False Positive Alerts Research Articles

Privacy-Preserving, Thermal Vision With Human in the Loop Fall Detection Alert System

To support the independent living of older adults in their own homes, it is essential to identify their abnormal behaviors before triggering an automated alert system. Existing normal vision sensing approaches to detect human falls in the activities of daily living (ADL) experienced acceptability issues due to outstanding privacy concerns when they are deployed in personal environments. Besides, false alerts (false-positive) fall detection has not been addressed thoroughly in systems that report abnormal human behaviors as emergency alerts to the information support. This article proposes a novel human-in-the-loop fall detection approach in the ADLs using a low-resolution thermal sensor array. The motivation for enabling a human interactive model, fall detection confirmation, is to influence resource efficiency by reducing false-positive alerts while keeping the false-negative fall predictions as low as possible. The proposed approach is based on the motion sequence classification of human movements using a recurrent neural network. The proposed approach is evaluated with comprehensive experiments using different learning techniques, users, and domestic environment conditions. This article shows a performance accuracy of 99.7% to detect human falls from various typical ADLs.

Association Rule Mining Frequent-Pattern-Based Intrusion Detection in Network

In the network security system, intrusion detection plays a significant role. The network security system detects the malicious actions in the network and also conforms the availability, integrity and confidentiality of data information resources. Intrusion identification system can easily detect the false positive alerts. If large number of false positive alerts are created then it makes intrusion detection system as difficult to differentiate the false positive alerts from genuine attacks. Many research works have been done. The issues in the existing algorithms are more memory space and need more time to execute the transactions of records. This paper proposes a novel framework of network security Intrusion Detection System (IDS) using Modified Frequent Pattern (MFP-Tree) via K-means algorithm. The accuracy rate of Modified Frequent Pattern Tree (MFPT)-K means method in finding the various attacks are Normal 94.89%, for DoS based attack 98.34%, for User to Root (U2R) attacks got 96.73%, Remote to Local (R2L) got 95.89% and Probe attack got 92.67% and is optimal when it is compared with other existing algorithms of K-Means and APRIORI.

Strategic reprogramming of implantable cardiac monitors reduces the false-positive remote alert burden in a nurse-led service.

Implantable cardiac monitors (ICMs) can generate false-positive (FP) alerts. Although these devices have an extended programmability, there are no recommendations on their optimization to reduce not-relevant activations.We tested a strategic programming optimization guide based on the type of FP and investigated the safety and feasibility of the nurse-led insertion of ICMs with a long-sensing vector. Consecutive patients implanted by trained nurses with long-sensing vector ICM were enrolled in a 1-month observational stage (Phase A). Patients who had ≥10 FP episodes underwent ICM reprogramming based on the predefined guide and were followed for an additional month (Phase B). A total of 78 patients had successful ICM insertion by nurses with a mean R wave amplitude of 0.96 ± 0.43 mV and an 86% P wave visibility. Only one patient reported a significant device-related issue, and nurse-delivered ICM was generally well accepted by the patients. During Phase A, 11 patients (14%) generated most of FP (3,627/3,849; 94%) and underwent ICM reprogramming. In the following month (Phase B), five patients (45%) were free from FP and six (55%) transmitted 57 FP alerts (98% reduction compared with Phase A). The median number of FP per patient was significantly reduced after reprogramming [195 (interquartile range, 50-311) vs. one (0-10), P = 0.0002]. A strategic reprogramming of ICM in those patients with a high FP alert burden reduces the volume of erroneous activations with potential benefits for the remote monitoring service. No concerns were raised regarding nurse-led insertion of ICMs with a long-sensing vector.

Implementation of an Automated Radiation Oncology Prescription Checking System, Revealing a Baseline Prescription Error Rate of at Least 0.2%

<h3>Purpose/Objective(s)</h3> Radiation dose prescriptions serve as the radiation oncologist's (RO) treatment intent, containing vital information such as treatment technique, total dose, dose per fraction, and number of fractions. Despite serving as a critical communication tool, prescriptions are entered manually and prone to various forms of error. Human systems and traditional safety checks may not catch these, due to assumption of RO intent and deference to ROs. This can lead to significant wasted treatment planning resources and, if not ultimately caught, can lead to misadministration. In response to the potential for erroneous prescription entry, an automated prescription checking system was designed and implemented. <h3>Materials/Methods</h3> Rules defining clinically appropriate prescriptions were generated, examining specific types of errors: 1) Approved dose per fraction. This was based on review of 14,487 prescriptions written in 2019-2020, divided into 17 disease sites, and manually curated by disease site experts for approved doses per fraction per site. 2) Dose per fraction too large for non-stereotactic treatment technique. 3) Dose per fraction too low (in dose painting prescriptions). With a goal of catching errors as far upstream as possible to minimize their propagation, a report was created and run every 30 minutes, checking all newly written prescriptions against the above rules. When prescriptions did not fall within the bounds of the rules, an automated email was sent to the prescriber alerting them of the atypical prescription and prompting them to check if it was written as intended. The rules were continuously analyzed in an attempt at balancing error detection against false positive alerts. <h3>Results</h3> From June-December 2021, 9,577 prescriptions were checked, and 70 email alerts were triggered, for an average alert rate of 0.7%. Of the 70 alerts, 60 (85.7%) were unapproved doses per fraction, 8 (11.4%) were doses too large for non-stereotactic treatment technique, and 2 (2.9%) were doses that were too low. The alert rate was 1.1% in June and trended down to 0.6% in December. Of the 70 alerts, 23 (32.9%) prescriptions were subsequently amended suggesting that the rate of erroneous prescription entry was 0.2% (23/9,577). <h3>Conclusion</h3> A baseline error rate of radiation oncology prescription entry has not been previously reported. This data suggests that the rate of erroneous prescription entry is at least 0.2%. Given the significant consequences of erroneous prescription entry, ranging from wasted resources and treatment delays (should these errors be caught prior to treatment), to potentially serious misadministration, there is significant value in implementing automated prescription checking systems in radiation oncology clinics.

The Predictive Value of False-Positive ForeseeHome Alerts in the ALOFT Study

False positive ForeseeHome alerts of fellow eyes to nAMD are at highest conversion risk. This can inform the follow-up plan, especially with long inter-visit periods and qualify candidates for prophylactic treatments studies.

Utility of Intraoperative Neurophysiologic Monitoring in Routine Anterior Cervical Spine Surgery

Introduction: Intraoperative neurophysiologic monitoring (IOM) is commonly used in spine surgery; advantages include identification of intraoperative neurologic decline that may be related to a remediable cause. Disadvantages include increased time and cost, morbidity associated with the monitoring procedure, and the potential for false positive alerts prompting unnecessary action. The study’s goal was to assess whether use of IOM in routine, uncomplicated cases of anterior cervical discectomy and fusion (ACDF) surgery was of demonstrable benefit. Methods: 50 consecutive patients were identified who underwent one-level ACDF with anterior instrumentation for cervical disc herniation with radiculopathy without myelopathy. For all cases, a NIMS tube was used to monitor laryngeal nerve function, and EMG, SSEP, and MEP modalities were monitored. Hospital and postoperative records were investigated for the presence of IOM alerts, whether corrective action was taken during surgery, and the presence of any postoperative neurologic deficits. Results: In all cases, there were no alerts of laryngeal nerve dysfunction, or SSEP/ MEP abnormality. In 12 cases, transient EMG irritation activity was documented; in no cases was there any change to the surgical procedure, such as abandonment of surgery, removal of implant, etc. There were no instances of new or worsened postoperative neurologic deficit, and clinical findings of vocal cord dysfunction. Conclusion: In ACDF with anterior instrumentation for cervical disc herniation with radiculopathy without myelopathy, IOM use did not convey any identifiable advantage. Therefore, the data does not support considering IOM to be required or standard of care for routine, uncomplicated ACDF surgery.

CYBER SECURITY DETECTION USING ANN

One of the major challenges in cyber security is the provision of an automated and effective cyber-threats detection technique. We present an AI technique for cyber-threats detection, based on artificial neural networks. The proposed technique converts multitude of collected security events to individual event profiles and use a deep learning-based detection method for enhanced cyberthreat detection. For this work, we developed an AI-SIEM system based on a combination of event profiling for data preprocessing and different artificial neural network methods, including FCNN, CNN, and LSTM. The system focuses on discriminating between true positive and false positive alerts, thus helping security analysts to rapidly respond to cyber threats. All experiments in this study are performed by authors using two benchmark datasets (NSLKDD and CICIDS2017) and two datasets collected in the real world. To evaluate the performance comparison with existing methods, we conducted experiments using the five conventional machine-learning methods (SVM, k- NN, RF, NB, and DT). Consequently, the experimental results of this study ensure that our proposed methods are capable of being employed as learning-based models for network intrusion-detection, and show that although it is employed in the real world, the performance outperforms the conventional machine-learning methods.

CGR-CUSUM: a continuous time generalized rapid response cumulative sum chart.

Rapidly detecting problems in the quality of care is of utmost importance for the well-being of patients. Without proper inspection schemes, such problems can go undetected for years. Cumulative sum (CUSUM) charts have proven to be useful for quality control, yet available methodology for survival outcomes is limited. The few available continuous time inspection charts usually require the researcher to specify an expected increase in the failure rate in advance, thereby requiring prior knowledge about the problem at hand. Misspecifying parameters can lead to false positive alerts and large detection delays. To solve this problem, we take a more general approach to derive the new Continuous time Generalized Rapid response CUSUM (CGR-CUSUM) chart. We find an expression for the approximate average run length (average time to detection) and illustrate the possible gain in detection speed by using the CGR-CUSUM over other commonly used monitoring schemes on a real-life data set from the Dutch Arthroplasty Register as well as in simulation studies. Besides the inspection of medical procedures, the CGR-CUSUM can also be used for other real-time inspection schemes such as industrial production lines and quality control of services.

A NOVEL AI ALGORITHM APPLIED TO ILR TRANSMISSIONS: PERFORMANCE AND AGREEMENT RATES WITH HEALTHCARE PROFESSIONALS

BackgroundThe use of implantable Loop Recorders (ILRs) is increasing rapidly but generates a high workload for timely adjudication of transmissions. This burden is aggravated by excessive false positive alerts. We developed a novel artificial intelligence (AI)-based algorithm to reclassify ILR episodes aiming to decrease False Positive rate by 80% while maintaining 99% sensitivity.ObjectiveTo evaluate the performance of the algorithm in real-life conditions.MethodsMedtronic Reveal LINQ ILR patients were enrolled from 40 European medical centers. Using a cloud based remote monitoring platform, all episodes detected as “Abnormal” by ILRs were re-diagnosed by the AI algorithm. Healthcare professionals (HCPs) monitoring their patients on this platform could review the diagnosis suggested by the algorithm and then attribute a new diagnosis to any episode. The positive predictive value (PPV) and negative predictive value (NPV) of the algorithm detecting “Abnormal” episodes were evaluated with healthcare professionals’ diagnoses, excluding uncertain diagnoses (artifact, lead noise, atrial and ventricular monitoring).ResultsAmong 10,296 “Abnormal” LINQ episodes analyzed by the AI algorithm and checked by HCPs, 4,442 (43.1%) were diagnosed as “Normal Rhythm” by the algorithm. HCPs submitted a certain diagnosis on 772 of these episodes, among which 750 were “Normal Rhythm”, resulting in a NPV of 97.1%. The other 5,854 (56.9%) “Abnormal” diagnoses were confirmed by the AI algorithm. HCPs submitted a certain diagnosis on 834 of these episodes, among which 773 were “Abnormal”, resulting in a PPV of 92.7%.Conclusion BackgroundThe use of implantable Loop Recorders (ILRs) is increasing rapidly but generates a high workload for timely adjudication of transmissions. This burden is aggravated by excessive false positive alerts. We developed a novel artificial intelligence (AI)-based algorithm to reclassify ILR episodes aiming to decrease False Positive rate by 80% while maintaining 99% sensitivity. The use of implantable Loop Recorders (ILRs) is increasing rapidly but generates a high workload for timely adjudication of transmissions. This burden is aggravated by excessive false positive alerts. We developed a novel artificial intelligence (AI)-based algorithm to reclassify ILR episodes aiming to decrease False Positive rate by 80% while maintaining 99% sensitivity. ObjectiveTo evaluate the performance of the algorithm in real-life conditions. To evaluate the performance of the algorithm in real-life conditions. MethodsMedtronic Reveal LINQ ILR patients were enrolled from 40 European medical centers. Using a cloud based remote monitoring platform, all episodes detected as “Abnormal” by ILRs were re-diagnosed by the AI algorithm. Healthcare professionals (HCPs) monitoring their patients on this platform could review the diagnosis suggested by the algorithm and then attribute a new diagnosis to any episode. The positive predictive value (PPV) and negative predictive value (NPV) of the algorithm detecting “Abnormal” episodes were evaluated with healthcare professionals’ diagnoses, excluding uncertain diagnoses (artifact, lead noise, atrial and ventricular monitoring). Medtronic Reveal LINQ ILR patients were enrolled from 40 European medical centers. Using a cloud based remote monitoring platform, all episodes detected as “Abnormal” by ILRs were re-diagnosed by the AI algorithm. Healthcare professionals (HCPs) monitoring their patients on this platform could review the diagnosis suggested by the algorithm and then attribute a new diagnosis to any episode. The positive predictive value (PPV) and negative predictive value (NPV) of the algorithm detecting “Abnormal” episodes were evaluated with healthcare professionals’ diagnoses, excluding uncertain diagnoses (artifact, lead noise, atrial and ventricular monitoring). ResultsAmong 10,296 “Abnormal” LINQ episodes analyzed by the AI algorithm and checked by HCPs, 4,442 (43.1%) were diagnosed as “Normal Rhythm” by the algorithm. HCPs submitted a certain diagnosis on 772 of these episodes, among which 750 were “Normal Rhythm”, resulting in a NPV of 97.1%. The other 5,854 (56.9%) “Abnormal” diagnoses were confirmed by the AI algorithm. HCPs submitted a certain diagnosis on 834 of these episodes, among which 773 were “Abnormal”, resulting in a PPV of 92.7%. Among 10,296 “Abnormal” LINQ episodes analyzed by the AI algorithm and checked by HCPs, 4,442 (43.1%) were diagnosed as “Normal Rhythm” by the algorithm. HCPs submitted a certain diagnosis on 772 of these episodes, among which 750 were “Normal Rhythm”, resulting in a NPV of 97.1%. The other 5,854 (56.9%) “Abnormal” diagnoses were confirmed by the AI algorithm. HCPs submitted a certain diagnosis on 834 of these episodes, among which 773 were “Abnormal”, resulting in a PPV of 92.7%. Conclusion

Improved Detection and Response via Optimized Alerts: Usability Study

Security analysts working in the modern threat landscape face excessive events and alerts, a high volume of false-positive alerts, significant time constraints, innovative adversaries, and a staggering volume of unstructured data. Organizations thus risk data breach, loss of valuable human resources, reputational damage, and impact to revenue when excessive security alert volume and a lack of fidelity degrade detection services. This study examined tactics to reduce security data fatigue, increase detection accuracy, and enhance security analysts’ experience using security alert output generated via data science and machine learning models. The research determined if security analysts utilizing this security alert data perceive a statistically significant difference in usability between security alert output that is visualized versus that which is text-based. Security analysts benefit two-fold: the efficiency of results derived at scale via ML models, with the additional benefit of quality alert results derived from these same models. This quantitative, quasi-experimental, explanatory study conveys survey research performed to understand security analysts’ perceptions via the Technology Acceptance Model. The population studied was security analysts working in a defender capacity, analyzing security monitoring data and alerts. The more specific sample was security analysts and managers in Security Operation Center (SOC), Digital Forensic and Incident Response (DFIR), Detection and Response Team (DART), and Threat Intelligence (TI) roles. Data analysis indicated a significant difference in security analysts’ perception of usability in favor of visualized alert output over text alert output. The study’s results showed how organizations can more effectively combat external threats by emphasizing visual rather than textual alerts.

A Systematic Review on Hybrid Intrusion Detection System

As computer networks keep growing at a high rate, achieving confidentiality, integrity, and availability of the information system is essential. Intrusion detection systems (IDSs) have been widely used to monitor and secure networks. The two major limitations facing existing intrusion detection systems are high rates of false-positive alerts and low detection rates on zero-day attacks. To overcome these problems, we need intrusion detection techniques that can learn and effectively detect intrusions. Hybrid methods based on machine learning techniques have been proposed by different researchers. These methods take advantage of the single detection methods and leverage their weakness. Therefore, this paper reviews 111 related studies in the period between 2012 and 2022 focusing on hybrid detection systems. The review points out the existing gaps in the development of hybrid intrusion detection systems and the need for further research in this area.

Performance of a HeartLogicTM Based Care Path in the Management of a Real-World Chronic Heart Failure Population

AimEarly detection of impending fluid retention and timely adjustment of (medical) therapy can prevent heart failure related hospitalizations. The multisensory cardiac implantable electronic device (CIED) based algorithm HeartLogicTM aims to alert in case of impending fluid retention. The aim of the current analysis is to evaluate the performance of the HeartLogicTM guided heart failure care path in a real-world heart failure population and to investigate whether the height of the index and the duration of the alert state are indicative of the degree of fluid retention.MethodsConsecutive adult heart failure patients with a CIED and an activated HeartLogicTM algorithm were eligible for inclusion. Patients were followed up according to the hospital's heart failure care path. The device technician reviewed alerts for a technical CIED checkup. Afterwards, the heart failure nurse contacted the patient to identify impending fluid retention. An alert was either true positive or false positive. Without an alert a patient was true negative or false negative.ResultsAmong 107 patients, [82 male, 70 (IQR 60–77) years, left ventricular ejection fraction 37 ± 11%] 130 HeartLogicTM alerts were available for analysis. Median follow up was 14 months [IQR 8–23]. The sensitivity to detect impending fluid retention was 79%, the specificity 88%. The positive predictive was value 71% and the negative predictive value 91%. The unexplained alert rate was 0.23 alerts/patient year and the false negative rate 0.17 alerts/patient year. True positive alerts [42 days (IQR 28–63)] lasted longer than false positive alerts [28 days (IQR 21–44)], p = 0.02. The maximal HeartLogicTM index was higher in true positive alerts [26 (IQR 21–34)] compared to false positive alerts [19 (IQR 17–24)], p < 0.01. Patients with higher HeartLogicTM indexes required more intense treatment (index height in outpatient setting 25 [IQR 20–32], day clinic treatment 28 [IQR 24–36] and hospitalized patients 45 [IQR 35–58], respectively), p < 0.01.ConclusionThe CIED-based HeartLogicTM algorithm facilitates early detection of impending fluid retention and thereby enables clinical action to prevent this at early stage. The current analysis illustrates that higher and persistent alerts are indicative for true positive alerts and higher index values are indicative for more severe fluid retention.

PO-648-03 MEASURE THRICE, CUT ONCE: MAPPING FOR ILR IMPLANT

The implantable loop recorder (ILR) is a subcutaneous device used for long-term cardiac monitoring. The CRYSTAL-AF and RAST studies both demonstrated that early implantation with ILR was more likely to provide a diagnosis compared to the conventional strategies. However, the real-world diagnostic yield is currently suboptimal with false positive alerts as high as 58%.

Programming Optimization in Implantable Cardiac Monitors to Reduce False-Positive Arrhythmia Alerts: A Call for Research.

No studies have investigated whether optimizing implantable cardiac monitors (ICM) programming can reduce false-positive (FP) alerts. We identified patients implanted with an ICM (BIOMONITOR III) who had more than 10 FP alerts in a 1-month retrospective period. Uniform adjustments of settings were performed based on the mechanism of FP triggers and assessed at 1 month. Eight patients (mean age 57.5 ± 23.2 years; 37% female) were enrolled. In 4 patients, FPs were caused by undersensing of low-amplitude premature ventricular contractions (PVCs). No further false bradycardia was observed with a more aggressive decay of the dynamic sensing threshold. Furthermore, false atrial fibrillation (AF) alerts decreased in 2 of 3 patients. Two patients had undersensing of R waves after high-amplitude PVCs; false bradycardia episodes disappeared or were significantly reduced by limiting the initial value of the sensing threshold. Finally, the presence of atrial ectopic activity or irregular sinus rhythm generated false alerts of AF in 2 patients that were reduced by increasing the R-R variability limit and the confirmation time. In conclusion, adjustments to nominal settings can reduce the number of FP episodes in ICM patients. More research is needed to provide practical recommendations and assess the value of extended ICM programmability.

A recurrent neural network for rapid detection of delivery errors during real-time portal dosimetry.

Real-time portal dosimetry compares measured images with predicted images to detect delivery errors as the radiotherapy treatment proceeds. This work aimed to investigate the performance of a recurrent neural network for processing image metrics so as to detect delivery errors as early as possible in the treatment. Volumetric modulated arc therapy (VMAT) plans of six prostate patients were used to generate sequences of predicted portal images. Errors were introduced into the treatment plans and the modified plans were delivered to a water-equivalent phantom. Four different metrics were used to detect errors. These metrics were applied to a threshold-based method to detect the errors as soon as possible during the delivery, and also to a recurrent neural network consisting of four layers. A leave-two-out approach was used to set thresholds and train the neural network then test the resulting systems. When using a combination of metrics in conjunction with optimal thresholds, the median segment index at which the errors were detected was 107 out of 180. When using the neural network, the median segment index for error detection was 66 out of 180, with no false positives. The neural network reduced the rate of false negative results from 0.36 to 0.24. The recurrent neural network allowed the detection of errors around 30% earlier than when using conventional threshold techniques. By appropriate training of the network, false positive alerts could be prevented, thereby avoiding unnecessary disruption to the patient workflow.

An enhanced classification framework for intrusions detection system using intelligent exoplanet atmospheric retrieval algorithm

Currently, many companies use data mining for various implementations. One form of implementation is intrusion detection system (IDS). In IDS, the main problem for nuisance network administrators in detecting attacks is false alerts. Regardless of the methods implemented by this system, eliminating false alerts is still a huge problem. To describe data traffic passing through the network, a database of the network security layer (NSL) knowledge discovery in database (KDD) dataset is used. The massive traffic of data sent over the network contains excessive and duplicated amounts of information. This causes the classifier to be biased, reduce classification accuracy, and increase false alert. To that end, we proposed a model that significantly improve the accuracy of the intrusion detection system by eliminating false alerts, whether they are false negative or false positive negative alerts. The results show that the proposed intelligent exoplanet atmospheric retrieval (INARA) algorithm has improved accuracy and is able to detect new attack types efficiently.

Clinical performance of implantable cardioverter-defibrillator lead monitoring diagnostics.

Implantable cardioverter-defibrillator (ICD) lead monitoring diagnostic alerts facilitate the diagnosis of structural lead failure. The purpose of this study was to prospectively study the performance of Medtronic ICD lead monitoring alerts. A prespecified ancillary substudy, World-Wide Randomized Antibiotic Envelope Infection Prevention Trial, was conducted in patients with an ICD with all available alerts enabled. The investigators reported possible lead system events (LSEs), with or without an alert. An independent committee reviewed all data and classified events as lead failure, other LSE, or nonlead system events (NLEs). In 4942 patients who were followed for 19.4 ± 8.7 months, there were 124 alerts (65 LSEs, 59 NLEs) and 19 LSEs without an alert. Lead monitoring alerts had 100% sensitivity for the 48 adjudicated lead failures (95% confidence interval 92.6%-100%) and for 10 events adjudicated as either lead failure or connection issue. The positive predictive value of alerts forlead failure was 38.7% (48 of 124). For 34 pace-sense lead failures,an alert that incorporated oversensing was more sensitivethan thepacing impedance threshold alert (33 patients [97.1%] vs 9 patients[26.5%]; P < .0001). However, the sensitivity was only 13.6% for lead dislodgments or perforations. Inappropriate shocksoccurred in 2 patients with pace-sense lead failure (5.9%). No patient had unnecessary lead replacement for any of the NLEs. In this first real-world prospective study, lead monitoring alerts had 100% sensitivity for identifying lead failures. Although their positive predictive value was modest, no false-positive alerts resulted in an unnecessary lead replacement. For the diagnosis of pace-sense lead failure, an alert for oversensing was more sensitive than a pacing impedance threshold alert. ClinicalTrials.gov identifier: NCT02277990.

Overall performance of a drug\u2013drug interaction clinical decision support system: quantitative evaluation and end-user survey

BackgroundClinical decision support systems are implemented in many hospitals to prevent medication errors and associated harm. They are however associated with a high burden of false positive alerts and alert fatigue. The aim of this study was to evaluate a drug–drug interaction (DDI) clinical decision support system in terms of its performance, uptake and user satisfaction and to identify barriers and opportunities for improvement.MethodsA quantitative evaluation and end-user survey were performed in a large teaching hospital. First, very severe DDI alerts generated between 2019 and 2021 were evaluated retrospectively. Data collection comprised alert burden, override rates, the number of alert overrides reviewed by pharmacists and the resulting pharmacist recommendations as well as their acceptance rate. Second, an e-survey was carried out among prescribers to assess satisfaction, usefulness and relevance of DDI alerts as well as reasons for overriding.ResultsA total of 38,409 very severe DDI alerts were generated, of which 88.2% were overridden by the prescriber. In 3.2% of reviewed overrides, a recommendation by the pharmacist was provided, of which 79.2% was accepted. False positive alerts were caused by a too broad screening interval and lack of incorporation of patient-specific characteristics, such as QTc values. Co-prescribing of a non-vitamin K oral anticoagulant and a low molecular weight heparin accounted for 49.8% of alerts, of which 92.2% were overridden. In 88 (1.1%) of these overridden alerts, concurrent therapy was still present. Despite the high override rate, the e-survey revealed that the DDI clinical decision support system was found useful by prescribers.ConclusionsIdentified barriers were the lack of DDI-specific screening intervals and inclusion of patient-specific characteristics, both leading to a high number of false positive alerts and risk for alert fatigue. Despite these barriers, the added value of the DDI clinical decision support system was recognized by prescribers. Hence, integration of DDI-specific screening intervals and patient-specific characteristics is warranted to improve the performance of the DDI software.

Bridging the Last-Mile Gap in Network Security via Generating Intrusion-Specific Detection Patterns through Machine Learning

With successful machine learning applications in many fields, researchers tried to introduce machine learning into intrusion detection systems for building classification models. Although experimental results showed that these classification models could produce higher accuracy in predicting network attacks on the offline datasets, compared with the operational intrusion detection systems, machine learning is rarely deployed in the real intrusion detection environment. This is what we call the last mile problem with the machine learning approach to network intrusion detection, the discrepancy between the strength and requirements of machine learning and network operational semantics. In this paper, we aim to bridge the aforementioned gap. In particular, an LCC-RF-RFEX feature selection approach is proposed to select optimal features of the specific type of attacks from dataset, and then, an intrusion-specific approach is introduced to convert them into detection patterns that can be used by the nonmachine-learning detector for the corresponding specific attack detection in the real-world network environment. To substantiate our approach, we take Snort, KDDCup’99 dataset, and Dos attacks as the experimental subjects to demonstrate how to close the last-mile gap. For the specific type of Dos attacks in the KDDCup’99 dataset, we use the LCC-RF-RFEX method to select optimal feature subset and utilize our intrusion-specific approach to generate new rules in Snort by using them. Comparing performance differences between the existing Snort rule set and our augmented Snort rule set with regard to Dos attacks, the experimental results showed that our approach expanded Snort’s detection capability of Dos attacks, on average, reduced up to 25.28% false-positive alerts for Teardrop attacks and Synflood attacks, and decreased up to 98.87% excessive alerts for Mail bomb attacks.

Cyber threat intelligence using PCA-DNN model to detect abnormal network behavior

Security issues are the most critical challenges facing new technologies associated with the internet of things (IoT), big data, and cloud computing. A secure and efficient intrusion detection system (IDS) is crucial to detect security threats. Existing IDSs are known to suffer from many problems, most notably the high rate of false positive alerts, the long time required to detect attacks, and the inability to detect zero-day attacks, which can ruin companies. The weakness of IDS backend engines costs companies time in the investigation process. This paper proposes and enhances IDS detection mechanisms via two processes: using a deep neural network (DNN) model with new features for threat detection based on two assumptions related to handling zero-day attacks, with low computing power and resources, and a comprehensive solution for detection by merging the DNN model and principle component analysis (PCA) to increase security and performance. The proposed detection mechanism combines DNN, PCA, statistical, and knowledge-based approaches to offer significantly greater efficiency than existing IDS, as indicated by analytical and software results. A simulation model is used with up-to-date web attacks, distributed denial of service (DDoS), denial of service (DoS), brute force, insider infiltration, Botnet, and Heartbleed attacks. The proposed detection techniques for large networks are analyzed and complexity in the design is avoided by reducing the number of DNN model layers, thus minimizing detection time delay and false positives, while increasing security against network attacks. Integrating the proposed DNN with PCA, an innovative contribution, introduces robust IDS to significantly improve the detection time delay and security performance. The proposed model showed a 98% accuracy rate. To best of our knowledge, the highest accuracy rate stated based on a large number of attacks is 97%, which makes our model state of art.