False Positive Alerts Research Articles

Collaborative Intrusion Detection System with Snort Machine Learning Plugin

The increasing prevalence of cybercrime and cyber-attacks underscores the imperative need for organizations to implement robust network security measures. Nevertheless, current Intrusion Detection Systems (IDS) often rely on single-sensor or multi-sensor in the same type of IDS, including Host-Based IDS (HIDS) or Network-Based IDS (NIDS), which inherently possess limited detection capabilities. To address this limitation, this research combines NIDS and HIDS components into a collaborative-IDS system, thus expanding the scope of intrusion detection and enhancing the efficacy of the established attack mitigation system. However, the integration of NIDS and HIDS introduces formidable challenges, notably the elevated rates of False Positive and False Negative alerts. To surmount these challenges, the researcher employs machine learning techniques in the form of Snort plugins and comparison methods to heighten the precision of attack detection. The obtained results unequivocally illustrate the effectiveness of this approach. Using a Support Vector Machine for static analysis of the NSL-KDD dataset attains an outstanding 99% detection rate for Denial of Service (DoS) attacks and an impressive 98% detection rate for Probe attacks. Furthermore, in dynamic real-time attack simulations, the machine learning plugins exhibit remarkable proficiency in detecting various types of DoS attacks, concurrently offering more comprehensive identification of SYN Flooding DoS attacks compared to the Snort community rules set. These findings signify a significant advancement in intrusion detection, paving the way for more robust and accurate network security systems in an era of escalating cyber threats.

The Impact of Customized Screening Intervals on the Burden of Drug-Drug Interaction Alerts: An Interrupted Time Series Analysis.

Fixed and broad screening intervals for drug-drug interaction (DDI) alerts lead to false positive alerts, thereby contributing to alert fatigue among healthcare professionals. Hence, we aimed to investigate the impact of customized screening intervals on the daily incidence of DDI alerts. An interrupted time series analysis was performed at the University Hospitals Leuven to evaluate the impact of a pragmatic intervention on the daily incidence of DDI alerts per 100 prescriptions. The study period encompassed 100 randomly selected days between April 2021 and December 2022. Preceding the intervention, a fixed and broad screening interval of 7 days before and after prescribing an interacting drug was applied. The intervention involved implementing customized screening intervals for a subset of highly prevalent or clinically relevant DDIs into the hospital information system. Additionally, the sensitivity of the tailored approach was evaluated. During the study period, a mean of 5731 (± 2909) new prescriptions per day was generated. The daily incidence of DDI alerts significantly decreased from 9.8% (95% confidence interval (CI) 8.4;11.1) before the intervention, to 6.3% (95% CI 5.4;7.2) afterwards, p < 0.0001. This corresponded to avoiding 201 (0.035*5731) false positive DDI alerts per day. Sensitivity was not compromised by our intervention. Defining and implementing customized screening intervals was feasible and effective in reducing the DDI alert burden without compromising sensitivity.

Assessment of the role of false-positive alerts in computer-aided polyp detection for assistance capabilities.

False positives (FPs) pose a significant challenge in the application of artificial intelligence (AI) for polyp detection during colonoscopy. The study aimed to quantitatively evaluate the impact of computer-aided polyp detection (CADe) systems' FPs on endoscopists. The model's FPs were categorized into four gradients: 0-5, 5-10, 10-15, and 15-20 FPs per minute (FPPM). Fifty-six colonoscopy videos were collected for a crossover study involving 10 endoscopists. Polyp missed rate (PMR) was set as primary outcome. Subsequently, to further verify the impact of FPPM on the assistance capability of AI in clinical environments, a secondary analysis was conducted on a prospective randomized controlled trial (RCT) from Renmin Hospital of Wuhan University in China from July 1 to October 15, 2020, with the adenoma detection rate (ADR) as primary outcome. Compared with routine group, CADe reduced PMR when FPPM was less than 5. However, with the continuous increase of FPPM, the beneficial effect of CADe gradually weakens. For secondary analysis of RCT, a total of 956 patients were enrolled. In AI-assisted group, ADR is higher when FPPM≤5 compared with FPPM>5 (CADe group: 27.78% vs 11.90%; P=0.014; odds ratio [OR], 0.351; 95% confidence interval [CI], 0.152-0.812; COMBO group: 38.40% vs 23.46%, P=0.029; OR, 0.427; 95% CI, 0.199-0.916). After AI intervention, ADR increased when FPPM≤5 (27.78% vs 14.76%; P=0.001; OR, 0.399; 95% CI, 0.231-0.690), but no statistically significant difference was found when FPPM>5 (11.90% vs 14.76%, P=0.788; OR, 1.111; 95% CI, 0.514-2.403). The level of FPs of CADe does affect its effectiveness as an aid to endoscopists, with its best effect when FPPM is less than 5.

Future state AML: Using advanced technology to reimagine transaction monitoring

Anti-money laundering teams are increasingly looking to implement advanced technology, including machine learning and artificial intelligence, to help reduce workloads while ensuring compliance with applicable regulation. However, much of what is being implemented today sits on top of legacy systems and is aimed less at effectively detecting financial crime and more at reducing false positive alerts. This paper reimagines how AML compliance can implement advanced technology from the ground up to not only reduce the number of false positives, but to also provide more useful and timely information to law enforcement. All technology discussed in this paper is currently on the market or under development. The paper can be used as a starting point for AML teams to think about how they can implement advanced technology end to end in order to improve the transaction monitoring process and suspicious transaction filings.

Transabdominal motor evoked potential neuromonitoring of lumbosacral spine surgery

BACKGROUND CONTEXTTranscranial Motor Evoked Potentials (TcMEPs) can improve intraoperative detection of femoral plexus and nerve root injury during lumbosacral spine surgery. However, even under ideal conditions, TcMEPs are not completely free of false-positive alerts due to the immobilizing effect of general anesthetics, especially in the proximal musculature. The application of transcutaneous stimulation to activate ventral nerve roots directly at the level of the conus medularis (bypassing the brain and spinal cord) has emerged as a method to potentially monitor the motor component of the femoral plexus and lumbosacral nerves free from the blunting effects of general anesthesia. PURPOSETo evaluate the reliability and efficacy of transabdominal motor evoked potentials (TaMEPs) compared to TcMEPs during lumbosacral spine procedures. DESIGNWe present the findings of a single-center 12-month retrospective experience of all lumbosacral spine surgeries utilizing multimodality intraoperative neuromonitoring (IONM) consisting of TcMEPs, TaMEPs, somatosensory evoked potentials (SSEPs), electromyography (EMG), and electroencephalography. PATIENT SAMPLETwo hundred and twenty patients having one, or a combination of lumbosacral spine procedures, including anterior lumbar interbody fusion (ALIF), lateral lumbar interbody fusion (LLIF), posterior spinal fusion (PSF), and/or transforaminal lumbar interbody fusion (TLIF). OUTCOME MEASURESIntraoperative neuromonitoring data was correlated to immediate postoperative neurologic examinations and chart review. METHODSBaseline reliability, false positive rate, true positive rate, false negative rate, area under the curve at baseline and at alerts, and detection of preoperative deficits of TcMEPs and TaMEPs were compared and analyzed for statistical significance. The relationship between transcutaneous stimulation voltage level and patient BMI was also examined. RESULTSTaMEPs were significantly more reliable than TcMEPs in all muscles except abductor hallucis. Of the 27 false positive alerts, 24 were TcMEPs alone, and 3 were TaMEPs alone. Of the 19 true positives, none were detected by TcMEPs alone, 3 were detected by TaMEPs alone (TcMEPs were not present), and the remaining 16 true positives involved TaMEPs and TcMEPs. TaMEPs had a significantly larger area under the curve (AUC) at baseline than TcMEPs in all muscles except abductor hallucis. The percent decrease in TcMEP and TaMEP AUC during LLIF alerts was not significantly different. Both TcMEPs and TaMEPs reflected three preexisting motor deficits. Patient BMI and TaMEP stimulation intensity were found to be moderately positively correlated. CONCLUSIONSThese findings demonstrate the high reliability and predictability of TaMEPs and the potential added value when TaMEPs are incorporated into multimodality IONM during lumbosacral spine surgery.

Monitoring of Remotely Reprogrammable Implantable Loop Recorders With Algorithms to Reduce False-Positive Alerts.

Implantable loop recorders (ILRs) are increasingly placed for arrhythmia detection. However, historically, ≈75% of ILR alerts are false positives, requiring significant time and effort for adjudication. The LINQII and LUX-Dx are remotely reprogrammable ILRs with dual-stage algorithms using artificial intelligence to reduce false positives, but their utility in routine clinical practice has not been studied. We identified patients with the LINQII and LUX-Dx who were monitored by the Veterans Affairs National Cardiac Device Surveillance Program between March and June 2022. ILR programming was customized on the basis of implant indication. All alerts and every 90-day scheduled transmissions were manually reviewed. ILRs were remotely reprogrammed, as appropriate, after false-positive alerts or 2 consecutive same-type alerts, unless there was ongoing clinical need for that alert. Outcomes were total number of transmissions and false positives. We performed medical record review to determine if patients experienced any adverse clinical events, including hospitalization and mortality. Among 117 LINQII patients, there were 239 total alerts, 43 (18.0%) of which were false positives. Among 105 LUX-Dx patients, there were 300 total alerts, 115 (38.3%) of which were false positives. LINQIIs were reprogrammed 22 times, resulting in a decrease in median alerts/day from 0.13 to 0.03. LUX-Dx ILRs were reprogrammed 52 times, resulting in a decrease from 0.15 to 0.01 median alerts/day. There were no adverse clinical events that could have been identified by superior or earlier arrhythmia detection. ILRs with artificial intelligence algorithms and remote reprogramming ability are associated with reduced alert burden because of higher true-positive rates than prior ILRs, without missing potentially consequential arrhythmias.

Multimodal Intraoperative Neurophysiological Monitoring in Cranial and Spinal Tumour Surgeries: A Descriptive Observational Study.

Intraoperative neurophysiological monitoring (IONM) involves monitoring the functional integrity of critical brain regions and pathways as well as identifying and preserving functionally viable neural tissues (mapping) during surgery using electrophysiological techniques. Multimodality combines various neurophysiological techniques to optimise diagnostic effectiveness and to improve the outcomes of the surgeries. The present study is a case series with comprehensive and illustrative descriptions of the neurophysiological changes in five neuromonitored cases of cranial and spinal cord tumour surgeries conducted with a multimodal approach. The cases were monitored with somatosensory evoked potentials (SSEP), transcranial motor evoked potentials (TcMEP), and both free run and triggered electromyography (fEMG and tEMG). No false negative outcomes were identified in the cases studied as there was an association of absence of change in SSEP and TcMEP both, with no neurological deficit postoperatively.Two cases were identified as having true positive neuromonitoring alerts.No false positive alerts were found in any case. Multimodal monitoring using SSEP, TcMEP, and EMG (fEMG and tEMG) in cranial and spinal tumour surgeries can improve performance with fewer false-negative and false-positive results. Neuromonitoring approaches used in combination can provide reliable information regarding postoperative neurological outcomes.

Collaborative Federated Learning-Based Model for Alert Correlation and Attack Scenario Recognition

Planned and targeted attacks, such as the advanced persistent threat (APT), are highly sophisticated forms of attack. They involve numerous steps and are intended to remain within a system for an extended length of period before progressing to the next stage of action. Anticipating the next behaviors of attackers is a challenging and crucial task due to the stealthy nature of advanced attack scenarios, in addition to the possible high volumes of false positive alerts generated by different security tools such as intrusion detection systems (IDSs). Intelligent models that are capable of establishing a correlation individual between individual security alerts in order to reconstruct attack scenarios and to extract a holistic view of intrusion activities are required to exploit hidden links between different attack stages. Federated learning models performed in distributed settings have achieved successful and reliable implementations. Alerts from distributed security devices can be utilized in a collaborative manner based on several learning models to construct a federated model. Therefore, we propose an intelligent detection system that employs federated learning models to identify advanced attack scenarios such as APT. Features extracted from alerts are preprocessed and engineered to produce a model with high accuracy and fewer false positives. We conducted training on four machine learning models in a centralized learning; these models are XGBoost, Random Forest, CatBoost, and an ensemble learning model. To maintain privacy and ensure the integrity of the global model, the proposed model has been implemented using conventional neural network federated learning (CNN_FL) across several clients during the process of updating weights. The experimental findings indicate that ensemble learning achieved the highest accuracy of 88.15% in the context of centralized learning. CNN_FL has demonstrated an accuracy of 90.18% in detecting various attacks of APTs while maintaining a low false alarm rate.

Remote monitoring of implantable cardiac monitors in patients with unexplained syncope: Predictors of false-positive alert episodes.

Remote monitoring is recommended for patients with implantable cardiac monitors (ICMs), but compared to other cardiac implantable devices, ICMs are less accurate and transmit a higher number of alerts. The aim of this study was to investigate the predictors of false-positive (FP) arrhythmic alerts in patients with unexplained syncope who were implanted with ICM and followed by an automatic remote monitoring system. We retrospectively evaluated all consecutive patients who received a long-sensing vector ICM for unexplained syncope between January 2019 to September 2021 at our Syncope Unit. The primary endpoint was the incidence of the first FP episode. The secondary endpoints included assessing the incidence of FP episodes for all types of algorhythms and indentifying the reasons for the misdetection of these episodes. Among 105 patients (44.8% males, median age 51 years), 51 (48.6%) transmitted at least one FP alert during a median follow-up of 301 days. The presence of pre-ventricular complexes (PVCs) on the resting electrocardiogram was the only clinical characteristic associated with an increased risk of FP alerts (adjusted Hazard ratio [HR] 5.76 [2.66-12.4], p=0.010). The other significant device-related variables were a low-frequency filter at 0.05Hz versus the default 0.5Hz (adjusted HR 3.82 [1.38-10.5], p=0.010) and the R-wave amplitude (adjusted HR 0.35 [0.13-0.99], p=0.049). Patients who have PVCs are at higher risk of inappropriate ICM activations. To reduce the occurrence of FP alerts, it may be beneficial to target a large R-wave amplitude during device insertion and avoid programming a low-frequency filter at 0.05Hz.

Automatic suppression of false positive alerts in anti-money laundering systems using machine learning

Criminal activities generate an estimated $2 trillion in laundered money per year, highlighting the need for financial institutions to detect and report suspicious activity to protect their reputation. However, rule-based models commonly used for this purpose generate a high number of false positives, draining compliance team time, and increasing investigation costs. However, the application of machine learning in conjunction with rule-based models presents noteworthy implications, encompassing the potential reduction in false positives and the concomitant risk of machine learning inadvertently suppressing true positive alerts. This paper proposes a framework called automatic suppression based on XGBoost for anti-money laundering (ASXAML) to enhance detection by reducing false positives. ASXAML leverages recursive feature elimination with cross-validation for optimal feature selection. Subsequently, Optuna is employed to fine-tune hyperparameters for the XGBoost model. Results indicate that ASXAML achieves an optimal balance between reducing false positives and avoiding missed money laundering events, with an 86% F-beta score and only 11% money laundering customers were incorrectly closed out of 1926 in the test data.

Beyond the override: Using evidence of previous drug tolerance to suppress drug allergy alerts; a retrospective study of opioid alerts

ObjectiveDespite the extensive literature exploring alert fatigue, most studies have focused on describing the phenomenon, but not on fixing it. The authors aimed to identify data useful to avert clinically irrelevant alerts to inform future research on clinical decision support (CDS) design. MethodsWe conducted a retrospective observational study of opioid drug allergy alert (DAA) overrides for the calendar year of 2019 at a large academic medical center, to identify data elements useful to find irrelevant alerts to be averted. ResultsOverall, 227,815 DAAs were fired in 2019, with an override rate of 91 % (n = 208196). Opioids represented nearly two-thirds of these overrides (n = 129063; 62 %) and were the drug class with the highest override rate (96 %). On average, 29 opioid DAAs were overridden per patient. While most opioid alerts (97.1 %) are fired for a possible match (the drug class of the allergen matches the drug class of the prescribed drug), they are overridden significantly less frequently for definite match (exact match between allergen and prescribed drug) (88 % vs. 95.9 %, p < 0.001). When comparing the triggering drug with previously administered drugs, override rates were equally high for both definite match (95.9 %), no match (95.5 %), and possible match (95.1 %). Likewise, when comparing to home medications, overrides were excessively high for possible match (96.3 %), no match (96 %), and definite match (94.4 %). ConclusionWe estimate that 74.5% of opioid DAAs (46.4% of all DAAs) at our institution could be relatively safely averted, since they either have a definite match for previous inpatient administrations suggesting drug tolerance or are fired as possible match with low risk of cross-sensitivity. Future research should focus on identifying other relevant data elements ideally with automated methods and use of emerging standards to empower CDS systems to suppress false-positive alerts while avoiding safety hazards.

Evaluation of a New Telemedicine System for Early Detection of Cardiac Instability in Patients With Chronic Heart Failure: Real-Life Out-of-Hospital Study.

For a decade, despite results from many studies, telemedicine systems have suffered from a lack of recommendations for chronic heart failure (CHF) care because of variable study results. Another limitation is the hospital-based architecture of most telemedicine systems. Some systems use an algorithm based on daily weight, transcutaneous oxygen measurement, and heart rate to detect and treat acute heart failure (AHF) in patients with CHF as early on as possible. The aim of this study is to determine the efficacy of a telemonitoring system in detecting clinical destabilization in real-life settings (out-of-hospital management) without generating too many false positive alerts. All patients self-monitoring at home using the system after a congestive AHF event treated at a cardiology clinic in France between March 2020 and March 2021 with at least 75% compliance on daily measurements were included retrospectively. New-onset AHF was defined by the presence of at least 1 of the following criteria: transcutaneous oxygen saturation loss, defined as a transcutaneous oxygen measurement under 90%; rise of cardiac frequency above 110 beats per minute; weight gain of at least 2 kg; and symptoms of congestive AHF, described over the phone. An AHF alert was generated when the criteria reached our definition of new-onset acute congestive heart failure (HF). A total of 111 consecutive patients (n=70 men) with a median age of 76.60 (IQR 69.5-83.4) years receiving the telemonitoring system were included. Thirty-nine patients (35.1%) reached the HF warning level, and 28 patients (25%) had confirmed HF destabilization during follow-up. No patient had AHF without being detected by the telemonitoring system. Among incorrect AHF alerts (n=11), 5 patients (45%) had taken inaccurate measurements, 3 patients (27%) had supraventricular arrhythmia, 1 patient (9%) had a pulmonary bacterial infection, and 1 patient (9%) contracted COVID-19. A weight gain of at least 2 kg within 4 days was significantly associated with a correct AHF alert (P=.004), and a heart rate of more than 110 beats per minute was more significantly associated with an incorrect AHF alert (P=.007). This single-center study highlighted the efficacy of the telemedicine system in detecting and quickly treating cardiac instability complicating the course of CHF by detecting new-onset AHF as well as supraventricular arrhythmia, thus helping cardiologists provide better follow-up to ambulatory patients.

Development and validation of machine learning models for venous thromboembolism risk assessment at admission: a retrospective study.

Venous thromboembolism (VTE) risk assessment at admission is of great importance for early screening and timely prophylaxis and management during hospitalization. The purpose of this study is to develop and validate novel risk assessment models at admission based on machine learning (ML) methods. In this retrospective study, a total of 3078 individuals were included with their Caprini variables within 24 hours at admission. Then several ML models were built, including logistic regression (LR), random forest (RF), and extreme gradient boosting (XGB). The prediction performance of ML models and the Caprini risk score (CRS) was then validated and compared through a series of evaluation metrics. The values of AUROC and AUPRC were 0.798 and 0.303 for LR, 0.804 and 0.360 for RF, and 0.796 and 0.352 for XGB, respectively, which outperformed CRS significantly (0.714 and 0.180, P < 0.001). When prediction scores were stratified into three risk levels for application, RF could obtain more reasonable results than CRS, including smaller false positive alerts and larger lower-risk proportions. The boosting results of stratification were further verified by the net-reclassification-improvement (NRI) analysis. This study indicated that machine learning models could improve VTE risk prediction at admission compared with CRS. Among the ML models, RF was found to have superior performance and great potential in clinical practice.

Optimization of Security Information and Event Management (SIEM) Infrastructures, and Events Correlation / Regression Analysis for Optimal Cyber Security Posture

This work integrates logical and physical security processes, and simplifies the manageability of the security infrastructure. The process increases visibility to resources, which makes it easier to prevent security incidents, and provides a platform to manage the response and recovery after an incident occur. Log collection is the heart and soul of a SIEM. Log correlation is employed to identify particular sequences of log events from devices. The comparison between network level and host level events automatically perform initial validation that would not normally be performed. It considers movement of data between systems where it would not normally accounts logging on at unusual times or from unusual places, these may not generate specific security alerts, but can be much more easily spotted and flagged by a log correlation solution that sees everything in the environment. It shows some enhancements to event log normalization and significantly improves correlation rule execution. The event monitoring algorithm and SIEM correlation rules result in false positives or false negatives. Security managers, therefore, may waste time and resources that could be used to respond to real threats and assaults if there are too many false positives. This study hereby, strikes a compromise between lowering false positive alerts and not ignoring any potential abnormalities that could indicate a cyberattack when establishing SIEM correlation rules. In order to decide which data is pertinent and which data is irrelevant in an event pipeline, this research employs the use of filters. Through this examination, it can be inferred that the conditions are advantageous for promoting investment in the growth and enhancement of this technology as an essential component of industrial control systems with security operation centers, as well as offering cyber security management for small and medium-sized enterprises (SMEs) with restricted security expertise and capabilities.

Improved adaptive neuro-fuzzy inference system based on modified salp swarm algorithm and golden eagle optimizer algorithm for intrusion detection in networks

With the increase in the growth of computer networks throughout the past years, network security has become an essential issue. Among the numerous network security measures, intrusion detection systems play a dynamic function with integrity, confidentiality, and accessibility of resources. An Intrusion Detection System (IDS) is a software program or hardware device which monitors computer system and/or network activities for malicious activities and produces alerts to security experts. In IDS there are three major problems namely generating many alerts, a huge rate of false positive alerts, and unknown attack types per generated alerts. Alert management methods are used to manage these problems. One of the methods of alert management is alert reduction and alert classification. The proposed approach focuses on enhancing the efficiency of the adaptive neuro-fuzzy inference system (ANFIS) using a modified salp swarm algorithm (SSA) and Golden Eagle optimizer (GEOSSA). The present study uses the Golden Eagle optimization algorithm to improve SSA behaviors. The proposed model (GEO-SSA-ANFIS) intends to determine the appropriate parameters using the GEO-SSA algorithm because these parameters are considered the main component affecting the ANFIS forecasting process. The results of the intrusion detection based on the NSL-KDD dataset were better and more efficient compared with those models because the detection rate was 96.68% and the FAR result was 0.438%.

Nesting Circles: An Interactive Visualization Paradigm for Network Intrusion Detection System Alerts

Intrusion detection systems (IDSs) are valuable tools for fighting against those who want to intrude on the network and steal sensitive information for any reason. These tools, however, have difficulties in their essence. The generated alerts are in textual format, and extracting the exact information from the textual files needs lots of time and scrutiny. Also, not all alerts are accurate, and these tools suffer a setback named false-positive alerts, meaning that although no attack occurs, they may log some alerts. It is almost impossible to detect the penetration according to the discussed conditions. Information visualization is a method that transforms information into a visual representation for a better and quicker understanding. Indeed, the more the visualization is representative and straightforward, the more information it can transfer and the more worthy it is. This paper proposes a new paradigm for visualizing IDS alerts named nesting circles. We keep simplicity by using circles as the primary mark and the size and color as the only used channels. This makes the visualization easy to read and intuitive to understand. Furthermore, nesting circles provide a complete visualization of explicit and implicit information to the admin, and the previous approaches lacked this vital feature. The efficiency of nesting circles is examined through the VAST challenge case study, and it is shown to be effective in finding hidden attacks in the logs.

Optimizing efficiency of a custom clinical decision support tool improves adult congenital heart disease care

Study objectiveImprove the efficiency of an inpatient clinical decision support tool (CDS) for patients with adult congenital heart disease (ACHD). DesignThe efficiency of a CDS was evaluated across two time periods and compared. SettingAn academic, tertiary care center. ParticipantsACHD patients roomed in an inpatient setting. InterventionPlan-Do-Study-Act (PDSA) methods were applied starting in 2021 and included refinement of diagnostic codes and the addition of department encounter codes. Main outcome measuresTrue positive and false positive CDS alerts. ResultsBaseline data from 2017 had a median (IQR) of 38 (17) and 2019 baseline data had 65 (19) total alerts per month. Combining both baseline data years, the median true positive CDS alerts was 47.3 %. There were 71 (6) total alerts per month for the 2021–2022 time period and with ongoing PDSA cycles and optimization in the CDS the true positive alerts improved substantially resulting in a shifting of the median to 78.9 % within 9 months. ConclusionCDS can efficiently notify providers when an ACHD patient is encountered. The use of ICD 10 codes alone to identify ACHD patients has limited accuracy with a high proportion of false positives. Ongoing revision of the CDS system methods is important to improving efficiency and minimizing provider alert fatigue.

Early detection of fluid retention with a multisensory algorithm in chronic heart failure patients

Abstract Funding Acknowledgements Type of funding sources: Public hospital(s). Main funding source(s): Leiden University Medical Center Background Hospitalizations for decompensated heart failure are a marker for poor prognosis and pose a burden on patients and resources. The mainstay in preventing these hospitalizations is early detection of fluid retention and timely pharmacological intervention. The multisensory cardiac implantable electronic device (CIED) based HeartLogic™ algorithm can alert in case of upcoming congestion. The cumulative HeartLogic™ index is based on the following sensors: heart sounds, thoracic impedance, respiratory rate, night heart rate and patient activity levels. The current analysis investigates the performance of the HeartLogicTM algorithm in a real-world ambulant heart failure population. Methods All consecutive heart failure patients with a CIED and an activated HeartLogic™ algorithm were included for analysis. Patients were followed from 01-01-2018 until 01-09-2022 according to the heart failure care path (figure 1). HeartLogic™ automatically generated an alert if the index surpassed the preset threshold of 16. An alert was either true positive (≥2 signs/symptoms of fluid retention on top of the alert) or false positive (≤1 signs/symptoms). Without an alert a patient was true negative (≤1 signs/symptoms) or false negative (≥2 signs/symptoms). A logistic regression model with linear mixed models was used. Furthermore, patients with ≥2 true positive alerts and ≤1 false positive alerts per year were compared to patients without alerts to identify characteristics of patients who benefit most from the HeartLogic™ algorithm supported management. Results Data of 138 patients were included, median age was 69 [60 – 77], 78% was male and 50% had an ischemic etiology of heart failure. Majority of the patients had a CRT-D (n=90, 65%) and the remaining 48 patients had an ICD (35%). Total follow-up entailed of 297 patient years, median follow-up was 26 months [14 – 36]. During follow-up, 231 alerts were observed. After exclusion of 14 alerts (incomplete clinical information), 217 alerts were available for analysis. Majority of these alerts were true positive for fluid retention(n=161, 74%). Of interest, 21 of these alerts (13%) were not primarily heart failure related, but prompted clinical action (e.g. pneumonia or anemia). The remaining 59 (26%) alerts were deemed false positive. The sensitivity to detect impending fluid retention was 86%, the specificity 88%. The positive predictive value was 73% and the negative predictive value was 94%. Patients with HeartLogicTM alerts had a significantly higher baseline NT-Pro BNP, when compared to patients without alerts, p&amp;lt;0.05 (Figure 2). No differential response was observed based on age, gender or BMI. Conclusions In a real world heart failure population the HeartLogic™ algorithm supported care path adequately detects impending fluid retention. Patients who benefited most had higher levels of NT-Pro BNP at baseline.

PO-03-083 REAL-WORLD PERFORMANCE AND AGREEMENT RATES WITH HEALTHCARE PROFESSIONALS OF A NOVEL AI ALGORITHM RECLASSIFYING ILR EPISODES

The use of implantable Loop Recorders (ILRs) is increasing rapidly but generates a high workload, challenging timely adjudication of transmissions. This burden is aggravated by excessive false positive alerts. A novel artificial intelligence (AI)-based algorithm has been developed to reclassify ILR episodes aiming to decrease false positive rate by 80% while maintaining 99% sensitivity. To evaluate the performance of the algorithm in real-life conditions. 2,269 Medtronic Reveal LINQ ILR patients were enrolled from European medical centers from June to October 202. Using a cloud based remote monitoring platform, all episodes detected as “Abnormal” by ILRs were re-diagnosed by the AI algorithm. Healthcare professionals (HCPs) monitoring their patients on this platform could review the diagnosis indicated by the algorithm but, if necessary, attribute a new diagnosis to any episode. The positive predictive value (PPV) and negative predictive value (NPV) of the algorithm detecting “Abnormal” episodes were evaluated by comparing AI algorithm classification with healthcare professionals’ diagnoses, excluding uncertain diagnoses (artifact, lead noise, atrial and ventricular monitoring). Among 27,158 “Abnormal” LINQ episodes analyzed by the AI algorithm and checked by HCPs, 12,065 (44.4%) were diagnosed as “Normal Rhythm” by the algorithm. HCPs submitted a “certain” diagnosis on 2,683 of these episodes, among which 2,657 were “Normal Rhythm”, resulting in a NPV of 99.0%. The other 15,093 (55,6%) “Abnormal” diagnoses were confirmed by the AI algorithm. HCPs submitted a certain diagnosis on 2,351 of these episodes, among which 1,832 were “Abnormal”, resulting in a PPV of 77.9%. In this real-world study, the AI algorithm re-diagnosed 43.1% of LINQ detected episodes as “Normal Rhythm”. In addition, the AI algorithm showed good agreement rates with the HCPs reviewing the same episodes, with a 99.0% NPV and a 78.2% PPV.

A108 AUTOMATED DETECTION OF ILEOCECAL VALVE, APPENDICEAL ORIFICE, AND POLYP DURING COLONOSCOPY USING A DEEP LEARNING MODEL

Abstract Background Identification and photo-documentation of the ileocecal valve (ICV) and appendiceal orifice (AO) confirm completeness of colonoscopy examinations. We hypothesized that an artificial intelligence (AI)-empowered solution could help us automatically differentiate anatomical landmarks such as AO and ICV from polyps and normal colon mucosa. Purpose We aimed to develop and test a deep convolutional neural network (DCNN) model that can automatically identify ICV and AO, and differentiate these landmarks from normal mucosa and colorectal polyps. Method We prospectively collected annotated full-length colonoscopy videos of 318 patients undergoing outpatient colonoscopies. We created three non-overlapping training, validation, and test datasets with 25,444 unaltered frames extracted from the colonoscopy videos showing four landmarks/image classes (AO, ICV, normal mucosa, and polyps). For each landmark, we extracted an average of 30 frames for each time of its appearance. All the extracted frames were reviewed and annotated by a team of three clinicians. Using a quality assessment tool, the clinicians examined a total of 86,754 frames (7982 AO, 8374 ICV, 32,971 polyps, and 37,427 normal mucosa) and verified whether or not the frame contained one unique landmark. For this research, all frames were extracted from the white-light colonoscopies, and all narrow-band imaging frames were excluded. A DCNN classification model was developed, validated, and tested in separate datasets of images. The primary outcome was the proportion of patients in whom the AI model could identify both ICV and AO, and differentiate them from polyps and normal mucosa, with an accuracy of detecting both AO and ICV above a threshold of 40% (representing a value in which reliable identification of the landmarks can be assumed without increasing false-positive alerts). Result(s) We trained a DCNN AI model on 21,503 unaltered frames extracted from the recorded colonoscopy videos of 272 patients, and validated and tested the model on 1,924 (25 patients) and 2,017 (21 patients) unaltered frames, respectively. We applied a transfer learning technique to fine-tune the model parameters to the endoscopic images using a cross-entropy loss function and back-propagation algorithm. After training and validation, the DCNN model could identify both AO and ICV in 18 out of 21 patients (85.71%), if accuracies were above the threshold of 40%. The accuracy of the model for differentiating AO from normal mucosa, and ICV from normal mucosa were 86.37% (95% CI 84.06% to 88.45%), and 86.44% (95% CI 84.06% to 88.59%), respectively. Furthermore, the accuracy of the model for differentiating polyps from normal mucosa was 88.57% (95% CI 86.60% to 90.33%). Conclusion(s) The model can reliably distinguish these anatomical landmarks from normal mucosa and colorectal polyps. It can be implemented into automated colonoscopy report generation, photo-documentation, and quality auditing solutions to improve colonoscopy reporting quality. Please acknowledge all funding agencies by checking the applicable boxes below Other Please indicate your source of funding; MEDTEQ Disclosure of Interest M. Taghiakbari: None Declared, S. Hamidi Ghalehjegh Employee of: Imagia Canexia Health Inc. , E. Jehanno Employee of: Imagia Canexia Health Inc. , T. Berthier Employee of: Imagia Canexia Health Inc. , L. di Jorio Employee of: Imagia Canexia Health Inc. , A. N. Barkun Grant / Research support from: co-awardee in funded research projects with Imagia Canexia Health Inc., Consultant of: Medtronic Inc. and A.I. VALI Inc, E. Deslandres: None Declared, S. Bouchard: None Declared, S. Sidani: None Declared, Y. Bengio: None Declared, D. von Renteln Grant / Research support from: ERBE, Ventage, Pendopharm, and Pentax, Consultant of: Boston Scientific and Pendopharm