Search

The use of Machine Learning (ML) models in cybersecurity solutions requires high-quality data that is stripped of redundant, missing, and noisy information. By selecting the most relevant features, data integrity and model efficiency can be significantly improved. This work evaluates the feature sets provided by a combination of different feature selection methods, namely Information Gain, Chi-Squared Test, Recursive Feature Elimination, Mean Absolute Deviation, and Dispersion Ratio, in multiple IoT network datasets. The influence of the smaller feature sets on both the classification performance and the training time of ML models is compared, with the aim of increasing the computational efficiency of IoT intrusion detection. Overall, the most impactful features of each dataset were identified, and the ML models obtained higher computational efficiency while preserving a good generalization, showing little to no difference between the sets., Comment: 10 pages, 9 tables, DCAI 2024 conference

The growing cybersecurity threats make it essential to use high-quality data to train Machine Learning (ML) models for network traffic analysis, without noisy or missing data. By selecting the most relevant features for cyber-attack detection, it is possible to improve both the robustness and computational efficiency of the models used in a cybersecurity system. This work presents a feature selection and consensus process that combines multiple methods and applies them to several network datasets. Two different feature sets were selected and were used to train multiple ML models with regular and adversarial training. Finally, an adversarial evasion robustness benchmark was performed to analyze the reliability of the different feature sets and their impact on the susceptibility of the models to adversarial examples. By using an improved dataset with more data diversity, selecting the best time-related features and a more specific feature set, and performing adversarial training, the ML models were able to achieve a better adversarially robust generalization. The robustness of the models was significantly improved without their generalization to regular traffic flows being affected, without increases of false alarms, and without requiring too many computational resources, which enables a reliable detection of suspicious activity and perturbed traffic flows in enterprise computer networks., Comment: 24 pages, 17 tables, Annals of Telecommunications journal. arXiv admin note: substantial text overlap with arXiv:2402.16912

As cyber-attacks become more sophisticated, improving the robustness of Machine Learning (ML) models must be a priority for enterprises of all sizes. To reliably compare the robustness of different ML models for cyber-attack detection in enterprise computer networks, they must be evaluated in standardized conditions. This work presents a methodical adversarial robustness benchmark of multiple decision tree ensembles with constrained adversarial examples generated from standard datasets. The robustness of regularly and adversarially trained RF, XGB, LGBM, and EBM models was evaluated on the original CICIDS2017 dataset, a corrected version of it designated as NewCICIDS, and the HIKARI dataset, which contains more recent network traffic. NewCICIDS led to models with a better performance, especially XGB and EBM, but RF and LGBM were less robust against the more recent cyber-attacks of HIKARI. Overall, the robustness of the models to adversarial cyber-attack examples was improved without their generalization to regular traffic being affected, enabling a reliable detection of suspicious activity without costly increases of false alarms., Comment: 15 pages, 8 tables, 2 figures, FPS 2023 conference

Vaccination is one of the most impactful healthcare interventions in terms of lives saved at a given cost, leading the anti-vaccination movement to be identified as one of the top 10 threats to global health in 2019 by the World Health Organization. This issue increased in importance during the COVID-19 pandemic where, despite good overall adherence to vaccination, specific communities still showed high rates of refusal. Online social media has been identified as a breeding ground for anti-vaccination discussions. In this work, we study how vaccination discussions are conducted in the discussion forum of Mumsnet, a United Kingdom based website aimed at parents. By representing vaccination discussions as networks of social interactions, we can apply techniques from network analysis to characterize these discussions, namely network comparison, a task aimed at quantifying similarities and differences between networks. Using network comparison based on graphlets -- small connected network subgraphs -- we show how the topological structure vaccination discussions on Mumsnet differs over time, in particular before and after COVID-19. We also perform sentiment analysis on the content of the discussions and show how the sentiment towards vaccinations changes over time. Our results highlight an association between differences in network structure and changes to sentiment, demonstrating how network comparison can be used as a tool to guide and enhance the conclusions from sentiment analysis.

Collaborative Filtering (CF), the most common approach to build Recommender Systems, became pervasive in our daily lives as consumers of products and services. However, challenges limit the effectiveness of Collaborative Filtering approaches when dealing with recommendation data, mainly due to the diversity and locality of user preferences, structural sparsity of user-item ratings, subjectivity of rating scales, and increasingly high item dimensionality and user bases. To answer some of these challenges, some authors proposed successful approaches combining CF with Biclustering techniques. This work assesses the effectiveness of Biclustering approaches for CF, comparing the impact of algorithmic choices, and identifies principles for superior Biclustering-based CF. As a result, we propose USBFC, a Biclustering-based CF approach that creates user-specific models from strongly coherent and statistically significant rating patterns, corresponding to subspaces of shared preferences across users. Evaluation on real-world data reveals that USBCF achieves competitive predictive accuracy against state-of-the-art CF methods. Moreover, USBFC successfully suppresses the main shortcomings of the previously proposed state-of-the-art biclustering-based CF by increasing coverage, and coclustering-based CF by strengthening subspace homogeneity.

This article presents the deployment and experimentation architecture of the Aveiro Tech City Living Lab (ATCLL) in Aveiro, Portugal. This platform comprises a large number of Internet-of-Things devices with communication, sensing and computing capabilities. The communication infrastructure, built on fiber and Millimeter-wave (mmWave) links, integrates a communication network with radio terminals (WiFi, ITS-G5, C-V2X, 5G and LoRa(WAN)), multiprotocol, spread throughout 44 connected points of access in the city. Additionally, public transportation has also been equipped with communication and sensing units. All these points combine and interconnect a set of sensors, such as mobility (Radars, Lidars, video cameras) and environmental sensors. Combining edge computing and cloud management to deploy the services and manage the platform, and a data platform to gather and process the data, the living lab supports a wide range of services and applications: IoT, intelligent transportation systems and assisted driving, environmental monitoring, emergency and safety, among others. This article describes the architecture, implementation and deployment to make the overall platform to work and integrate researchers and citizens. Moreover, it showcases some examples of the performance metrics achieved in the city infrastructure, the data that can be collected, visualized and used to build services and applications to the cities, and, finally, different use cases in the mobility and safety scenarios.

Network comparison is a widely-used tool for analyzing complex systems, with applications in varied domains including comparison of protein interactions or highlighting changes in structure of trade networks. In recent years, a number of network comparison methodologies based on the distribution of graphlets (small connected network subgraphs) have been introduced. In particular, NetEmd has recently achieved state of the art performance in undirected networks. In this work, we propose an extension of NetEmd to directed networks and deal with the significant increase in complexity of graphlet structure in the directed case by denoising through linear projections. Simulation results show that our framework is able to improve on the performance of a simple translation of the undirected NetEmd algorithm to the directed case, especially when networks differ in size and density.

Testing for infection with SARS-CoV-2 is an important intervention in reducing onwards transmission of COVID-19, particularly when combined with the isolation and contact-tracing of positive cases. Many countries with the capacity to do so have made use of lab-processed Polymerase Chain Reaction (PCR) testing targeted at individuals with symptoms and the contacts of confirmed cases. Alternatively, Lateral Flow Tests (LFTs) are able to deliver a result quickly, without lab-processing and at a relatively low cost. Their adoption can support regular mass asymptomatic testing, allowing earlier detection of infection and isolation of infectious individuals. In this paper we extend and apply the agent-based epidemic modelling framework Covasim to explore the impact of regular asymptomatic testing on the peak and total number of infections in an emerging COVID-19 wave. We explore testing with LFTs at different frequency levels within a population with high levels of immunity and with background symptomatic PCR testing, case isolation and contact tracing for testing. The effectiveness of regular asymptomatic testing was compared with `lockdown' interventions seeking to reduce the number of non-household contacts across the whole population through measures such as mandating working from home and restrictions on gatherings. Since regular asymptomatic testing requires only those with a positive result to reduce contact, while lockdown measures require the whole population to reduce contact, any policy decision that seeks to trade off harms from infection against other harms will not automatically favour one over the other. Our results demonstrate that, where such a trade off is being made, at moderate rates of early exponential growth regular asymptomatic testing has the potential to achieve significant infection control without the wider harms associated with additional lockdown measures.