Machine Learning Based Detection System Research Articles

Machine Learning Based A Comparative Analysis for Predicting Intensive Care Unit Admission of COVID-19 Cases

COVID-19 is a disease caused by the SARS-CoV-2 virus that emerged in December 2019 in Wuhan, China. This virus, which can be transmitted quickly, spread worldwide quickly, causing many people to be infected and even killed. The rapid course of the epidemic made managing medical resources difficult. Intensive care units play an important role in saving the lives of severely ill COVID-19 patients. In this study, a machine learning-based detection system was developed to predict the hospitalization of COVID-19 patients in intensive care units. Using a dataset of demographic characteristics and clinical findings of COVID-19 patients, DT, kNN, LR, MLP, NB, RF, and SVM were compared in practice using accuracy, recall, precision, and F-score. Experimental results showed that SVM has 0.964 accuracy, 0.957 precision, 0.971 recall, and 0.963 F-score.

An intelligent identification and classification system for malicious uniform resource locators (URLs).

Uniform Resource Locator (URL) is a unique identifier composed of protocol and domain name used to locate and retrieve a resource on the Internet. Like any Internet service, URLs (also called websites) are vulnerable to compromise by attackers to develop Malicious URLs that can exploit/devastate the user's information and resources. Malicious URLs are usually designed with the intention of promoting cyber-attacks such as spam, phishing, malware, and defacement. These websites usually require action on the user's side and can reach users across emails, text messages, pop-ups, or devious advertisements. They have a potential impact that can reach, in some cases, to compromise the machine or network of the user, especially those arriving by email. Therefore, developing systems to detect malicious URLs is of great interest nowadays.This paper proposes a high-performance machine learning-based detection system to identify Malicious URLs. The proposed system provides two layers of detection. Firstly, we identify the URLs as either benign or malware using a binary classifier. Secondly, we classify the URL classes based on their feature into five classes: benign, spam, phishing, malware, and defacement. Specifically, we report on four ensemble learning approaches, viz. the ensemble of bagging trees (En_Bag) approach, the ensemble of k-nearest neighbor (En_kNN) approach, and the ensemble of boosted decision trees (En_Bos) approach, and the ensemble of subspace discriminator (En_Dsc) approach. The developed approaches have been evaluated on an inclusive and contemporary dataset for uniform resource locators (ISCX-URL2016). ISCX-URL2016 provides a lightweight dataset for detecting and categorizing malicious URLs according to their attack type and lexical analysis. Conventional machine learning evaluation measurements are used to evaluate the detection accuracy, precision, recall, F Score, and detection time. Our experiential assessment indicates that the ensemble of bagging trees (En_Bag) approach provides better performance rates than other ensemble methods. Alternatively, the ensemble of the k-nearest neighbor (En_kNN) approach provides the highest inference speed. We also contrast our En_Bag model with state-of-the-art solutions and show its superiority in binary classification and multi-classification with accuracy rates of 99.3% and 97.92%, respectively.

Development and validation of a machine learning-based detection system to improve precision screening for medication errors in the neonatal intensive care unit.

Aim: To develop models that predict the presence of medication errors (MEs) (prescription, preparation, administration, and monitoring) using machine learning in NICU patients. Design: Prospective, observational cohort study randomized with machine learning (ML) algorithms. Setting: A 22-bed capacity NICU in Ankara, Turkey, between February 2020 and July 2021. Results: A total of 11,908 medication orders (28.9 orders/patient) for 412 NICU patients (5.53 drugs/patient/day) who received 2,280 prescriptions over 32,925 patient days were analyzed. At least one physician-related ME and nurse-related ME were found in 174 (42.2%) and 235 (57.0%) of the patients, respectively. The parameters that had the highest correlation with ME occurrence and subsequently included in the model were: total number of drugs, anti-infective drugs, nervous system drugs, 5-min APGAR score, postnatal age, alimentary tract and metabolism drugs, and respiratory system drugs as patient-related parameters, and weekly working hours of nurses, weekly working hours of physicians, and number of nurses' monthly shifts as care provider-related parameters. The obtained model showed high performance to predict ME (AUC: 0.920; 95% CI: 0.876-0.970) presence and is accessible online (http://softmed.hacettepe.edu.tr/NEO-DEER_Medication_Error/). Conclusion: This is the first developed and validated model to predict the presence of ME using work environment and pharmacotherapy parameters with high-performance ML algorithms in NICU patients. This approach and the current model hold the promise of implementation of targeted/precision screening to prevent MEs in neonates. Clinical Trial Registration: ClinicalTrials.gov, identifier NCT04899960.

On the application of active learning for efficient and effective IoT botnet detection

The active learning approach for machine learning can greatly benefit those environments where a wealth of unlabeled data is available, and the labeling cost of the data can be restrictive. In this regard, security operations centers (SOCs) can take advantage of the human expertise available to improve machine learning-based detection models using the active learning approach. In the context of SOC operations and IoT botnet detection, our study provides a thorough benchmarking of the application of different active learning approaches within the framework of pool-based sampling. The selection of the optimal query instance for learning is evaluated using uncertainty sampling, ranked batch-mode sampling, and query by committee strategies. Our results show that the active learning approach can help to generate better detection models using all the active learning query strategies tested in our benchmarking setup. Leveraging the human–machine interaction can produce high-performance models in the context of IoT botnet detection using significantly less data than the passive approaches traditionally used for the generation of machine learning-based detection systems. Additionally, the impact of wrong-labeled data in the active learning implementation is explored.

Detection of Adversarial DDoS Attacks Using Symmetric Defense Generative Adversarial Networks

DDoS (distributed denial of service) attacks consist of a large number of compromised computer systems that launch joint attacks at a targeted victim, such as a server, website, or other network equipment, simultaneously. DDoS has become a widespread and severe threat to the integrity of computer networks. DDoS can lead to system paralysis, making it difficult to troubleshoot. As a critical component of the creation of an integrated defensive system, it is essential to detect DDoS attacks as early as possible. With the popularization of artificial intelligence, more and more researchers have applied machine learning (ML) and deep learning (DL) to the detection of DDoS attacks and have achieved satisfactory accomplishments. The complexity and sophistication of DDoS attacks have continuously increased and evolved since the first DDoS attack was reported in 1996. Regarding the headways in this problem, a new type of DDoS attack, named adversarial DDoS attack, is investigated in this study. The generating adversarial DDoS traffic is carried out using a symmetric generative adversarial network (GAN) architecture called CycleGAN to demonstrate the severe impact of adversarial DDoS attacks. Experiment results reveal that the synthesized attack can easily penetrate ML-based detection systems, including RF (random forest), KNN (k-nearest neighbor), SVM (support vector machine), and naïve Bayes. These alarming results intimate the urgent need for countermeasures against adversarial DDoS attacks. We present a novel DDoS detection framework that incorporates GAN with a symmetrically built generator and discriminator defense system (SDGAN) to deal with these problems. Both symmetric discriminators are intended to simultaneously identify adversarial DDoS traffic. As demonstrated by the experimental results, the suggested SDGAN can be an effective solution against adversarial DDoS attacks. We train SDGAN on adversarial DDoS data generated by CycleGAN and compare it to four previous machine learning-based detection systems. SDGAN outperformed the other machine learning models, with a TPR (true positive rate) of 87.2%, proving its protection ability. Additionally, a more comprehensive test was undertaken to evaluate SDGAN’s capacity to defend against unseen adversarial threats. SDGAN was evaluated using non-training data-generated adversarial traffic. SDGAN remained effective, with a TPR of around 70.9%, compared to RF’s 9.4%.

SDN Framework for Mitigating Time-Based Delay Attack

Due to recent cyberattacks on the Cyber-Physical Systems, the traditional security schemes face difficulties in dealing with such attacks as the attackers nowadays have adopted many intelligent mechanisms involving advanced information and communication technologies to launch attacks. This recent type of attack provides a significant impact on the resiliency of the software-defined networks. In this paper, we present a real-time delay attack on fault-resilient software-defined networks. The main objective of the time delay attack is to reduce the resiliency in the SDN-RM by adding a delay in the LLDP packets in the OpenFlow Switch. This addition of delay causes degradation in the network performance resulting in a low success rate in the SDN-RM mechanisms. In this paper, we present a machine learning-based detection system for detecting the attacks. The integration of machine learning techniques with network resilience solutions can effectively address the issue of predicting and classifying the LLDP packets that are delayed at a particular switch. Another issue is the detection of the malicious switch at the controller side which results in the improvement of the resiliency in SDN-RM. We propose a machine learning solution to detect the anomalies that are present in the topology and can be detected at the controller side. We use machine learning models such as k-nearest neighbors, support vector machines (SVM), Random Forest, and decision trees to detect the poisonous switches. The delay-based time attack detection system (DTA-DS) helps the controller to take a reactive decision to improve resilience by detecting poisonous network switches. With the help of the preventive approach, we achieve high-fault resiliency in fault resilient-based software-defined networks.

A Semi-Supervised Learning Approach for Tackling Twitter Spam Drift

Abstract: Twitter play an important role in accelerating the spread of spam. In order to protect the users, Twitter and the research community have been developing different spam detection systems by applying different machine-learning techniques. However, a recent study showed that the current machine learning-based detection systems are not able to detect spam accurately because spam tweet characteristics vary over time. This issue is called "Twitter Spam Drift". In the proposed system a semi-supervised learning approach (SSLA) has been proposed to tackle this. The new approach uses the unlabeled data to learn the structure of the domain. To handle the drift, live twitter stream of data is taken for the study. The pre-processing of livedownloaded data is labeled and machine learning is applied to detect spam and non-spam users. The data is stored in cloud storage, which can be accessed by user from anywhere. Experimental results were conducted on more than one machine learning algorithm and finds the better for the proposed problem, in-terms of accuracy

A Ensemble Machine Learning Based System for Merchant Credit Risk Detection in Merchant Mcc Misuse

Although credit score models have been widely applied, one of the important variables-Merchant Category Code (MCC)-is sometimes misused. MCC misuse may cause errors in credit scoring systems. The present study aimed to develop and deploy an MCC misuse detection system with ensemble models, gives insights into the development process and compares different machine learning methods. XGBoost exhibited the best performance, with overall error, sensitivity, specificity, F_1 score, AUC and PRAUC of 0.1095, 0.7777, 0.9672, 0.8518, 0.9095 and 0.9090, respectively. MCC misuse by merchants can be predicted with satisfactory accuracy by using our ensemble-based detection system. The paper can thus not only suggest the MCC misuse cannot be overlooked but also help researchers and practitioners to apply new ensemble machine learning based detection system or similar problems.

PSI Clustering for the Assessment of Underground Infrastructure Deterioration

Remote sensing images find application in several different domains, such as land cover or land usage observation, environmental monitoring, and urbanization. This latter field has recently witnessed an interesting development with the use of remote sensing for infrastructural monitoring. In this work, we present an analysis of Sentinel-1 images, which were used to monitor the Italian provinces of Bologna and Modena located at the Emilia Region Apennines foothill. The goal of this study was the development of a machine learning-based detection system to monitor the deterioration of public aqueduct infrastructures based on Persistent Scatterer Interferometry (PSI). We evaluated the land deformation over a temporal range of five years; these series feed a k-means clustering algorithm to separate the pixels of the region according to different deformation patterns. Furthermore, we defined the critical areas as those areas where different patterns collided or overlapped. The proposed approach provides an informative tool for the structural health monitoring of underground infrastructures.

Analyzing Data Granularity Levels for Insider Threat Detection Using Machine Learning

Malicious insider attacks represent one of the most damaging threats to networked systems of companies and government agencies. There is a unique set of challenges that come with insider threat detection in terms of hugely unbalanced data, limited ground truth, as well as behaviour drifts and shifts. This work proposes and evaluates a machine learning based system for user-centered insider threat detection. Using machine learning, analysis of data is performed on multiple levels of granularity under realistic conditions for identifying not only malicious behaviours, but also malicious insiders. Detailed analysis of popular insider threat scenarios with different performance measures are presented to facilitate the realistic estimation of system performance. Evaluation results show that the machine learning based detection system can learn from limited ground truth and detect new malicious insiders in unseen data with a high accuracy. Specifically, up to 85% of malicious insiders are detected at only 0.78% false positive rate. The system is also able to quickly detect the malicious behaviours, as low as 14 minutes after the first malicious action. Comprehensive result reporting allows the system to provide valuable insights to analysts in investigating insider threat cases.

PhishHaven—An Efficient Real-Time AI Phishing URLs Detection System

Different machine learning and deep learning-based approaches have been proposed for designing defensive mechanisms against various phishing attacks. Recently, researchers showed that phishing attacks can be performed by employing a deep neural network-based phishing URL generating system called DeepPhish. To prevent this kind of attack, we design an ensemble machine learning-based detection system called PhishHaven to identify AI-generated as well as human-crafted phishing URLs. To the best of our knowledge, this is the first study to consider detecting phishing attacks by both AI and human attackers. PhishHaven employs lexical analysis for feature extraction. To further enhance lexical analysis, we introduce URL HTML Encoding to classify URL on-the-fly and proactively compare with some of the existing methods. We also introduce a URL Hit approach to deal with tiny URLs, which is an open problem yet to be solved. Moreover, the final classification of URLs is made on an unbiased voting mechanism in PhishHaven, which aims to avoid misclassification when the number of votes is equal. To speed up the ensemble-based machine learning models, PhishHaven employs a multi-threading approach to execute the classification in parallel, leading to real-time detection. Theoretical analysis of our solution shows that (1) it can always detect tiny URLs, and (2) it can detect future AI-generated Phishing URLs based on our selected lexical features with 100% accuracy. Through experiments, we analyze our solution with a benchmark dataset of 100,000 phishing and normal URLs. The results show that PhishHaven can achieve 98.00% accuracy, outperforming the existing lexical-based human-crafted phishing URLs detection systems.

A Semi-Supervised Learning Approach for Tackling Twitter Spam Drift

Twitter has changed the way people get information by allowing them to express their opinion and comments on the daily tweets. Unfortunately, due to the high popularity of Twitter, it has become very attractive to spammers. Unlike other types of spam, Twitter spam has become a serious issue in the last few years. The large number of users and the high amount of information being shared on Twitter play an important role in accelerating the spread of spam. In order to protect the users, Twitter and the research community have been developing different spam detection systems by applying different machine-learning techniques. However, a recent study showed that the current machine learning-based detection systems are not able to detect spam accurately because spam tweet characteristics vary over time. This issue is called “Twitter Spam Drift”. In this paper, a semi-supervised learning approach (SSLA) has been proposed to tackle this. The new approach uses the unlabeled data to learn the structure of the domain. Different experiments were performed on English and Arabic datasets to test and evaluate the proposed approach and the results show that the proposed SSLA can reduce the effect of Twitter spam drift and outperform the existing techniques.

Sensitive system calls based packed malware variants detection using principal component initialized MultiLayers neural networks

Malware detection has become mission sensitive as its threats spread from computer systems to Internet of things systems. Modern malware variants are generally equipped with sophisticated packers, which allow them bypass modern machine learning based detection systems. To detect packed malware variants, unpacking techniques and dynamic malware analysis are the two choices. However, unpacking techniques cannot always be useful since there exist some packers such as private packers which are hard to unpack. Although dynamic malware analysis can obtain the running behaviours of executables, the unpacking behaviours of packers add noisy information to the real behaviours of executables, which has a bad affect on accuracy. To overcome these challenges, in this paper, we propose a new method which first extracts a series of system calls which is sensitive to malicious behaviours, then use principal component analysis to extract features of these sensitive system calls, and finally adopt multi-layers neural networks to classify the features of malware variants and legitimate ones. Theoretical analysis and real-life experimental results show that our packed malware variants detection technique is comparable with the the state-of-art methods in terms of accuracy. Our approach can achieve more than 95.6\\% of detection accuracy and 0.048 s of classification time cost.

A design and development of an intelligent jammer and jamming detection methodologies using machine learning approach

Nowadays, the utilization of mobile phones has increased rapidly. Due to this evolution schools, mosques, prisons, etc., require silence and security. This is achieved by using the mobile phone jammers. An intelligent mobile jammer is designed for allowing only the emergency calls by utilizing the microcontroller. Here, the jammer utilizes the successive approximation for reducing the transmission power. However, it requires few modifications. Therefore in this paper, an improved successive approximation based on divide and conquer algorithm is proposed in order to design the improved intelligent mobile jammer and reduce transmission power. Subsequently, the proposed jammer is analysed based on the different scenarios and frequency bands to illustrate their performance effectiveness. Furthermore, the normal activities are distinguished from jamming by using machine learning-based detection system according to the various parameters. Finally, the proposed algorithm is compared with conventional algorithms to demonstrate its performance efficiency in terms of detection accuracy.

Evaluation of random forest classifier in security domain

There is an intrinsic adversarial nature in the security domain such as spam filtering and malware detection systems that attempt to mislead the detection system. This adversarial nature makes security applications different from the classical machine learning problems; for instance, an adversary (attacker) might change the distribution of test data and violate the data stationarity, a common assumption in machine learning techniques. Since machine learning methods are not inherently adversary-aware, a classifier designer should investigate the robustness of a learning system under attack. In this respect, recent studies have modeled the identified attacks against machine learning-based detection systems. Based on this, a classifier designer can evaluate the performance of a learning system leveraging the modeled attacks. Prior research explored a gradient-based approach in order to devise an attack against a classifier with differentiable discriminant function like SVM. However, there are several powerful classifiers with non-differentiable decision boundary such as Random Forest, which are commonly used in different security domain and applications. In this paper, we present a novel approach to model an attack against classifiers with non-differentiable decision boundary. In the experimentation, we first present an example that visually shows the effect of a successful attack on the MNIST handwritten digits classification task. Then we conduct experiments for two well-known applications in the security domain: spam filtering and malware detection in PDF files. The experimental results demonstrate that the proposed attack successfully evades Random Forest classifier and effectively degrades the classifier’s performance.

Power-aware anomaly detection in smartphones: An analysis of on-platform versus externalized operation

Many security problems in smartphones and other smart devices are approached from an anomaly detection perspective in which the main goal reduces to identifying anomalous activity patterns. Since machine learning algorithms are generally used to build such detectors, one major challenge is adapting these techniques to battery-powered devices. Many recent works simply assume that on-platform detection is prohibitive and suggest using offloaded (i.e., cloud-based) engines. Such a strategy seeks to save battery life by exchanging computation and communication costs, but it still remains unclear whether this is optimal or not in all circumstances. In this paper, we evaluate different strategies for offloading certain functional tasks in machine learning based detection systems. Our experimental results confirm the intuition that outsourced computation is clearly the best option in terms of power consumption, outweighing on-platform strategies in, essentially, all practical scenarios. Our findings also point out noticeable differences among different machine learning algorithms, and we provide separate consumption models for functional blocks (data preprocessing, training, test, and communications) that can be used to obtain power consumption estimates and compare detectors.