Domain-flux僵尸网络域名检测

针对现有Domain-flux僵尸网络检测方法在检测范围方面的不足,提出基于域名访问活跃特征的Domain-flux僵尸网络域名检测方法。通过阐述Domain-flux僵尸网络所利用的域名集合在访问方面所表现出的时间行为特征,提出一种基于域名访问活跃特征的检测算法,给出检测算法的具体描述、检测处理流程及系统整体结构,利用某运行商DNS服务器镜像数据实验验证检测算法。实验结果显示,检测算法不依赖于具体的域名字符特征,可以有效过滤出Domain-flux僵尸网络所利用的域名。     

DisCoveR: accurate and efficient discovery of declarative process models

International Journal on Software Tools for Technology Transfer - Declarative process modeling formalisms—which capture high-level process constraints—have seen growing interest,...     

Knowledge discovery in medicine: Current issue and future trend

Data mining is a powerful method to extract knowledge from data. Raw data faces various challenges that make traditional method improper for knowledge extraction. Data mining is supposed to be able to handle various data types in all formats. Relevance of this paper is emphasized by the fact that data mining is an object of research in different areas. In this paper, we review previous works in the context of knowledge extraction from medical data. The main idea in this paper is to describe key papers and provide some guidelines to help medical practitioners. Medical data mining is a multidisciplinary field with contribution of medicine and data mining. Due to this fact, previous works should be classified to cover all users’ requirements from various fields. Because of this, we have studied papers with the aim of extracting knowledge from structural medical data published between 1999 and 2013. We clarify medical data mining and its main goals. Therefore, each paper is studied based on the six medical tasks: screening, diagnosis, treatment, prognosis, monitoring and management. In each task, five data mining approaches are considered: classification, regression, clustering, association and hybrid. At the end of each task, a brief summarization and discussion are stated. A standard framework according to CRISP-DM is additionally adapted to manage all activities. As a discussion, current issue and future trend are mentioned. The amount of the works published in this scope is substantial and it is impossible to discuss all of them on a single work. We hope this paper will make it possible to explore previous works and identify interesting areas for future research.     

基于深度学习的恶意DGA域名检测

针对域名产生算法生成的恶意域名,提出基于动态卷积算法的检测方法.基于现有的深度学习检测模型,在检测模型的向量嵌入阶段采用基于字符嵌入的高级词嵌入方法,能够对生僻词语和训练集中不存在的新词进行有效表示,减小嵌入矩阵的规模,降低存储成本.设计动态卷积算法对恶意域名进行检测,动态调整网络参数,有利于在更大范围内提取深层的特征,压缩数据大小,提高运算的速度,能够更有效识别恶意域名.实现了整体检测模型,通过实验验证了该方案的可行性.     

Hybrid approach for context-aware service discovery in healthcare domain

Context-awareness computing is a research field which often refers to healthcare as an interesting and rich area of application. Context aware computing attains environments monitoring by means of sensors to provide relevant information or services according to the identified context. In particular, wireless ad hoc sensor networks for medical purposes are playing an increasing role within healthcare. Body Sensor Networks (BSN) are being designed for prophylactic and follow-up monitoring of patients in e.g. their homes, during hospitalization, and in emergencies. This work presents an integrated environment aimed at providing personalized healthcare services which appropriately meet the user?s context. Deploying the semantics embedded in web services and context models is a mandatory step in the automation of service discovery, invocation and composition. Nevertheless, in a context aware domain purely logic-based reasoning on respectively context and services may not be enough. The main idea of this work is related to enrich with qualitative representation of context underling data by means of Fuzzy Logic in order to automatically recognize the context and to consequently find the right set of healthcare services among the available ones. Semantic formalisms (e.g., OWL, OWL-S, etc.) enable the context and services modeling in terms of domain ontology concepts. On the other hand, soft computing techniques support activity of unsupervised context analysis and healthcare semantic service discovery. Goal is to define context-aware system whose quality of retrieved services relies on the acquisition of user context by means of a robust theoretical approach. Moreover, this work defines hybrid architecture which attains a synergy between the agent-based paradigm and the fuzzy modeling. Specifically, the system exploits some task oriented agents in order to achieve context recognition, services matchmaking and brokerage activities.     

Dominic I: Progress toward domain independence in design by iterative redesign

This paper describes the first working version of a program called Dominic that performs design by iterative redesign in a domain-independent manner. The paper describes in detail the program's strategy, which stresses the concept of redesign dependencies to guide its redesign process. Dominic has been successfully tested in four different domains. Its performance on two of these (v-belt drive design and design of extruded heat sinks) is presented here. The redesign class of design problems on which Dominic works is that large class of problems that are intellectually manageable and solvable without subdivision into smaller parts. This includes the various subproblems ultimately created when large complex problems are decomposed for solution. Dominic is a hill-climbing algorithm, similar in this respect to standard optimization methods. However, its problem formulation or input language is more flexible for some design applications than optimization techniques. Work is continuing on a Dominic II in an effort to overcome some of the limitations of Dominic.     

DNS最多查询域名的内存记录置换统计算法

为了挖掘出域名服务器一段时间内最大查询量的若干个域名,针对很多负荷重的域名服务器一般都不打开查询日志开关,从而不能采用统计日志记录方法的情况,提出了一个内存记录置换统计算法,在内存中近似统计出一段时间内最大查询量的若干个域名。实验和实践表明该算法效果良好。     

An empirical study of domain knowledge and its benefits tosubstructure discovery

Discovering repetitive, interesting, and functional substructures in a structural database improves the ability to interpret and compress the data. However, scientists working with a database in their area of expertise often search for predetermined types of structures or for structures exhibiting characteristics specific to the domain. The paper presents a method for guiding the discovery process with domain specific knowledge. The SUBDUE discovery system is used to evaluate the benefits of using domain knowledge to guide the discovery process. Domain knowledge is incorporated into SUBDUE following a single general methodology to guide the discovery process. Results show that domain specific knowledge improves the search for substructures that are useful to the domain and leads to greater compression of the data. To illustrate these benefits, examples and experiments from the computer programming, computer aided design circuit, and artificially generated domains are presented     

Proteomic approach toward personalized sarcoma treatment: Lessons from prognostic biomarker discovery in gastrointestinal stromal tumor

Sarcomas range from curable tumors to those causing death via metastasis and recurrence. Thus, there is an urgent need for biomarker identification in order to assess the degree of malignancy, predict prognosis, and evaluate possible therapies. Various proteomic approaches and different clinical materials have been used to this end, and candidate biomarkers have been reported for the different types of sarcomas. However, the sample size used in these biomarker studies was generally insufficient, and thus far, no biomarker has been proved useful in clinics. Given that sarcomas are rare, biomarker validation in this setting is more challenging than in other malignancies. In gastrointestinal stromal tumor, adjuvant therapy has proven to be effective. However, only 40% patients experience metastasis after curative surgery alone, and the rest of the patients may not need adjuvant therapy. Using a proteomic approach, we identified pfetin (potassium channel tetramerization domain containing 12, KCTD 12) as a novel prognostic biomarker for sarcoma, and immunohistochemically confirmed its clinical usefulness by a multiinstitutional validation study. Here, we describe our experience and discuss the critical points in the discovery of this biomarker.     

Using domain knowledge to optimize the knowledge discovery process in databases

Modern database technologies process large volumes of data to discover new knowledge. Some large databases make discovery computationally expensive. Additional knowledge, known as domain or background knowledge, can often guide and restrict the search for interesting knowledge. This paper discusses mechanisms by which domain knowledge can be used effectively in discovering knowledge from databases. In particular, we look at the use of domain knowledge to reduce the size of the database for discovery, to optimize the hypotheses which represent the interesting knowledge to be discovered, to optimize the queries used to prove the hypotheses, and to avoid possible redundant and contradictory rule discovery. Some experimental results using the IDIS knowledge discovery tool is provided. ©2000 John Wiley & Sons, Inc.     

基于条件随机场与信息熵的特定领域概念发现

针对特定领域内自动化识别既有概念和发现新概念的问题,提出一种基于条件随机场和信息熵的抽取方法。通过使用条件随机场对文本中的概念词进行边界预测,与词典中的概念对比,筛选出新概念的候选项并找出其大概位置,然后由互信息和左右熵分别判断概念窗口内的概念内部结合度和概念边界自由度,从而发现新的专业概念。实验表明,使用该方法进行概念发现比单独使用条件随机场的方法有更好的效果,基于字和词的模型概念发现的准确率分别提升了20.06%和46.54%。     

Fast discovery and the generalization of strong jumping emerging patterns for building compact and accurate classifiers

Classification of large data sets is an important data mining problem that has wide applications. Jumping emerging patterns (JEPs) are those itemsets whose supports increase abruptly from zero in one data set to nonzero in another data set. In this paper, we propose a fast, accurate, and less complex classifier based on a subset of JEPs, called strong jumping emerging patterns (SJEPs). The support constraint of SJEP removes potentially less useful JEPs while retaining those with high discriminating power. Previous algorithms based on the manipulation of border as well as consEPMiner cannot directly mine SJEPs. In this paper, we present a new tree-based algorithm for their efficient discovery. Experimental results show that: 1) the training of our classifier is typically 10 times faster than earlier approaches, 2) our classifier uses much fewer patterns than the JEP-classifier to achieve a similar (and, often, improved) accuracy, and 3) in many cases, it is superior to other state-of-the-art classification systems such as naive Bayes, CBA, C4.5, and bagged and boosted versions of C4.5. We argue that SJEPs are high-quality patterns which possess the most differentiating power. As a consequence, they represent sufficient information for the construction of accurate classifiers. In addition, we generalize these patterns by introducing noise-tolerant emerging patterns (NEPs) and generalized noise-tolerant emerging patterns (GNEPs). Our tree-based algorithms can be adopted to easily discover these variations. We experimentally demonstrate that SJEPs, NEPs, and GNEPs are extremely useful for building effective classifiers that can deal well with noise.     

Learning task models in ill-defined domain using an hybrid knowledge discovery framework

Domain experts should provide Intelligent Tutoring Systems (ITS) with relevant domain knowledge that enable it to guide the learner during problem-solving learning activities. However, for ill-defined domains this knowledge is hard to define explicitly. Our hypothesis is that knowledge discovery (KD) techniques can be used to extract problem-solving task models from the recorded usage of expert, intermediate and novice learners. This paper proposes a procedural-knowledge acquisition framework based on a combination of sequential pattern mining and association rules discovery techniques. The framework has been implemented and is used to discover new meta-knowledge and rules in a given domain which then extend domain knowledge and serve as problem space, allowing the Intelligent Tutoring System to guide learners in problem-solving situations. Preliminary experiments have been conducted using the framework as an alternative to a path-planning problem solver in CanadarmTutor.     

基于突发话题和领域专家的微博谣言检测方法

针对现有谣言检测方法中存在的数据采集困难和谣言检测滞后的问题,提出一种基于动量模型的突发话题检测和领域专家发现的谣言检测方法。该方法借鉴物理学中的动力学理论对话题特征进行建模,使用特征的动力学物理量描述特征的突发特性和发展趋势,并在对突发特征进行特征聚合之后提取得到突发话题;然后,依据话题与用户个人信息的领域相关性在候选专家池中发现领域相关的微博用户来甄别话题信息的真实性。基于新浪微博数据的实验结果表明,相对于仅基于有监督机器学习的微博谣言识别方法,该方法谣言识别准确率提高了13个百分点;相对于主流人工识别方法,将最长谣言检测用时缩短至20h,能够较好地应用于实际的微博谣言检测环境。     

基于基因表达式编程的知识发现--沿革、成果和发展方向

综述了基于基因表达式编程(Gene Expression Programming,GEP)的知识发现技术的沿革、特色和成果。剖析了GEP中通过简单编码解决复杂问题的关键技术。特别介绍了在这一领域的工作成果,如基于GEP的多项式因式分解,频繁函数挖掘,抗噪声数据的函数挖掘,太阳黑子预测等。对进一步开展基于GEP的知识发现技术的发展策略提出了自己的见解。     

Proteomic-based approach for biomarkers discovery in early detection of invasive urothelial carcinoma

Identification of reliable non-invasive markers for the detection of invasive phenotype of urothelial carcinoma is needed. This study characterizes and compares protein expression profiles of adjacent non-neoplastic urothelium and invasive urothelial carcinoma to identify biomarkers for early detection of de novo bladder cancer. Differences in protein expression between adjacent non-neoplastic and high-grade, stage T4, grade 3 invasive urothelial carcinoma tissues were investigated using 2-DE, MALDI-TOF-MS, and data processing. Ingenuity Pathway Analysis (IPA) was applied to examine the biological mechanisms represented by the altered proteins. The 2-DE of the adjacent non-neoplastic urothelium and invasive urothelial carcinoma showed reproducibly similar proteomic mapping for each group distinguishing adjacent non-neoplastic urothelium from invasive urothelial carcinoma. Twenty-one proteins were altered in expression and one of these proteins, Choroideremia-like protein (CHML) was significantly overexpressed (p<0.005) and therefore was analyzed further using IHC and Western blot. Urothelial carcinoma presented an elevated expression of CHML but not adjacent non-neoplastic or normal bladder tissues. IPA revealed the involvement of CHML in cell morphology, cellular assembly, and organization. Further investigation is warranted to elucidate the biological significance of CHML and to validate its role as a biomarker for early detection of invasive urothelial carcinoma de novo.