{"title":"Causal Discovery of Cyber Attack Phases","authors":"W. G. Mueller, Alex Memory, Kyle Bartrem","doi":"10.1109/ICMLA.2019.00219","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00219","url":null,"abstract":"Causal discovery algorithms are increasingly being used to discover valid, novel, and significant causal relationships from large amounts of observational data. Cyberattacks are hypothesized to evolve according to the Cyber Kill Chain® which consists of a causal model describing the phases of a cyberattack. This paper introduces causal discovery to cybersecurity research and provides evidence of the kill chain with an extensive empirical assessment of two databases of real cyberattacks.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130383054","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ghada Zamzmi, L. Hsu, Wen Li, V. Sachdev, Sameer Kiran Antani
{"title":"Echo Doppler Flow Classification and Goodness Assessment with Convolutional Neural Networks","authors":"Ghada Zamzmi, L. Hsu, Wen Li, V. Sachdev, Sameer Kiran Antani","doi":"10.1109/ICMLA.2019.00283","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00283","url":null,"abstract":"Doppler Echocardiography is critical for measuring abnormal cardiac function and diagnosing valvular stenosis and regurgitation. The current practice for assessing and interpreting Doppler echo images is time-consuming and depends highly on the experience of the operator. The limitations of this practice can be mitigated using fully automated intelligent systems. Essential first steps toward comprehensive computer-assisted Doppler echocardiographic interpretation include automatic classification into view/flow categories and goodness assessment of these flows. In this paper, we propose a deep learning-based method for Doppler flow classification and goodness assessment. The method has been trained on labeled images representing a wide range of real-world clinical variation. Our method, when evaluated on unseen data, achieved overall accuracies of 91.6% and 88.9% for flow classification and goodness assessment, respectively. While further research is needed, these results are encouraging and prove the feasibility of using fully automated intelligent systems for analyzing and interpreting Doppler echo images.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123006048","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Nikola Marković, T. Stoetzel, V. Staudt, D. Kolossa
{"title":"Hybrid Condition Monitoring for Power Electronic Systems","authors":"Nikola Marković, T. Stoetzel, V. Staudt, D. Kolossa","doi":"10.1109/ICMLA.2019.00275","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00275","url":null,"abstract":"This paper proposes a novel approach for condition monitoring of power electronic systems. When monitoring the state of a power system, reliability is crucial, as this type of system is usually operated continuously for long periods of time, and as both missed faults as well as false detections can easily become prohibitively expensive. Recently, machine-learning-based methods for fault detection of power systems have gained popularity, since they can overcome many of the constrains of model-based techniques. Most of these methods train classifiers for different states of the system under test, and thus, the problem of fault detection becomes a problem of classification. In this paper we compare two of such recent techniques. We show that despite good results, it cannot reasonably be expected that the state classification is solved perfectly for every instant of time, which makes the application of such classifiers infeasible in practical systems. In order to overcome these issues, we propose to re-formulate the task into one of hybrid—neural and statistical—cross-temporal hypothesis testing. This novel hybrid framework allows us to build upon the previous machine-learning-based classification approaches, and to achieve full reliability on a challenging dataset of fault monitoring measurements for a buck-converter.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114160327","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Uncertainty-Aware Personalized Readability Assessments for Second Language Learners","authors":"Yo Ehara","doi":"10.1109/ICMLA.2019.00307","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00307","url":null,"abstract":"Assessing whether an ungraded second language learner can read a given text quickly is important for further instructing and supporting the learner, particularly when evaluating numerous ungraded learners from diverse backgrounds. Second language acquisition (SLA) studies have tackled such assessment tasks wherein only a single short vocabulary test result is available to assess a learner; such studies have shown that the text-coverage, i.e., the percentage of words the learner knows in the text, is the key assessment measure. Currently, count-based percentages are used, in which each word in the given text is classified as being known or unknown to the learner, and the words classified as known are then simply counted. When each word is classified, we can also obtain an uncertainty value as to how likely each word is known to the learner. Although such values can be informative for a readability assessment, how to leverage these values to guarantee their use as an assessment measure that is comparable to that of the previous values remains unclear. We propose a novel framework that allows assessment methods to be uncertainty-aware while guaranteeing comparability to the text-coverage threshold. Such methods involve a computationally complex problem, for which we also propose a practical algorithm. In addition, we propose a neural-network based classifier from which we can obtain better uncertainty values. For evaluation, we created a crowdsourcing-based dataset in which a learner takes both vocabulary and readability tests. The best method under our framework outperformed conventional methods.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114474099","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Sanket Shukla, Gaurav Kolhe, Sai Manoj Pudukotai Dinakarrao, S. Rafatirad
{"title":"RNN-Based Classifier to Detect Stealthy Malware using Localized Features and Complex Symbolic Sequence","authors":"Sanket Shukla, Gaurav Kolhe, Sai Manoj Pudukotai Dinakarrao, S. Rafatirad","doi":"10.1109/ICMLA.2019.00076","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00076","url":null,"abstract":"Malware detection and classification has enticed a lot of researchers in the past decades. Several mechanisms based on machine learning (ML), computer vision and deep learning have been deployed to this task and have achieved considerable results. However, advanced malware (stealthy malware) generated using various obfuscation techniques like code relocation, code transposition, polymorphism and mutation thwart the detection. In this paper, we propose a two-pronged technique which can efficiently detect both traditional and stealthy malware. Firstly, we extract the microarchitectural traces procured while executing the application, which are fed to the traditional ML classifiers to identify malware spawned as separate thread. In parallel, for an efficient stealthy malware detection, we instigate an automated localized feature extraction technique that will be used as an input to recurrent neural networks (RNNs) for classification. We have tested the proposed mechanism rigorously on stealthy malware created using code relocation obfuscation technique. With the proposed two-pronged approach, an accuracy of 94%, precision of 93%, recall score of 96% and F-1 score of 94% is achieved. Furthermore, the proposed technique attains up to 11% higher on average detection accuracy and precision, along with 24% higher on average recall and F-1 score as compared to the CNN-based sequence classification and hidden Markov model (HMM) based approaches in detecting stealthy malware.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"393 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121787602","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Independent Component Analysis Based on Mutual Dependence Measures","authors":"Ze Jin, D. Matteson, Tianrong Zhang","doi":"10.1109/ICMLA.2019.00107","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00107","url":null,"abstract":"We apply both distance-based and kernel-based mutual dependence measures to independent component analysis (ICA), and generalize dCovICA to MDMICA, minimizing empirical dependence measures as an objective function in both deflation and parallel manners. Solving this minimization problem, we introduce Latin hypercube sampling (LHS), and a global optimization method, Bayesian optimization (BO) to improve the initialization of the Newton-type local optimization method. The performance of MDMICA is evaluated in various simulation studies and an image data example. When the ICA model is correct, MDMICA achieves competitive results compared to existing approaches. When the ICA model is misspecified, the estimated independent components are less mutually dependent than the observed components using MDMICA, while the estimated independent components are prone to be even more mutually dependent than the observed components using other approaches.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125830222","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Comparing the Modeling Powers of RNN and HMM","authors":"Achille Salaün, Y. Petetin, F. Desbouvries","doi":"10.1109/ICMLA.2019.00246","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00246","url":null,"abstract":"Recurrent Neural Networks (RNN) and Hidden Markov Models (HMM) are popular models for processing sequential data and have found many applications such as speech recognition, time series prediction or machine translation. Although both models have been extended in several ways (eg. Long Short Term Memory and Gated Recurrent Unit architectures, Variational RNN, partially observed Markov models...), their theoretical understanding remains partially open. In this context, our approach consists in classifying both models from an information geometry point of view. More precisely, both models can be used for modeling the distribution of a sequence of random observations from a set of latent variables; however, in RNN, the latent variable is deterministically deduced from the current observation and the previous latent variable, while, in HMM, the set of (random) latent variables is a Markov chain. In this paper, we first embed these two generative models into a generative unified model (GUM). We next consider the subclass of GUM models which yield a stationary Gaussian observations probability distribution function (pdf). Such pdf are characterized by their covariance sequence; we show that the GUM model can produce any stationary Gaussian distribution with geometrical covariance structure. We finally discuss about the modeling power of the HMM and RNN submodels, via their associated observations pdf: some observations pdf can be modeled by a RNN, but not by an HMM, and vice versa; some can be produced by both structures, up to a re-parameterization.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126666298","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
K. Nakayama, N. Muralidhar, Chenrui Jin, Ratnesh K. Sharma
{"title":"Detection of False Data Injection Attacks in Cyber-Physical Systems using Dynamic Invariants","authors":"K. Nakayama, N. Muralidhar, Chenrui Jin, Ratnesh K. Sharma","doi":"10.1109/ICMLA.2019.00173","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00173","url":null,"abstract":"Modern cyber-physical systems are increasingly complex and vulnerable to attacks like false data injection aimed at destabilizing and confusing the systems. We develop and evaluate an attack-detection framework aimed at learning a dynamic invariant network, data-driven temporal causal relationships between components of cyber-physical systems. We evaluate the relative performance in attack detection of the proposed model relative to traditional anomaly detection approaches. In this paper, we introduce Granger Causality based Kalman Filter with Adaptive Robust Thresholding (G-KART) as a framework for anomaly detection based on data-driven functional relationships between components in cyber-physical systems. In particular, we select power systems as a critical infrastructure with complex cyber-physical systems whose protection is an essential facet of national security. The system presented is capable of learning with or without network topology the task of detection of false data injection attacks in power systems. Kalman filters are used to learn and update the dynamic state of each component in the power system and in-turn monitor the component for malicious activity. The ego network for each node in the invariant graph is treated as an ensemble model of Kalman filters, each of which captures a subset of the node's interactions with other parts of the network. We finally also introduce an alerting mechanism to surface alerts about compromised nodes.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"96 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121255693","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
K. Rahman, Deepak Neupane, Abdulrahman Zaiter, M. Hossain
{"title":"Web User Authentication Using Chosen Word Keystroke Dynamics","authors":"K. Rahman, Deepak Neupane, Abdulrahman Zaiter, M. Hossain","doi":"10.1109/ICMLA.2019.00188","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00188","url":null,"abstract":"Keystroke dynamics has been used as a form of one-time user authentication and continuous verification especially when it comes to securing the cyberspace. In this paper, we present the idea of using keystroke dynamics as a form of second layer authentication in web applications. We showed that this method can authenticate a user with high accuracy and can be used as an alternate to CAPTCHA tests, security questions and image selections that are being used today. We have developed a working web-based platform in a browser environment that enforces the proposed second-layer security. We performed penetration test experiments by launching a total of 598,500 impostor and genuine authentication attempts and found the Equal Error Rate (EER) as 10.5%.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"34 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128930789","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Sid Ryan, Roberto Corizzo, I. Kiringa, N. Japkowicz
{"title":"Pattern and Anomaly Localization in Complex and Dynamic Data","authors":"Sid Ryan, Roberto Corizzo, I. Kiringa, N. Japkowicz","doi":"10.1109/ICMLA.2019.00285","DOIUrl":"https://doi.org/10.1109/ICMLA.2019.00285","url":null,"abstract":"Following a series of deep learning breakthroughs in the area of image segmentation, multiple objects in an image input can be finely sub-categorized. Although Convolutional Neural Networks (CNNs) are known for their state-of-the-art performance in image classification, they present drawbacks when used to analyze different data types, such as time series. In this paper, we propose the Sequential Mask Convolutional Neural Network (SMCNN), a method that overcomes such drawbacks, and leverages CNNs for sequential data analysis. Our method transforms sequential data into an image representation by means of a specialized filter that produces flexible shape forms, and detects multiple types of outliers simultaneously. We evaluate the effectiveness of our method on data containing a variety of anomaly types combined with different concept drifts. The solution shows to significantly outperform prior endeavors and to provide high generalization capabilities on a wide array of data characteristics. We attribute its success to its ability to pinpoint the exact location of patterns and anomalies in parallel and to the invariance of CNNs, which allows them to adapt seamlessly to concept drifts.","PeriodicalId":436714,"journal":{"name":"2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)","volume":"114 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128594980","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}