Search

Given the limited scalability of dynamic analysis, static analysis, such as the use of Control Flow Graph (CFG)-based features, is widely used by machine learning algorithms for malware analysis and detection. However, recent studies have shown these approaches are susceptible to adversarial attacks by adding codes to the binaries with an intention to fool detection systems. This study proposes a malware detection system robust to adversarial attacks. We examine the performance of the state-of-the-art methods against adversarial IoT software crafted using the graph embedding and augmentation techniques; namely, we study the robustness of such methods against two black-box adversarial methods, GEA and SGEA, to generate Adversarial Examples (AEs) with reduced overhead, and keeping their practicality intact. Our comprehensive experimentation with GEA-based AEs show the relation between misclassification and the graph size of the injected sample. Upon optimization and with small perturbation, by use of SGEA, all IoT malware samples are misclassified as benign. This highlights the vulnerability of current detection systems under adversarial settings. With the landscape of possible adversarial attacks, we then propose DL-FHMC, a fine-grained hierarchical learning approach for malware detection and classification, that is robust to AEs with a capability to detect 88.52% of the malicious AEs.

Source Code Authorship Attribution can answer many interesting questions such as: Who wrote the malicious source code? Is the source code plagiarized, and does it infringe on copyright? Source Code Authorship Attribution is done by observing distinctive patterns of style in a source code whose author is unknown and comparing them with patterns learned from known authors’ source codes. In this paper, we present an efficient approach to learn a novel representation using deep metric learning. The existing state of the art approaches tokenize the source code and work on the keyword level, limiting the elements of style they can consider. Our approach uses the raw character stream of source code. It can examine keywords and different stylistic features such as variable naming conventions or using tabs vs. spaces, enabling us to learn a richer representation than other keyword-based approaches. Our approach uses a character-level Convolutional Neural Network (CNN). We train the CNN to map the input character stream to a dense vector, mapping the source codes authored by the same author close to each other. In contrast, source codes written by different programmers are mapped farther apart in the embedding space. We then feed these source code vectors into the K-nearest neighbor (KNN) classifier that uses Manhattan-distance to perform authorship attribution. We validated our approach on Google Code Jam (GCJ) dataset across three different programming languages. We prepare our large-scale dataset in such a way that it does not induce type-I error. Our approach is more scalable and efficient than existing methods. We were able to achieve an accuracy of 84.94% across 20,458 authors, which is more than twice the scale of any previous study under a much more challenging setting.

Context Modern applications contain pervasive telemetry to ensure reliability and enable monitoring and diagnosis. This presents a new opportunity in the area of regression testing techniques, as we now have the ability to consider usage profiles of the software when making decisions on test execution. Objective The results of our prior work on test prioritization using telemetry data showed improvement rate on test suite reduction, and test execution time. The objective of this paper is to further investigate this approach and apply prioritization based on multiple prioritization algorithms in an enterprise level cloud application as well as open source projects. We aim to provide an effective prioritization scheme that practitioners can implement with minimum effort. The other objective is to compare the results and the benefits of this technique factors with code coverage-based prioritization approaches, which is the most commonly used test prioritization technique. Method We introduce a method for identifying usage patterns based on telemetry, which we refer to as “telemetry fingerprinting.” Through the use of various algorithms to compute fingerprints, we conduct empirical studies on multiple software products to show that telemetry fingerprinting can be used to more effectively prioritize regression tests. Results Our experimental results show that the proposed techniques were able to reduce over 30% in regression test suite run times compared to the coverage-based prioritization technique in detecting discoverable faults. Further, the results indicate that fingerprints are effective in identifying usage patterns, and that the fingerprints can be applied to improve regression testing techniques. Conclusion In this research, we introduce the concept of fingerprinting software usage patterns through telemetry. We provide various algorithms to compute fingerprints and conduct empirical studies that show that fingerprints are effective in identifying distinct usage patterns. By applying these techniques, we believe that regression testing techniques can be improved beyond the current state-of-the-art, yielding additional cost and quality benefits.

Background: Mining frequent co-expression networks enables the discovery of interesting network motifs that elucidate important interactions among genes. Such interaction subnetworks have been shown to enhance the discovery of biological modules and subnetwork signatures for gene expression and disease classification. Results: We propose a reverse search algorithm for mining frequent and maximal subgraphs over a collection of graphs. We develop an approach for enumerating connected edge-induced subgraphs of an undirected graph by using a reverse-search algorithm, and then use this enumeration strategy for mining all maximal frequent subgraphs. To overcome the computationally prohibitive task of enumerating all frequent subgraphs while mining for maximal subgraphs, the proposed algorithm employs several pruning strategies, which substantially improve its overall runtime performance. Experimental results show that on large gene coexpression networks, the proposed algorithm efficiently mines biologically relevant maximal frequent subgraphs. Conclusion: Extracting recurrent gene coexpression subnetworks from multiple gene expression experiments enables the discovery of functional modules and subnetwork biomarkers. We have proposed a reverse search algorithm for mining maximal frequent subnetworks. Enrichment analysis of the extracted maximal frequent subnetworks reveals that subnetworks that are more frequent are more likely to be enriched with biological ontologies.

Enterprises are increasingly considering security as an added cost, making it necessary for those enterprises to see a tangible incentive in adopting security measures. Despite data breach laws, prior studies have suggested that only 4% of reported data breach incidents have resulted in litigation in federal courts, showing the limited legal ramifications of security breaches and vulnerabilities. In this paper, we study the hidden cost of software vulnerabilities reported in the National Vulnerability Database (NVD) through stock price analysis. We perform a high-fidelity data augmentation to ensure data reliability and to estimate vulnerability disclosure dates as a baseline for estimating the implication of software vulnerabilities. We further build a model for stock price prediction using the nonlinear autoregressive neural network with exogenous factors (NARX) Neural Network model to estimate the effect of vulnerability disclosure on the stock price. Compared to prior work, which relies on linear regression models, our approach is shown to provide better prediction performance. Our analysis also shows that the effect of vulnerabilities on vendors varies, and greatly depends on the specific software industry. Whereas some industries are shown statistically to be affected negatively by the release of software vulnerabilities, even when those vulnerabilities are not broadly covered by the media, some others were not affected at all.

Internet of Things (IoT) has become widely adopted in many fields, including industry, social networks, health care, and smart homes, connecting billions of IoT devices through the internet. Understanding and studying IoT malware through analysis using various approaches, such as Control Flow Graph (CFG)-based features and then applying deep learning detection, are widely explored. In this study, we investigate the robustness of such models against adversarial attacks. Our approach crafts the adversarial IoT software using the Subgraph Embedding and Augmentation (SGEA) method that reduces the embedded size required to cause misclassification. Intensive experiments are conducted to evaluate the performance of the proposed method. We observed that SGEA approach is able to misclassify all IoT malware samples as benign by embedding an average size of 6.8 nodes. This highlights that the current detection systems are prone to adversarial examples attacks; thus, there is a need to build more robust systems to detect such manipulated features generated by adversarial examples.

We have obtained new exponential identities. By ten original propositions we have proved them.

Mining multiple gene coexpressions networks allows for identifying context-specific modules, and improving biological function prediction. Frequent subnetworks represent essential biological modules. Existing algorithms for frequent subgraph mining do not scale for large networks. In this work, we propose a greedy approach for mining approximate frequent subgraphs. Experiments on two real coexpression networks demonstrate the effectiveness of the proposed algorithm. Biological enrichment analysis of the reported patterns show that the patterns are biologically relevant and enriched with known biological processes and KEGG pathways.

With the availability of vast amounts of protein-protein, protein-DNA interactions, and genome-wide mRNA expression data for several organisms, identifying biological complexes has emerged as a major task in systems biology. Most of the existing approaches for complex identification have focused on utilizing one source of data. Recent research has shown that systematic integration of gene profile data with interaction data yields significant patterns. In this paper, we introduce the problem of mining maximal cohesive subnetworks that satisfy user-defined constraints defined over the gene profiles of the reported subnetworks. Moreover, we introduce the problem of finding maximal cohesive patterns which are sets of cohesive genes. Experiments on Yeast and Human datasets show the effectiveness of the proposed approach by assessing the overlap of the discovered subnetworks with known biological complexes. Moreover, GO enrichment analysis shows that the discovered subnetworks are biologically significant.

Pervasive telemetry in modern applications is providing new possibilities in the application of regression testing techniques. Similar to how research in bioinformatics is leading to personalized medicine, tailored to individuals, usage telemetry in modern software allows for custom regression testing, tailored to the usage patterns of an installation. By customizing regression testing based on software usage, the effectiveness of regression testing techniques can be greatly improved, leading to reduced testing costs and enhanced detection of defects that are most important to that customer. In this research, we introduce the concept of fingerprinting software usage patterns through telemetry. Weprovide various algorithms tocompute fingerprints and conduct an empirical study that shows that fingerprints are effective in identifying distinct usage patterns. Further, we discuss how usage fingerprints can be used to improve regression test prioritization run time by over 30 percent compared to traditional prioritization techniques.

Frequent pattern mining (FPM) is an important data mining paradigm to extract informative patterns like itemsets, sequences, trees, and graphs. However, no practical framework for integrating the FPM tasks has been attempted. In this paper, we describe the design and implementation of the Data Mining Template Library (DMTL) for FPM. DMTL utilizes a generic data mining approach, where all aspects of mining are controlled via a set of properties. It uses a novel pattern property hierarchy to define and mine different pattern types. This property hierarchy can be thought of as a systematic characterization of the pattern space, i.e., a meta-pattern specification that allows the analyst to specify new pattern types, by extending this hierarchy. Furthermore, in DMTL all aspects of mining are controlled by a set of different mining properties. For example, the kind of mining approach to use, the kind of data types and formats to mine over, the kind of back-end storage manager to use, are all specified as a list of properties. This provides tremendous flexibility to customize the toolkit for various applications. Flexibility of the toolkit is exemplified by the ease with which support for a new pattern can be added. Experiments on synthetic and public dataset are conducted to demonstrate the scalability provided by the persistent back-end in the library. DMTL been publicly released as open-source software ( http://dmtl.sourceforge.net/ ), and has been downloaded by numerous researchers from all over the world.

Detecting densely connected subgraphs is of great importance in sociology, biology and computer science disciplines where systems are often represented as a large graph. Several approaches have been proposed for detecting dense connected subgraphs in large graphs. Often these large graphs have additional attribute data characterizing either the nodes or edges of a graph. Recent research has combined the problem of dense connected subgraph detection with subspace similarity over attribute data. While detecting dense and cohesive subgraphs is desirable, the density factor can prevent the existing algorithms from reporting highly cohesive subgraphs which are not particularly dense. In this paper, we introduce an algorithm for mining maximal cohesive subgraphs from node attributed graphs. Unlike other approaches for detecting dense subgraphs, this algorithm does not require any density threshold. It discovers all maximal cohesive subgraphs regardless of their density. Experiments on real world datasets show that the proposed approach is effective in mining meaningful biological subgraphs from protein-protein interaction network, where attributes are extracted from gene expression datasets. We compare the proposed approach with the baseline technique, and results show that the proposed algorithm is much faster than the baseline algorithm.

Regression testing is an important part of software development projects, and it is used to ensure software quality. Traditionally, a regression test focuses primarily on functional correctness of a modified program and is examined only when it fails, meaning it found a fault that would have otherwise been undetected. For certain application domains, regression tests for non-functional quality aspects such as performance, security, and usability could be just as important. However, those regression tests are much more costly and difficult to create, and thus many applications lack adequate non-functional regression test coverage. This adds risk of regressions in these areas as changes are made over time. In this research, we propose using metrics from passing test cases to predict quality aspects of the software beyond the traditional focus of regression tests. Our industrial case study shows that metrics such as test response time from functional regression tests are good predictors of which product areas are likely to contain certain types of non-functional performance faults. Furthermore, we show that this prediction can be improved through environmental perturbation such as the use of synthetic volume datasets or data size variation.

Massive amounts of graph data have been generated in many areas, including computational biology and social networks. Often these graphs have attributes associated with nodes. One of the most intriguing questions in graphs representing complex data is to find communities or clusters. The use of attribute data in finding clusters is shown to be effective in many application areas, e.g., finding subnetwork biomarkers for cancer prediction and targeted advertising for a group of friends in social network. In this paper, we propose an algorithm for mining maximal dense cohesive clusters from node-attributed graphs. Typically the number of reported maximal dense cohesive clusters can be very large for relaxed constraints; therefore, we propose a post-processing algorithm for extracting a representative subset of these clusters. Experiments on real-world datasets show that the proposed approach is effective in mining meaningful biological clusters from protein–protein interaction network with attributes extracted from gene expression datasets. Furthermore, the proposed approach outperforms competitive algorithms in terms of the running time of the algorithm.

High throughput technologies have enabled the acquisition of large amounts of genomic data, including gene expression and RNA sequencing data for multiple species under various biological and environmental conditions. Recently, researchers have proposed methods for mining biological modules from gene co-expression networks. Biological inference from a single expression dataset suffers from spurious co-expression. Integrating multiple gene expression datasets is a promising strategy to alleviate the challenges of protein functional annotation and biological module discovery based on single gene expression data. We propose an integrative mining algorithm that constructs a template edge similarity graph whose nodes are the co-expression edges and a weighted edge connecting the two nodes corresponds to the structural similarity of the two edges across the co-expression graphs. Clustering the weighted edge similarity graph yields recurrent co-expression link clusters (modules). Experimental results on Human gene expression datasets show that the reported modules are functionally homogeneous as evident by their enrichment with biological process GO terms.

Advances in genomic technologies have allowed vast amounts of gene expression data to be collected. Protein functional annotation and biological module discovery that are based on a single gene expression data suffers from spurious coexpression. Recent work have focused on integrating multiple independent gene expression data sets. In this paper, we propose a two-step approach for mining maximally frequent collection of highly connected modules from coexpression graphs. We first mine maximal frequent edge-sets and then extract highly connected subgraphs from the edge-induced subgraphs. Experimental results on the collection of modules mined from 52 Human gene expression data sets show that coexpression links that occur together in a significant number of experiments have a modular topological structure. Moreover, GO enrichment analysis shows that the proposed approach discovers biologically significant frequent collections of modules.

With the availability of vast amounts of protein-protein, protein-DNA interactions, and genome-wide mRNA expression data for several organisms, identifying biological complexes has emerged as a major task in systems biology. Most of the existing approaches for complex identification have focused on utilizing one source of data. Recent research has shown that systematic integration of gene profile data with interaction data yields significant patterns. In this paper, we introduce the problem of mining maximal cohesive subnetworks that satisfy user-defined constraints defined over the gene profiles of the reported subnetworks. Moreover, we introduce the problem of finding maximal cohesive patterns which are sets of coehsive genes. Experiments on Yeast and Human datasets show the effectiveness of the proposed approach by assessing the overlap of the discovered subnetworks with known biological complexes. Moreover, GO enrichment analysis show that the discovered subnetworks are biologically significant. The proposed algorithm takes only seconds to several minutes to run on the Human dataset depending on how stringent the user-defined constraint is.

Many online social networks such as Face book, Linked In and My Space have become increasingly important. These social networks are rich in information about entities like hobbies, demographic information, friendship, and other attributes. This information can be used extensively for network analysis. One of the most important problems in social network analysis is community detection. The community detection problem is closely related to graph clustering. Most of the existing graph clustering algorithms employ only the structure of a graph to find highly connected components. These algorithms ignore nodes' attributes that can help in improving the quality of the clustering. In this paper, we propose a clustering algorithm which clusters a graph by incorporating both the topological structure of the graph as well as attribute information. The aim is to find clusters such that the nodes in each cluster are similar in the attribute space. In terms of social networks, we are looking to find communities where the members of the same community have similar profiles. The method was evaluated using real and synthetic graph datasets. The experimental results demonstrate the effectiveness of the proposed method.

Background. The bug assignment problem is the problem of triaging new bug reports to the most qualified developer. The qualified developer is the one who has enough knowledge in a specific area that is relevant to the reported bug. In recent years, bug triaging has received a considerable amount of attention from researchers. In previous work, bugs were represented as vectors of terms extracted from the bug reports' description. Once the bugs are represented as vectors in the terms space, traditional machine learning techniques are employed for the bug assignment. Most of the previous algorithms are marred by low accuracy values. Aims. This paper formulates the bug assignment problem as a classification task, and then examines the impact of several term selection approaches on the classification effectiveness. Method. Three variants selection methods that are based on the Log Odds Ratio (LOR) score are compared against methods that are based on the Information Gain (IG) score and Latent Semantic Analysis (LSA). The main difference in the methods that are based on the LOR score is in the process of selecting the terms. Results. Term selection techniques that are based on the Log Odds Ratio achieved up to 30% improvement in the precision and up to 5% higher in recall compared to other term selection methods such as Latent Semantic Analysis and Information Gain. Conclusions. Experimental results showed that the effectiveness of bug assignment methods is directly affected by the selected terms that are used in the classification methods.

Electrical grids are highly complex and dynamic systems that can be unreliable, insecure, and inefficient in serving end consumers. The promise of Smart Grids lies in the architecting and developing of intelligent distributed and networked systems for automated monitoring and controlling of the grid to improve performance. We have designed an agent-oriented architecture for a simulation which can help in understanding Smart Grid issues and in identifying ways to improve the electrical grid. We focus primarily on the self-healing problem, which concerns methodologies for activating control solutions to take preventative actions or to handle problems after they occur. We present software design issues that must be considered in producing a system that is flexible, adaptable and scalable. Agent-based systems provide a paradigm for conceptualizing, designing, and implementing software systems. Agents are sophisticated computer programs that can act autonomously and communicate with each other across open and distributed environments. We present design issues that are appropriate in developing a Multi-agent System (MAS) for the grid. Our MAS is implemented in the Java Agent Development Framework (JADE). Our Smart Grid Simulation uses many types of agents to acquire and monitor data, support decision making, and represent devices, controls, alternative power sources, the environment, management functions, and user interfaces.

Background Proteins have evolved subject to energetic selection pressure for stability and flexibility. Structural similarity between proteins that have gone through conformational changes can be captured effectively if flexibility is considered. Topologically unrelated proteins that preserve secondary structure packing interactions can be detected if both flexibility and Sequential permutations are considered. We propose the FlexSnap algorithm for flexible non-topological protein structural alignment. Results The effectiveness of FlexSnap is demonstrated by measuring the agreement of its alignments with manually curated non-sequential structural alignments. FlexSnap showed competitive results against state-of-the-art algorithms, like DALI, SARF2, MultiProt, FlexProt, and FATCAT. Moreover on the DynDom dataset, FlexSnap reported longer alignments with smaller rmsd. Conclusions We have introduced FlexSnap, a greedy chaining algorithm that reports both sequential and non-sequential alignments and allows twists (hinges). We assessed the quality of the FlexSnap alignments by measuring its agreements with manually curated non-sequential alignments. On the FlexProt dataset, FlexSnap was competitive to state-of-the-art flexible alignment methods. Moreover, we demonstrated the benefits of introducing hinges by showing significant improvements in the alignments reported by FlexSnap for the structure pairs for which rigid alignment methods reported alignments with either low coverage or large rmsd. Availability An implementation of the FlexSnap algorithm will be made available online at http://www.cs.rpi.edu/~zaki/software/flexsnap.

Clustering is one of the fundamental data mining tasks. Many different clustering paradigms have been developed over the years, which include partitional, hierarchical, mixture model based, density-based, spectral, subspace, and so on. The focus of this paper is on full-dimensional, arbitrary shaped clusters. Existing methods for this problem suffer either in terms of the memory or time complexity (quadratic or even cubic). This shortcoming has restricted these algorithms to datasets of moderate sizes. In this paper we propose SPARCL, a simple and scalable algorithm for finding clusters with arbitrary shapes and sizes, and it has linear space and time complexity. SPARCL consists of two stages - the first stage runs a carefully initialized version of the K-means algorithm to generate many small seed clusters. The second stage iteratively merges the generated clusters to obtain the final shape-based clusters. Experiments were conducted on a variety of datasets to highlight the effectiveness, efficiency, and scalability of our approach. On the large datasets SPARCL is an order of magnitude faster than the best existing approaches.

Structural similarity between proteins gives us insights into their evolutionary relationships when there is low sequence similarity. In this paper, we present a novel approach called SNAP for non-sequential pair-wise structural alignment. Starting from an initial alignment, our approach iterates over a two-step process consisting of a superposition step and an alignment step, until convergence. We propose a novel greedy algorithm to construct both sequential and non-sequential alignments. The quality of SNAP alignments were assessed by comparing against the manually curated reference alignments in the challenging SISY and RIPC datasets. Moreover, when applied to a dataset of 4410 protein pairs selected from the CATH database, SNAP produced longer alignments with lower rmsd than several state-of-the-art alignment methods. Classification of folds using SNAP alignments was both highly sensitive and highly selective. The SNAP software along with the datasets are available online at http://www.cs.rpi.edu/~zaki/software/SNAP.

International audience; In this paper, we introduce the concept of alpha-orthogonal patterns to mine a representative set of graph patterns. Intuitively, two graph patterns are alpha-orthogonal if their similarity is bounded above by alpha. Each alpha-orthogonal pattern is also a representative for those patterns that are at least beta similar to it. Given user defined alpha, beta in [0, 1], the goal is to mine an alpha-orthogonal, beta-representative set that minimizes the set of unrepresented patterns. We present ORIGAMI, an effective algorithm for mining the set of representative orthogonal patterns. ORIGAMI first uses a randomized algorithm to randomly traverse the pattern space, seeking previously unexplored regions, to return a set of maximal patterns. ORIGAMI then extracts an alpha-orthogonal, beta-representative set from the mined maximal patterns. We show the effectiveness of our algorithm on a number of real and synthetic datasets. In particular, we show that our method is able to extract high quality patterns even in cases where existing enumerative graph mining methods fail to do so.

Frequent Pattern Mining (FPM) is a very powerful paradigm for mining informative and useful patterns in massive, complex datasets. In this paper we propose the Data Mining Template Library, a collection of generic containers and algorithms for FPM, as well as persistency and database management classes. DMTL provides a systematic solution to a whole class of common FPM tasks like itemset, sequence, tree and graph mining. DMTL is extensible, scalable, and high-performance for rapid response on massive datasets. Our experiments show that DMTL is competitive with special purpose algorithms designed for a particular pattern type, especially as database sizes increase.

Frequent Pattern Mining (FPM) is a very powerful paradigm which encompasses an entire class of data mining tasks. The specific tasks encompassed by FPM include the mining of increasingly complex and informative patterns, in complex structured and unstructured relational datasets, such as: Itemsets or co-occurrences [1] (transactional, unordered data), Sequences [2,8] (temporal or positional data, as in text mining, bioinformatics), Tree patterns [9] (XML/semistructured data), and Graph patterns [4,5,6] (complex relational data, bioinformatics). Figure [1] shows examples of these different types of patterns; in a generic sense a pattern denotes links/relationships between several objects of interest. The objects are denoted as nodes, and the links as edges. Patterns can have multiple labels, denoting various attributes, on both the nodes and edges.

Background Advances in genomic technologies have enabled the accumulation of vast amount of genomic data, including gene expression data for multiple species under various biological and environmental conditions. Integration of these gene expression datasets is a promising strategy to alleviate the challenges of protein functional annotation and biological module discovery based on a single gene expression data, which suffers from spurious coexpression. Results We propose a joint mining algorithm that constructs a weighted hybrid similarity graph whose nodes are the coexpression links. The weight of an edge between two coexpression links in this hybrid graph is a linear combination of the topological similarities and co-appearance similarities of the corresponding two coexpression links. Clustering the weighted hybrid similarity graph yields recurrent coexpression link clusters (modules). Experimental results on Human gene expression datasets show that the reported modules are functionally homogeneous as evident by their enrichment with biological process GO terms and KEGG pathways.

In the current era of Big data, high volumes of high-value data---such as social network data---can be generated at a high velocity. The quality and accuracy of these data depend on their veracity: uncertainty of the data. A collection of these uncertain data can be viewed as a big, interlinked, dynamic graph structure. Embedded in these big data are implicit, previously unknown, and potentially useful knowledge. Hence, efficient and effective knowledge discovery algorithms for mining frequent subgraphs from these dynamic streaming graph structured data are in demand. Most of the existing algorithms mine frequent subgraph from streams of precise data. However, there are many real-life scientific and engineering applications, in which data are uncertain. Hence, in this paper, we propose algorithms that use limited memory space for mining frequent subgraphs from streams of uncertain data. Evaluation results show the effectiveness of our algorithms in mining frequent subgraphs from streams of uncertain data.