“Andromaly”: a behavioral malware detection framework for android devices

This article presents Andromaly—a framework for detecting malware on Android mobile devices. The proposed framework realizes a Host-based Malware Detection System that continuously monitors various features and events obtained from the mobile device and then applies Machine Learning anomaly detectors to classify the collected data as normal (benign) or abnormal (malicious). Since no malicious applications are yet available for Android, we developed four malicious applications, and evaluated Andromaly’s ability to detect new malware based on samples of known malware. We evaluated several combinations of anomaly detection algorithms, feature selection method and the number of top features in order to find the combination that yields the best performance in detecting new malware on Android. Empirical results suggest that the proposed framework is effective in detecting malware on mobile devices in general and on Android in particular.     

MLDroid—framework for Android malware detection using machine learning techniques

Neural Computing and Applications - This research paper presents MLDroid—a web-based framework—which helps to detect malware from Android devices. Due to increase in the popularity of...     

A coupled encoder–decoder network for joint face detection and landmark localization

Face detection and landmark localization have been extensively investigated and are the prerequisite for many face related applications, such as face recognition and 3D face reconstruction. Most existing methods address only one of the two problems. In this paper, we propose a coupled encoder–decoder network to jointly detect faces and localize facial key points. The encoder and decoder generate response maps for facial landmark localization. Moreover, we observe that the intermediate feature maps from the encoder and decoder represent facial regions, which motivates us to build a unified framework for multi-scale cascaded face detection by coupling the feature maps. Experiments on face detection using two public benchmarks show improved results compared to the existing methods. They also demonstrate that face detection as a pre-processing step leads to increased robustness in face recognition. Finally, our experiments show that the landmark localization accuracy is consistently better than the state-of-the-art on three face-in-the-wild databases.     

A new higher order effective P–C methods for stiff systems

In this paper a special class of k-step methods of order k+1 with two free parameters up to order 9 are established. The stability analysis of the P–C scheme is investigated. The coefficients of our class and the values of the parameters for getting A₀-stable schemes are tabulated. The relation between the parameters for obtaining L(α)-stable formula is determined. A comparison between the stability region and the error estimation for the fourth-order of our scheme and Cash's scheme is carried on.     

A new spatio-temporal background–foreground bimodal for motion segmentation and detection in urban traffic scenes

Neural Computing and Applications - Automatic vehicle detection in urban traffic surveillance is an important and urgent issue, since it provides necessary information for further processing....     

GAN–SOM: A clustering framework with SOM-similar network based on deep learning

Since an increasing amount of data is generated and collected in real life, clustering is more frequently applied to process these unlabeled data in practical problems. Due to the simple similarity measure of conventional clustering methods, they are unable to achieve good performance on current big data. With the popularity of deep learning, deep clustering has been developed in recent years and obtained remarkable results. However, they have complex architecture and consume numerous computational resources, which goes against the migration to edge devices. Therefore, methods with low cost are required to satisfy edge computing, which is the trend of development. In this paper, we propose GAN–SOM as a new architecture for clustering based on deep learning. A SOM-similar network is designed to simultaneously implement encoding and clustering purposes on data samples, which is jointly trained with a GAN to optimizes a new defined clustering loss. We also utilize self-attention mechanism and spectral normalization in the GAN architecture to enhance effects of generated data, which aims to achieve better clustering results. The experimental results compared with other clustering baselines with deep learning verify that our method maintains high clustering metrics while saving computational cost significantly.

     

A Krylov–Arnoldi reduced order modelling framework for efficient,fully coupled,structural–acoustic optimization

In this work, a reduced order multidisciplinary optimization procedure is developed to enable efficient, low frequency, undamped and damped, fully coupled, structural–acoustic optimization of interior cavities backed by flexible structural systems. This new method does not require the solution of traditional eigen value based problems to reduce computational time during optimization, but are instead based on computation of Arnoldi vectors belonging to the induced Krylov Subspaces. The key idea of constructing such a reduced order model is to remove the uncontrollable, unobservable and weakly controllable, observable parts without affecting the noise transfer function of the coupled system. In a unified approach, the validity of the optimization framework is demonstrated on a constrained composite plate/prism cavity coupled system. For the fully coupled, vibro–acoustic, unconstrained optimization problem, the design variables take the form of stacking sequences of a composite structure enclosing the acoustic cavity. The goal of the optimization is to reduce sound pressure levels at the driver’s ear location. It is shown that by incorporating the reduced order modelling procedure within the optimization framework, a significant reduction in computational time can be obtained, without any loss of accuracy—when compared to the direct method. The method could prove as a valuable tool to analyze and optimize complex coupled structural–acoustic systems, where, in addition to fast analysis, a fine frequency resolution is often required.     

OTIS-MOT: an efficient interconnection network for parallel processing

Mesh of trees (MOT) is well known for its small diameter, high bisection width, simple decomposability and area universality. On the other hand, OTIS (Optical Transpose Interconnection System) provides an efficient optoelectronic model for massively parallel processing system. In this paper, we present OTIS-MOT as a competent candidate for a two-tier architecture that can take the advantages of both the OTIS and the MOT. We show that an n⁴_-n^{4}_{-} processor OTIS-MOT has diameter 8log n ^∗+1 (The base of the logarithm is assumed to be 2 throughout this paper.) and fault diameter 8log n+2 under single node failure. We establish other topological properties such as bisection width, multiple paths and the modularity. We show that many communication as well as application algorithms can run on this network in comparable time or even faster than other similar tree-based two-tier architectures. The communication algorithms including row/column-group broadcast and one-to-all broadcast are shown to require O(log n) time, multicast in O(n ²log n) time and the bit-reverse permutation in O(n) time. Many parallel algorithms for various problems such as finding polynomial zeros, sales forecasting, matrix-vector multiplication and the DFT computation are proposed to map in O(log n) time. Sorting and prefix computation are also shown to run in O(log n) time.     

A separation–aggregation network for image denoising

Image denoising is the problem that aims at recovering a clean image from a noisy counterpart. A promising solution for image denoising is to employ an appropriate deep neural network to learn a hierarchical mapping function from the noisy image to its clean counterpart. This mapping function, however, is generally difficult to learn since the potential feature space of the noisy patterns can be huge. To overcome this difficulty, we propose a separation–aggregation strategy to decompose the noisy image into multiple bands, each of which exhibits one kind of pattern. Then a deep mapping function is learned for each band and the mapping results are ultimately assembled to the clean image. By doing so, the network only needs to deal with the compositing components of the noisy image, thus makes it easier to learn an effective mapping function. Moreover, as any image can be viewed as a composition of some basic patterns, our strategy is expected to better generalize to unseen images. Inspired by this idea, we develop a separation–aggregation network. The proposed network consists of three blocks, namely a convolutional separation block that decomposes the input into multiple bands, a deep mapping block that learns the mapping function for each band, and a band aggregation block that assembles the mapping results. Experimental results demonstrate the superiority of our strategy over counterparts without image decomposition.     

A modified fuzzy min–max neural network with rule extraction and its application to fault detection and classification

The fuzzy min–max (FMM) network is a supervised neural network classifier that forms hyperboxes for classification and prediction. In this paper, we propose modifications to FMM in an attempt to improve its classification performance when a small number of large hyperboxes are formed in the network. Given a new input pattern, in addition to measuring the fuzzy membership function of the input pattern to the hyperboxes formed in FMM, an Euclidean distance measure is introduced for predicting the target class associated with the new input pattern. A rule extraction algorithm is also embedded into the modified FMM network. A confidence factor is calculated for each FMM hyperbox, and a user-defined threshold is used to prune the hyperboxes with low confidence factors. Fuzzy if–then rules are then extracted from the pruned network. The benefits of the proposed modifications are twofold, viz., to improve the performance of FMM when large hyperboxes are formed in the network; to facilitate the extraction of a compact rule set from FMM to justify its predictions. To assess the effectiveness of modified FMM, two benchmark pattern classification problems are experimented, and the results from different methods published in the literature are compared. In addition, a fault detection and classification problem with a set of real sensor measurements collected from a power generation plant is evaluated using modified FMM. The results obtained are analyzed and explained, and implications of the modified FMM network as a useful fault detection and classification tool in real environments are discussed.     

A federation–agent–workflow simulation framework for virtual organisation development

Traditional information system development approaches separate the domain model from the system model and then focus on the transformation between them. They are not, however, useful in rapid development of virtual organisations. This paper proposes a simulation-based development framework for establishing such organisations. It consists of a federation–agent–workflow (FAW) model, a set of rules for establishing the mapping from the domain into the virtual organisation, a set of management services, and a macro development process. Basic elements of the model are agents, which can perform active domain behaviour, and they are organised as autonomous federations. Agents within the same federation perform relevant tasks according to an overall workflow. Domain organisation is simulated by the multi-level agents whose behaviour are driven by a nested-workflow mechanism. The framework unifies the traditional domain organisation and information system model into a virtual organisation model, and this allows users to develop intuitive virtual organisations from the viewpoint of the domain. A comparison between the framework and the traditional information system approaches shows that the framework provides a simpler development process, so it meets the needs of virtual organisations for rapid and mobile development.     

A cascaded classifier approach for improving detection rates on?rare attack categories in network intrusion detection

Network intrusion detection research work that employed KDDCup 99 dataset often encounter challenges in creating classifiers that could handle unequal distributed attack categories. The accuracy of a classification model could be jeopardized if the distribution of attack categories in a training dataset is heavily imbalanced where the rare categories are less than 2% of the total population. In such cases, the model could not efficiently learn the characteristics of rare categories and this will result in poor detection rates. In this research, we introduce an efficient and effective approach in dealing with the unequal distribution of attack categories. Our approach relies on the training of cascaded classifiers using a dichotomized training dataset in each cascading stage. The training dataset is dichotomized based on the rare and non-rare attack categories. The empirical findings support our arguments that training cascaded classifiers using the dichotomized dataset provides higher detection rates on the rare categories as well as comparably higher detection rates for the non-rare attack categories as compared to the findings reported in other research works. The higher detection rates are due to the mitigation of the influence from the dominant categories if the rare attack categories are separated from the dataset.     

A new arc detection method based on fuzzy logic using S-transform for pantograph–catenary systems

pantograph–catenary system is one of the critical components used in electrical trains. It ensures the transmission of the electrical energy to the train taken from the substation that is required for electrical trains. The condition monitoring and early diagnosis for pantograph–catenary systems are very important in terms of rail transport disruption. In this study, a new method is proposed for arc detection in the pantograph–catenary system based signal processing and S-transform. Arc detection and condition monitoring were achieved by using current signals received from a real pantograph–catenary system. Firstly, model based current data for pantograph–catenary system is obtained from Mayr arc model. The method with S-transform is developed by using this current data. Noises on the current signal are eliminated by applying a low pass filter to the current signal. The peak values of the noiseless signals are determined by taking absolute values of these signals in a certain frequency range. After the data of the peak points has been normalized, a new signal will be obtained by combining these points via a linear interpolation method. The frequency-time analysis was realized by applying S-transform on the signal obtained from peak values. Feature extraction that obtained by S-matrix was used in the fuzzy system. The current signal is detected the contdition as healthy or faulty by using the outputs of the fuzzy system. Furthermore the real-time processing of the proposed method is examined by applying to the current signal received from a locomotive.     

An efficient network flow code for finding all minimum cost s–t cutsets

Cutset algorithms have been well documented in the operations research literature. A directed graph is used to model the network, where each node and arc has an associated cost to cut or remove it from the graph. The problem considered in this paper is to determine all minimum cost sets of nodes and/or arcs to cut so that no directed paths exist from a specified source node s to a specified sink node t. By solving the dual maximum flow problem, it is possible to construct a binary relation associated with an optimal maximum flow such that all minimum cost s–t cutsets are identified through the set of closures for this relation. The key to our implementation is the use of graph theoretic techniques to rapidly enumerate this set of closures. Computational results are presented to suggest the efficiency of our approach.Scope and purposeThis paper describes the technical details of a network flow algorithm used to find all minimum cost s–t cutsets in any network topology. The motivation for this work was to provide additional automated analysis capability to a military network targeting system. Specifically, the problem is to identify a minimum cost set of nodes and/or arcs that when removed from the network, will disconnect a selected pair of origin–destination nodes. Algorithms for solving this problem are well understood, with an active research thrust in both the operations research and computer science academic communities in developing more efficient algorithms for larger networks. The main contribution of this paper is in extending these algorithms to quickly find all minimum cost cutset solutions. The implementation described in this paper outperformed conventional methods by several orders of magnitude on networks having thousands of nodes and arcs, with empirical solution times that grew linearly with the network size. The results translate to a real-time cutset analysis capability to support military targeting applications.     

A multi-objective cost–benefit optimization algorithm for network hardening

International Journal of Information Security - Network hardening is an optimization problem to find the best combination of countermeasures to protect a network from cyber-attacks. While an...     

A new hybrid method for time series forecasting: AR–ANFIS

In this study, a new hybrid forecasting method is proposed. The proposed method is called autoregressive adaptive network fuzzy inference system (AR–ANFIS). AR–ANFIS can be shown in a network structure. The architecture of the network has two parts. The first part is an ANFIS structure and the second part is a linear AR model structure. In the literature, AR models and ANFIS are widely used in time series forecasting. Linear AR models are used according to model-based strategy. A nonlinear model is employed by using ANFIS. Moreover, ANFIS is a kind of data-based modeling system like artificial neural network. In this study, a linear and nonlinear forecasting model is proposed by creating a hybrid method of AR and ANFIS. The new method has advantages of data-based and model-based approaches. AR–ANFIS is trained by using particle swarm optimization, and fuzzification is done by using fuzzy C-Means method. AR–ANFIS method is examined on some real-life time series data, and it is compared with the other time series forecasting methods. As a consequence of applications, it is shown that the proposed method can produce accurate forecasts.

     

A secure and efficient identity-based authenticated key exchange protocol for mobile client–server networks

Recently, Chou et al. (J Supercomput 66(2): 973–988, 2013) proposed two identity-based key exchange protocols using elliptic curves for mobile environments. The first one is an two-party authentication key exchange protocol to establish a session key between a client and a remote server. The second one is an extended version for three-party setting to establish a session key between two clients with the help of a trusted server. However, this paper finds the first one vulnerable to impersonation attack and key-compromise impersonation attack, and the second one insecure against impersonation attack. To overcome the weaknesses, we propose an improved identity-based two-party authentication key exchange protocol using elliptic curves. The rigorous analysis shows that our scheme achieves more security than related protocols.     

A framework for process–solution analysis in collaborative learning environments

One of the most challenging aspects of computer-supported collaborative learning (CSCL) research is automation of collaboration and interaction analysis in order to understand and improve the learning processes. It is particularly necessary to look in more depth at the joint analysis of the collaborative process and its resulting product. In this article, we present a framework for comprehensive analysis in CSCL synchronous environments supporting a problem-solving approach to learning. This framework is based on an observation–abstraction–intervention analysis life-cycle and consists of a suite of analysis indicators, procedures for calculating indicators and a model of intervention based on indicators. Analysis indicators are used to represent the collaboration and knowledge building process at different levels of abstraction, and to characterize the solution built using models of the application domain, the problems to solve and their solutions. The analysis procedures combine analysis of actions and dialogue with analysis of the solution. In this way, the process and the solution are studied independently as well as together, enabling the detection of correlations between them. In order to exemplify and test the framework, the methodological process underlying the framework was followed to guide the implementation of the analysis subsystems of two existing CSCL environments. In addition, a number of studies have been conducted to evaluate the framework's approach, demonstrating that certain modes of collaborating and working imply particular types of solutions and vice versa.     

A new graph representation for cable–membrane structures

In this paper, a new graph representation is proposed which is applicable to cable–membrane structures modelled using both one- and two-dimensional elements. The proposed graph representation is an engineering design approach and not based on a mathematically derived representation. The proposed graphs are partitioned using state-of-the-art tools, including METIS [METIS, a software package for partitioning unstructured graphs, partitioning meshes, and computing fill-reducing orderings of sparse matrices (1997); J Parallel Distribut Comput (1997)], and JOSTLE [Advances in computational mechanics with parallel and distributed processing (1997); Parallel dynamic graph-partitioning for unstructured meshes (1997); Int J High Perform Comput Appl 13 (1999) 334; Appl Math Model 25 (2000) 123]. The graph representation performs better than standard graph representations for those cases when the rules of geometric locality and uniform element distribution around nodes are violated. The relation of the proposed graph representation to the most advanced hyper-graph representation [IEEE Trans Parallel Distribut Syst 10 (1999) 673; Parallel Comput 26 (2000) 673] is also discussed.