Behavioral Fingerprints Research Articles

Multiparametric Assays Capture Sex- and Environment-Dependent Modifiers of Behavioral Phenotypes in Autism Mouse Models

BackgroundCurrent phenotyping approaches for murine autism models often focus on one selected behavioral feature, making the translation onto a spectrum of autistic characteristics in humans challenging. Furthermore, sex and environmental factors are rarely considered. Here, we aimed to capture the full spectrum of behavioral manifestations in 3 autism mouse models to develop a “behavioral fingerprint” that takes environmental and sex influences under consideration. MethodsTo this end, we employed a wide range of classical standardized behavioral tests and 2 multiparametric behavioral assays—the Live Mouse Tracker and Motion Sequencing—on male and female Shank2, Tsc1, and Purkinje cell–specific Tsc1 mutant mice raised in standard or enriched environments. Our aim was to integrate our high dimensional data into one single platform to classify differences in all experimental groups along dimensions with maximum discriminative power. ResultsMultiparametric behavioral assays enabled a more accurate classification of experimental groups than classical tests, and dimensionality reduction analysis demonstrated significant additional gains in classification accuracy, highlighting the presence of sex, environmental, and genotype differences in our experimental groups. ConclusionsTogether, our results provide a complete phenotypic description of all tested groups, suggesting that multiparametric assays can capture the entire spectrum of the heterogeneous phenotype in autism mouse models.

A novel IoT trust model leveraging fully distributed behavioral fingerprinting and secure delegation

The pervasiveness and high number of Internet of Things (IoT) applications in people’s daily lives make this context a very critical attack surface for cyber threats. The high heterogeneity of involved entities, both in terms of hardware and software characteristics, does not allow the definition of uniform, global, and efficient security solutions. Therefore, researchers have started to investigate novel mechanisms, in which a super node (a gateway, a hub, or a router) analyzes the interactions of the target node with other peers in the network, to detect possible anomalies. The most recent of these strategies base such an analysis on the modeling of the fingerprint of a node behavior in an IoT; nevertheless, existing solutions do not cope with the fully distributed nature of the referring scenario.In this paper, we try to provide a contribution in this setting, by designing a novel and fully distributed trust model exploiting point-to-point devices’ behavioral fingerprints, a distributed consensus mechanism, and Blockchain technology. In our solution we tackle the non-trivial issue of equipping smart things with a secure mechanism to evaluate, also through their neighbors, the trustworthiness of an object in the network before interacting with it. Beyond the detailed description of our framework, we also illustrate the security model associated with it and the tests carried out to evaluate its correctness and performance.

CyberSpec: Behavioral Fingerprinting for Intelligent Attacks Detection on Crowdsensing Spectrum Sensors

Integrated sensing and communication (ISAC) is a novel paradigm using crowdsensing spectrum sensors to help with the management of spectrum scarcity. However, well-known vulnerabilities of resource-constrained spectrum sensors and the possibility of being manipulated by users with physical access complicate their protection against spectrum sensing data falsification (SSDF) attacks. Most recent literature suggests using behavioral fingerprinting and Machine/Deep Learning (ML/DL) for improving similar cybersecurity issues. Nevertheless, the applicability of these techniques in resource-constrained devices, the impact of attacks affecting spectrum data integrity, and the performance and scalability of models suitable for heterogeneous sensors types are still open challenges. To improve limitations, this work presents seven SSDF attacks affecting spectrum sensors and introduces CyberSpec, an ML/DL-oriented framework using device behavioral fingerprinting to detect anomalies produced by SSDF attacks affecting resource-constrained spectrum sensors. CyberSpec has been implemented and validated in ElectroSense, a real crowdsensing RF monitoring platform where several configurations of the proposed SSDF attacks have been executed in different sensors. A pool of experiments with different unsupervised ML/DL-based models has demonstrated the suitability of CyberSpec detecting the previous attacks within an acceptable timeframe.

A Fully Privacy-Preserving Solution for Anomaly Detection in IoT using Federated Learning and Homomorphic Encryption

AbstractAnomaly detection for the Internet of Things (IoT) is a very important topic in the context of cyber-security. Indeed, as the pervasiveness of this technology is increasing, so is the number of threats and attacks targeting smart objects and their interactions. Behavioral fingerprinting has gained attention from researchers in this domain as it represents a novel strategy to model object interactions and assess their correctness and honesty. Still, there exist challenges in terms of the performance of such AI-based solutions. The main reasons can be alleged to scalability, privacy, and limitations on adopted Machine Learning algorithms. Indeed, in classical distributed fingerprinting approaches, an object models the behavior of a target contact by exploiting only the information coming from the direct interaction with it, which represents a very limited view of the target because it does not consider services and messages exchanged with other neighbors. On the other hand, building a global model of a target node behavior leveraging the information coming from the interactions with its neighbors, may lead to critical privacy concerns. To face this issue, the strategy proposed in this paper exploits Federated Learning to compute a global behavioral fingerprinting model for a target object, by analyzing its interactions with different peers in the network. Our solution allows the training of such models in a distributed way by relying also on a secure delegation strategy to involve less capable nodes in IoT. Moreover, through homomorphic encryption and Blockchain technology, our approach guarantees the privacy of both the target object and the different workers, as well as the robustness of the strategy in the presence of attacks. All these features lead to a secure fully privacy-preserving solution whose robustness, correctness, and performance are evaluated in this paper using a detailed security analysis and an extensive experimental campaign. Finally, the performance of our model is very satisfactory, as it consistently discriminates between normal and anomalous behaviors across all evaluated test sets, achieving an average accuracy value of 0.85.

Behavioral fingerprinting to detect ransomware in resource-constrained devices

The Internet of Things (IoT), a network of interconnected devices, has grown and gained traction over the last few years. This paradigm can impact our lives while also providing significant economic benefits. However, although resource-constrained IoT devices offer numerous advantages, they are also vulnerable to cyberattacks. As a result, ransomware severely threatens IoT devices managing sensitive and relevant information. Solutions based on Machine and Deep Learning (ML/DL) that consider behavioral data have been identified as promising. However, most detection solutions have been developed for Windows-based systems, which generally have more resources than IoT devices. As a result, these solutions are not suitable for resource-constrained components. In addition, no solution compares the pros and cons of different behavioral dimensions of resource-constrained devices. Thus, this work presents a framework that combines three different behavioral sources with supervised and unsupervised ML/DL algorithms to detect and classify heterogeneous ransomware impacting resource-constrained spectrum sensors. A pool of experiments has demonstrated the suitability of the proposed solution and compared its performance with a rule-based system. In conclusion, the usage of resources combined with local outlier factor and decision tree are the most promising combinations to detect anomalies and classify ransomware while consuming CPU, RAM, and time of devices in a reduced manner.

A Multi-layer Approach for Mobile Devices: Behavioral Fingerprinting

A Multi-layer Approach for Mobile Devices: Behavioral Fingerprinting

SpecForce: A Framework to Secure IoT Spectrum Sensors in the Internet of Battlefield Things

The battlefield has evolved into a mobile and dynamic scenario where soldiers and heterogeneous military equipment exchange information in real-time and wirelessly. This fact brings to reality the Internet of Battlefield Things (IoBT). Wireless communications are key enablers for the IoBT, and their management is critical due to the spectrum scarcity and the increasing number of IoBT devices. In this sense, IoBT spectrum sensors are deployed on the battlefield to monitor the frequency spectrum, transmit over unoccupied bands, intercept enemy transmissions, or decode valuable information. However, IoBT spectrum sensors are vulnerable to heterogeneous cyber-attacks, and their accurate detection is an open challenge in the literature. Thus, this paper presents SpecForce, a security framework for IoBT spectrum sensors based on device behavioral fingerprinting and ML/DL techniques. SpecForce considers heterogeneous data sources to detect the most dangerous and recent cyber-attacks affecting IoBT spectrum sensors, such as impersonation, malware, and spectrum sensing data falsification attacks. To evaluate the SpecForce detection performance, it has been deployed on 25 real spectrum sensors, and results show almost perfect detection for the three cyber-attack families previously mentioned.

Hidden behavioral fingerprints in epilepsy

Epilepsy is a major disorder affecting millions of people. Although modern electrophysiological and imaging approaches provide high-resolution access to the multi-scale brain circuit malfunctions in epilepsy, our understanding of how behavior changes with epilepsy has remained rudimentary. As a result, screening for new therapies for children and adults with devastating epilepsies still relies on the inherently subjective, semi-quantitative assessment of a handful of pre-selected behavioral signs of epilepsy in animal models. Here, we use machine learning-assisted 3D video analysis to reveal hidden behavioral phenotypes in mice with acquired and genetic epilepsies and track their alterations during post-insult epileptogenesis and in response to anti-epileptic drugs. These results show the persistent reconfiguration of behavioral fingerprints in epilepsy and indicate that they can be employed for rapid, automated anti-epileptic drug testing at scale.

Hidden Behavioral Fingerprints in Epilepsy

Hidden Behavioral Fingerprints in Epilepsy

A methodology to identify identical single-board computers based on hardware behavior fingerprinting

The connectivity and resource-constrained nature of single-board devices open the door to cybersecurity concerns affecting Internet of Things (IoT) scenarios. One of the most important issues is the presence of unauthorized IoT devices that want to impersonate legitimate ones by using identical hardware and software specifications. This situation can provoke sensitive information leakages, data poisoning, or privilege escalation in IoT scenarios. Combining behavioral fingerprinting and Machine/Deep Learning (ML/DL) techniques is a promising approach to identify these malicious spoofing devices by detecting minor performance differences generated by imperfections in manufacturing. However, existing solutions are not suitable for single-board devices since they do not consider their hardware and software limitations, underestimate critical aspects such as fingerprint stability or context changes, and do not explore the potential of ML/DL techniques. To improve it, this work first identifies the essential properties for single-board device identification: uniqueness, stability, diversity, scalability, efficiency, robustness, and security. Then, a novel methodology relies on behavioral fingerprinting to identify identical single-board devices and meet the previous properties. The methodology leverages the different built-in components of the system and ML/DL techniques, comparing the device internal behavior with each other to detect variations that occurred in manufacturing processes. The methodology validation has been performed in a real environment composed of 15 identical Raspberry Pi 4 Model B and 10 Raspberry Pi 3 Model B＋ devices, obtaining a 91.9% average TPR with an XGBoost model and achieving the identification for all devices by setting a 50% threshold in the evaluation process. Finally, a discussion compares the proposed solution with related work, highlighting the fingerprint properties not met, and provides important lessons learned and limitations.

Robust Federated Learning for execution time-based device model identification under label-flipping attack

The computing device deployment explosion experienced in recent years, motivated by the advances of technologies such as Internet-of-Things (IoT) and 5G, has led to a global scenario with increasing cybersecurity risks and threats. Among them, device spoofing and impersonation cyberattacks stand out due to their impact and, usually, low complexity required to be launched. To solve this issue, several solutions have emerged to identify device models and types based on the combination of behavioral fingerprinting and Machine/Deep Learning (ML/DL) techniques. However, these solutions are not appropriate for scenarios where data privacy and protection are a must, as they require data centralization for processing. In this context, newer approaches such as Federated Learning (FL) have not been fully explored yet, especially when malicious clients are present in the scenario setup. The present work analyzes and compares the device model identification performance of a centralized DL model with an FL one while using execution time-based events. For experimental purposes, a dataset containing execution-time features of 55 Raspberry Pis belonging to four different models has been collected and published. Using this dataset, the proposed solution achieved 0.9999 accuracy in both setups, centralized and federated, showing no performance decrease while preserving data privacy. Later, the impact of a label-flipping attack during the federated model training is evaluated using several aggregation mechanisms as countermeasures. Zeno and coordinate-wise median aggregation show the best performance, although their performance greatly degrades when the percentage of fully malicious clients (all training samples poisoned) grows over 50%.

Wearable full-body motion tracking of activities of daily living predicts disease trajectory in Duchenne muscular dystrophy

Artificial intelligence has the potential to revolutionize healthcare, yet clinical trials in neurological diseases continue to rely on subjective, semiquantitative and motivation-dependent endpoints for drug development. To overcome this limitation, we collected a digital readout of whole-body movement behavior of patients with Duchenne muscular dystrophy (DMD) (n = 21) and age-matched controls (n = 17). Movement behavior was assessed while the participant engaged in everyday activities using a 17-sensor bodysuit during three clinical visits over the course of 12 months. We first defined new movement behavioral fingerprints capable of distinguishing DMD from controls. Then, we used machine learning algorithms that combined the behavioral fingerprints to make cross-sectional and longitudinal disease course predictions, which outperformed predictions derived from currently used clinical assessments. Finally, using Bayesian optimization, we constructed a behavioral biomarker, termed the KineDMD ethomic biomarker, which is derived from daily-life behavioral data and whose value progresses with age in an S-shaped sigmoid curve form. The biomarker developed in this study, derived from digital readouts of daily-life movement behavior, can predict disease progression in patients with muscular dystrophy and can potentially track the response to therapy.

Social behavioral profiling by unsupervised deep learning reveals a stimulative effect of dopamine D3 agonists on zebrafish sociality

It has been a major challenge to systematically evaluate and compare how pharmacological perturbations influence social behavioral outcomes. Although some pharmacological agents are known to alter social behavior, precise description and quantification of such effects have proven difficult. We developed a scalable social behavioral assay for zebrafish named ZeChat based on unsupervised deep learning to characterize sociality at high resolution. High-dimensional and dynamic social behavioral phenotypes are automatically classified using this method. By screening a neuroactive compound library, we found that different classes of chemicals evoke distinct patterns of social behavioral fingerprints. By examining these patterns, we discovered that dopamine D3 agonists possess a social stimulative effect on zebrafish. The D3 agonists pramipexole, piribedil, and 7-hydroxy-DPAT-HBr rescued social deficits in a valproic-acid-induced zebrafish autism model. The ZeChat platform provides a promising approach for dissecting the pharmacology of social behavior and discovering novel social-modulatory compounds.

Behavioral Fingerprinting: Acceleration Sensors for Identifying Changes in Livestock Health

During disease or toxin challenges, the behavioral activities of grazing animals alter in response to adverse situations, potentially providing an indicator of their welfare status. Behavioral changes such as feeding behavior, rumination and physical behavior as well as expressive behavior, can serve as indicators of animal health and welfare. Sometimes behavioral changes are subtle and occur gradually, often missed by infrequent visual monitoring until the condition becomes acute. There is growing popularity in the use of sensors for monitoring animal health. Acceleration sensors have been designed to attach to ears, jaws, noses, collars and legs to detect the behavioral changes of cattle and sheep. So far, some automated acceleration sensors with high accuracies have been found to have the capacity to remotely monitor the behavioral patterns of cattle and sheep. These acceleration sensors have the potential to identify behavioral patterns of farm animals for monitoring changes in behavior which can indicate a deterioration in health. Here, we review the current automated accelerometer systems and the evidence they can detect behavioral patterns of animals for the application of potential directions and future solutions for automatically monitoring and the early detection of health concerns in grazing animals.

Software-Defined Security-by-Contract for Blockchain-Enabled MUD-Aware Industrial IoT Edge Networks

To ensure the proper functioning and performance of Industrial grade Internet of Things devices (IIoT) in Industry 4.0 networks, it is critical to identify the capabilities and malfunctions of their component devices (e.g., sensors, actuators, and controllers) and detect potential misbehavior arising due to cyber-attacks, and misconfiguration. We envision future IoT devices embed behavioral profiles through <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Security-by-Contract</i> (S×C) that are easy to validate and verify against network security policies; manufacturers to provide manufacturer usage description (MUD) profiles as a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">manifest</i> for the devices to signal to the network what sort of access and network functionality they require to properly function. We design authentication in the IoT onboarding process, employ blockchains to a verifiable and immutable repository to store this network manifests, that is signed and verifiable with S×C based <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">smart contracts</i> by the device manufacturer, or industry authority. The integrated framework combines blockchains and S×C security contracts, MUD-based behavioral fingerprinting, and software-defined-networking for managing the security of IIoT ecosystems. Finally, the proposed scheme is validated in a simulated IoT environment on various performance parameters.

Intelligent and behavioral-based detection of malware in IoT spectrum sensors

The number of Cyber-Physical Systems (CPS) available in industrial environments is growing mainly due to the evolution of the Internet-of-Things (IoT) paradigm. In such a context, radio frequency spectrum sensing in industrial scenarios is one of the most interesting applications of CPS due to the scarcity of the spectrum. Despite the benefits of operational platforms, IoT spectrum sensors are vulnerable to heterogeneous malware. The usage of behavioral fingerprinting and machine learning has shown merit in detecting cyberattacks. Still, there exist challenges in terms of (i) designing, deploying, and evaluating ML-based fingerprinting solutions able to detect malware attacks affecting real IoT spectrum sensors, (ii) analyzing the suitability of kernel events to create stable and precise fingerprints of spectrum sensors, and (iii) detecting recent malware samples affecting real IoT spectrum sensors of crowdsensing platforms. Thus, this work presents a detection framework that applies device behavioral fingerprinting and machine learning to detect anomalies and classify different botnets, rootkits, backdoors, ransomware and cryptojackers affecting real IoT spectrum sensors. Kernel events from CPU, memory, network, file system, scheduler, drivers, and random number generation have been analyzed, selected, and monitored to create device behavioral fingerprints. During testing, an IoT spectrum sensor of the ElectroSense platform has been infected with ten recent malware samples (two botnets, three rootkits, three backdoors, one ransomware, and one cryptojacker) to measure the detection performance of the framework in two different network configurations. Both supervised and semi-supervised approaches provided promising results when detecting and classifying malicious behaviors from the eight previous malware and seven normal behaviors. In particular, the framework obtained 0.88–0.90 true positive rate when detecting the previous malicious behaviors as unseen or zero-day attacks and 0.94–0.96 F1-score when classifying them.

Study protocol: a comprehensive multi-method neuroimaging approach to disentangle developmental effects and individual differences in second language learning

BackgroundWhile it is well established that second language (L2) learning success changes with age and across individuals, the underlying neural mechanisms responsible for this developmental shift and these individual differences are largely unknown. We will study the behavioral and neural factors that subserve new grammar and word learning in a large cross-sectional developmental sample. This study falls under the NWO (Nederlandse Organisatie voor Wetenschappelijk Onderzoek [Dutch Research Council]) Language in Interaction consortium (website: https://www.languageininteraction.nl/).MethodsWe will sample 360 healthy individuals across a broad age range between 8 and 25 years. In this paper, we describe the study design and protocol, which involves multiple study visits covering a comprehensive behavioral battery and extensive magnetic resonance imaging (MRI) protocols. On the basis of these measures, we will create behavioral and neural fingerprints that capture age-based and individual variability in new language learning. The behavioral fingerprint will be based on first and second language proficiency, memory systems, and executive functioning. We will map the neural fingerprint for each participant using the following MRI modalities: T1‐weighted, diffusion-weighted, resting-state functional MRI, and multiple functional-MRI paradigms. With respect to the functional MRI measures, half of the sample will learn grammatical features and half will learn words of a new language. Combining all individual fingerprints allows us to explore the neural maturation effects on grammar and word learning.DiscussionThis will be one of the largest neuroimaging studies to date that investigates the developmental shift in L2 learning covering preadolescence to adulthood. Our comprehensive approach of combining behavioral and neuroimaging data will contribute to the understanding of the mechanisms influencing this developmental shift and individual differences in new language learning. We aim to answer: (I) do these fingerprints differ according to age and can these explain the age-related differences observed in new language learning? And (II) which aspects of the behavioral and neural fingerprints explain individual differences (across and within ages) in grammar and word learning? The results of this study provide a unique opportunity to understand how the development of brain structure and function influence new language learning success.

BEFP: An Extension Recognition System Based on Behavioral and Environmental Fingerprinting

Browser extensions are third-party applications that can customize the browsing experience. Previous studies have shown that browser extension fingerprinting can be used to track users and reveal users’ privacy information by obtaining the browser extension list. However, the proposal of various defense measures weakens the effectiveness of the existing extension fingerprinting technologies. In this paper, we first propose two extension fingerprinting technologies: JavaScript-based environmental fingerprinting and DOM-based behavioral fingerprinting. They, respectively, capture the operation behaviors of extensions on JavaScript properties and webpage’s DOM. Second, we design BEFP, an extension recognition system which comprehensively utilizes the above two technologies to improve the uniqueness of the extension fingerprint. Finally, we collect the latest data set and carry out experiments on the actual scenario where users install multiple extensions. The results show that the true positive rate of extension recognition is as high as 96.3%. And the extension’s detectable rate of BEFP is superior to the existing technologies. Moreover, it is proved that the JavaScript-based environmental fingerprinting can complement the DOM-based fingerprinting to distinguish the extensions with the same DOM modification.

Can Evil Iot Twins Be Identified? Now Yes, a Hardware Behavioral Fingerprinting Methodology

Can Evil Iot Twins Be Identified? Now Yes, a Hardware Behavioral Fingerprinting Methodology

Zebrafish Behavioral Phenomics Links Artificial Sweetener Aspartame to Behavioral Toxicity and Neurotransmitter Homeostasis.

Artificial sweeteners (ASs) are extensively used as food additives in drinks and beverages to lower calorie intake and prevent lifestyle diseases such as obesity. Although clinical and epidemiological data revealed the link between the chronic overconsumption of ASs and adverse health effects, there still exist controversies over the potential adverse neural toxic effect of ASs such as aspartame (APM), with acceptable daily intake (ADI) for a long time, on human health. In addition, whether APM and its metabolites are neurotoxic remains debatable due to a lack of data from an animal experiment or clinical investigation. Herein, to fully describe the potential neurological effect of APM, adult zebrafish served as the animal model to assess neurophysiological alteration induced by APM exposure within the range of the ADI (1, 10, and 100 mg/L) for 2 months. A cohort of standardized neurobehavioral phenotyping assays was conducted, including light/dark preference tests (LDP), novel tank diving tests, novel object recognition tests, social interaction tests, and color preference tests. For instance, in the LDP test, saccharin remarkably decreased the swimming time of zebrafish in the DARK part from 111 ± 10.8 (control group) to 72.2 ± 11.4 (100 mg/L groups). Besides, brain chemistry involved in the alteration of total neurotransmitters was determined by LC-MS/MS to confirm the behavioral results. Overall, current research studies revealed that APM within the range of the ADI altered the total behavioral profiles of zebrafish and disturbed the homeostasis of neurotransmitters in the brain. The present study has established a set of experimental paradigms, revealing the standardized procedure of using adult zebrafish to determine the neural activity or toxicity of AS molecules phenotypically. Zebrafish behavioral phenotyping methods, which were characterized by a cohort of behavioral fingerprints, can link the phenotypical alteration to changes in neurotransmitters in the brain, so as to provide a predictive reference for the further exploration of the molecular mechanism of phenotypic changes induced by ASs.