Intelligent Data Analysis: An International Journal

Nowadays, computers, as well as smart devices, are connected through communication networks making them more vulnerable to attacks. Honeypots are proposed as deception tools but usually used as part of a proactive defense strategy. Hence, this article demonstrates how honeypots data can be analyzed in an active defense strategy. Furthermore, anomaly detection based on unsupervised machine learning techniques allows to build autonomous systems and to detect unknown anomalies without the need for prior knowledge. However, the unsupervised techniques applied for honeypots data analysis do not value the advantages of these tools’ data, particularly the high probability that they include a large number of previously unseen anomalies with unexpected and diverse patterns. Therefore, in the present work, the aim is to improve the unsupervised anomaly detection in honeypots data by varying the data feature subset and the parameterization of the anomaly detection algorithm. To this purpose, an outlier ensemble with LOF (Local Outlier Factor) as a base algorithm is proposed. The ensemble outperforms existing solutions as depicted in the experiments where a detection rate higher than 92% is achieved.

The rapid growth of malicious software (malware) production in recent decades and the increasing number of threats posed by malware to network environments, such as the Internet and intelligent environments, emphasize the need for more research on the security of computer networks in information security and digital forensics. The method presented in this study identifies “species” of malware families, which are more sophisticated, obfuscated, and structurally diverse. We propose a hybrid technique combining aspects of signature detection with machine learning based methods to classify malware families. The method is carried out by utilizing Profile Hidden Markov Models (PHMMs) on the behavioral characteristics of malware species. This paper explains the process of modeling and training an advanced PHMM using sequences obtained from the extraction of each malware family’s paramount features, and the canonical sequences created in the process of Multiple Sequence Alignment (MSA) production. Due to the fact that not all parts of a file are malicious, the goal is to distinguish the malicious portions from the benign ones and place more emphasis on them in order to increase the likelihood of malware detection by having the least impact from the benign portions. Based on “consensus sequences”, the experimental results show that our proposed approach outperforms other HMM-based techniques even when limited training data is available. All supplementary materials including the code, datasets, and a complete list of results are available for public access on the Web. 1

Fuzzy C-Means (FCM) is the most commonly used and discussed fuzzy clustering algorithm in the literature. Nevertheless, it is well known that the performance of FCM is strongly affected by the selection of the initial cluster centers. In other words, the selection of a good set of initial cluster centers plays an important role in the performance of this algorithm. The most common selection method is the trial-and-test random method, in which each execution is performed with different initial centers, randomly generated, resulting in different dataset partitions. This paper proposes two methods to obtain the initial cluster centers which are applied in FCM and its variants. The proposed methods are deterministic, since, for each data set and number of clusters, they will always provide the same cluster centers set. The main advantage of these methods is to provide high quality partitions faster than the original methods as well as other FCM and ckMeans-based algorithms with deterministic selection of cluster centers.

A major challenge in stream clustering is the evolution in the statistical properties of the underlying data. As clustering is inherently unsupervised, selecting suitable parameter values is often difficult. Clustering algorithms with sensitive parameters are often not robust to such changes, leading to poor clustering outputs. Algorithms using K -NN graphs face this problem, as they have a sensitive K -connectivity parameter which prohibits them from adapting to stream concept evolution. We address this by controlling the excess of the skewness of edge length distributions in the underlying K -NN graph by introducing novel skewness excess concept. We demonstrate the asymptotic linear dependency of skewness excess against the graph connectivity and propose the novel RobustRepStream algorithm, which extends the RepStream algorithm, and provides improved robustness against stream evolution. By automatically controlling the skewness excess, the user no longer needs to specify the K -connectivity parameter, and RobustRepStream can adjust the graph connectivity locally in order to achieve performance close to when the optimal K value is known. We demonstrate that RobustRepStream’s skewness threshold parameter is insensitive and universal across all data sets. We comprehensively evaluate RobustRepStream on real-world benchmark data sets against previous stream clustering algorithms, and demonstrate that it provides better clustering performance.

Privacy-preserving utility itemset mining is the process of hiding sensitive-high utility itemsets (SHUIs) appearing in original database such that they will not be discovered in the sanitized database. The purpose of SHUI hiding algorithm is to conceal the set of SHUIs while minimizing the side effects which caused by data distortion process. In this paper, a novel algorithm, named EHSHUI (An Efficient Algorithm for Hiding Sensitive-high utility Itemsets), is proposed to minimize the side effects of the sanitization process. The proposed algorithm includes three heuristic steps: (1) The transaction on which the SHUI achieves maximal utility among transactions containing it is specified as victim transaction; (2) The item that causes minimal impacts on non-SHUIs is selected as victim item; and (3) An exactly number of utility is calculated for reducing internal utility of victim item from victim transaction. This strategy exactly identifies item and transaction for data modification such that it minimizes the impacts on non-SHUIs, data distortions, and the time to access database. The experiment results illustrate that the proposed algorithm achieves higher performance and lower side effects than the state-of-the-art.

Social Networks is an essential phenomenon in all aspects through various perspectives. These networks contain a large number of users better termed as nodes and the connections between the users termed as edges. For efficient information processing and retrieving, accessing the influential node is essential for improving the diffusion process. To identify the influential node inside a heterogeneous community, incorporating probability metrics with regression classifier is put forth stated by proposed method Support Vector Bayesian Machine (SVBM). Node metrics such as degree centrality, closeness centrality is measured for eliminating the nodes primarily. A standardized index based on the centrality values computed for enhancing into SVBM. After the standardized index, similarity dissimilarity index values evaluated by combining the Euclidean, Hamming, Pearson coefficient for valued relations and Jaccard for binary relations which results in a single index value considered as the power degree value(p). The value p determines the node’s boundedness, which indicates the range of influence within the community. The outlier nodes in the bounded region get eliminated, and the nodes remaining taken for the final phase of SVBM, probability regression line predicts the node inhibiting the most influential nature. Experimental evaluation of the proposed system with the existing Support Vector Machine (SVM) technique resulted in 0.95 and 0.41 respectively for Area Under Curve (AUC) denoting that the true positive influential node classification process from the other existing nodes was higher than SVM. In comparison with the existing SVM, the proposed methodology SVBM attained a node detection, which influenced a higher diffusion rate within the networks.

Identifying features to represent graphs such as social networks, protein graphs is increasingly common in both research and business communities, thanks to the fact that data has increased not only in quantity but also in complexity. This results in the graphs to be sparser because not all nodes are fully connected. In addition, if this whole graph is used as input data for learning algorithms e.g. neural network, a lot of training time will be required. Substantial efforts have been made to convert the graphs to better yet compact representations, among of which is graph embedding. The traditional methods used to map the original graph to its embedding representation had not yielded significant results until deep learning was invented. Many good approaches in this direction, as examples, are DeepWalk, node2vec. However, their general weakness is many important connections in the original graph could be lost. In this paper, we propose another approach to retain more edge information while ensuring the embedding graph is still sufficiently small, compared to the original one. Our experiment results show that the method also increases the accuracy of latter learning models.

The theories about crime and correction have their inception in the eighteenth century, highly influenced by the anthropological thoughts emerging during the age of Enlightenment. Throughout the decades, the criminological studies observed their sociological essence encompassing practices from other scientific fields to explain the more contemporary questions, becoming Criminology an inherently interdisciplinary science as a result. The adoption of concepts from Exact Sciences is a recent moving, originating it a novel research area, called Computational Criminology, which employs procedures from Applied Mathematics, Statistics and Computer Science to provide original or enhanced solutions to such questions. One of the most prominent tasks brought by this rising field is crime prediction, which attempts to uncover potential targets for future police intervention and also help solving already committed offenses. The present comparative analysis thus investigates the employment of statistical inference by means of Bayesian network for predictive policing, using the openly accessible registers from Chicago Police Department. Numerous algorithms are available to learn the structure for a Bayesian network purely from data and a comparative examination about them is hence described, with the purpose to establish the most precise and efficient one, according to the attributes of the said criminal dataset, for the implementation of the intended inference.

The problem of efficiently classifying imbalanced data has become one of the most challenging tasks in machine learning. Some real world examples include medical image analysis, fraud detection, fault diagnosis, and anomaly detection. Although several data-level algorithms have been developed to address imbalance, they are typically subject to some restrictions. We propose a novel variant of the k -NN family of classifiers, and name this as Density-based Adaptive-distance k NN (DA k NN). It can effectively handle data with skewed distributions and varying class-densities using the concept of adaptive distance. Comparative superiority is experimentally established over related data-level algorithms (SMOTE, ADASYN), using ten sets of two-class data, in terms of geometric mean (of the true positive and negative rates) and accuracy. Additionally, five sets of multi-class data are considered and compared with different variants of k -NN, which are currently very popular. Finally, DA k NN is successfully applied on the highly imbalanced Lower Grade Glioma (LGG) MR images, with an Average-Dice score of 0.9082 for delineating the tumor regions. The results demonstrate clear superiority over state-of-the-art algorithms.

Social networks have evolved into a popular information and communication platform, and the vast amount of data it generates are rapidly changing and spreading. Thus, it is essential to detect and trace large events and burst topics in mass social network data based on real-time Big Data parallel computing. In this paper, we propose a model that uses the Negative Binomial Distribution to fit the distribution of Weibo topic words. Then, we introduce the concepts of the ‘hot degree’ and the ‘dispersion degree’ of a topic with their corresponding computing methods. And we validate the efficiency of the model using real data. Furthermore, we design a topic detection and trend-tracing algorithm based on stream data, and implement the algorithm on Spark Streaming which is a streaming processing framework that uses memory computing. Finally, the experiments on real data demonstrate that our proposal is effective and efficient in tracking bursting events.

Graph pattern matching has been widespread used for protein structure analysis, expert finding and social group selection, ect. Recently, the study of graph pattern matching using the abundant attribute information of vertices and edges as constraint conditions has attracted the attention of scholars, and multi-constrained simulation has been proposed to address the problem in contextual social networks. Actually, multi-constrained graph pattern matching is an NP-complete problem and the fuzziness of constraint variables may exist in many applications. In this paper, we introduce a multi-fuzzy-constrained graph pattern matching problem in big graph data, and propose an efficient first-k algorithm Fuzzy-ETOF-K for solving it. Specifically, exploration-based method based on edge topology is adopted to improve the efficiency of edge connection, and breadth-first bounded search is used for edge matching instead of shortest path query between two nodes to improve the efficiency of edge matching. The results of our experiments conducted on three datasets of real social networks illustrate that our proposed algorithm Fuzzy-ETOF-K significantly outperforms existing approaches in efficiency and the introduction of fuzzy constraints makes our proposed algorithm more efficient and effective.

The purpose of the influence maximization is to find the top k influential seeds which can maximize the influence spread. Recently, some researchers address this problem through community structure. However, most of these community-based studies only consider the static social network, which ignores that social networks change frequently. In order to deal with the above problem, we present a community-based algorithm on the dynamic social network, which is divided into three phases: (i) community detection, (ii) candidate seed set on the dynamic network, and (iii) final seed set. In the first phase, we use the Louvain algorithm to obtain the community structure. In each community, we analyze the node location to judge the importance of the node. In the second phase, considering the dynamic social network, when a node is added to the network or removed from the network, we update the structure of the social network. Then, the candidate nodes are those nodes with a large influence in each community. And in the third phase, we select k influential seeds from the candidate seeds by CELF algorithm. Extensive experimental results show that our algorithm obtains a better influence spread than many baseline algorithms as well as an acceptable running time while considering the dynamic social networks.