved features are taken as input to the machine learning classifier such as Support Vector Machine (SVM), Naive Bayes, K-Nearest Neighbor (K-NN), and Linear Discriminant Analysis (LDA) to construct the model. For assessment of feature extraction and classification, several performance metrics like accuracy, True and False Positive Rate (TPR/FPR), True and False Negative Rate (TNR/FNR), precision, and Performance Index (PI) are used. From the analysis, it is found that the GLCM feature extraction with the Naive Bayes model is the finest combination and it gives a 95% accuracy level.

Cloud computing has enabled organizations to get rid of the infrastructural cost and increase the service availability. However, the risks associated with the openness and resource sharing of the cloud presents serious security challenges. Intrusion Detection System acts as a monitoring and alerting system against the security breaches. However, such a system needs to be efficient and generate least false alarms. This paper reviews the Intrusion Detection Systems proposed during the year 2015-2020 and evaluates their performance based on Accuracy, Detection Rate and False Positive Rate. This work also highlights the average performance of Intrusion Detection Systems during the period of study and method that resulted in best performance.

Cloud computing refers to the availability of IT resources based on the, particularly data storage and processing power, without the direct intervention of users to manage them. Perpetrators are taking advantage of its multi-tenant feature to deny services to the clients by orchestrating attacks called Denial of Service (DoS) attacks. A more advanced version of DoS attacks called Distributed Denial of Service (DDoS) attacks has been causing a lot of damage to service providers and clients. As a result, the importance of detecting these attacks is critical. This paper provides a hybrid approach for detecting the DDoS attacks using Self Organizing Map (SOM) and Artificial Neural Network (ANN). SOM is used to find the outliers, i.e. attacks, by reducing the high-dimensional dataset into a 2-dimensional representation of input space. ANN is trained on the outliers from SOM to predict attacks. The dataset used for the experiment is the real cyber defense dataset CICIDS 2017. The proposed approach achieves high accuracy of 99.66% and low false positive rate of 0.004.

Increasing security concerns in the public domain lead to a more widespread use of video and audio surveillance techniques. While both technologies are already advanced, they still produce high false alarm rates when deployed on their own under realistic conditions. We present a method for sensor fusion based on weighted maps and a rule engine. The system was tested in a public space with the combination of audio localization, audio classification and video crowd detection, using 79 simulated security relevant scenarios and 44 hours sample data recorded over a period of several weeks. It has been shown that the false positive rate was reduced by 60 % and the localization accuracy has been increased by 25% with the fusion approach compared to the detection performance of individual sensors alone.

Prediction models can help to identify traffic incidents in roadways, reducing incident detection and response time. Advances in machine learning techniques to support the safety of roadways is a relatively underexplored area. This research seeks to advance machine learning to predict incidents based on detector data by comparing and analyzing the performance of different learning models. This study first discusses the severe class imbalance affecting the dataset. Then, using to-fold cross validation, the performance of the algorithms J48 Decision Tree, Naive Bayes, and AdaBoost were compared. In the explored problem, a false positive indicates an incident where there is no incident, and this is highly undesirable. AdaBoost reached an ideal 0% false positive rate, followed by Naive Bayes and J48. However, these values were achieved with a cost of high false negative rates for all classifiers. AdaBoost was also successful in handling the low correlation between fit and test datasets, which was not observed for the other two.

Violence detection has been investigated extensively in the literature. Recently, IOT based violence video surveillance is an intelligent component integrated in security system of smart buildings. Violence video detector is a specific kind of detection models that should be highly accurate to increase the model's sensitivity and reduce the false alarm rate. This paper proposes a novel architecture of end-to-end CNN-LSTM (Convolutional Neural Network - Long Short-Term Memory) model that can run on low-cost Internet of Things (IOT) device such as raspberry pi board. The paper utilized CNN to learn spatial features from video's frames that were applied to LSTM for video classification into violence/non-violence classes. A complex dataset including two public datasets: RWF-2000 and RLVS-2000 was used for model training and evaluation. The challenging video content includes crowds and chaos, small object at far distance, low resolution, and transient action. Additionally, the videos were captured in various environments such as street, prison, and schools with several human actions such as eating, playing basketball, football, tennis, and swimming. The experimental results show good performance of the proposed violence detection model in terms of average metrics having an accuracy of 73.35 %, recall of 76.90 %, precision of 72.53 %, F1 score of 74.01 %, false negative rate of 23.10 %, false positive rate of 30.20 %, and AUC of 82.0 %. The proposed CNN-LSTM can balance good performance with low number of parameters and thus can be implemented on low-cost IOT node.

Detection of adult contents such as pornography, sex, and nudity has been investigated extensively in the literature. Recently, content moderator is a significant component for social platforms to be integrated in their software applications and services. Cartoon content moderator is a specific kind of moderators that should be highly accurate to reduce the classification error and increase the model’s sensitivity to adult contents. This paper aims to compare the models pre-trained on natural adult images and called cross-domain learning models with ones pre-trained on cartoon images and called in-domain learning models for adult content detection in cartoons. The paper utilized pre-trained convolutional neural networks such as ResNet and EfficientNet to extract features that were applied to support vector machine for porn/normal classification. It was found that in-domain models outperformed cross-domain model in terms of performance metrics to improve the accuracy by 13 %, recall by 2 %, precision by 18 %, F1 score by 14 %, false negative rate by 2 %, and false positive rate by 16 %.

Breast ultrasound is often used as a supplement to mammography. However, standard breast ultrasound imaging often has a high false positive rate which limits its use as a screening tool. The spatial coherence of ultrasound signals has particularly impactful implications for breast mass diagnoses when considering both quantitative ultrasound and coherence-based ultrasound beamforming techniques. However, coherence can be computationally expensive to compute. Our recent work demonstrated a novel deep neural network architecture, named CohereNet, which has the ability to estimate coherence features by leveraging the universal approximation properties of deep neural networks. The work in this paper extends the CohereNet architecture to perform binary classification and extract unique features from raw ultrasound data that differentiate benign from malignant breast masses. This extended network classified breast masses as benign or malignant with 83% classification accuracy when tested with data that was not used during training. With the CohereNet architecture as the backbone of this extended network, we leverage coherence features during training and ultimately display network-modified coherence functions. Overall, our extended network architecture and training strategy are promising for a new class of deep learning methods that simultaneously extract features from raw ultrasound data, retain physical interpretations, and diagnose breast masses as benign or malignant.

Despite the work done by academia and industry in the area of vulnerability detection, the number of vulnerabilities reported each year is still growing rapidly. Nowadays, the mainstream vulnerability detection methods mainly transform source code into an intermediate representation and then detect it by machine learning or deep learning algorithms, but the problem of high false-positive rate and negative rate is difficult to solve. This is mainly because the intermediate representation does not reflect the characteristics of the vulnerabilities well. In this paper, we propose a convolutional neural network-based feature extraction model. By extracting features from such intermediate representations of code metrics, these features are used as input to a deep learning model for vulnerability detection. By experimenting with other vulnerability detection methods under the same benchmark, our proposed model shows improvement in all evaluation metrics, with Precision and Recall reaching close to 80%, and False Positive Rate and False Negative Rate decreasing to close to 20%. Finally, we analyze the proposed method and discuss how it should be improved in the future.

Malicious web crawler has been a serious threat to the security and performance of web servers in Internet. Generally, malicious web crawler systematically obtains massive web pages without approval, and may involve the theft of data assets. In this paper, we propose an unsupervised learning based method for detecting malicious web crawler. The method can be divided into three phases. Firstly, the method generates a representative vector for each client by combining the information of its visiting statistic behaviors and page request stream. Secondly, a new subspace clustering algorithm is developed to cluster the clients into groups. Finally, four metrics are designed to detect the groups of malicious web crawlers. The proposed method is validated based on a real data set consisting of 580 thousand accessing requests. Experimental results show that the proposed method can accurately detect malicious web crawlers with a high TPR (true positive rate) of 91.0% and a low FPR (false positive rate) of 1.3%.

To make sure the quality and reliability of lithium-ion batteries(LIBs) and improve detection speed, developing automatic defects detection to take the place of manual detection has been a general trend in the quality control lines of LIBs. In this paper, a detection method based on X-ray technology and convolutional neural network(CNN) is proposed for internal wrinkles detection in LIBs. Besides, for reducing false positive rate, loss fuction is modified by adding penalty coefficient when training CNN model. The proposed method has a nice performance in accuracy and false positive rate, and satisfies industrial requirements, and has been applied in the quality control of Lithium-ion battery production lines.

There has been an extensive amount of study on cough detection using acoustic features captured from smartphones and smartwatches in the past decade. However, the specificity of the algorithms has always been a concern when exposed to the unseen field data containing cough-like sounds. In this paper, we propose a novel sensor fusion algorithm that employs a hybrid of classification and template matching algorithms to tackle the problem of unseen classes. The algorithm utilizes in-ear audio signal as well as head motion captured by the inertial measurement unit (IMU). A clinical study including 45 subjects from healthy and chronic cough cohorts was conducted that contained various tasks including cough and cough-like body sounds in various conditions such as quiet/noisy and stationary/non-stationary. Our hybrid model was evaluated for sensitivity and specificity in these conditions using leave one-subject out validation (LOSOV) and achieved an average sensitivity of 83% for stationary tasks and an specificity of 91.7% for cough-like sounds reducing the false positive rate by 55%. These results indicate the feasibility and superiority of fusion in earbuds platforms for detection of cough events.

Efficient recognition of electricity stealth cyberattacks within the advanced metering infrastructures (AMIs) is limited by the lack of deliberate electricity theft datasets. Thus, anomaly-based detectors trained using only the information provided by the electricity usage profiles of truthful customers can overcome this limitation. This paper investigates the performance of deep (stacked) basic autoencoders (BAEs) with fully connected (FC) and long-short-term-memory (LSTM) structures for electricity thefts identification. The performance of the BAEs is compared to existing anomaly detectors such as one-class support vector machine (SVM) and auto-regressive integrated moving average (ARIMA) models as benchmarks. This study shows an enhancement of 8-9% in true positive rate and 7-16% in false positive rate for the deep LSTM-based BAE architecture relative to the benchmark anomaly detectors.

Due to the bypass of muscle activity or peripheral nerve control, brain-computer interface (BCI) technique has advantages in different fields such as medical field for the rehabilitation of paralyzed patients. Steady-state visual evoked potential (SSVEP) has been widely adopted in BCI applications. SSVEP based BCIs have the advantages of high information transfer rate, less or no need of training, and strong anti-interference, which could be used in the more natural asynchronous BCI application with control of the users rather than the operant system of the synchronous mode. In order to solve the problem of high false positive rate (FPR) in common asynchronous SSVEP BCI applications, this paper proposed an eye-tracking switch based BCI paradigm to reduce the FPR and to improve the performance of the asynchronous BCI system. In the proposed paradigm, the fixation point position instead of EEG signal is used to determine whether the system is in idle state. Experimental results showed that when eye-tracking switch was applied in the asynchronous SSVEP BCI, the FPR was reduced to less than 10% and the recognition accuracy (i.e., the true positive rate, TPR) can also be improved to a certain extent, which proved the applicability of the eye-tracking switch in asynchronous BCI applications.

In the presented paper the authors are showing the usage of fuzzy extensions of isolations forests for detecting road anomalies like potholes. Using the data acquired by the accelerometer in the smartphone and the proper smartphone application, the vibrations while driving over road were analyzed using multiple variants of extended isolation forests - n-ary (NIF), with fuzzy membership function (MIF), with k-means clustering (KIF), with two fuzzy clusters incorporated (CIF) or two fuzzy clusters and the distance to the cluster center (prototype) utilized (C2DIF). The presented research shows that in comparison to the state-of-the-art methods previously discussed by the authors, the accuracy and false positive rate have improved, while the sensitivity has been improved to reach 100%.

In human diseases, the cancer is very critical among all. In category, Lung cancer has been the deadliest amongst all form of cancers. Cancer patients must be diagnosed early to have a better chance of survival. Our goal is to create a computer-aided diagnosis (CAD) system that can detect lung nodules in the parenchyma region of the lung and identify them as cancerous (Malignant) or non-cancerous (Benign). Early detection of lung cancer is possible with computer-aided diagnosis of solitary pulmonary nodules using X-ray and CT images. For the diagnosis of solitary pulmonary nodules, a computer-aided system for detection of pulmonary nodules on CT scan-based support vector machine classifier and Artificial Neural Network are utilized to identify the nodules of cancers. As a result, techniques are used to minimize the amount of data in the first step. The suspected nodules are then separated by the area of the chest, and nodules are subsequently identified. Support vector machine classifier to classify more accurately describes areas of the lungs than threshold-based approaches. The false positive rate is minimized in this study by combining a threshold with a support vector machine classifier.

Early detection of cardiac disease is one of the significant issue in healthcare industry and machine learning techniques are widely used by researchers for its early prediction. Therefore, the objective of this study is to find the performance analysis of different machine learning techniques used for cardiac disease prediction. The frequently used ML techniques decision tree(DT), Naive Bayes (NB), k nearest neighbor (KNN), support vector machine (SVM), linear regression (LR) and multilayer perceptron (MLP) are evaluated at k-fold 5 and 10. For experimentation, the Cleveland, Hungarian, Switzerland and Va datasets from UCI repository are considered. Missing values in original datasets are filled with constant value. Accuracy, Misclassification rate, True Positive rate, True Negative Rate, False Positive rate, Precision, and F-Score are used for performance comparison. After experimental study, it is found that SVM and KNN classifiers gives the significant performance at k-fold 10.

In the Internet of Things (IoT), numerous scientific and industrial researchers are enticed by the smart buildings. Occupancy detection stands as a striking research domain on account of its potentially significant benefits. Though the researchers developed various approaches, the reliable ones in detecting occupancy are still in demand and those methods showed slow learning convergence and worse performance. Hence, this work proposed an efficient occupancy detection system utilizing an optimized SVNN classifier. For this, the phases, namely, i) sensor data acquisition, ii) feature extraction (FE), iii) feature reduction (FR), and iii) classification, are performed. The input data are gathered from different sensors deployed in a tutorial room. The data are extracted from temperature, humidity, CO 2 , and light sensors. The features are highly reduced by utilizing PCA. At last, the reduced features are sent to the Support Vector Neural Network (SVNN) classifier as input for predicting whether occupants in the room are present or not. The extensive outcomes are analyzed by the performance shown by the proposed classification methodology and other existing approaches regarding accuracy, and False positive rate(FPR).

The article deals with the architecture and structure of the most effective artificial neural networks (ANNs) in the tasks of network traffic classification: multilayer perceptron and LSTM (long short-term memory) network. Using one of the actual datasets CSE-CIC-IDS2018 trained ANNs and tested the effectiveness of detection of various attacks in the network traffic. An analysis of existing work has been performed. A multiclass classification was performed and the detection effectiveness of separate computer attacks was reported. The effectiveness evaluation focused on three metrics: completeness, correct response rate, and false positive rate. The test classification results were considered both in terms of comparison of numerical characteristics of recognition quality and in terms of class analysis in order to identify which computer attacks (CA) are better identified using multilayer perceptron and which are better identified using LSTM. On the basis of these results, an ANN, which is a hybrid network, is proposed as a promising Intrusion Detection System (IDS).

To solve the problems of low detection accuracy, high false positive rate and unbalanced network data sets in the high-dimensional massive data environment of traditional intrusion detection model, an intrusion detection model based on improved Stack autoencoder (SAE) and bidirectional feature attention short-time memory network (BALSTM) is proposed. In the model, firstly, Smote-Tomek combined sampling algorithm is used to reduce the imbalance rate of data sets, and then batch standardization and early stop mechanism are used to improve SAE for feature extraction, which accelerates the convergence speed of the model and solves the over-fitting problem. Finally, an attention module is added to BLSTM, which enables BALSTM model to pay attention to context information and strengthen the learning of important features. Analysis and simulation results show that the model has better performance in accuracy and false alarm rate.

In view of the low detection rate and high false alarm rate in the current imbalance of classification in intrusion detection, an intrusion detection algorithm based on sparse autoencoder is proposed. This method uses sparse autoencoder technology to build a classified model to complete the detection of different types of data labels, and to improve the detection effect by adjusting the parameters. The experiment uses the UNSW-NB15 data set to test the algorithm. The experimental results show that the algorithm has a higher detection rate and a lower false positive rate.

Breast cancer is currently one of the leading causes of death among women worldwide. Masses are considered significant signs of the existence of malignant lesions, as they occur in most breast cancer cases. However, their detection is challenging since masses have large variation in shape, margin, size and are often indistinguishable from surrounding tissue, making the radiologist's task tedious in the case where a significant number of mammograms require fast and accurate interpretation. For these reasons, computer-aided diagnosis (CAD) systems are being developed to make the diagnostic process easier for radiologists. In these systems, segmentation and classification of breast masses in mammograms are important steps. This work aims to evaluate the performance of machine learning techniques in classifying tumors into benign and malignant. The selected techniques were applied on 1663 mammograms from the Digital Database for Screening Mammography. Of the 1663 images, 769 images correspond to malignant cases, and 894 correspond to benign cases. The efficiency of each of the considered techniques was evaluated by using four metrics, namely, the false positive rate, sensitivity, specificity, and accuracy.

We present a CMOS imager for low-latency face detection empowered by parallel imaging and computing of machine-learning (ML) classifiers. The energy-efficient parallel operation and multi-scale detection eliminate image capture delay and significantly alleviate backend computational loads. The proposed pixel architecture, composed of dynamic samplers in a global shutter (GS) pixel array, allows for energy-efficient in-memory charge-domain computing of feature extraction and classification. The illumination-invariant detection was realized by using log-Haar features. A prototype 240×240 imager achieved an on-chip face detection latency of 5.1ms with a 97.9% true positive rate and 2% false positive rate at 120fps. Moreover, a dynamic nature of in-memory computing allows an energy efficiency of 419pJ/pixel for feature extraction and classification, leading to the smallest latency-energy product of 3.66ms∙nJ/pixel with digital backend processing.

In this paper, we propose a novel feature decoupling method to tackle two critical problems in the lung nodule segmentation task: (i) ambiguity of nodule boundary leads to the imprecise segmentation boundary and (ii) the high false positive rate of segmentation result. Our motivation is that an accurate segmentation network needs explicitly modeling the nodule boundary and texture information, and suppressing the noise information. To do so, a novel Deep Feature Decoupling Module (DFDM) is proposed to decouple the nodule boundary, noise, and texture information from the original feature maps. The decoupled boundary and texture information is used to benefit the segmentation, and the noise information is removed from the input features to reduce the false positive rate. The proposed DFDM consists of three parallel branches, including Boundary Sensitive Branch (BSB), Noise Removal Branch (NRB), and Texture Preserving Branch (TPB) to decouple the mentioned three information, respectively. In particular, we design our BSB with a novel architecture to effectively capture the boundary information of lung nodules. We apply the proposed DFDM to the U-Net architecture and achieve convincing segmentation results on the LIDC–IDRI dataset. Code and models are available at https://github.com/chinichenw/DFDM.

We propose an efficient seizure prediction model based on a two-layer LSTM using the Swish activation function. The proposed structure performs feature extraction based on the time and frequency domains and uses the minimum distance algorithm as a post-processing step. The proposed model is evaluated on the Melbourne dataset and achieves the highest Area Under Curve (AUC) score of 0.92 and the lowest False Positive Rate (FPR) of 0.147 compared to previous work while having sensitivity and accuracy of 86.8 and 85.1, respectively. The proposed system has a low number of trainable parameters, and thus reducing the complexity of resource-constrained applications.

Autoencoder-based anomaly detection methods have been used in identifying anomalous users from large-scale enterprise logs with the assumption that adversarial activities do not follow past habitual patterns. Most existing approaches typically build models by reconstructing single-day and individual-user behaviors. However, without capturing long-term signals and group-correlation signals, the models cannot identify low-signal yet long-lasting threats, and will wrongly report many normal users as anomalies on busy days, which, in turn, lead to high false positive rate. In this paper, we propose ACOBE, an Anomaly detection method based on COmpound BEhavior, which takes into consideration long-term patterns and group behaviors. ACOBE leverages a novel behavior representation and an ensemble of deep autoencoders and produces an ordered investigation list. Our evaluation shows that ACOBE outperforms prior work by a large margin in terms of precision and recall, and our case study demonstrates that ACOBE is applicable in practice for cyberattack detection.

Demographic bias is a significant challenge in practical face recognition systems. Existing methods heavily rely on accurate demographic annotations. However, such annotations are usually unavailable in real scenarios. Moreover, these methods are typically designed for a specific demographic group and are not general enough. In this paper, we propose a false positive rate penalty loss, which mitigates face recognition bias by increasing the consistency of instance False Positive Rate (FPR). Specifically, we first define the instance FPR as the ratio between the number of the non-target similarities above a unified threshold and the total number of the non-target similarities. The unified threshold is estimated for a given total FPR. Then, an additional penalty term, which is in proportion to the ratio of instance FPR overall FPR, is introduced into the denominator of the softmax-based loss. The larger the instance FPR, the larger the penalty. By such unequal penalties, the instance FPRs are supposed to be consistent. Compared with the previous debiasing methods, our method requires no demographic annotations. Thus, it can mitigate the bias among demographic groups divided by various attributes, and these attributes are not needed to be previously predefined during training. Extensive experimental results on popular benchmarks demonstrate the superiority of our method over state-of-the-art competitors. Code and trained models are available at https://github.com/Tencent/TFace., Comment: CVPR2021

Although deep learning-based models have achieved tremendous success in image-related tasks, they are known to be vulnerable to adversarial examples—inputs with imperceptible, but subtly crafted perturbation which fool the models to produce incorrect outputs. To distinguish adversarial examples from benign images, in this paper, we propose a novel watermarking-based framework for protecting deep image classifiers against adversarial attacks. The proposed framework consists of a watermark encoder, a possible adversary, and a detector followed by a deep image classifier to be protected. Specific methods of watermarking and detection are also presented. It is shown by experiment on a subset of ImageNet validation dataset that the proposed framework along with the presented methods of watermarking and detection is effective against a wide range of advanced attacks (static and adaptive), achieving a near zero (effective) false negative rate for FGSM and PGD attacks (static and adaptive) with the guaranteed zero false positive rate. In addition, for all tested deep image classifiers (ResNet50V2, MobileNetV2, InceptionV3), the impact of watermarking on classification accuracy is insignificant with, on average, 0.63% and 0.49% degradation in top 1 and top 5 accuracy, respectively.

The Internet of Things (IoT) is a network of distributed devices or sensors connected through the internet to allow gathering and sharing of data. The data generated by these devices is affected by anomalies or abnormal behaviour due to attack issues, or breakdown in devices, as examples. However, most current anomaly detection systems rely on labelled data, while the class labels for IoT data are usually unavailable. Furthermore, the manual labelling task is expensive and time-consuming to perform due to the need for domain experts. More importantly, the volume of data in the IoT is growing rapidly, creating a need to predict the classification labels for future data. This study proposes a Hybrid Learning Model which uses both Clustering and Classification methods (HLMCC) to automate the labelling process and detect anomalies in IoT data. The model consists of two practical phases, automatic labelling and detecting anomalies. First, the HLMCC groups the data into normal and anomaly clusters by adopting Hierarchical Affinity Propagation (HAP) clustering. Second, the labelled data obtained from the clustering phase is used to train the Decision Trees (DTs) and to classify future unseen data. The results show that the HLMCC is able to automate the labelling of data, which is beneficial to minimize human involvement. Moreover, HLMCC outperforms the DTs on the originally labelled datasets and the state-of-the-art model over a wide range of evaluation metrics based on the average ranks. HLMCC produces the highest average ranks against other models in terms of False Positive Rate (FPR), recall, precision and the Area Under the Precision-Recall curve (AUCPR) with 1.8, 1.6, 1.8 and 1.8, respectively.

Modern IC designs often involve outsourced IP cores. It is convinced that there are opportunities in which the IP cores contain malicious logic, namely hardware Trojan (HT), which raises serious concerns about the trustworthiness of ICs used in mission-critical applications. This paper proposes an HT detection method by analyzing the combined structural features of HTs and host circuits. The structural features of combinational and sequential logic HTs are extracted and form an HT feature database. An efficient quantization approach on feature matching is proposed to search the features from circuit designs. The experiments conducted on TrustHub benchmarks show that the proposed method can successfully detect all stealth Trojans with runtime within 72 s on a platform with an AMD 2.00-GHz CPU with 4-GB RAM and a low false positive rate compared with the existing methods.

Smart grid technology increases reliability, security, and efficiency of the electrical grids. However, its strong dependencies on digital communication technology bring up new vulnerabilities that need to be considered for efficient and reliable power distribution. In this paper, an unsupervised anomaly detection based on statistical correlation between measurements is proposed. The goal is to design a scalable anomaly detection engine suitable for large-scale smart grids, which can differentiate an actual fault from a disturbance and an intelligent cyber-attack. The proposed method applies feature extraction utilizing symbolic dynamic filtering (SDF) to reduce computational burden while discovering causal interactions between the subsystems. The simulation results on IEEE 39, 118, and 2848 bus systems verify the performance of the proposed method under different operation conditions. The results show an accuracy of 99%, true positive rate of 98%, and false positive rate of less than 2%

Winter jujubes get bruised easily during harvest and transportation. In order to detect subtle bruises on winter jujubes in a more efficient way, a rapid and accurate technique, hyperspectral imaging was used. Near-infrared reflectance (NIR) and visible/near-infrared reflectance (Vis-NIR) hyperspectral imaging at the spectral region of 874-1734 nm and 380-1030 nm, respectively, were applied in this study. The hyperspectral images of winter jujubes from four geographical origins were acquired. Pixel-wise spectra were extracted and preprocessed; pixel-wise principal component analysis (PCA) was used to conduct a qualitative analysis. Accuracy, true positive rate (TPR) and false positive rate (FPR) were utilized to compare the efficiency of the models. Support vector machine (SVM), logistic regression (LR) and a deep learning method, and convolutional neural network (CNN) were used to build pixel-wise classification models based on single or all geographical origins for quantitative analyses. All the models using NIR spectra obtained decent results with accuracies in the range of 90–100%, and TPRs and FPRs close to 1 and 0, respectively. Compared with the other two methods using Vis-NIR spectra, the CNN model based on all geographical origins got the best performance with most of the accuracies surpassing 85%. For Vis-NIR spectra and NIR spectra, the overall time efficiency for modeling and prediction of CNN was at an intermediate level among the three models. The short prediction time of CNN indicated that CNN had the potential for real-time detection. The prediction maps obtained by the CNN models indicated that the color information and geographical origins could affect the detection performance. The overall results demonstrated the promising potential for detecting subtle bruises on winter jujubes using pixel-wise spectra extracted from the hyperspectral images at the two spectral ranges with the deep learning method. The results in this study would help to develop an online winter jujube bruises detection system in the future.