Reduction In False Alarm Rate Research Articles

Hybrid Learning Model for intrusion detection system: A combination of parametric and non-parametric classifiers

The growing digital transformation has increased the need for effective intrusion detection systems. Traditional intrusion detection systems face challenges in accurately classifying complex patterns. To address this issue, this study proposed a Hybrid Learning Model (HLM) that combines both parametric and non-parametric classifiers. The proposed HLM consist of two stages: the first stage employs a non-parametric Base Learner (np-BL) to analyze the data patterns and the second stage involves meta-modelling to generalize the overall performance of the model, named the Parametric Meta-Learning (PML) model. The proposed HLM blends the outcomes of np-BL and PML models using a stacking ensemble. As a base learning model K-Nearest Neighbors (KNN), Decision Tree (DT), Random Forest (RF), Gradient Boosting Machine (GBM), and Support Vector Classification with Radial Basis Function (SVC-RBF), are adopted from a non-parametric classifier group. The parametric classifiers Logistic Regression (LR), Naïve Bayes Classifier (NBC), Linear Discriminant Analysis (LDA), Quadratic Discriminant Analysis (QDA) and Support Vector Machine with linear kernel (Linear SVM) were used as meta-models. The HLM, as proposed, enhances the adaptability and robustness of the model by combining non-parametric and parametric models. To evaluate the competence of the proposed HLM, a performance analysis was conducted using the NSL-KDD, UNSW-NB15, and CICIDS2017 datasets. The effectiveness was assessed using various metrics, including classification accuracy, precision, recall, F1-Score (F1), Receiver Operating Characteristic (ROC) curve, Detection Rate (DR), and False Alarm Rate (FAR). The proposed HLM achieves a better accuracy rate across different datasets when compared with the existing models. The achieved accuracies are 99.02 %, 99.98 % and 99.63 % for the NSL-KDD, UNSW-NB15, and CICIDS2017 datasets respectively. Furthermore, the HLM gave a significant reduction in FAR, with values of 0.0126, 0.0001, and 0.0016 for the above-mentioned datasets.

Network anomaly detection using Deep Autoencoder and parallel Artificial Bee Colony algorithm-trained neural network

Cyberattacks are increasingly becoming more complex, which makes intrusion detection extremely difficult. Several intrusion detection approaches have been developed in the literature and utilized to tackle computer security intrusions. Implementing machine learning and deep learning models for network intrusion detection has been a topic of active research in cybersecurity. In this study, artificial neural networks (ANNs), a type of machine learning algorithm, are employed to determine optimal network weight sets during the training phase. Conventional training algorithms, such as back-propagation, may encounter challenges in optimization due to being entrapped within local minima during the iterative optimization process; global search strategies can be slow at locating global minima, and they may suffer from a low detection rate. In the ANN training, the Artificial Bee Colony (ABC) algorithm enables the avoidance of local minimum solutions by conducting a high-performance search in the solution space but it needs some modifications. To address these challenges, this work suggests a Deep Autoencoder (DAE)-based, vectorized, and parallelized ABC algorithm for training feed-forward artificial neural networks, which is tested on the UNSW-NB15 and NF-UNSW-NB15-v2 datasets. Our experimental results demonstrate that the proposed DAE-based parallel ABC-ANN outperforms existing metaheuristics, showing notable improvements in network intrusion detection. The experimental results reveal a notable improvement in network intrusion detection through this proposed approach, exhibiting an increase in detection rate (DR) by 0.76 to 0.81 and a reduction in false alarm rate (FAR) by 0.016 to 0.005 compared to the ANN-BP algorithm on the UNSW-NB15 dataset. Furthermore, there is a reduction in FAR by 0.006 to 0.0003 compared to the ANN-BP algorithm on the NF-UNSW-NB15-v2 dataset. These findings underscore the effectiveness of our proposed approach in enhancing network security against network intrusions.

CACM-Net: Daytime Cloud Mask for AGRI Onboard the FY-4A Satellite

Accurate cloud detection is a crucial initial stage in optical satellite remote sensing. In this study, a daytime cloud mask model is proposed for the Advanced Geostationary Radiation Imager (AGRI) onboard the Fengyun 4A (FY-4A) satellite based on a deep learning approach. The model, named “Convolutional and Attention-based Cloud Mask Net (CACM-Net)”, was trained using the 2021 dataset with CALIPSO data as the truth value. Two CACM-Net models were trained based on a satellite zenith angle (SZA) < 70° and >70°, respectively. The study evaluated the National Satellite Meteorological Center (NSMC) cloud mask product and compared it with the method established in this paper. The results indicate that CACM-Net outperforms the NSMC cloud mask product overall. Specifically, in the SZA < 70° subset, CACM-Net enhances accuracy, precision, and F1 score by 4.8%, 7.3%, and 3.6%, respectively, while reducing the false alarm rate (FAR) by approximately 7.3%. In the SZA > 70° section, improvements of 12.2%, 19.5%, and 8% in accuracy, precision, and F1 score, respectively, were observed, with a 19.5% reduction in FAR compared to NSMC. An independent validation dataset for January–June 2023 further validates the performance of CACM-Net. The results show improvements of 3.5%, 2.2%, and 2.8% in accuracy, precision, and F1 scores for SZA < 70° and 7.8%, 11.3%, and 4.8% for SZA > 70°, respectively, along with reductions in FAR. Cross-comparison with other satellite cloud mask products reveals high levels of agreement, with 88.6% and 86.3% matching results with the MODIS and Himawari-9 products, respectively. These results confirm the reliability of the CACM-Net cloud mask model, which can produce stable and high-quality FY-4A AGRI cloud mask results.

Precise and low-power closed-loop neuromodulation through algorithm-integrated circuit co-design.

Implantable neuromodulation devices have significantly advanced treatments for neurological disorders such as Parkinson's disease, epilepsy, and depression. Traditional open-loop devices like deep brain stimulation (DBS) and spinal cord stimulators (SCS) often lead to overstimulation and lack adaptive precision, raising safety and side-effect concerns. Next-generation closed-loop systems offer real-time monitoring and on-device diagnostics for responsive stimulation, presenting a significant advancement for treating a range of brain diseases. However, the high false alarm rates of current closed-loop technologies limit their efficacy and increase energy consumption due to unnecessary stimulations. In this study, we introduce an artificial intelligence-integrated circuit co-design that targets these issues and using an online demonstration system for closed-loop seizure prediction to showcase its effectiveness. Firstly, two neural network models are obtained with neural-network search and quantization strategies. A binary neural network is optimized for minimal computation with high sensitivity and a convolutional neural network with a false alarm rate as low as 0.1/h for false alarm rejection. Then, a dedicated low-power processor is fabricated in 55 nm technology to implement the two models. With reconfigurable design and event-driven processing feature the resulting application-specific integrated circuit (ASIC) occupies only 5mm2 silicon area and the average power consumption is 142 μW. The proposed solution achieves a significant reduction in both false alarm rates and power consumption when benchmarked against state-of-the-art counterparts.

Assessing attention and impulsivity in the variable stimulus duration and variable intertrial interval rodent continuous performance test schedules using dopamine receptor antagonists in female C57BL/6JRj mice

RationaleDopaminergic dysfunction is implicated in disorders of impulsivity and inattention. The rodent continuous performance test (rCPT) has been used to quantify changes in attention and impulsivity.ObjectiveTo examine the roles of dopamine receptors in attention and impulsivity behaviours measured in the rCPT variable stimulus duration (vSD) and the variable intertrial interval schedules (vITI) using DA receptor antagonists.MethodsTwo cohorts of 35 and 36 female C57BL/6JRj mice were examined separately in the rCPT, vSD, and vITI schedules, respectively. Both cohorts received antagonists of the following receptors: D1/5 (SCH23390, SCH: 0.01, 0.02, 0.04 mg/kg) and D2/3 (raclopride, RAC 0.03, 0.10, 0.30 mg/kg) in consecutive balanced Latin square designs with flanking reference measurements. The antagonists were subsequently examined for effects on locomotor activity.ResultsSCH showed similar effects in both schedules, and the effects were reference-dependent in the vITI schedule. SCH reduced responding, but improved response accuracy, impulsivity, discriminability, and locomotor activity. RAC showed mixed effects on responsivity, but improved accuracy and discriminability. The discriminability improvement was driven by an increase in hit rate in the vITI schedule and a reduction in false alarm rate in the vSD schedule. RAC also decreased locomotor activity.ConclusionBoth D1/5 and D2/3 receptor antagonism reduced responding, but the outcome on discriminability differed, stemming from individual effects on hit and false alarm rate, and the weight of omissions within the calculation. The effects of SCH and RAC suggest that endogenous DA increases responding and impulsivity, but reduces accuracy and shows mixed effects on discriminability.

Scalable anomaly-based intrusion detection for secure Internet of Things using generative adversarial networks in fog environment

The data generated exponentially by a massive number of devices in the Internet of Things (IoT) are extremely high-dimensional, large-scale, non-labeled, which poses great challenges to timely analysis and effective decision making for anomaly detection in IoT. In this paper, we propose a novel unsupervised deep learning method to identify anomalies against IoT networks, which exploits Bidirectional Generative Adversarial Networks (BiGAN) to build model on normal IoT data. The model introduces Wasserstein distance to capture and learn the distribution of high-dimensional raw data and focuses on latent representations using an auxiliary classifier. A cycle consistency connection between data is designed to prevent information loss that helps to reduce false positive rate. The model detects outliers by utilizing reconstruction error in feature space. Another challenge facing the current anomaly detection solutions is their limited scalability, which restricts capability in handling big IoT data. This issue is resolved by deploying and jointly training the proposed method in a fog computing environment. The anomaly-based intrusion detection can be scalable by leveraging the flexibility of fog computing, which contributes to supporting efficient detection. Experimental results on two recent datasets (i.e., UNSW-NB15 and CIC-IDS2017) validate that the proposed method achieves 4% increase in accuracy and 4% reduction in false alarm rate than the state-of-the-art methods while keeping computational efficiency.

Data augmentation in hotspot detection based on generative adversarial network

Background: In datasets for hotspot detection in physical verification, data are predominantly composed of non-hotspot samples with only a small percentage of hotspot ones; this leads to the class imbalance problem, which usually hinders the performance of classifiers. Aim: We aim to enrich datasets by applying a data augmentation technique. Approach: We propose a data augmentation flow-based generative adversarial network (GAN) to generate high-resolution hotspot samples. Results: We evaluated our flow with the current state-of-the-art convolutional neural network hotspot classifier by comparison with conventional data augmentation techniques. Experimental results demonstrate that the accuracy improvement of our work can reach 3% at the same false alarm rate and the false alarm rate reduction can reach 5% at the same accuracy. Conclusions: Our study demonstrates that rational hotspot classification can improve the efficiency of data. It also highlights the potential of GAN to generate complicated layout patterns.

Rain False-Alarm-Rate Reduction for CSCAT

In tropical regions, Ku-band scatterometer observations are affected by heavy rain, and affected data are labeled in the quality control (QC) step during wind product generation. This is achieved by setting thresholds for QC indicators. Among the applied indicators, it has been shown that Joss can be beneficially applied for reducing the false alarm rate (FAR) for Ku-band observations for data sets collocated to C-band observations. In this letter, the FAR reduction method based on Joss is further generalized to be tested without collocated C-band observations, which extension is subsequently applied to the CSCAT wind products. Results prove the effectiveness of the FAR reduction method without C-band collocations for Ku-band scatterometers. Verification with rain rates from the Global Precipitation Mission (GPM) proves the capability of the recruited data set to benefit nowcasting applications. Moreover, the results of this research indicate the consistency of products in rainy conditions for the new rotating-fan-beam CSCAT and the existing rotating-pencil-beam Ku-band scatterometers. Further research would be to analyze detailed rain effects in different rain development stages in a wind vector cell (WVC) for tropical regions.

Reduction of False Alarm Rate in SAR-MTI Based on Weighted Kurtosis

Moving target indication (MTI) is considered one of the most important applications of synthetic aperture radar (SAR) in military operations and traffic monitoring. Although many studies have focused on detectors based on the statistical clutter models, a mismatch between the measured data and the applied statistical model often leads to unreliable MTI results, particularly in terms of false alarm rates. To reduce the number of false alarms, we propose an efficient MTI scheme consisting of conventional MTI techniques (the displaced phase center antenna (DPCA) and the interferogram's magnitude and phase (IMP) methods), which operate in dual-receive antenna (DRA) mode in an SAR system. These techniques are coupled with a new discrimination stage based on a new detection metric-weighted kurtosis. Using simulated and real measured data from TerraSAR-X, the proposed MTI scheme demonstrates robust performance in the reduction of false alarm rates with only a slight increase in the computation time compared with conventional schemes.

Network intrusion detection based on deep learning model optimized with rule-based hybrid feature selection

ABSTRACT Network Intrusion Detection System (NIDS) is often used to classify network traffic in an attempt to protect computer systems from various network attacks. A major component for building an efficient intrusion detection system is the preprocessing of network traffic and identification of essential features which is essential for building robust classifier. In this study, a NIDS based on deep learning model optimized with rule-based hybrid feature selection is proposed. The architecture is divided into three phases namely: hybrid feature selection, rule evaluation and detection. Several search methods and attribute evaluators were combined for features selection to enhance experimentation and comparison. The results obtained showed that the number of selected features will not affect the detection accuracy of the feature selection algorithms, but directly proportional to the performance of the base classifier. Results from the performance comparison proved that the proposed method outperforms other related methods with reduction of false alarm rate, high accuracy rate, reduced training and testing time of 1.2%, 98.8%, 7.17s and 3.11s, respectively. Finally, the simulation experiments on standard evaluation metrics showed that the proposed method is suitable for attack classification in NIDS.

Detection of Stock Price Manipulation Using Kernel Based Principal Component Analysis and Multivariate Density Estimation

Stock price manipulation uses illegitimate means to artificially influence market prices of several stocks. It causes massive losses and undermines investors’ confidence and the integrity of the stock market. Several existing research works focused on detecting a specific manipulation scheme using supervised learning but lacks the adaptive capability to capture different manipulative strategies. This begets the assumption of model parameter values specific to the underlying manipulation scheme. In addition, supervised learning requires the use of labelled data which is difficult to acquire due to confidentiality and the proprietary nature of trading data. The proposed research establishes a detection model based on unsupervised learning using Kernel Principal Component Analysis (KPCA) and applied increased variance of selected latent features in higher dimensions. A proposed Multidimensional Kernel Density Estimation (MKDE) clustering is then applied upon the selected components to identify abnormal patterns of manipulation in data. This research has an advantage over the existing methods in overcoming the ambiguity of assuming values of several parameters, reducing the high dimensions obtained from conventional KPCA and thereby reducing computational complexity. The robustness of the detection model has also been evaluated when two or more manipulative activities occur within a short duration of each other and by varying the window length of the dataset fed to the model. Validation on multiple datasets and a comprehensive assessment of the model performance has been conducted without providing any prior information about the location of the manipulation. The results show a significant performance enhancement in terms of the F-measure values and a significant reduction in false alarm rate (FAR) has been achieved.

Real-Time Quality-Aware PPG Waveform Delineation and Parameter Extraction for Effective Unsupervised and IoT Health Monitoring Systems

In this paper, we present a real-time quality-aware pulse waveform delineation and parameter extraction method for accurate and reliable measurements of pulse parameters from photoplethysmogram (PPG) signals. It consists of three major stages: the PPG signal quality assessment (PPG-SQA) using autocorrelation function (ACF) and number of threshold-crossings (NTC) features, the zero-frequency resonator (ZFR) based pulse onset and peak determination, and the pulse parameter extraction. The method is implemented on the Arduino Due with a 32-bit Atmel SAM3X8E ARM Cortex-M3 CPU, 512-kB flash memory, 96-kB SRAM, and 84-MHz clock speed. The method is evaluated on the recorded PPG signals and three standard PPG databases. The PPG-SQA algorithm achieves an average sensitivity (Se)=98.62%, specificity (Sp)=97.37%, and overall accuracy (OA)=98.09%. The algorithm achieves an average Se=99.88%, positive predictivity (Pp)=99.89, Se=99.82%, and Pp=99.95%, respectively with the delineation errors (mean ± standard deviation) of 8.45 ± 9.39 $ms$ and 0.23 ± 1.33 $ms$ for finding onsets and peaks, respectively. The statistical analysis demonstrates that the parameter measurement errors are minimum for most of the pulse cycles. Results show that our quality-aware PPG analysis scheme can achieve a false alarm rate reduction (FARR) of 97.36% which outperforms the other existing SQA algorithms. It can lead to save transmission and processing energy from 8.33% to 95.63% and 8.33% to 59.77% for a duration from 5 to 60 s, respectively. The method has great potential for low-energy IoT and unsupervised health monitoring devices.

RATIR Follow-up of LIGO/Virgo Gravitational Wave Events

Abstract We have recently witnessed the first multi-messenger detection of colliding neutron stars through gravitational waves (GWs) and electromagnetic (EM) waves (GW 170817) thanks to the joint efforts of LIGO/Virgo and Space/Ground-based telescopes. In this paper, we report on the RATIR follow-up observation strategies and show the results for the trigger G194575. This trigger is not of astrophysical interest; however, it is of great interest to the robust design of a follow-up engine to explore large sky-error regions. We discuss the development of an image-subtraction pipeline for the six-color, optical/NIR imaging camera RATIR. Considering a two-band (i and r) campaign in the fall of 2015, we find that the requirement of simultaneous detection in both bands leads to a factor ∼10 reduction in false alarm rate, which can be further reduced using additional bands. We also show that the performance of our proposed algorithm is robust to fluctuating observing conditions, maintaining a low false alarm rate with a modest decrease in system efficiency that can be overcome utilizing repeat visits. Expanding our pipeline to search for either optical or NIR detections (three or more bands), considering separately the optical riZ and NIR YJH bands, should result in a false alarm rate ≈1% and an efficiency ≈90%. RATIR’s simultaneous optical/NIR observations are expected to yield about one candidate transient in the vast 100 deg2 LIGO error region for prioritized follow-up with larger aperture telescopes.

Scalable and Robust ANN Based Cooperative Spectrum Sensing for Cognitive Radio Networks

Cognitive radio network (CRN) supports dynamic spectrum access addressing spectrum scarcity issue experienced by today’s wireless communication network. Sensing is an important task and cooperative spectrum sensing is used for improving detection performance of spectrum. The sensing information from individual secondary users is sent to fusion center to infer a common global decision regarding primary user’s presence. Various fusion schemes for decision making are proposed in the literature but they lack scalability and robustness. We have introduced artificial neural network (ANN) at fusion center thereby achieving significant improvement in detection performance and reduction in false alarm rate as compared to conventional schemes. The proposed ANN scheme is found capable to deal with scalability of CRN with consistent performance. Further, SNR of individual Secondary user is taken into consideration in decision making at fusion center. Moreover the proposed scheme is tested against security attack (malicious users) and inadvertent errors occurring at SUs are found to be robust.

HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection

The development of an anomaly-based intrusion detection system (IDS) is a primary research direction in the field of intrusion detection. An IDS learns normal and anomalous behavior by analyzing network traffic and can detect unknown and new attacks. However, the performance of an IDS is highly dependent on feature design, and designing a feature set that can accurately characterize network traffic is still an ongoing research issue. Anomaly-based IDSs also have the problem of a high false alarm rate (FAR), which seriously restricts their practical applications. In this paper, we propose a novel IDS called the hierarchical spatial-temporal features-based intrusion detection system (HAST-IDS), which first learns the low-level spatial features of network traffic using deep convolutional neural networks (CNNs) and then learns high-level temporal features using long short-term memory networks. The entire process of feature learning is completed by the deep neural networks automatically; no feature engineering techniques are required. The automatically learned traffic features effectively reduce the FAR. The standard DARPA1998 and ISCX2012 data sets are used to evaluate the performance of the proposed system. The experimental results show that the HAST-IDS outperforms other published approaches in terms of accuracy, detection rate, and FAR, which successfully demonstrates its effectiveness in both feature learning and FAR reduction.

Reduction of False Alarm Rate by using K-NN and Naive Bayes: A Review

Reduction of False Alarm Rate by using K-NN and Naive Bayes: A Review

Neural Network Based Protection of Software Defined Network Controller against Distributed Denial of Service Attacks

Software Defined Network (SDN) is a new architecture for network management and its main concept is centralizing network management in the network control level that has an overview of the network and determines the forwarding rules for switches and routers (the data level). Although this centralized control is the main advantage of SDN, it is also a single point of failure. If this main control is made unreachable for any reason, the architecture of the network is crashed. A distributed denial of service (DDoS) attack is a threat for the SDN controller which can make it unreachable. In the previous researches in DDoS detection in SDN, not enough work has been done on improvement of accuracy in detection. The proposed solution of this research can detect DDoS attack on SDN controller with a noticeable accuracy and prevents serious damage to the controller. For this purpose, fast entropy of each flow is computed at certain time intervals. Then, by the use of adaptive threshold, the possibility of a DDoS attack is investigated. In order to achieve more accuracy, another method, computing flow initiation rate, is used alongside. After observation of the results of this two methods, according to the described conditions, the existence of an attack is confirmed or rejected, or this decision is made at the next step of the algorithm, with further study of flow statistics of network switches by the perceptron neural network. The evaluation results show that the proposed algorithm has been able to make a significant improvement in detection rate and a reduction in false alarm rate compared to closest previous work, besides maintaining the average detection time on an acceptable level.

지상 클러터 환경에서 접근표적 감지를 위한 오경보율 감소기법 연구

지상 클러터 환경에서 접근표적 감지를 위한 오경보율 감소기법 연구

Automatic tuning strategies for model-based diagnosis methods applied to a rocket engine demonstrator

Rocket engines are complex and critical systems mostly relying on simple redlines strategies for monitoring the main functional parameters. This approach is typical on expendable rockets with non-adjustable valves because in case of failure the only possible action is to cut off the engine. Anyway years of experiments on engine firings or subsystem benches show that there is space for an update of the monitoring strategies because this would lead to a reduction of false alarm rates and to an improved exploitation of test hardware. Moreover real-time diagnosis methods will be necessary in case of design of intelligent rocket engine controllers for next generation reusable launchers. The work presented in this paper is part of a demonstration project of new diagnosis tools for rocket engines applied to the cryogenic combustion bench Mascotte. This bench developed by ONERA and CNES is used to analyze combustion and nozzle expansion characteristics of cryogenic fuels such as oxygen and hydrogen or methane. Model-based diagnosis tools have been developed for the combustion chamber and nozzle water cooling circuit. The basis was the setup of simplified expressions for modeling the functional behavior of the water circuit and then the development of predictive strategies such as parameter identification and Kalman filters. Anomalous event detection is obtained via residual analysis based on a CUSUM test. This paper presents the new automatic tuning strategies for the CUSUM threshold setting and the detection results obtained on Mascotte firing data.

Fault detection and diagnosis of chiller using Bayesian network classifier with probabilistic boundary

False alarm rate (FAR) is an important evaluating indicator when chiller fault detection and diagnosis (FDD) system is applied on site, and higher FAR will not be accepted by users and manufacturers. When we use Bayesian network classifier (BNC) to operate FDD process, it is hard to keep the FAR within an acceptable range when the class node contained the normal operating condition. So a practical chiller FDD methodology is proposed. At first, a probabilistic boundary limit under the normal operating condition is integrated in the BNC to reduce the FAR in chiller FDD process. Then, we add the site information to the BNC to solve the problem that missed detection rate (MDR) rises caused by the reduction of FAR. Evaluation of the methodology was made on a 90-ton water-cooled centrifugal chiller reported in ASHRAE RP-1043. The results show that the FAR decreases from 22.7% to 4.7% after integrating the probabilistic boundary, and the MDR of refrigerant overcharge and refrigerant leakage decreases from 27.6% and 9.4–7.6% and 4.5% respectively after adding the site information.