A Survey of Malware Analysis Using Community Detection Algorithms

This thesis focuses on the pressing issue of illicit drug trafficking and its impact on public health and safety at a global level. With the advent of digital technologies and social media platforms, combating drug trafficking has become increasingly challenging for law enforcement and researchers alike. Among these platforms, Instagram, a popular photo and video-sharing social networking platform, has emerged as a prominent hub for drug trafficking activities. In this study, we delve into the effectiveness of community and key player detection algorithms in identifying and disrupting illicit drug supply networks on Instagram. To conduct our research, we collected real Instagram data spanning from June to August 2022. We examined several community detection algorithms, including Louvain, Newman-Girvan, Infomap, Label Propagation, and Hierarchical Clustering. Additionally, we explored key player algorithms, namely CDKPE, TopRank, K-core, and KPEI, the latter being a novel algorithm introduced in this study. Our objective was to assess the performance of these algorithms in accurately identifying and targeting drug trafficking networks. Our findings reveal that the Louvain and Newman-Girvan algorithms outperformed others in terms of community detection, demonstrating their effectiveness in identifying cohesive groups involved in drug trafficking on Instagram. In terms of key player detection, the CDKPE and KPEI algorithms emerged as the most effective, highlighting the individuals who play pivotal roles within these networks. These algorithms offer practical applications for law enforcement agencies seeking to disrupt drug trafficking operations on Instagram. By emphasizing the importance of leveraging advanced analytical tools, our study underscores the significance of combating drug trafficking on social media platforms.

Association rules are widely used to extract patterns from a given database. The association rules are capable of finding correlations among items, making it possible for the user to learn which items are present in the transactions and which of them have a significant correlation. One of the major problems with association rules is that the number of extracted rules usually exceeds the number of transactions present in the database, also surpassing the user’s capability to explore the obtained knowledge. To overcome this problem, the post-processing phase was proposed with the objective of directing the user to the rules that potentially have the most interesting knowledge. One of the used approaches is to divide the association rules into groups (or clusters), so that rules behave similarly are on the same group, facilitating the rule set understanding. In the literature, there are some works that uses clustering algorithms to split the rules while some other works use community detection algorithms. As both approaches obtain groups of association rules, but using different premises, different results can be obtained. No study has been done on the differences among clustering and community detection algorithms, which makes the selection of the algorithm hard, once their behavior is not well known in the association rule post-processing phase. This paper presents an analysis on both approaches, aiming to find the differences and the similarities among them, making it easier to select an approach by knowing its behavior.

Software-Defined Networking (SDN) is a networking approach that separates the network's control plane and data plane to provide better network control. The nature of SDN requires an essential focus on its reliability and availability, which includes failure detection aspects. Several techniques have been proposed to enhance SDN failure detection, including passive and active approaches. However, the Route Inspection (RI) algorithm, an example of the active probing method in active detection, has scalability issues when deployed in large-scale networks as it generates inefficient and lengthy probe paths. To address this, we propose using community detection (CD) algorithms to improve the probe path generation of the RI algorithm, resulting in the 'Failure Detection using Community Detection and probing (FDCD)' framework. With the aim to reduce travel paths, the proposed framework minimizes the network topology using CD algorithms to reduce the topology size into smaller communities. Then, the RI algorithm calculates the probe path in the communities instead of the single large topology, thus improving the efficiency of the failure detection mechanism. This paper adopts three community detection algorithms: Louvain, Label Propagation, and Girvan-Newman. We evaluate the framework using three well-known network topologies, COST266, PIORO40, and GERMANY50, in Mininet to observe the framework's performance. The results indicate that the proposed approach improves the algorithm's scalability against its baseline approach, improving the average probe round trip time by 66.87% and the average path installation time by 2.67%.

Complex network analysis which can be represented as graph has gained much interest from researchers recently. Analysis derived from complex network leading to a discovery of important group or community lies within the network. It imposes a significant challenge to computer scientists, physicists, and sociologists alike, to identify and discover the true meaning of community for complex network. Different community detection algorithms have been proposed in different perspective of almost similar aim of identifying the community. In this paper, we apply the modularity measurement on complex network and test the strengthness of community found by algorithm proposed. The main study focuses on the importance of having robust algorithm in detecting communities in different type of complex network. Experimental results show that the method is able to successfully separate community by achieving an ideal modularity value.

Incorporating Community Detection and Clustering Techniques into Collaborative Filtering Model

This paper investigates the image-based malware classification using machine learning techniques. It is a recent approach for malware classification in which malware binaries are converted into images (i.e. malware images) prior to feeding machine learning models, i.e. k-nearest neighbour (k-NN), Naive Bayes (NB), Support Vector Machine (SVM) or Convolution Neural Networks (CNN). This approach relies on image texture to classify a malware instead of signatures or behaviours of malware collected via malware analysis, thus it does not encounter a problem if the signatures of a new malware variant has not been collected or the behaviours of a new malware variant has not been updated.

Community detection is one of the primary tools to discover useful information that is hidden in complex networks. Some community detection algorithms for bipartite networks have been proposed from various viewpoints. However, the performance of these algorithms deteriorates when the community structure becomes unclear. Enhancing community structure remains a nontrivial task. In this paper, we propose a community detection algorithm, called ECD, that enhances community structure in bipartite networks. In the proposed ECD, the topology of a network is modified by reducing unnecessary edges that are connected to neighboring low-weight communities. Therefore, an ambiguous community structure is converted into a structure that is much clearer than the original structure. The experimental results on both artificial and real-world networks verify the accuracy and reliability of our algorithm. Compared with existing community detection algorithms using state-of-the-art methods, our algorithm has better performance.

Community detection in social networks based on fire propagation

The human brain can be represented as a graph in which neural units such as cells or small volumes of tissue are heterogeneously connected to one another through structural or functional links. Brain graphs are parsimonious representations of neural systems that have begun to offer fundamental insights into healthy human cognition, as well as its alteration in disease. A critical open question in network neuroscience lies in how neural units cluster into densely interconnected groups that can provide the coordinated activity that is characteristic of perception, action, and adaptive behaviors. Tools that have proven particularly useful for addressing this question are community detection approaches, which can identify communities or modules: groups of neural units that are densely interconnected with other units in their own group but sparsely interconnected with units in other groups. In this paper, we describe a common community detection algorithm known as modularity maximization, and we detail its applications to brain graphs constructed from neuroimaging data. We pay particular attention to important algorithmic considerations, especially in recent extensions of these techniques to graphs that evolve in time. After recounting a few fundamental insights that these techniques have provided into brain function, we highlight potential avenues of methodological advancements for future studies seeking to better characterize the patterns of coordinated activity in the brain that accompany human behavior. This tutorial provides a naive reader with an introduction to theoretical considerations pertinent to the generation of brain graphs, an understanding of modularity maximization for community detection, a resource of statistical measures that can be used to characterize community structure, and an appreciation of the usefulness of these approaches in uncovering behaviorally-relevant network dynamics in neuroimaging data.

Many complex systems in the real world such as social networks can be modeled by complex networks. The complex network analysis and especially community detection is an important research topic in graph analysis that aims to identify the structure of a graph and its similar groups of nodes. In recent years, various algorithms such as Girvan and Newman’s method (GN) is introduced which is based on a divisive approach for graph clustering. Although GN is a highly popular and widely used method, it suffers from scalability and computational complexity. GN needs O(m3) and O(m3 + m3logm) time to detects communities in unweighted and weighted graphs respectively. Hence, in this paper, a faster method is suggested that detects communities in O(m2) for both weighted and unweighted graphs. In this paper, firstly, we define degree for each edge and then we propose a new and fast approach for the calculation of edges betweenness that is based on edge degree centrality. Furthermore, in order to boost the speed of the algorithm, we suggest instead of just one edge, multiple edges can be removed in each iteration. Since the proposed method wants to enhance the GN method, in the evaluation section the quality of detected communities, the accuracy and speed of the suggested method are assessed by the comparison with the GN method. Results prove that our proposed method is extremely faster than plain GN and the detected communities often have better quality than the plain GN method. Furthermore, we compare our proposed method with meta-heuristic algorithms which are a novel approach for community detection. Results clarify that the suggested method is notably faster, scalable, stable, reliable, and efficient than meta-heuristic algorithms.

<p dir="ltr">One of the most critical features of real-world networks is their community structure, as it reveals the internal organization of nodes. Finding such partitions is an interesting and essential task from both theoretical and practical perspectives. As a result, there is a growing demand for effective community detection algorithms. However, testing and designing such algorithms is demanding and challenging: one of the biggest problems is the lack of proper datasets and the fact that some have disputable ground-truth labeling, to say the least. One way to avoid this problem is to use artificial benchmarks with a built-in community structure.</p><p dir="ltr">In this work, we propose ABCDe—a multi-threaded implementation of the ABCD (Artificial Benchmark for Community Detection) graph generator. We test its performance and compare it with the previously available sequential version of the ABCD model and the parallel implementation of the standard and widely used LFR generator. We also investigate various theoretical asymptotic properties of the ABCD and ABCDe models. In particular, we analyze the modularity function, arguably the most important graph property in the context of community detection. By doing so, we show that models from the ABCD family are proper tools for designing new algorithms, not only those suited specifically for the community detection task.</p><p dir="ltr">Finally, we introduce a new approach to community detection in graphs. The idea is to initialize one of the popular heuristic-based community detection algorithms, such as Louvain or Leiden, with a partition obtained by embedding the graph nodes into a high-dimensional real vector space and then running a clustering algorithm on this latent representation. This procedure significantly improves the results and reduces the inherent volatility of such algorithms. Proper embedding filters out unnecessary information while retaining the proximity of nodes belonging to the same community.</p>

Research has focused on exploring communities in evolving social networks where rapid changes occur continuously. Most community detection approaches rely only on network structure ignoring its content and thus valuable information. We propose a community detection algorithm that exploits both content and structure so as to form more thematically cohesive communities. In particular, we extend a fast incremental structural community detection algorithm in order to take into consideration the content of the network at each step and detect evolving, overlapping communities. We compare the proposed algorithm against the original one and show that it discovers more cohesive communities through time.

Immune response to Plasmodium falciparum antigens in Cameroonian primigravidae: Evolution after delivery and during second pregnancy : Fievet, N., Cot, M., Ringwald, P., Bickii, J., Dubois, B., Le Hesran, J.Y., Migot, F., Deloron, P. INSERM U13/IMEA, Hopital Bichat-Claude Bernard, 46 Rue Henri Huchard, 75018 Paris, France [Clinical and Experimental Immunology 107/3, 462–467 (1997)

Memetic algorithm using node entropy and partition entropy for community detection in networks

In this paper, we present a novel data clustering framework for big sensory data produced by IoT applications. Based on a network representation of the relations among multi-dimensional data, data clustering is mapped to node clustering over the produced data graphs. To address the potential very large scale of such datasets/graphs that test the limits of state-of-the-art approaches, we map the problem of data clustering to a community detection one over the corresponding data graphs. Specifically, we propose a novel computational approach for enhancing the traditional Girvan–Newman (GN) community detection algorithm via hyperbolic network embedding. The data dependency graph is embedded in the hyperbolic space via Rigel embedding, allowing more efficient computation of edge-betweenness centrality needed in the GN algorithm. This allows for more efficient clustering of the nodes of the data graph in terms of modularity, without sacrificing considerable accuracy. In order to study the operation of our approach with respect to enhancing GN community detection, we employ various representative types of artificial complex networks, such as scale-free, small-world and random geometric topologies, and frequently-employed benchmark datasets for demonstrating its efficacy in terms of data clustering via community detection. Furthermore, we provide a proof-of-concept evaluation by applying the proposed framework over multi-dimensional datasets obtained from an operational smart-city/building IoT infrastructure provided by the Federated Interoperable Semantic IoT/cloud Testbeds and Applications (FIESTA-IoT) testbed federation. It is shown that the proposed framework can be indeed used for community detection/data clustering and exploited in various other IoT applications, such as performing more energy-efficient smart-city/building sensing.