Low False Positive Rate Research Articles

VEAD: Variance profile Exploitation for Anomaly Detection in real-time IoT data streaming

The explosion of online streaming services in the Internet-of-Things (IoT) ecosystem poses new difficulties in detecting anomalies in real-time and continuous data. The IoT data anomalies are classified into long-term and short-term, with unique characteristics that make it difficult to develop a common detection mechanism for both. The existing techniques require excessive training data and suffer from high variability. This paper overcomes these challenges by proposing a Variance profile Exploitation for Anomaly Detection (VEAD) scheme using discrete wavelet transform and k-means clustering. VEAD is initialized by a fast training phase with a single data segment, from which a sensor variance profile is created. This variance profile reflects the degree of deviation in the collected data from different sensors at a specific time period and is continuously updated by integrating new data segments for effective anomaly detection. Overlapping data collection in the detection phase shows correlations among consecutive data segments, leading to improved detection accuracy (ACC). The Intel Berkeley Research Lab dataset with injected synthetic anomalies is used to perform numerical experiments. A comparative performance evaluation with state-of-the-art methods confirms the effectiveness of VEAD in achieving a higher ACC and a lower false-positive rate (FPR). Notably, 95% and 97% ACCs are achieved in detecting long-term and short-term anomalies, respectively. The high specificity of VEAD is also revealed by the low FPR of at most 2% in all cases. The low computational complexity and fast anomaly detection make VEAD suitable for deployment in live systems with massive data streams.

Pilot study of lung cancer screening for survivors of Hodgkin lymphoma.

Hodgkin lymphoma (HL) treatment increases the risk of lung cancer. Most HL survivors are not eligible for lung cancer screening (LCS) programs developed for the general population, and the utility of these programs has not been tested in HL survivors. We ran a LCS pilot in HL survivors to describe screening uptake, participant characteristics, impact of a decision aid and screen findings. HL survivors treated ≥5 years ago with mustine/procarbazine and/or thoracic radiation, were identified from a follow-up database and invited to participate. Participants underwent a low-dose computed tomography (LDCT) reported using protocols validated for the general population. Two hundred and eighteen individuals were invited, 123 were eligible, 102 were screened (58% response rate): 58% female, median age 52 years, median 22 years since HL treatment; 91.4% were deemed to have made an informed decision; participation was not influenced by age, sex, years since treatment or deprivation. Only three of 35 ever-smokers met criteria for LCS through the program aimed at the general population. Baseline LDCT results were: 90 (88.2%) negative, ten (9.8%) indeterminate, two (2.0%) positive. Two 3-month surveillance scans were positive. Of four positive scans, two patients were diagnosed with small-cell lung cancer; one underwent curative surgery. Coronary artery calcification was detected in 36.3%, and clinically significant incidental findings in 2.9%. LDCT protocols validated in ever-smokers can detect asymptomatic early-stage lung cancers in HL survivors. This finding, together with screening uptake and low false positive rates, supports further research to implement LCS for HL survivors (clinicaltrials gov. Identifier: NCT04986189.).

Treatment of Accounting Changes and Covenant Violation Errors

ABSTRACTGAAP provisions in loan contracts specify how to address the effect of accounting changes on financial covenants. I document a pronounced upward trend in and the dominance of frozen‐on‐request (FOR) GAAP provisions, which incorporate accounting changes unless either the borrower or the lender requests a freeze. FOR GAAP streamlines the process of incorporating accounting changes into covenant calculations by obviating the need for renegotiations and prevents opportunistic GAAP freezes by requiring good faith renegotiations. Therefore, FOR GAAP is more likely to incorporate accounting changes beneficial to covenant informativeness, leading to lower false positives (i.e., Type I errors of financial covenant violations) and false negatives (i.e., Type II errors of financial covenant violations). Based on a large sample of loan contracts, I find that FOR GAAP decreases false positives and false negatives after controlling for self‐selection bias and that the decrease is more pronounced when accounting changes relevant to financial covenants are more significant. My study provides new evidence of the role accounting standards and GAAP provisions play in debt contracting efficiency.

Improved discovery of RNA-binding protein binding sites in eCLIP data using DEWSeq.

Enhanced crosslinking and immunoprecipitation (eCLIP) sequencing is a method for transcriptome-wide detection of binding sites of RNA-binding proteins (RBPs). However, identified crosslink sites can deviate from experimentally established functional elements of even well-studied RBPs. Current peak-calling strategies result in low replication and high false positive rates. Here, we present the R/Bioconductor package DEWSeq that makes use of replicate information and size-matched input controls. We benchmarked DEWSeq on 107 RBPs for which both eCLIP data and RNA sequence motifs are available and were able to more than double the number of motif-containing binding regions relative to standard eCLIP processing. The improvement not only relates to the number of binding sites (3.1-fold with known motifs for RBFOX2), but also their subcellular localization (1.9-fold of mitochondrial genes for FASTKD2) and structural targets (2.2-fold increase of stem-loop regions for SLBP. On several orthogonal CLIP-seq datasets, DEWSeq recovers a larger number of motif-containing binding sites (3.3-fold). DEWSeq is a well-documented R/Bioconductor package, scalable to adequate numbers of replicates, and tends to substantially increase the proportion and total number of RBP binding sites containing biologically relevant features.

Open-set face recognition with maximal entropy and Objectosphere loss

Open-set face recognition characterizes a scenario where unknown individuals, unseen during the training and enrollment stages, appear on operation time. This work concentrates on watchlists, an open-set task that is expected to operate at a low false-positive identification rate and generally includes only a few enrollment samples per identity. We introduce a compact adapter network that benefits from additional negative face images when combined with distinct cost functions, such as Objectosphere Loss (OS) and the proposed Maximal Entropy Loss (MEL). MEL modifies the traditional Cross-Entropy loss in favor of increasing the entropy for negative samples and attaches a penalty to known target classes in pursuance of gallery specialization. The proposed approach adopts pre-trained deep neural networks (DNNs) for face recognition as feature extractors. Then, the adapter network takes deep feature representations and acts as a substitute for the output layer of the pre-trained DNN in exchange for an agile domain adaptation. Promising results have been achieved following open-set protocols for three different datasets: LFW, IJB-C, and UCCS as well as state-of-the-art performance when supplementary negative data is properly selected to fine-tune the adapter network.

Emerging infectious disease surveillance using a hierarchical diagnosis model and the Knox algorithm

Emerging infectious diseases are a critical public health challenge in the twenty-first century. The recent proliferation of such diseases has raised major social and economic concerns. Therefore, early detection of emerging infectious diseases is essential. Subjects from five medical institutions in Beijing, China, which met the spatial-specific requirements, were analyzed. A quality control process was used to select 37,422 medical records of infectious diseases and 56,133 cases of non-infectious diseases. An emerging infectious disease detection model (EIDDM), a two-layer model that divides the problem into two sub-problems, i.e., whether a case is an infectious disease, and if so, whether it is a known infectious disease, was proposed. The first layer model adopts the binary classification model TextCNN-Attention. The second layer is a multi-classification model of LightGBM based on the one-vs-rest strategy. Based on the experimental results, a threshold of 0.5 is selected. The model results were compared with those of other models such as XGBoost and Random Forest using the following evaluation indicators: accuracy, sensitivity, specificity, positive predictive value, and negative predictive value. The prediction performance of the first-layer TextCNN is better than that of other comparison models. Its average specificity for non-infectious diseases is 97.57%, with an average negative predictive value of 82.63%, indicating a low risk of misdiagnosing non-infectious diseases as infectious (i.e., a low false positive rate). Its average positive predictive value for eight selected infectious diseases is 95.07%, demonstrating the model's ability to avoid misdiagnoses. The overall average accuracy of the model is 86.11%. The average prediction accuracy of the second-layer LightGBM model for emerging infectious diseases reaches 90.44%. Furthermore, the response time of a single online reasoning using the LightGBM model is approximately 27 ms, which makes it suitable for analyzing clinical records in real time. Using the Knox method, we found that all the infectious diseases were within 2000 m in our case, and a clustering feature of spatiotemporal interactions (P < 0.05) was observed as well. Performance testing and model comparison results indicated that the EIDDM is fast and accurate and can be used to monitor the onset/outbreak of emerging infectious diseases in real-world hospitals.

Usefulness of receptor binding domain protein-based serodiagnosis of COVID-19

ObjectivesThis study evaluated the performance of recombinant receptor binding domain (RBD) protein-based enzyme-linked immunosorbent assays (RBD-ELISAs) for detecting anti-SARS-CoV-2 immunoglobulin (Ig) G and IgM antibodies. MethodsIn this study, 705 sera from SARS-CoV-2-infected individuals and 315 sera from healthy individuals were analyzed. ResultsThe RBD-ELISA IgG exhibited high specificity (99.1%) and moderate sensitivity (48.0%), with an overall diagnostic accuracy of 73.5%. RBD-ELISA IgM demonstrated specificity at 94.6% and sensitivity at 51.1%, with an accuracy of 72.8%. Both assays displayed improved performance when analyzing samples collected 15-21 days post-symptom onset, achieving sensitivity and accuracy exceeding 88% and 90%, respectively. Combining RBD-ELISA IgG and IgM in parallel analysis enhanced sensitivity to 98.6% and accuracy to 96.2%. Comparing these RBD-ELISAs with commercially available tests, the study found overlapping sensitivity and similar specificity values. Notably, the combined RBD-ELISA IgG and IgM showed superior performance. Cross-reactivity analysis revealed low false-positive rates (4.4% for IgG, 3.7% for IgM), primarily with viral infections. ConclusionThis research underscores the potential of RBD-based ELISAs for COVID-19 diagnosis, especially when assessing samples collected 15-21 days post-symptom onset and utilizing a parallel testing approach. The RBD protein's immunogenicity and specificity make it a valuable tool for serodiagnosis, offering an alternative to polymerase chain reaction-based methods, particularly in resource-limited settings.

Support vector data description with kernel density estimation (SVDD-KDE) control chart for network intrusion monitoring

Multivariate control charts have been applied in many sectors. One of the sectors that employ this method is network intrusion detection. However, the issue arises when the conventional control chart faces difficulty monitoring the network-traffic data that do not follow a normal distribution as required. Consequently, more false alarms will be found when inspecting network traffic data. To settle this problem, support vector data description (SVDD) is suggested. The control chart based on the SVDD distance can be applied for the non-normal distribution, even the unknown distributions. Kernel density estimation (KDE) is the nonparametric approach that can be applied in estimating the control limit of the non-parametric control charts. Based on these facts, a multivariate chart based on the integrated SVDD and KDE (SVDD-KDE) is proposed to monitor the network's anomaly. Simulation using the synthetic dataset is performed to examine the performance of the SVDD-KDE chart in detecting multivariate data shifts and outliers. Based on the simulation results, the proposed method produces better performance in detecting shifts and higher accuracy in detecting outliers. Further, the proposed method is applied in the intrusion detection system (IDS) to monitor network attacks. The NSL-KDD data is analyzed as the benchmark dataset. A comparison between the SVDD-KDE chart with the other IDS-based-control chart and the machine learning algorithms is executed. Although the it has high computational cost, the results show that the IDS based on the SVDD-KDE chart produces a high accuracy at 0.917 and AUC at 0.915 with a low false positive rate compared to several algorithms.

Asset pricing with neural networks: Significance tests

This study proposes a novel hypothesis test for evaluating the statistical significance of input variables in multi-layer perceptron (MLP) regression models. Theoretical foundations are established through consistency results and estimation rate analysis using the sieves method. To validate the test’s performance in complex and realistic settings, an extensive Monte Carlo simulation is conducted. Results of the simulation reveal that the test has a high power and low rate of false positives, making it a powerful tool for detecting true effects in data. The test is further applied to identify the most influential predictors of equity risk premiums, with results indicating that only a small number of characteristics have statistical significance and all macroeconomic predictors are insignificant at the 1% level. These findings are consistent across a variety of neural network architectures.

Improving power of genome-wide association studies via transforming ordinal phenotypes into continuous phenotypes.

Ordinal traits are important complex traits in crops, while genome-wide association study (GWAS) is a widely-used method in their gene mining. Presently, GWAS of continuous quantitative traits (C-GWAS) and single-locus association analysis method of ordinal traits are the main methods used for ordinal traits. However, the detection power of these two methods is low. To address this issue, we proposed a new method, named MTOTC, in which hierarchical data of ordinal traits are transformed into continuous phenotypic data (CPData). Then, FASTmrMLM, one C-GWAS method, was used to conduct GWAS for CPData. The results from the simulation studies showed that, MTOTC+FASTmrMLM for ordinal traits was better than the classical methods when there were four and fewer hierarchical levels. In addition, when MTOTC was combined with FASTmrEMMA, mrMLM, ISIS EM-BLASSO, pLARmEB, and pKWmEB, relatively high power and low false positive rate in QTN detection were observed as well. Subsequently, MTOTC was applied to analyze the hierarchical data of soybean salt-alkali tolerance. It was revealed that more significant QTNs were detected when MTOTC was combined with any of the above six C-GWAs. Accordingly, the new method increases the choices of the GWAS methods for ordinal traits and helps to mine the genes for ordinal traits in resource populations.

Enhancing Intrusion Detection Systems with a Hybrid Deep Learning Model and Optimized Feature Composition

Systems for detecting intrusions (IDS) are essential for protecting network infrastructures from hostile activity. Advanced methods are required since traditional IDS techniques frequently fail to properly identify sophisticated and developing assaults. In this article, we suggest a novel method for improving IDS performance through the use of a hybrid deep learning model and feature composition optimization. RNN and CNN has strengths that the proposed hybrid deep learning model leverages to efficiently capture both spatial and temporal correlations in network traffic data. The model can extract useful features from unprocessed network packets using CNNs and RNNs, giving a thorough picture of network behaviour. To increase the IDS's ability to discriminate, we also offer feature optimization strategies. We uncover the most pertinent and instructive features that support precise intrusion detection through a methodical feature selection and engineering process. In order to reduce the computational load and improve the model's efficiency without compromising detection accuracy, we also use dimensionality reduction approaches. We carried out extensive experiments using a benchmark dataset that is frequently utilized in intrusion detection research to assess the suggested approach. The outcomes show that the hybrid deep learning model performs better than conventional IDS methods, obtaining noticeably greater detection rates and lower false positive rates. The performance of model is further improved by the optimized feature composition, which offers a more accurate depiction of network traffic patterns.

BSCSML: Design of an Efficient Bioinspired Security &amp;Privacy Model for Cyber Physical System using Machine Learning

With the increasing prevalence of Smart Grid Cyber Physical Systems with Advanced Metering Infrastructure (SG CPS AMI), securing their internal components has become one of the paramount concerns. Traditional security mechanisms have proven to be insufficient in defending against sophisticated attacks. Bioinspired security and privacy models have emerged as promising solutions due to their stochastic solutions. This paper proposes a novel bio-inspired security and privacy model for SG CPS AMI that utilizes machine learning to strengthen their security levels. The proposed model is inspired by the hybrid Grey Wolf Teacher Learner based Optimizer (GWTLbO) Method’s ability to detect and respond to threats in real-time deployments. The GWTLbO Model also ensures higher privacy by selecting optimal methods between k-privacy, t-closeness &amp; l-diversity depending upon contextual requirements. This study improves system accuracy and efficiency under diverse attacks using machine learning techniques. The method uses supervised learning to teach the model to recognize known attack trends and uncontrolled learning to spot unknown attacks. Our model was tested using real-time IoT device data samples. The model identified Zero-Day Attacks, Meter Bypass, Flash Image Manipulation, and Buffer-level attacks. The proposed model detects and responds to attacks with high accuracy and low false-positive rates. In real-time operations, the proposed model can handle huge volumes of data efficiently. The bioinspired security and privacy model secures CPS efficiently and is scalable for various cases. Machine learning techniques can improve the security and secrecy of these systems and revolutionize defense against different attacks.

Detection of DoS Attacks in Smart City Networks With Feature Distance Maps: A Statistical Approach

Smart cities are highly digitalized cities, with a high volume of data stored digitally, as well as a large number of physical objects and Internet of Things (IoT) devices. It is no surprise that security concerns increase as connected IoT devices become more prevalent. There has long been a perception that Denial of Service (DoS) attacks give rise to a notable menace to the security of smart city networks. A statistical method based on feature distance maps is suggested in this work for the identification of DoS attacks in smart city networks. This study aims to build a DoS attack detection model that has a low computational complexity and a low rate of false positives. The performance of the model is arbitrated using smart city network traffic dataset. In order to make processing easier, the features are normalized using Min-Max normalization. A subset of features suitable for attack detection can be evaluated with Pearson Correlation Coefficient. A feature distance map method is proposed for extracting correlations between features between records. Manhattan distance measures are used to generate the feature distance maps. The feature distance maps enhance the statistical analysis process. Hellinger distance measure is used to generate the normal traffic profile by calculating the degree of similarity between the feature distance map of each record and the normal traffic profile mean. On the basis of the proposed threshold, the Hellinger distance is used to evaluate whether an unknown traffic data belongs to normal or attack. Compared with Mahalanobis distance-based DoS detection, the Hellinger distance-based attack detection takes less time to execute. Based on the theoretical and experimental results, the proposed DoS attack detection system has a low computational complexity and a low false positive rate. Furthermore, the proposed approach outperforms the existing state-of-the-art feature ranking based DoS attack detection systems.

Development and clinical validation of a novel algorithmic score (GAAD) for detecting HCC in prospective cohort studies.

Alpha-fetoprotein (AFP) and des-gamma carboxyprothrombin (DCP), also known as protein induced by vitamin K absence-II (PIVKA-II [DCP]) are biomarkers for HCC with limited diagnostic value when used in isolation. The novel GAAD algorithm is an in vitro diagnostic combining PIVKA-II (DCP) and AFP measurements, age, and gender (biological sex) to generate a semi-quantitative result. We conducted prospective studies to develop, implement, and clinically validate the GAAD algorithm for differentiating HCC (early and all-stage) and benign chronic liver disease (CLD), across disease stages and etiologies. Patients aged ≥18 years with HCC or CLD were prospectively enrolled internationally into algorithm development [n = 1084; 309 HCC cases (40.7% early-stage) and 736 controls] and clinical validation studies [n = 877; 366 HCC cases (47.6% early-stage) and 303 controls]. Serum samples were analyzed on a cobas® e 601 analyzer. Performance was assessed using receiver operating characteristic curve analyses to calculate AUC. For algorithm development, AUC for differentiation between early-stage HCC and CLD was 90.7%, 84.4%, and 77.2% for GAAD, AFP, and PIVKA-II, respectively. The sensitivity of GAAD for the detection of early-stage HCC was 71.8% with 90.0% specificity. Similar results were shown in the clinical validation study; AUC for differentiation between early-stage HCC and CLD was 91.4% with 70.1% sensitivity and 93.7% specificity. GAAD also showed strong specificity, with a lower rate of false positives regardless of disease stage, etiology, or region. The GAAD algorithm significantly improves early-stage HCC detection for patients with CLD undergoing HCC surveillance. Further phase III and IV studies are warranted to assess the utility of incorporating the algorithm into clinical practice.

APTSHIELD: A Stable, Efficient and Real-Time APT Detection System for Linux Hosts

Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT attacks have caused serious security threats and massive financial loss worldwide. Academics and industry thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios. To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

DDoS Attack Detection in SDN using ML Techniques

Abstract: The increasing prevalence of DDoS attacks poses a serious threat to modern network infrastructures. SDN has been proposed as a promising solution for enhancing network security. However, detecting and mitigating DDoS attack in software definednetwork remains a challenging task. In this research paper, suggest an innovative approach in order to identify DDoS assaults in software-defined networks using (ML) techniques. Ourmethod entails gathering and analyzing network data. Traffic data using SDN controllers. We use variety of ML techniques analyze the traffic information to discover unexpected traffic patterns that might point to the presence of a DDoS attack. Random Forest, DecisionTree, K-Means clustering are among the algorithms used. We evaluate our approach using a real-world dataset and compare it to existing DDoS detection techniques in SDN. Our results show that our approach achieves high accuracy, precision, and recall rates indetecting DDoS attacks. We also demonstrate that our technique can detect either known and unexpected DDoS assaults with low false-positive rates. Overall, our study indicates thepotency of applying machine learning methods to SDN DDoS attack detection. Our methodoffers a promising remedy for boosting network security in contemporary infrastructures.

Efficient Inductive Transfer Learning based Framework for Zero-Day Attack Detection

An Intrusion Detection System (IDS) is a type of security domain that tracks and evaluates network connections or system operations to detect potential security breaches, unauthorized usage, and malicious activity within computer networks. Machine learning (ML) and deep learning (DL) algorithms provide better IDS based on the labelled dataset. However, due to a lack of labelled data, its effectiveness in detecting zero-day attacks is limited. Anomaly detection methods frequently produce high False Positive Rates (FPR). Transfer learning (TL) is a powerful technique in various domains, including intrusion detection systems (IDS). It also creates advanced classifiers using knowledge extracted from the related source domain(s) with little or no labelled data. This paper introduced zero-day attack detection (ZDAD) model by combining it with transfer learning that helps classify the attacks and non-attacks from the given dataset. Using the UNSW-NB15 dataset, the authors created a Transfer Learning-based prototype in this study. The goal was to unify the feature space for distinguishing unlabeled Generic samples representing zero-day attacks from regular instances using labelled DoS samples. The ZDAD performed admirably, achieving 99.24% accuracy and a low False Positive Rate (FPR) of 0.02%. This performance outperforms current state-of-the-art methods.

Comparison of Residual-based Methods on Fault Detection

An important initial step in fault detection for complex industrial systems is gaining an understanding of their health condition. Subsequently, continuous monitoring of this health condition becomes crucial to observe its evolution, track changes over time, and isolate faults. As faults are typically rare occurrences, it is essential to perform this monitoring in an unsupervised manner. Various approaches have been proposed not only to detect faults in an unsupervised manner but also to distinguish between different potential fault types. In this study, we perform a comprehensive comparison between two residual-based approaches: autoencoders, and theinput-output models that establish a mapping between operating conditions and sensor readings. We explore the sensorwise residuals and aggregated residuals for the entire system in both methods. The performance evaluation focuses on three tasks: health indicator construction, fault detection, and health indicator interpretation. To perform the comparison, we utilize the Commercial Modular Aero-Propulsion System Simulation (C-MAPSS) dynamical model, specifically a subset of the turbofan engine dataset containing three different fault types. All models are trained exclusively on healthy data. Fault detection is achieved by applying a threshold that is determined based on the healthy condition. The detection results reveal that both models are capable of detecting faults with an average delay of around 20 cycles and maintain a low false positive rate. While the fault detection performance is similar for both models, the input-output model provides better interpretability regarding potential fault types and the possible faulty components.

Exploring the Use of Pattern Classification Approaches for the Recognition of Landslide-Triggering Rainfalls

Rainfall-triggered landslides are well-known natural hazards that pose significant risks, and lot of effort has been invested to reduce the risk associated with this type of phenomenon. One approach to reduce such risk is the establishment of landslide early warning systems (LEWSs). LEWSs are designated to proactively identify conditions favorable to the initiation of landslides. When dealing with regional scale works, LEWSs are usually based on statistical methodologies to determine the minimum amount of rainfall required to trigger a landslide. This amount is often expressed in terms of minimum intensity or cumulative rainfall in a given time period. This research explores the use of artificial intelligence, specifically Long Short-Term Memory (LSTM) networks to analyze rainfall time series as either likely or not likely to result in a landslide. Various lengths of time series and different configurations of the model were tested to identify the best setting of the model. To develop the research, the selected test site was the Emilia-Romagna region in Italy, which has a robust landslide inventory, with assessed accuracy. Model performances were evaluated using several statistical indicators, including sensitivity (0.9), specificity (0.8), positive prediction power (0.82), negative prediction power (0.89), Efficiency (0.85) and misclassification rate (0.15). These results showed that the defined model correctly identified the rainfall conditions associated with landslide initiation with a high degree of accuracy and a low rate of false positives. In summary, this research demonstrates the potential of artificial intelligence, particularly LSTM networks, in improving the accuracy of LEWSs by analyzing rainfall time series data, ultimately enhancing our ability to predict and mitigate the risks of rainfall-triggered landslides.

Spoofed Email Based Cyberattack Detection Using Machine Learning

ABSTRACT Cyberattacks on e-mails are of different types, but the most pervasive and ubiquitous are spoofing attacks. Our approach uses memory forensics to extract e-mail headers from live memory to perform an e-mail header investigation to identify spoofing attacks. We have identified the research gaps and advanced our work to achieve better results. In this paper, we have made two significant improvements. First is URL validation module that uses a novel technique of checking each captured URL with an MX record and e-mail URL features. This scheme is fast, and reduces the total time from 35 sec to 27 sec. Second, spoofed e-mail detection is ameliorated by applying an ML model built using two novel e-mail header fields (BIMI and X-FraudScore) and four authentication header fields (SPF, DKIM, DMARC, and ARC). This enhances the spoofed e-mail detection accuracy from 96.15% to 97.57% with low false positives.