White-box Approach Research Articles

Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities

The application of Artificial Intelligence (AI) and Machine Learning (ML) to cybersecurity challenges has gained traction in industry and academia, partially as a result of widespread malware attacks on critical systems such as cloud infrastructures and government institutions. Intrusion Detection Systems (IDS), using some forms of AI, have received widespread adoption due to their ability to handle vast amounts of data with a high prediction accuracy. These systems are hosted in the organizational Cyber Security Operation Center (CSoC) as a defense tool to monitor and detect malicious network flow that would otherwise impact the Confidentiality, Integrity, and Availability (CIA). CSoC analysts rely on these systems to make decisions about the detected threats. However, IDSs designed using Deep Learning (DL) techniques are often treated as black box models and do not provide a justification for their predictions. This creates a barrier for CSoC analysts, as they are unable to improve their decisions based on the model’s predictions. One solution to this problem is to design explainable IDS (X-IDS). This survey reviews the state-of-the-art in explainable AI (XAI) for IDS, its current challenges, and discusses how these challenges span to the design of an X-IDS. In particular, we discuss black box and white box approaches comprehensively. We also present the tradeoff between these approaches in terms of their performance and ability to produce explanations. Furthermore, we propose a generic architecture that considers human-in-the-loop which can be used as a guideline when designing an X-IDS. Research recommendations are given from three critical viewpoints: the need to define explainability for IDS, the need to create explanations tailored to various stakeholders, and the need to design metrics to evaluate explanations.

On the risk of confusing interpretability with explicability

This Comment explores the implications of a lack of tools that facilitate an explicable utilization of epistemologically richer, but also more involved white-box approaches in AI. In contrast, advances in explainable artificial intelligence for black-box approaches have led to the availability of semi-standardized and attractive toolchains that offer a seemingly competitive edge over inherently interpretable white-box models in terms of intelligibility towards users. Consequently, there is a need for research on efficient tools for rendering interpretable white-box approaches in AI explicable to facilitate responsible use.

Challenges and solutions in adapting an AI-powered health management tool for South African

Abstract Background Africa has the lowest density of healthcare workers in the world and artificial intelligence (AI) technology can assist doctors and patients to bridge that gap. This paper describes the 3 challenges we identified to adapt Ada, an AI-powered health management tool, to assist pregnant women and mothers in South Africa (SA). Challenges and solutions Localization Maternal and child health challenges in SA differ from those in the West. We adapted Ada's knowledge base to account for regional differences in incidence and disease presentation. We optimized 51 maternal and pediatric health conditions. Readability An improved readability leads to better understanding of medical content. We calculated the readability score of Ada's consumer-facing medical content using the Automated Readability Index and deemed it too high (grade 11.0±1.8, range=5.8-17.5). Using Content Design London's Readability Guidelines, we reduced the readability score of Ada's content to below grade 8 (7.4±0.8, range=4.6-10.2) while maintaining medical accuracy. Different approaches to AI The majority of medical research is conducted in high-income countries and tends to recruit people with high literacy levels. This means the differences in underrepresented populations and low-income countries are not captured in medical research. When this data is applied to technology and AI, it can lead to bias. To reduce this bias, we use a white-box approach. This allows us to deliver solutions to meet the needs of a specific population. Using the expertise of medical doctors with clinical experience in low-income areas, we curated a medical knowledge base that was specific to our target population. Conclusions AI solutions can only improve health outcomes in low-income countries if they are designed and adapted with the needs of the local population in mind. By partnering with local health departments, AI health companies can assist doctors and patients to reduce the burden on vulnerable healthcare systems. Key messages White-box AI-approach makes it possible to build AI solutions that capture the differences in underrepresented populations and low-income countries. By partnering with local health departments, AI health companies can assist patients and doctors in reducing the burden on vulnerable healthcare systems.

A Survey of Belief Rule-Base Expert System

The belief rule-base (BRB) model is a new intelligent expert system with the characteristics of both expert system and data-driven model. In BRB there are many if-then rules which use belief degrees to express various types of uncertain information, including fuzziness, randomness, and ignorance. As a semi-quantitative modeling tool for complex systems, BRB has the superiorities of dealing both numerical quantitative data and linguistic qualitative knowledge that are derived from heterogeneous sources. Moreover, it is also a white box approach which can provide direct access and transparency to decision makers and stakeholders. Currently, BRB has been widely applied in many fields, such as decision making, reliability evaluation, network security situation awareness, fault diagnosis, and so on. To fully demonstrate the progress of BRB, the original BRB, and some evolution forms are introduced in this article.

System risk quantification and decision making support using functional modeling and dynamic Bayesian network

Risk-informed decision-making requires a probabilistic assessment of the likelihood of success of control action, given the system status. This paper presents a systematic state transition modeling approach integrating dynamic probabilistic risk assessment with a decision-making process using a dynamic Bayesian network (DBN) coupled with functional modeling. A functional model designed with multilevel flow modeling (MFM) technique was used to build a system state structure inferred by energy, mass, and information flow so that one can verify the developed model with respect to system functionality. The MFM model represents the causal relationship among the nodes, which captures the structure of process parameters and control units. Each node may have multiple possible states, and the DBN structured by the MFM model represents the time-domain transitions among the defined states. The MFM-DBN integrated state transition modeling is a white-box approach that allows one to draw the system's risk profile by updating the system states and supports the decisions probabilistically with physical inference. An example of a simple heating system has been used to illustrate this process, including decision-making support based on quantitative risk profile. For demonstrating its applicability to a complex system operational decision making, a case study of station blackout accident scenario leading to the seal loss of coolant accident in a nuclear power plant is presented. The proposed approach effectively provided the risk profile along time for each option so that the operators can make the best decision, which minimizes the plant risk.

Analysis of Bond Portfolios in an ALM Context

A system is implemented that simulates a bond portfolio over the long-term of liabilities. It pays all liabilities and extracts continuously a fixed percentage of remaining liabilities to stakeholders while maintaining a strategic asset allocation. This fixed percentage is proposed as return measure in an ALM-context with risk derived from its distribution. Tabled inputs completed with simple coherent inductive models for interest rate changes and spread changes allow to map return and risk as function of market probability in a deterministic white-box approach. Aim is to provide insight in the dependency of return potential and risk drivers on the bond allocation, on assumptions and on market conditions in order to improve allocations, understand risk, specify risk-appetite, facilitate capital management and budgeting. Examples are based on an actual €10billion insurer portfolio. Current market conditions favor short bond duration, reducing government bonds and mixing in some high yield bonds. Duration matching now decreases return potential and increases risk so that Solvency 2 regulation is counterproductive from a quantitative risk perspective. Bond portfolios are less risky in an ALM-context than in an assets-context due to the mitigation of loss by a balance of opposing forces when bonds are reinvested. Their downside is resilient to increasing correlation. This system is the kernel of a system for all assets but first focus is exclusively on bonds for their weight in current allocations and their pricing characteristics.

Deep Learning for Gravitational-Wave Data Analysis: A Resampling White-Box Approach.

In this work, we apply Convolutional Neural Networks (CNNs) to detect gravitational wave (GW) signals of compact binary coalescences, using single-interferometer data from real LIGO detectors. Here, we adopted a resampling white-box approach to advance towards a statistical understanding of uncertainties intrinsic to CNNs in GW data analysis. We used Morlet wavelets to convert strain time series to time-frequency images. Moreover, we only worked with data of non-Gaussian noise and hardware injections, removing freedom to set signal-to-noise ratio (SNR) values in GW templates by hand, in order to reproduce more realistic experimental conditions. After hyperparameter adjustments, we found that resampling through repeated k-fold cross-validation smooths the stochasticity of mini-batch stochastic gradient descent present in accuracy perturbations by a factor of . CNNs are quite precise to detect noise, for H1 data and for L1 data; but, not sensitive enough to recall GW signals, for H1 data and for L1 data—although recall values are dependent on expected SNR. Our predictions are transparently understood by exploring tthe distribution of probabilistic scores outputted by the softmax layer, and they are strengthened by a receiving operating characteristic analysis and a paired-sample t-test to compare with a random classifier.

Biogas Plants in Renewable Energy Systems—A Systematic Review of Modeling Approaches of Biogas Production

Biogas production is a relevant component in renewable energy systems. The paper addresses modeling approaches from an energy system, as well as from a process optimization, point of view. Model approaches of biogas production show different levels of detail. They can be classified as white, gray, and black box, or bottom-up and top-down approaches. On the one hand, biogas modeling can supply dynamic information on the anaerobic digestion process, e.g., to predict biogas yields or to optimize the anaerobic digestion process. These models are characterized by a bottom-up approach with different levels of detail: the comprehensive ADM1 (white box), simplifications and abstractions of AD models (gray box), or highly simplified process descriptions (black box). On the other hand, biogas production is included in energy system models. These models usually supply aggregated information on regional biogas potentials and greenhouse gas emissions. They are characterized by a top-down approach with a low level of detail. Most energy system models reported in literature are based on black box approaches. Considering the strengths and weaknesses of the integration of detailed and deeply investigated process models in energy system models reveals the opportunity to develop dynamic and fluctuating business models of biogas usage.

Evolving a Multi-Classifier System for Multi-Pitch Estimation of Piano Music and Beyond: An Application of Cartesian Genetic Programming

This paper presents a new method with a set of desirable properties for multi-pitch estimation of piano recordings. We propose a framework based on a set of classifiers to analyze audio input and to identify piano notes present in a given audio signal. Our system’s classifiers are evolved using Cartesian genetic programming: we take advantage of Cartesian genetic programming to evolve a set of mathematical functions that act as independent classifiers for piano notes. Two significant improvements are described: the use of a harmonic mask for better fitness values and a data augmentation process for improving the training stage. The proposed approach achieves competitive results using F-measure metrics when compared to state-of-the-art algorithms. Then, we go beyond piano and show how it can be directly applied to other musical instruments, achieving even better results. Our system’s architecture is also described to show the feasibility of its parallelization and its implementation as a real-time system. Our methodology is also a white-box optimization approach that allows for clear analysis of the solutions found and for researchers to learn and test improvements based on the new findings.

Correlation-oriented complex system structural risk assessment using Copula and belief rule base

Structural risk assessment is very important for maintaining the safe operations of many complex systems. However, there are two major requirements that still need to be addressed, namely the correlation among multiple factors and high interpretability to produce a trustworthy result. For the first challenge on correlation, the Copula model is applied to quantitatively measure the correlation among the data gathered from multiple sources. For the second challenge on interpretability, the Belief Rule Base (BRB) model is applied since it is essentially a white-box approach that can provide good interpretability by its transparent inferencing and decision-making process. With this, a novel approach is proposed by combining the Copula model and BRB, namely Copula-BRB. Moreover, two frameworks are separately designed as well. The first is a knowledge-driven inferencing framework when experts’ knowledge is available but with limited data. The second is a data-driven optimization framework when there is a large quantity of data. Correspondingly, a numerical case with only limited data and another practical case with 1000 sets of data are studied to explain and validate the two frameworks of the Copula-BRB approach, respectively. The numerical case is mainly used to explain the knowledge-driven Copula-BRB inferencing framework, and the practical case is conducted in a comparative fashion where three Copula functions are used, namely Clayton, Frank, and Gumbel, and the results are compared with the Support Vector Machine (SVM) and conventional BRB (without consideration of the attribute correlation). The results of the two case studies show that, by using the Copula-BRB which incorporates the attribute correlation into the conventional BRB, superior performance has been achieved in comparison with SVM and BRB. A detailed exploration of how this superior performance concerning outputs in intervals has been conducted as well.

Toward Resource-Efficient Federated Learning in Mobile Edge Computing

Federated learning is a newly emerged distributed deep learning paradigm, where the clients separately train their local neural network models with private data and then jointly aggregate a global model at the central server. Mobile edge computing is aimed at deploying mobile applications at the edge of wireless networks. Federated learning in mobile edge computing is a prospective distributed framework to deploy deep learning algorithms in many application scenarios. The bottleneck of federated learning in mobile edge computing is the intensive resources of mobile clients in computation, bandwidth, energy, and data. This article first illustrates the typical use cases of federated learning in mobile edge computing, and then investigates the state-of-the-art resource optimization approaches in federated learning. The resource-effi-cient techniques for federated learning are broadly divided into two classes: the black-box and white-box approaches. For black-box approaches, the techniques of training tricks, client selection, data compensation, and hierarchical aggregation are reviewed. For white-box approaches, the techniques of model compression, knowledge distillation, feature fusion, and asynchronous update are discussed. After that, a neural-structure-aware resource management approach with mod-ule-based federated learning is proposed, where mobile clients are assigned with different subnetworks of the global model according to the status of their local resources. Experiments demonstrate the superiority of our approach in elastic and efficient resource utilization.

Cartesian genetic programming for diagnosis of Parkinson disease through handwriting analysis: Performance vs. interpretability issues

In the last decades, early disease identification through non-invasive and automatic methodologies has gathered increasing interest from the scientific community. Among others, Parkinson's disease (PD) has received special attention in that it is a severe and progressive neuro-degenerative disease. As a consequence, early diagnosis would provide more effective and prompt care strategies, that cloud successfully influence patients’ life expectancy. However, the most performing systems implement the so called black-box approach, which do not provide explicit rules to reach a decision. This lack of interpretability, has hampered the acceptance of those systems by clinicians and their deployment on the field. In this context, we perform a thorough comparison of different machine learning (ML) techniques, whose classification results are characterized by different levels of interpretability. Such techniques were applied for automatically identify PD patients through the analysis of handwriting and drawing samples. Results analysis shows that white-box approaches, such as Cartesian Genetic Programming and Decision Tree, allow to reach a twofold goal: support the diagnosis of PD and obtain explicit classification models, on which only a subset of features (related to specific tasks) were identified and exploited for classification. Obtained classification models provide important insights for the design of non-invasive, inexpensive and easy to administer diagnostic protocols. Comparison of different ML approaches (in terms of both accuracy and interpretability) has been performed on the features extracted from the handwriting and drawing samples included in the publicly available PaHaW and NewHandPD datasets. The experimental findings show that the Cartesian Genetic Programming outperforms the white-box methods in accuracy and the black-box ones in interpretability.

Electromagnetic and Power Side-Channel Analysis: Advanced Attacks and Low-Overhead Generic Countermeasures through White-Box Approach

Electromagnetic and power side-channel analysis (SCA) provides attackers a prominent tool to extract the secret key from the cryptographic engine. In this article, we present our cross-device deep learning (DL)-based side-channel attack (X-DeepSCA) which reduces the time to attack on embedded devices, thereby increasing the threat surface significantly. Consequently, with the knowledge of such advanced attacks, we performed a ground-up white-box analysis of the crypto IC to root-cause the source of the electromagnetic (EM) side-channel leakage. Equipped with the understanding that the higher-level metals significantly contribute to the EM leakage, we present STELLAR, which proposes to route the crypto core within the lower metals and then embed it within a current-domain signature attenuation (CDSA) hardware to ensure that the critical correlated signature gets suppressed before it reaches the top-level metal layers. CDSA-AES256 with local lower metal routing was fabricated in a TSMC 65 nm process and evaluated against different profiled and non-profiled attacks, showing protection beyond 1B encryptions, compared to ∼10K for the unprotected AES. Overall, the presented countermeasure achieved a 100× improvement over the state-of-the-art countermeasures available, with comparable power/area overheads and without any performance degradation. Moreover, it is a generic countermeasure and can be used to protect any crypto cores while preserving the legacy of the existing implementations.

Sparkle: User-Aware Viewport Prediction in 360-Degree Video Streaming

In 360-degree video streaming, users commonly watch a video scene within a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Field of View (FoV)</i> . Such observation provides an opportunity to save bandwidth consumption by predicting and then prefetching video tiles within the FoV. However, existing FoV prediction methods seldom consider the diversity among user behaviors and the impact of different video genres. Thus, previous one-size-fits-all models cannot make accurate prediction for users with different behavior patterns. In this paper, we propose a user-aware viewport prediction algorithm called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Sparkle</i> , which is a practical whitebox approach for FoV prediction. Instead of training a single learning model to predict the behaviors for all users, our proposed algorithm is tailored to fit each individual user. In particular, unlike other learning models, our prediction model is completely explainable and all the parameters have their physical meanings. We first conduct a measurement study to analyze real user behaviors and observe that there exists sharp fluctuation of view orientation and user posture has significant impact on the viewport movement of users. Moreover, cross-user similarity is diverse across different video genres. Inspired by these insights, we further design a user-aware viewport prediction algorithm by mimicking a user's viewport movement on the tile map, and determine how a user will change the viewport angle based on his (or her) trajectory and other similar users’ behaviors in the past time window. Extensive evaluations with real datasets demonstrate that, our proposed algorithm significantly outperforms the state-of-the-art benchmark methods (e.g., LSTM-based methods) by over <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\text{5}\%$</tex-math></inline-formula> , and the prediction accuracy is much more stable on various types of 360-degree videos than previous methods.

ConfigCrusher: towards white-box performance analysis for configurable systems

Stakeholders of configurable systems are often interested in knowing how configuration options influence the performance of a system to facilitate, for example, the debugging and optimization processes of these systems. Several black-box approaches can be used to obtain this information, but they either sample a large number of configurations to make accurate predictions or miss important performance-influencing interactions when sampling few configurations. Furthermore, black-box approaches cannot pinpoint the parts of a system that are responsible for performance differences among configurations. This article proposes ConfigCrusher, a white-box performance analysis that inspects the implementation of a system to guide the performance analysis, exploiting several insights of configurable systems in the process. ConfigCrusher employs a static data-flow analysis to identify how configuration options may influence control-flow statements and instruments code regions, corresponding to these statements, to dynamically analyze the influence of configuration options on the regions’ performance. Our evaluation on 10 configurable systems shows the feasibility of our white-box approach to more efficiently build performance-influence models that are similar to or more accurate than current state of the art approaches. Overall, we showcase the benefits of white-box performance analyses and their potential to outperform black-box approaches and provide additional information for analyzing configurable systems.

On sparse identification of complex dynamical systems: A study on discovering influential reactions in chemical reaction networks

A wide variety of real life complex networks are prohibitively large for modeling, analysis and control. Understanding the structure and dynamics of such networks entails creating a smaller representative network that preserves its relevant topological and dynamical properties. While modern machine learning methods have enabled identification of governing laws for complex dynamical systems, their inability to produce white-box models with sufficient physical interpretation renders such methods undesirable to domain experts. In this paper, we introduce a hybrid black-box, white-box approach for the sparse identification of the governing laws for complex, highly coupled dynamical systems with particular emphasis on finding the influential reactions in chemical reaction networks for combustion applications, using a data-driven sparse-learning technique. The proposed approach identifies a set of influential reactions using species concentrations and reaction rates, with minimal computational cost without requiring additional data or simulations. The new approach is applied to analyze the combustion chemistry of H2 and C3H8 in a constant-volume homogeneous reactor. The influential reactions determined by the sparse-learning method are consistent with the current kinetics knowledge of chemical mechanisms. Additionally, we show that a reduced version of the parent mechanism can be generated as a combination of the significantly reduced influential reactions identified at different times and conditions and that for both H2 and C3H8 fuel, the reduced mechanisms perform closely to the parent mechanisms as a function of the ignition delay time over a wide range of conditions. Our results demonstrate the potential of the sparse-learning approach as an effective and efficient tool for dynamical system analysis and reduction. The uniqueness of this approach as applied to combustion systems lies in the ability to identify influential reactions in specified conditions and times during the evolution of the combustion process. This ability is of great interest to understand chemical reaction systems.

Measuring Performances of a White-Box Approach in the IoT Context

The internet of things (IoT) refers to all the smart objects that are connected to other objects, devices or servers and that are able to collect and share data, in order to “learn” and improve their functionalities. Smart objects suffer from lack of memory and computational power, since they are usually lightweight. Moreover, their security is weakened by the fact that smart objects can be placed in unprotected environments, where adversaries are able to play with the symmetric-key algorithm used and the device on which the cryptographic operations are executed. In this paper, we focus on a family of white-box symmetric ciphers substitution–permutation network (SPN)box, extending and improving our previous paper on the topic presented at WIDECOM2019. We highlight the importance of white-box cryptography in the IoT context, but also the need to have a fast black-box implementation (server-side) of the cipher. We show that, modifying an internal layer of SPNbox, we are able to increase the key length and to improve the performance of the implementation. We measure these improvements (a) on 32/64-bit architectures and (b) in the IoT context by encrypting/decrypting 10,000 payloads of lightweight messaging protocol Message Queuing Telemetry Transport (MQTT).

RGA Based Decoupler Design for a Coupled Tank MIMO Process

The objective of this paper is to develop the Relative Gain Array (RGA) based Decoupler design with PI Controller for a MIMO Process. The contrsoller thus developed is implemented on Laboratory interacting coupled tank process through simulation. This can be regarded as the relevant process control in petrol and chemical industries. These industries involve controlling the liquid level and the flow rate in the presence of nonlinearity and disturbance which justifies the use of PI Controller with Decoupler scheme. For this purpose, mathematical models are obtained for each of the input-output combinations using white box approach and the respective controllers are developed. A detailed analysis on the performance of the chosen process with these controllers is carried out. Simulation studies reveal the effectiveness of proposed controller for MIMO process that exhibits nonlinear behaviour.

Evaluation of simulation models to mimic the distortions introduced into squiggles by nanopore sequencers and segmentation algorithms.

Nucleotides ratcheted through the biomolecular pores of nanopore sequencers generate raw picoamperage currents, which are segmented into step-current level signals representing the nucleotide sequence. These ‘squiggles’ are a noisy, distorted representation of the underlying true stepped current levels due to experimental and algorithmic factors. We were interested in developing a simulation model to support a white-box approach to identify common distortions, rather than relying on commonly used black box neural network techniques for basecalling nanopore signals. Dynamic time warped-space averaging (DTWA) techniques can generate a consensus from multiple noisy signals without introducing key feature distortions that occur with standard averaging. As a preprocessing tool, DTWA could provide cleaner and more accurate current signals for direct RNA or DNA analysis tools. However, DTWA approaches need modification to take advantage of the a-priori knowledge regarding a common, underlying gold-standard RNA / DNA sequence. Using experimental data, we derive a simulation model to provide known squiggle distortion signals to assist in validating the performance of analysis tools such as DTWA. Simulation models were evaluated by comparing mocked and experimental squiggle characteristics from one Enolase mRNA squiggle group produced by an Oxford MinION nanopore sequencer, and cross-validated using other Enolase, Sequin R1_71_1 and Sequin R2_55_3 mRNA studies. New techniques identified high inserted but low deleted base rates, generating consistent x1.7 squiggle event to base called ratios. Similar probability density and cumulative distribution functions, PDF and CDF, were found across all studies. Experimental PDFs were not the normal distributions expected if squiggle distortion arose from segmentation algorithm artefacts, or through individual nucleotides randomly interacting with individual nanopores. Matching experimental and mocked CDFs required the assumption that there are unique features associated with individual raw-current data streams. Z-normalized signal-to-noise ratios suggest intrinsic sensor limitations being responsible for half the gold standard and noisy squiggle DTW differences.

White-Box Cryptography: Don’t Forget About Grey-Box Attacks

Despite the fact that all current scientific white-box approaches of standardized cryptographic primitives have been publicly broken, these attacks require knowledge of the internal data representation used by the implementation. In practice, the level of implementation knowledge required is only attainable through significant reverse-engineering efforts. In this paper, we describe new approaches to assess the security of white-box implementations which require neither knowledge about the look-up tables used nor expensive reverse-engineering efforts. We introduce the differential computation analysis (DCA) attack which is the software counterpart of the differential power analysis attack as applied by the cryptographic hardware community. Similarly, the differential fault analysis (DFA) attack is the software counterpart of fault injection attacks on cryptographic hardware. For DCA, we developed plugins to widely available dynamic binary instrumentation (DBI) frameworks to produce software execution traces which contain information about the memory addresses being accessed. For the DFA attack, we developed modified emulators and plugins for DBI frameworks that allow injecting faults at selected moments within the execution of the encryption or decryption process as well as a framework to automate static fault injection. To illustrate the effectiveness, we show how DCA and DFA can extract the secret key from numerous publicly available non-commercial white-box implementations of standardized cryptographic algorithms. These approaches allow one to extract the secret key material from white-box implementations significantly faster and without specific knowledge of the white-box design in an automated or semi-automated manner.