Machine Learning-based Detection Research Articles

Machine learning-based detection of the man-in-the-middle attack in the physical layer of 5G networks

Fifth generation communication networks (5G) has received a great deal of attention from academia and industry alike, which will enable a wide variety of vertical applications by connecting heterogeneous devices and machines. Assessing availability and reliability in many circumstances and environments is critical. Researchers have recently focused on investigating and analyzing new multimedia networks with artificial intelligence (AI) technologies to achieve higher data rates and secure communication traffic between parties. User information privacy and security are of vital importance and of growing concerns that present evolving challenges to overcome in preventing attacks. Man-in-the-middle (MITM) attack is considered one of the most common attacks, where an attacker can impersonate one of the parties in a communication system to steal user data or forge the malicious data. Due to the limitation of using conventional cryptographic techniques for mobile networks and similar systems, new methods have been introduced to validate and authenticate transmitted signals dynamically, depending on the physical layer. In this paper, we present the distance-time directional delay (DTDD) model to detect the MITM attack in a variety of contexts and scenario.Indoor hotspots (InH) and urban micro-cellular (UMi) propagation environments were investigated to verify the reliability of the proposed approaches using realistic 5G millimeter-wave configurations and system setups. Simulations have been constructed based on the mmWave 5G channel simulator tool NYUSIM, in conjunction with a collection of machine learning algorithms (ML) including the extreme gradient boosting (XGBoost) and light gradient boosting machine (LGBM) as the core of the presented models and methodologies. Numerical simulations results produced a detection accuracy approaching 100% in the InH environment scenario, whereas for UMi environment scenario, a detection accuracy approaching 99% was attained.

Galaxy merger challenge: A comparison study between machine learning-based detection methods

Aims. Various galaxy merger detection methods have been applied to diverse datasets. However, it is difficult to understand how they compare. Our aim is to benchmark the relative performance of merger detection methods based on machine learning (ML). Methods. We explore six leading ML methods using three main datasets. The first dataset consists of mock observations from the IllustrisTNG simulations, which acts as the training data and allows us to quantify the performance metrics of the detection methods. The second dataset consists of mock observations from the Horizon-AGN simulations, introduced to evaluate the performance of classifiers trained on different, but comparable data to those employed for training. The third dataset is composed of real observations from the Hyper Suprime-Cam Subaru Strategic Program (HSC-SSP) survey. We also compare mergers and non-mergers detected by the different methods with a subset of HSC-SSP visually identified galaxies. Results. For the simplest binary classification task (i.e. mergers vs. non-mergers), all six methods perform reasonably well in the domain of the training data. At the lowest redshift explored 0.1 < ɀ < 0.3, precision and recall generally range between ~70% and 80%, both of which decrease with increasing ɀ as expected (by ~5% for precision and ~10% for recall at the highest ɀ explored 0.76 < ɀ < 1.0). When transferred to a different domain, the precision of all classifiers is only slightly reduced, but the recall is significantly worse (by ~20–40% depending on the method). Zoobot offers the best overall performance in terms of precision and F1 score. When applied to real HSC observations, different methods agree well with visual labels of clear mergers, but can differ by more than an order of magnitude in predicting the overall fraction of major mergers. For the more challenging multi-class classification task to distinguish between pre-mergers, ongoing-mergers, and post-mergers, none of the methods in their current set-ups offer good performance, which could be partly due to the limitations in resolution and the depth of the data. In particular, ongoing-mergers and post-mergers are much more difficult to classify than pre-mergers. With the advent of better quality data (e.g. from JWST and Euclid), it is of great importance to improve our ability to detect mergers and distinguish between merger stages.

Machine learning-based detection of sleep-disordered breathing in hypertrophic cardiomyopathy

BackgroundHypertrophic cardiomyopathy (HCM) is often concomitant with sleep-disordered breathing (SDB), which can cause adverse cardiovascular events. Although an appropriate approach to SDB prevents cardiac remodelling, detection of concomitant SDB in...

Machine learning-based detection of sudden air pollutant level changes: impacts on public health

Machine learning-based detection of sudden air pollutant level changes: impacts on public health

Defect Detection of Cell Phone Screen Using a Faster Regional Convolutional Neural Network with Multi-head Attention Mechanism

Since the glass outer screen of a cell phone is the main sensory part of the human eye when using a cell phone, the advantages and disadvantages of the cell phone screen directly affect people's sense of use. Therefore, the defect detection requirements for cell phone screens are high and need to meet the needs of high-volume factory inspection. Most of the traditional defect detection methods use visual methods, the detection results are overly dependent on the subjectivity and experience of workers, the efficiency of this method is low, and the accuracy is poor. Currently, machine learning-based detection methods are applied in numerous industries. In this paper, a faster Regional Convolutional Neural Network (R-CNN) with multi-head attention mechanism for defect detection of cell phone screen is proposed. To enhance the network's capability in extracting feature information, a four-head attention mechanism is added to the last convolutional layer of the ResNet50 network. An improved Region of Interest (ROI) Align is proposed to replace the original ROI Pooling to reduce the localization error of cell phone screen defects. Replace the original Rectified Linear Unit (ReLU) activation function with the Copy Exponential Linear Unit (CELU) activation function to expedite the convergence capability of the network. Finally, by comparing with other classical model training, the evaluation results indicate that the proposed method achieved an average accuracy of 95.71%, which is a 5.34% improvement compared to the original faster R-CNN network.

Machine learning-based detection of acute psychosocial stress from body posture and movements

Investigating acute stress responses is crucial to understanding the underlying mechanisms of stress. Current stress assessment methods include self-reports that can be biased and biomarkers that are often based on complex laboratory procedures. A promising additional modality for stress assessment might be the observation of body movements, which are affected by negative emotions and threatening situations. In this paper, we investigated the relationship between acute psychosocial stress induction and body posture and movements. We collected motion data from N = 59 individuals over two studies (Pilot Study: N = 20, Main Study: N = 39) using inertial measurement unit (IMU)-based motion capture suits. In both studies, individuals underwent the Trier Social Stress Test (TSST) and a stress-free control condition (friendly-TSST; f-TSST) in randomized order. Our results show that acute stress induction leads to a reproducible freezing behavior, characterized by less overall motion as well as more and longer periods of no movement. Based on these data, we trained machine learning pipelines to detect acute stress solely from movement information, achieving an accuracy of 75.0±17.7%\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$${75.0 \\pm 17.7}{\\%}$$\\end{document} (Pilot Study) and 73.4±7.7%\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$${73.4 \\pm 7.7}{\\%}$$\\end{document} (Main Study). This, for the first time, suggests that body posture and movements can be used to detect whether individuals are exposed to acute psychosocial stress. While more studies are needed to further validate our approach, we are convinced that motion information can be a valuable extension to the existing biomarkers and can help to obtain a more holistic picture of the human stress response. Our work is the first to systematically explore the use of full-body body posture and movement to gain novel insights into the human stress response and its effects on the body and mind.

Effective and Efficient Android Malware Detection and Category Classification Using the Enhanced KronoDroid Dataset

Android is the most widely used mobile operating system and responsible for handling a wide variety of data from simple messages to sensitive banking details. The explosive increase in malware targeting this platform has made it imperative to adopt machine learning approaches for effective malware detection and classification. Since its release in 2008, the Android platform has changed substantially and there has also been a significant increase in the number, complexity, and evolution of malware that target this platform. This rapid evolution quickly renders existing malware datasets out of date and has a degrading impact on machine learning-based detection models. Many studies have been carried out to explore the effectiveness of various machine learning models for Android malware detection. Majority of these studies use datasets that have compiled using static or dynamic analysis of malware but the use of hybrid analysis approaches has not been addressed completely. Likewise, the impact of malware evolution has not been fully investigated. Although some of the models have achieved exceptional results, their performance deteriorated for evolving malware and they were also not effective against antidynamic malware. In this paper, we address both these limitations by creating an enhanced subset of the KronoDroid dataset and using it to develop a supervised machine learning model capable of detecting evolving and antidynamic malware. The original KronoDroid dataset contains malware samples from 2008 to 2020, making it effective for the detection of evolving malware and handling concept drift. Also, the dynamic features are collected by executing the malware on a real device, making it effective for handling antidynamic malware. We create an enhanced subset of this dataset by adding malware category labels with the help of multiple online repositories. Then, we train multiple supervised machine learning models and use the ExtraTree classifier to select the top 50 features. Our results show that the random forest (RF) model has the highest accuracy of 98.03% for malware detection and 87.56% for malware category classification (for 15 malware categories).

Robust Graph Autoencoder-Based Detection of False Data Injection Attacks Against Data Poisoning in Smart Grids

Machine learning-based detection of false data injection attacks (FDIAs) in smart grids relies on labeled measurement data for training and testing. The majority of existing detectors are developed assuming that the adopted datasets for training have correct labeling information. However, such an assumption is not always valid as training data might include measurement samples that are incorrectly labeled as benign, namely, adversarial data poisoning samples, which have not been detected before. Neglecting such an aspect makes detectors susceptible to data poisoning. Our investigations revealed that detection rates (DRs) of existing detectors significantly deteriorate by up to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$9 - 29\%$</tex-math></inline-formula> when subject to data poisoning in generalized and topology-specific settings. Thus, we propose a generalized graph neural network (GNN)-based anomaly detector that is robust against FDIAs and data poisoning. It requires only benign datasets for training and employs an autoencoder with Chebyshev graph convolutional recurrent layers with attention mechanism to capture the spatial and temporal correlations within measurement data. The proposed convolutional recurrent graph autoencoder (CR-GAE) model is trained and tested on various topologies (from 14, 39, and 118-bus systems). Due to such factors, it yields stable generalized detection performance that is degraded by only <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$1.6 - 3.7\%$</tex-math></inline-formula> in DR against high levels of data poisoning and unseen FDIAs in unobserved topologies.

A Repeated Game-Based Distributed Denial of Service Attacks Mitigation Method for Mining Pools

A Distributed Denial of Service (DDoS) attack is a prevalent issue in the blockchain network layer, causing significant revenue loss for honest mining pools. This paper introduces a novel method, the Repeated Game-based DDoS attack mitigation (RGD), to address this problem. Unlike traditional methods such as game theory and machine learning-based detection, the RGD method can effectively reflect the changes in mining revenue and strategies under different network-strength environments. In particular, we abstract the problem of DDoS mining pool revenue loss into a game revenue model and propose the subgame perfect equilibrium (SPE) approach to solve the optimal payoffs and pool strategies in various network environments. Furthermore, we address the returns of mining pools in an infinitely repeated game environment using the Two-Stage Repeated Game (TSRG) method, where the strategy varies with different network environments. The Matlab experimental simulation results indicate that as the network environment improves, the optimal mining strategies of mining pools are gradually shifting from honest strategies to launching DDoS attacks against each other. The RGD method can effectively represent the impact of changes in the network environment on the mining pool’s strategy selection and optimal revenue. Consequently, with the changing network environment, the optimal revenue of the mining pool only increases by 10% of the revenue loss during a DDoS attack.

AI Trojan Attack for Evading Machine Learning-based Detection of Hardware Trojans

The globalized semiconductor supply chain significantly increases the risk of exposing System-on-Chip (SoC) designs to hardware Trojans. While machine learning (ML) based Trojan detection approaches are promising due to their scalability as well as detection accuracy, ML-based methods themselves are vulnerable from Trojan attacks. In this paper, we propose a robust backdoor attack on ML-based Trojan detection algorithms to demonstrate this serious vulnerability. The proposed framework is able to design an AI Trojan and implant it inside the ML model that can be triggered by specific inputs. Experimental results demonstrate that the proposed AI Trojans can bypass state-of-the-art defense algorithms. Moreover, our approach provides a fast and cost-effective solution in achieving 100% attack success rate that outperforms state-of-the art methods based on adversarial attacks.

Computational simulation of virtual patients reduces dataset bias and improves machine learning-based detection of ARDS from noisy heterogeneous ICU datasets

Goal: Machine learning (ML) technologies that leverage large-scale patient data are promising tools predicting disease evolution in individual patients. However, the limited generalizability of ML models developed on single-center datasets, and their unproven performance in real-world settings, remain significant constraints to their widespread adoption in clinical practice. One approach to tackle this issue is to base learning on large multi-center datasets. However, such heterogeneous datasets can introduce further biases driven by data origin, as data structures and patient cohorts may differ between hospitals. Methods: In this paper, we demonstrate how mechanistic virtual patient (VP) modeling can be used to capture specific features of patients' states and dynamics, while reducing biases introduced by heterogeneous datasets. We show how VP modeling can be used for data augmentation through identification of individualized model parameters approximating disease states of patients with suspected acute respiratory distress syndrome (ARDS) from observational data of mixed origin. We compare the results of an unsupervised learning method (clustering) in two cases: where the learning is based on original patient data and on data derived in the matching procedure of the VP model to real patient data. Results: More robust cluster configurations were observed in clustering using the model-derived data. VP model-based clustering also reduced biases introduced by the inclusion of data from different hospitals and was able to discover an additional cluster with significant ARDS enrichment. Conclusions: Our results indicate that mechanistic VP modeling can be used to significantly reduce biases introduced by learning from heterogeneous datasets and to allow improved discovery of patient cohorts driven exclusively by medical conditions.

EVALUATING STOCHASTIC EPIGENETIC MUTATIONS: RELIABILITY, SUBTYPES, AND AN ALTERNATIVE DETECTION APPROACH

Abstract Stochastic Epigenetic Mutations (SEMs) have emerged as promising biomarkers for aging and age-related disorders. Conceptually, a SEM is defined as an outlier in DNA methylation (DNAme) value at a specific genomic site, compared to a given population or cohort. These mutations are seldom shared among subjects, emphasizing their potential to capture the heterogeneity of age-associated DNAme changes, and their cumulative count in individuals rises with age. We hypothesized that the original statistical method for SEM detection is not well suited for DNAme data and demonstrated its reliability constraints at both the individual and aggregate levels, using technical replicates from whole blood samples. In response to these challenges, we explored the factors influencing individual SEM reliability and identified best practices for SEM detection. We also developed an alternative machine learning-based detection method. Importantly, our classifier demonstrated improvements in the proportion of shared SEM and ICC scores when tested in an independent dataset with technical replicates, maintaining the associations of higher SEM loads with age, mortality, and cardiovascular disorders in the FHS study cohort. To support the wider application of our findings and address the need for SEM analysis tools, we have introduced a novel R package, SEMdetectR. Leveraging parallel programming, this package offers rapid SEM identification using both the original and new methods, accompanied by robust downstream analysis features.

Machine Learning-based Detection of Malaria Infection through Blood Sample Analysis

Machine Learning-based Detection of Malaria Infection through Blood Sample Analysis

Machine Learning-Based Detection and Severity Assessment of Sunflower Powdery Mildew: A Precision Agriculture Approach

Sunflower powdery mildew (Golovinomyces cichoracearum (DC.) V.P. Heluta) is a substantial threat &#x0D; to sunflower crops, causing significant yield loss. Traditional identification methods, based on human &#x0D; observation, fall short in providing early disease detection and quick control. This study presents a novel &#x0D; approach to this problem, utilizing machine learning for the early detection of powdery mildew in sunflowers. The disease severity levels were determined by training a Decision Trees model using matrix of soil, powdery mildew, stems, and leaf images obtained from original field images. It was detected disease severity levels of 18.14% and 5.56% in test images labeled as A and C, respectively. The model's demonstrated accuracy of 85% suggests high proficiency, indicating that machine learning, specifically the DTs model, holds promising prospects for revolutionizing disease control and diseases prevention in agriculture.

Machine learning-based detection of sarcopenic obesity and association with adverse outcomes in patients undergoing surgical treatment for spinal metastases.

The distributions and proportions of lean and fat tissues may help better assess the prognosis and outcomes of patients with spinal metastases. Specifically, in obese patients, sarcopenia may be easily overlooked as a poor prognostic indicator. The role of this body phenotype, sarcopenic obesity (SO), has not been adequately studied among patients undergoing surgical treatment for spinal metastases. To this end, here the authors investigated the role of SO as a potential prognostic factor in patients undergoing surgical treatment for spinal metastases. The authors identified patients who underwent surgical treatment for spinal metastases between 2010 and 2020. A validated deep learning approach evaluated sarcopenia and adiposity on routine preoperative CT images. Based on composition analyses, patients were classified with SO or nonsarcopenic obesity. After nearest-neighbor propensity matching that accounted for confounders, the authors compared the rates and odds of postoperative complications, length of stay, 30-day readmission, and all-cause mortality at 90 days and 1 year between the SO and nonsarcopenic obesity groups. A total of 62 patients with obesity underwent surgical treatment for spinal metastases during the study period. Of these, 37 patients had nonsarcopenic obesity and 25 had SO. After propensity matching, 50 records were evaluated that were equally composed of patients with nonsarcopenic obesity and SO (25 patients each). Patients with SO were noted to have increased odds of nonhome discharge (OR 6.0, 95% CI 1.69-21.26), 30-day readmission (OR 3.27, 95% CI 1.01-10.62), and 90-day (OR 4.85, 95% CI 1.29-18.26) and 1-year (OR 3.78, 95% CI 1.17-12.19) mortality, as well as increased time to mortality after surgery (12.60 ± 19.84 months vs 37.16 ± 35.19 months, p = 0.002; standardized mean difference 0.86). No significant differences were noted in terms of length of stay or postoperative complications when comparing the two groups (p > 0.05). The SO phenotype was associated with increased odds of nonhome discharge, readmission, and postoperative mortality. This study suggests that SO may be an important prognostic factor to consider when developing care plans for patients with spinal metastases.

SMDFbs: Specification-Based Misbehavior Detection for False Base Stations

The advancement of cellular communication technology has profoundly transformed human life. People can now watch high-definition videos anytime, anywhere, and aim for the implementation of advanced autonomous driving capabilities. However, the sustainability of such an environment is threatened by false base stations. False base stations execute attacks in the Radio Access Network (RAN) of cellular systems, adversely affecting the network or its users. To address this challenge, we propose a behavior rule specification-based false base station detection system, SMDFbs. We derive behavior rules from the normal operations of base stations and convert these rules into a state machine. Based on this state machine, we detect network anomalies and mitigate threats. We conducted experiments detecting false base stations in a 5G RAN simulator, comparing our system with seven machine learning-based detection techniques. The experimental results showed that our proposed system achieved a detection accuracy of 98% and demonstrated lower overhead compared to other algorithms.

IoT Botnet Detection Using Autoencoders and Decision Trees

The use of IoT devices has grown rapidly, leading to an increase in cyber attacks that pose greater security and privacy threats than ever before. One such threat is botnet attacks on IoT devices. An IoT botnet is a group of Internet-connected IoT devices infected with malware and remotely controlled by an attacker. Machine learning techniques can be employed to detect botnet attacks. The use of machine learning-based detection methods has been shown to be effective in identifying cyber attacks. The performance of the detection system in machine learning can be improved by utilizing data reduction methods. The data reduction process in classification is used to overcome the problem of scalability and computation resources in the IoT. This paper proposes a detection system using the Autoencoder reduction method and the Decision tree classification method. The test results demonstrate that the Deep Autoencoder algorithm can reduce data and memory usage from 1.62 GB to 75.9 MB, while also improving the performance of decision tree classification, resulting in a high level of accuracy up to 100%. The Autoencoder approach in conjunction with the Decision Tree exhibits superior capabilities compared to previous studies.

Numerical Feature Selection and Hyperbolic Tangent Feature Scaling in Machine Learning-Based Detection of Anomalies in the Computer Network Behavior

Anomaly-based intrusion detection systems identify the computer network behavior which deviates from the statistical model of typical network behavior. Binary classifiers based on supervised machine learning are very accurate at classifying network data into two categories: normal traffic and anomalous activity. Most problems with supervised learning are related to the large amount of data required to train the classifiers. Feature selection can be used to reduce datasets. The goal of feature selection is to select a subset of relevant input features to optimize the evaluation and improve performance of a given classifier. Feature scaling normalizes all features to the same range, preventing the large size of features from affecting classification models or other features. The most commonly used supervised machine learning models, including decision trees, support vector machine, k-nearest neighbors, weighted k-nearest neighbors and feedforward neural network, can all be improved by using feature selection and feature scaling. This paper introduces a new feature scaling technique based on a hyperbolic tangent function and damping strategy of the Levenberg–Marquardt algorithm.

Machine-Learning-Based Single-Molecule Quantification of Circulating MicroRNA Mixtures.

MicroRNAs (miRs) are small noncoding RNAs that regulate gene expression and are emerging as powerful indicators of diseases. MiRs are secreted in blood plasma and thus may report on systemic aberrations at an early stage via liquid biopsy analysis. We present a method for multiplexed single-molecule detection and quantification of a selected panel of miRs. The proposed assay does not depend on sequencing, requires less than 1 mL of blood, and provides fast results by direct analysis of native, unamplified miRs. This is enabled by a novel combination of compact spectral imaging and a machine learning-based detection scheme that allows simultaneous multiplexed classification of multiple miR targets per sample. The proposed end-to-end pipeline is extremely time efficient and cost-effective. We benchmark our method with synthetic mixtures of three target miRs, showcasing the ability to quantify and distinguish subtle ratio changes between miR targets.

Machine learning-based detection of irrigation in Vojvodina (Serbia) using Sentinel-2 data

ABSTRACT With rapid population growth and the high influence of climate change on agricultural productivity, providing enough food is the main challenge in the 21st century. Irrigation, as a hydrological artificial process, has an indispensable role in achieving that goal. However, high pressure and demand on water resources could lead to serious problems in water consumption. Knowing information about the spatial distribution of irrigation parcels is essential to many aspects of Earth system science and global change research. To extract this knowledge for the main agricultural region in Serbia located in the moderate continental area, we utilized optical satellite Sentinel-2 data and collected ground truth data needed to train the machine learning model. Both satellite imagery and ground truth data were collected for the three most irrigated crops, maize, soybean, and sugar beet during 3 years (2020–2022) characterized by different weather conditions. This data was then used for training the Random Forest-based models, separately for each crop type, differentiating irrigated and rainfed crops on the parcel level. Finally, the models were run for the whole territory of Vojvodina generating 10 m resolution maps of irrigated three crops of interest. With overall accuracy for crops per year (2020: 0.76; 2021: 0.78; 2022: 0.84) results showed that this method could be successfully used for detecting the irrigation of three crops of interest. This was confirmed by validation with the national dataset from Public Water Management Company “Vode Vojvodine” which revealed that classification maps had an accuracy of 76%. These maps further allow us to understand the spatial dynamics of the most important irrigated crops and can serve for the improvement of sustainable agricultural water management.