Search

Background There is a huge body of scientific literature describing the relation between tumor types and anti-cancer drugs. The vast amount of scientific literature makes it impossible for researchers and physicians to extract all relevant information manually. Methods In order to cope with the large amount of literature we applied an automated text mining approach to assess the relations between 30 most frequent cancer types and 270 anti-cancer drugs. We applied two different approaches, a classical text mining based on named entity recognition and an AI-based approach employing word embeddings. The consistency of literature mining results was validated with 3 independent methods: first, using data from FDA approvals, second, using experimentally measured IC-50 cell line data and third, using clinical patient survival data. Results We demonstrated that the automated text mining was able to successfully assess the relation between cancer types and anti-cancer drugs. All validation methods showed a good correspondence between the results from literature mining and independent confirmatory approaches. The relation between most frequent cancer types and drugs employed for their treatment were visualized in a large heatmap. All results are accessible in an interactive web-based knowledge base using the following link: https://knowledgebase.microdiscovery.de/heatmap. Conclusions Our approach is able to assess the relations between compounds and cancer types in an automated manner. Both, cancer types and compounds could be grouped into different clusters. Researchers can use the interactive knowledge base to inspect the presented results and follow their own research questions, for example the identification of novel indication areas for known drugs.

We address the problems of identifying malware in network telemetry logs and providing indicators of compromise—comprehensible explanations of behavioral patterns that identify the threat. In our system, an array of specialized detectors abstracts network-flow data into comprehensible network events in a first step. We develop a neural network that processes this sequence of events and identifies specific threats, malware families and broad categories of malware. We then use the integrated-gradients method to highlight events that jointly constitute the characteristic behavioral pattern of the threat. We compare network architectures based on CNNs, LSTMs, and transformers, and explore the efficacy of unsupervised pre-training experimentally on large-scale telemetry data. We demonstrate how this system detects njRAT and other malware based on behavioral patterns.

International audience; We present results of the classification contest organized for the EMSLIBS 2019 conference. For this publication, we chose only the five best approaches and discussed their algorithm in detail. The main focus of the contest reflected both recent and long-term challenges of Laser-Induced Breakdown Spectroscopy (LIBS) data processing. The contest was designed with a purpose to raise a challenge in handling and processing a very large dataset, containing high-dimensional elemental spectra. For the contest, 138 samples were measured using a lab-based LIBS system. In total, the data set consisted of 70,000 spectra, separated into 12 classes according to their elemental composition. Due to its extensivity and complexity, the data set is unique within the LIBS community. The central idea was to simulate the so-called “out-of-sample” classification (i.e. according to similar elemental composition), implying various real-world applications. Even more, it reflects the current level of expertise in the LIBS community and the capability of the LIBS method itself.

Detection of malware-infected computers and detection of malicious web domains based on their encrypted HTTPS traffic are challenging problems, because only addresses, timestamps, and data volumes are observable. The detection problems are coupled, because infected clients tend to interact with malicious domains. Traffic data can be collected at a large scale, and antivirus tools can be used to identify infected clients in retrospect. Domains, by contrast, have to be labeled individually after forensic analysis. We explore transfer learning based on sluice networks; this allows the detection models to bootstrap each other. In a large-scale experimental study, we find that the model outperforms known reference models and detects previously unknown malware, previously unknown malware families, and previously unknown malicious domains., Comment: Mach Learn (2019)

In order to evade network-traffic analysis, an increasing proportion of malware uses the encrypted HTTPS protocol. We study the problem of detecting malware on client computers based on HTTPS traffic analysis. Here, malware has to be detected based on the host address, timestamps, and data volume information of aggregated packets that are sent and received by all the applications on the client. We develop a scalable protocol that allows us to collect network flows of known malicious and benign applications as training data and derive a malware-detection method based on a neural language model and a long short-term memory (LSTM) network. We study the method's ability to detect new malware in a large-scale empirical study.

We study the problem of detecting malware on client computers based on the analysis of HTTPS traffic. Here, malware has to be detected based on the host address, timestamps, and data volume information of the computer’s network traffic. We develop a scalable protocol that allows us to collect network flows of known malicious and benign applications as training data and derive a malware-detection method based on a neural embedding of domain names and a long short-term memory network that processes network flows. We study the method’s ability to detect new malware in a large-scale empirical study.