Search

Traditional energy supply systems generally focus on energy storage, which ignore the coupling relationship and interaction among natural gas, heat energy and electrical energy. In this paper, an integrated energy system with various energy storage forms is established, in which six kinds of operating modes of energy storage equipment are put forward. Its operation costs of different operating modes are analyzed, which lead to the cost optimal operating scheme.

To ensure the cyber security of an enterprise, a SIEM (Security Information and Event Management) system is in place to flag alerts and assign each of them a severity score based on some pre-determined rules. Analysts in the security operations center investigate the high severity alerts to decide if those alerts are truly malicious or not. However, generally the number of alerts is overwhelmingly large, far exceeding the SOC's capacity to handle them, and the majority of them are false positive. There is a great need for a machine learning system to accurately detect the risky hosts. Traditional supervised learning algorithms cannot be directly applied to this problem as very few risky hosts (positive labels) are identified and the positive labels are biased because the SOC analysts only investigate high severity alerts. In this paper, we propose a new distance-based PU learning approach, in which we use four different distances to measure similarity to the positive labels and a Gaussian Copula function to capture their correlation structure and ensemble four different distance measures into one joint probability density that we can directly use to infer new labels. The new approach has the advantage of significantly reducing the bias of the inferred labels while traditional supervised PU learning increases bias. To quantify bias, we also propose a new bias estimate method. We apply the new bias-reduction Positive Unlabeled (PU) learning system to detect host risk in cyber security. Results on real enterprise data indicate that the proposed PU learning is able to detect risky hosts effectively while at the same time greatly reducing the label bias. t-SNE 2-dimensional visualization also demonstrates that the labels from distance-based PU learning are more evenly distributed with higher Kozachenko-Leonenko entropy.

Companies frequently receive RFP (Request for Proposal) from interested customers requiring technical expertise, specialized capability regarding to their products or services. Appropriately responding to these RFPs is heavily influential in buyer decision-making. Currently most companies answer RFPs manually, and they (including some major RFP solution providers) mainly use key word(s) matching algorithm to search for similar questions in the knowledge base and choose the one the working analyst thinks most relevant. However, the biggest challenge is the same question can be rephrased using different wordings, so key word matching may lead to irrelevant result(s). The current process is very time-consuming, inefficient, ineffective and sometimes can create inconsistencies. In this paper, we propose using a method which combines state-of-the-art Word Embedding solution in Natural Language Processing (NLP) and AI with the promising new idea of Soft Cosine Measure (SCM) in finding the matching responses. This is by far the first effort to introduce the state-of-the-art technologies in RFP process to improve accuracy, efficiency and effectiveness. From our study of applying this method, we observed high response relevancy rates for non-standardized questionnaires which are out of the knowledge base.

Instance selection plays an important role in improving scalability of data mining algorithms, but it can also be used to improve the quality of the data mining results. In this dissertation we present a new optimization-based approach for instance selection that uses a genetic algorithm (GA) to select a subset of instances to produce a simpler decision tree with acceptable accuracy. The resultant trees are likely to be easier to comprehend and interpret by the decision maker and hence more useful in practice. We present numerical results for several difficult test datasets that indicate that GA-based instance selection can often reduce the size of the decision tree by an order of magnitude while still maintaining good prediction accuracy. The results suggest that GA-based instance selection works best for low entropy datasets. With higher entropy, there will be less benefit from instance selection. A comparison between GA and other heuristic approaches such as Rmhc (Random Mutation Hill Climbing) and simple construction heuristic, indicates that GA is able to obtain a good solution with low computation cost even for some large datasets. One advantage of instance selection is that it is able to increase the average instances associated with the leaves of the decision trees to avoid overfitting, thus instance selection can be used as an effective alternative to prune decision trees. Finally, the analysis on the selected instances reveals that instance selection helps to reduce outliers, reduce missing values, and select the most useful instances for separating classes.

To assure cyber security of an enterprise, typically SIEM (Security Information and Event Management) system is in place to normalize security events from different preventive technologies and flag alerts. Analysts in the security operation center (SOC) investigate the alerts to decide if it is truly malicious or not. However, generally the number of alerts is overwhelming with majority of them being false positive and exceeding the SOC's capacity to handle all alerts. Because of this, potential malicious attacks and compromised hosts may be missed. Machine learning is a viable approach to reduce the false positive rate and improve the productivity of SOC analysts. In this paper, we develop a user-centric machine learning framework for the cyber security operation center in real enterprise environment. We discuss the typical data sources in SOC, their work flow, and how to leverage and process these data sets to build an effective machine learning system. The paper is targeted towards two groups of readers. The first group is data scientists or machine learning researchers who do not have cyber security domain knowledge but want to build machine learning systems for security operations center. The second group of audiences are those cyber security practitioners who have deep knowledge and expertise in cyber security, but do not have machine learning experiences and wish to build one by themselves. Throughout the paper, we use the system we built in the Symantec SOC production environment as an example to demonstrate the complete steps from data collection, label creation, feature engineering, machine learning algorithm selection, model performance evaluations, to risk score generation.

Identity disclosure is one of the most serious privacy concerns in today's information age. A well-known method for protecting identity disclosure is k-anonymity. A dataset provides k-anonymity protection if the information for each individual in the dataset cannot be distinguished from at least k-1 individuals whose information also appears in the dataset. There is a flaw in k-anonymity that would still allow an intruder to discern the confidential information of individuals in the anonymized data. To overcome this problem, we propose a data reconstruction approach to achieve k-anonymity protection in predictive data mining. In this approach, the potentially identifying attributes are first masked using aggregation (for numeric data) and swapping (for nominal data). A genetic algorithm technique is then applied to the masked data to find a good subset of it. This subset is then replicated to form the released dataset that satisfies the k-anonymity constraint.

With the rapid growth of databases in many modern enterprises data mining has become an increasingly important approach for data analysis. The operations research community has contributed significantly to this field, especially through the formulation and solution of numerous data mining problems as optimization problems, and several operations research applications can also be addressed using data mining methods. This paper provides a survey of the intersection of operations research and data mining. The primary goals of the paper are to illustrate the range of interactions between the two fields, present some detailed examples of important research work, and provide comprehensive references to other important work in the area. The paper thus looks at both the different optimization methods that can be used for data mining, as well as the data mining process itself and how operations research methods can be used in almost every step of this process. Promising directions for future research are also identified throughout the paper. Finally, the paper looks at some applications related to the area of management of electronic services, namely customer relationship management and personalization.

To cope with the heterogeneity, cooperation and openness in collaborative design and simulation, we have studied the knowledge base technologie!s and their realization for collaborative environment. The traditional production- system-based knowledge bast? eonstruetion technology is developed after decades of research, bu4 it is not designed for collaborative design and simulation and does not support them very well. Considering this we bring forward an improved production-system-based knowledge expression method, which takes the advantages of the traditional method, uses semantic mapping table, borrows ideas from the objectsriented method, and combines the data mining and XML technologies to build the knowledge base system for colliaborative design and simulation.