Enhancing malware detection with feature selection and scaling techniques using machine learning models

Intrusion detection plays a critical role in safeguarding computer networks from malicious activities and unauthorized access. Traditional machine learning (ML) models have been widely employed for intrusion detection, but their effectiveness can be limited due to the complex and evolving nature of network attacks. An efficient Convolutional Neural Network (CNN) that utilizes one-dimensional convolutions, batch normalization, and max pooling layers is designed to capture the attack patterns in network traffic data. By leveraging the inherent feature extraction capabilities of CNNs, the proposed architecture demonstrates improved performance in identifying network intrusions compared to traditional ML models. The effectiveness of the novel CNN architecture is evaluated by conducted comprehensive experiments on two benchmark intrusion detection datasets. The designed CNN performance was compared with four other ML models such as logistic regression, k-nearest neighbors, decision trees, and random forest. The experimental results revealed that the proposed CNN architecture outperformed the traditional ML models with highest accuracy of 97.68% and 97.39% and highest F1-score of 97.68% and 97.40% for. UNSW-NB15 and CICIDS2017 datasets, respectively. The proposed CNN architecture serves as a promising alternative to traditional ML models, offering improved performance in identifying and mitigating network attacks.

Graph theory provides a robust framework for modelling complex relationships in medical data, enhancing classification accuracy through relational learning. Unlike traditional machine learning (ML) models that treat data points independently, graph-based approaches support structural dependencies to improve feature representation. This study explores the application of Graph Attention Networks (GAT), GraphSAGE, Graph Convolutional Network(GCN) and Graph Isomorphism Network (GIN) for breast cancer classification, employing k-nearest neighbor (KNN) graphs to construct a structured dataset where nodes represent patients and edges capture feature similarities. The effectiveness of the graph-based approaches is evaluated against traditional ML classifiers, including Decision Trees, Random Forest, LightGBM, and XGBoost. Experimental results indicate that GCN, GIN, GAT and GraphSAGE are beat conventional methods, with GCN, GAT and GraphSAGE achieved 100% test-accuracy and with GIN achieved 99.42%, to confirm the percentage of accuracy, authors conducted extensive experiments, including robustness testing by reducing KNN connections, introducing noise, and shuffling train-test splits. Results demonstrate that graph-based models are significantly best than traditional ML models, and these graph-based models maintain same classification accuracy while maintaining stability under robustness tests. The findings confirm that graph-based learning provides a scalable, interpretable, and highly accurate alternative for medical classification tasks, proving its effectiveness in distinguishing between benign and malignant tumors.

Identification of high-risk genes and classification of acute myocardial infarction patients utilizing deep learning in a restricted cohort.

Polycystic ovary syndrome (PCOS) is the most frequent endocrinological anomaly in reproductive women that causes persistent hormonal secretion disruption, leading to the formation of numerous cysts within the ovaries and serious health complications. But the real-world clinical detection technique for PCOS is very critical since the accuracy of interpretations being substantially dependent on the physician's expertise. Thus, an artificially intelligent PCOS prediction model might be a feasible additional technique to the error prone and time-consuming diagnostic technique. In this study, a modified ensemble machine learning (ML) classification approach is proposed utilizing state-of-the-art stacking technique for PCOS identification with patients' symptom data; employing five traditional ML models as base learners and then one bagging or boosting ensemble ML model as the meta-learner of the stacked model. Furthermore, three distinct types of feature selection strategies are applied to pick different sets of features with varied numbers and combinations of attributes. To evaluate and explore the dominant features necessary for predicting PCOS, the proposed technique with five variety of models and other ten types of classifiers is trained, tested and assessed utilizing different feature sets. As outcomes, the proposed stacking ensemble technique significantly enhances the accuracy in comparison to the other existing ML based techniques in case of all varieties of feature sets. However, among various models investigated to categorize PCOS and non-PCOS patients, the stacking ensemble model with ‘Gradient Boosting’ classifier as meta learner outperforms others with 95.7% accuracy while utilizing the top 25 features selected using Principal Component Analysis (PCA) feature selection technique.

Propofol is a widely used sedative-hypnotic agent for critically-ill patients requiring invasive mechanical ventilation (IMV). Despite its clinical benefits, propofol is associated with increased risks of hypertriglyceridemia. Early identification of patients at risk for propofol-associated hypertriglyceridemia is crucial for optimizing sedation strategies and preventing adverse outcomes. Machine learning (ML) models offer a promising approach for predicting individualized patient risks of propofol-associated hypertriglyceridemia. We propose the development of a ML model aimed at predicting the risk of propofol-associated hypertriglyceridemia in ICU patients receiving IMV. The study will utilize retrospective data from four Mayo Clinic sites. Nested cross-validation (CV) will be employed, with a 10-fold inner CV loop for model tuning and selection as well as an outer loop using leave-one-site-out CV for external validation. Feature selection will be conducted using Boruta and LASSO-penalized logistic regression. Data preprocessing steps include missing data imputation, feature scaling, and dimensionality reduction techniques. Six ML algorithms will be tuned and evaluated. Bayesian optimization will be used for hyperparameter selection. Global model explainability will be assessed using permutation importance, and local model explainability will be assessed using SHapley Additive exPlanations (SHAP). The proposed ML model aims to provide a reliable and interpretable tool for clinicians to predict the risk of propofol-associated hypertriglyceridemia in ICU patients. The final model will be deployed in a web-based clinical risk calculator. The model development process and performance measures obtained during nested cross-validation will be described in a study publication to be disseminated in a peer-reviewed journal. The proposed study has received ethics approval from the Mayo Clinic Institutional Review Board (IRB #23-007416). Robust external validation using a nested cross-validation (CV) framework will help assess the generalizability of models produced from the modeling pipeline across different hospital settings.A diverse set of machine learning (ML) algorithms and advanced hyperparameter tuning techniques will be employed to identify the most optimal model configuration.Integration of feature explainability will enhance the clinical applicability of the ML models by providing transparency in predictions, which can improve clinician trust and encourage adoption.Reliance on retrospective data may introduce biases due to inconsistent or erroneous data collection, and the computational intensity of the validation approach may limit replication and future model expansion in resource-constrained settings.

Physics-supervised ensemble learning model for predicting failure modes of reinforced concrete columns

Causal machine learning is an approach that combines causal inference and machine learning to understand and utilize causal relationships in data. In current research and applications, traditional machine learning and deep learning models always focus on prediction and pattern recognition. In contrast, causal machine learning goes a step further by revealing causal relationships between different variables. We explore a novel concept called Double Machine Learning that embraces causal machine learning in this research. The core goal is to select independent variables from a gesture identification problem that are causally related to final gesture results. This selection allows us to classify and analyze gestures more efficiently, thereby improving models’ performance and interpretability. Compared to commonly used feature selection methods such as Variance Threshold, Select From Model, Principal Component Analysis, Least Absolute Shrinkage and Selection Operator, Artificial Neural Network, and TabNet, Double Machine Learning methods focus more on causal relationships between variables rather than correlations. Our research shows that variables selected using the Double Machine Learning method perform well under different classification models, with final results significantly better than those of traditional methods. This novel Double Machine Learning-based approach offers researchers a valuable perspective for feature selection and model construction. It enhances the model’s ability to uncover causal relationships within complex data. Variables with causal significance can be more informative than those with only correlative significance, thus improving overall prediction performance and reliability.

Objective: To investigate the feasibility of a machine learning (ML) model based on radiomic features to identify active giant cell arteritis (GCA) in the aorta and differentiate it from atherosclerosis in follow-up [18F]FDG-PET/CT images for therapy monitoring. Methods: To train the ML model, 64 [18F]FDG-PET scans of 34 patients with proven GCA and 34 control subjects with type 2 diabetes mellitus were retrospectively included. The aorta was delineated into the ascending, arch, descending, and abdominal aorta. From each segment, 95 features were extracted. All segments were randomly split into a training/validation (n = 192; 80%) and test set (n = 46; 20%). In total, 441 ML models were trained, using combinations of seven feature selection methods, seven classifiers, and nine different numbers of features. The performance was assessed by area under the curve (AUC). The best performing ML model was compared to the clinical report of nuclear medicine physicians in 19 follow-up scans (7 active GCA, 12 inactive GCA). For explainability, an occlusion map was created to illustrate the important regions of the aorta for the decision of the ML model. Results: The ten-feature model with ANOVA as the feature selector and random forest classifier demonstrated the highest performance (AUC = 0.92 ± 0.01). Compared with the clinical report, this model showed a higher PPV (0.83 vs. 0.80), NPV (0.85 vs. 0.79), and accuracy (0.84 vs. 0.79) in the detection of active GCA in follow-up scans. Conclusions: The current radiomics ML model was able to identify active GCA and differentiate GCA from atherosclerosis in follow-up [18F]FDG-PET/CT scans. This demonstrates the potential of the ML model as a monitoring tool in challenging [18F]FDG-PET scans of GCA patients.

12074 Background: Skeletal-related events (SREs) are detrimental clinical events in bone metastasis from advanced cancer, defined by pathologic fracture, spinal cord compression, and inevitable surgical or radiational intervention to the bone. Given their negative impact on quality of life and prognosis and interpatient heterogeneity in the SRE risk, accurate identification of patients with high SRE risk is critical. Methods: The patient-level data from three randomized clinical trials that administered zoledronic acid (ZA) to patients with bone-metastatic breast cancer, castration-resistant prostate cancer (CRPC), and other types of cancer were analyzed. (N = 460, 452, and 315, respectively) Machine learning (ML) models to predict SREs within 18 months (breast cancer), 12 months (CRPC), and 9 months (other cancers) were developed based on more than 40 baseline clinical and laboratory data. Seven ML algorithms and five feature selection methods were utilized to develop multiple models. The ML model with the best performance was identified based on the F1 score and the area under the receiver operating characteristic curve (AUC-ROC) for each cancer type and interrogated for important features with Shapley additive explanations. Lastly, the ML models’ ability to stratify patients by the cumulative SRE risk was evaluated by calculating hazard ratio (HR) with Cox-proportional hazards models. Results: Among the multiple ML models developed with different algorithms and feature selection methods, the model developed utilizing the random forests algorithm and the Boruta method for selecting features demonstrated the best performance in all types of cancer (F1 0.70, 0.67, and 0.67, and AUC-ROC 0.72, 0.68, and 0.73 for breast cancer, CRPC, and other cancers, respectively). In the ML model for breast cancer, performance status (PS), history of SRE, serum alkaline phosphatase (ALP), history of anti-neoplastic surgery, radiation therapy, and pathologic fracture were included as important features. Serum ALP, albumin, sodium, Gleason scores, and geographic regions were shown to be relevant in the CRPC model. For other cancers, serum ALP, albumin, total protein, phosphorus, red blood cell count, white blood cell count, visceral metastases, and history of arthritis were incorporated in the ML model. The ML model prediction successfully stratified the patients for cumulative SRE risk in all three cohorts. (HR with 95% confidence interval: 2.43 [1.86 – 3.18], 1.92 [1.51 – 2.45], and 3.06 [2.29 – 4.09] for breast cancer, CRPC, and other types of cancer, respectively). Conclusions: ML models incorporating baseline clinical and laboratory data can identify patients with bone metastasis on ZA harboring a high SRE risk.

Small data, big challenges: Machine- and deep-learning strategies for data-limited drug discovery.

A study on road accident prediction and contributing factors using explainable machine learning models: analysis and performance

In recent years, infections and damage caused by malware have increased at exponential rates. At the same time, machine learning (ML) techniques have shown tremendous promise in many domains, often out performing human efforts by learning from large amounts of data. Results in the open literature suggest that ML is able to provide similar results for malware detection, achieving greater than 99% classification accuracy [49]. However, the same detection rates when applied in deployed settings have not been achieved. Malware is distinct from many other domains in which ML has shown success in that (1) it purposefully tries to hide, leading to noisy labels and (2) often its behavior is similar to benign software only differing in intent, among other complicating factors. This report details the reasons for the difficultly of detecting novel malware by ML methods and offers solutions to improve the detection of novel malware. We propose to detect malware by detecting behaviors commonly exhibited by malware such as DLL injection, and process hollowing. This is based on the assumption that there is a set of behaviors that are common to most malware samples and detecting them will generalize to novel malware. Additionally, detected behaviors point analysts toward appropriate handling and mitigation strategies, which is not the case with a binary benign/malicious classification. A behavior labeling method was developed and was used to label an existing malware dataset. Results show that detecting malicious behaviors is much more difficult than simply classifying malware and goodware?achieving 80% accuracy compared to reported 99% accuracy from classifying malware and goodware. This drop is due to several reasons which are detailed in the report. We also propose to evaluate the performance of detecting novel malware by holding out a malware family for testing and training on the other families. Traditional ML evaluation will shuffle the data and then split the data into training and testing. Our method addresses the use-case when novel malware families are encountered and they require more than just a malicious or benign designation. Our results suggest that this type of evaluation is much more difficult than traditional methods and provides more realistic results, albeit, significantly worse. For our behavior detection, accuracy decreases from 80% to 68% across all behaviors when holding out a malware family from training. We show that the degradation in performance is because each malware family has distinct characteristics resulting in high extrapolations by an ML model. Here, an ML model should return an "I do not know" response and request further analysis from an analyst. We run a number of experiments that compare novel malware families to the training data using different feature representations including a genomics-inspired distance measure and features extracted by deep learning. Generally, held-out families are significantly different from the training data, resulting in unpredictable results. This has been observed generally in the ML community [22, 9]. We empirically demonstrate this in the domain of malware detection. In an attempt to improve the detection of malware behaviors, we examine the impact that additional synthetic data has on the performance of an ML model in detecting behaviors in novel malware families. We find that while synthetic data does improve the performance of ML models, often simpler methods perform better than more complicated ones. Two generative modeling techniques were examined to produce synthetic malware samples such that the behaviors present are able to be specified externally. The difficulty is due to finer grained analysis of the executable and modifying the problem from a binary classification problem to a multi-label problem. The addition of synthetic data increases the overall accuracy from 68% to 70%. While far less accurate than measures presented in academic analyses, we believe that this is more representative of real-world performance and allows models to be properly placed within a malware detection system. We suggest that in highly dynamic environments ML pipelines should determine whether an ML model is competent in the area of new data and should involve mechanisms to improve over time with a human in the loop.

Purpose The blood–brain barrier (BBB) is a major obstacle in neurological drug development, restricting most drugs from entering the brain. To address this, computational models leveraging Artificial Intelligence (AI) and machine learning (ML) have been explored for predicting BBB permeability. This meta-review explores various computational strategies leveraging AI and ML to improve BBB permeability prediction. Methods 31 publications were included in this review following a search in PubMed Central and in the Journal of Cheminformatics. Models are categorized into three groups: (1) traditional ML models using physiochemical descriptors, (2) graph/image-based models leveraging molecular structure, and (3) encoder-based methods using SMILES representations. Results Traditional ML models achieve greater predictive accuracy due to their reliance on explicitly defined features, whereas deep learning methods, particularly graph neural networks (GNNs), show promise but require large-scale datasets and pretraining. Encoder-based methods underperform compared to traditional ML and GNNs, likely due to inadequate feature extraction. Conclusion Despite advancements, challenges such as dataset biases, model interpretability, and the need for experimental validation remain. Future research should explore multi-modal integration and generative AI to enhance BBB permeability prediction and aid drug discovery.

Accurate rainfall forecasting is crucial in activities such as agricultural planning, water resource management, and flood preparedness, so failure to accurately forecast rainfall might undermine these activities. This study aimed to improve the accuracy of daily rainfall prediction in Hai district, Kilimanjaro region, Tanzania, a region characterised by a bimodal rainfall pattern, by comparing rainfall prediction accuracies of Traditional Machine Learning (TML) and Deep Learning (DL) models. The 25-year daily rainfall dataset for Hai district was first pre-processed by cleaning, normalisation, and splitting into training (first 60%), validation (next 20%), and test (last 20%) sets. TML models (K-Nearest Neighbours (KNN) through its variant KNN Regressor and Support Vector Machine (SVM) through its variant Support Vector Regressor (SVR)) were developed, trained, and their performances compared with developed and trained DL models (Long Short-Term Memory (LSTM) and Gated Recurrent Units (GRU)). Each model’s test performance was evaluated using the Root Mean Squared Error (RMSE) metric. The findings revealed that the DL models, LSTM and GRU, achieved test RMSE scores of 6.35 mm and 6.49 mm, respectively, while the TML models, KNN and SVM, achieved test RMSE scores of 6.61 mm and 10.42 mm, respectively. The study demonstrated that DL models are more effective for accurate rainfall forecasting than TML models in regions with complex rainfall patterns. The insights gained will guide the development of more reliable, location-specific weather prediction systems, ultimately supporting informed decision-making in agriculture, environmental management, and flood risk reduction in Tanzania and other regions facing similar climatic challenges

Heart disease is one of the leading causes of mortality worldwide, emphasizing the need for early and accurate diagnosis. Traditional machine learning (ML) models such as Random Forest (RF) and Support Vector Machines (SVM) have been widely used for heart disease classification. However, these models often lack the ability to extract hierarchical patterns and long-range dependencies present in complex medical data. To address this limitation, we propose a hybrid deep learning framework that integrates XGBoost with Capsule Networks (XGBoost-CapsNet) and Convolutional Neural Networks (CNN) with Transformer Encoders (CNN-TE) to enhance classification performance.The study utilizes a structured dataset containing essential heart disease indicators. Feature selection is performed using XGBoost, which ranks attributes based on importance. The Capsule Network (CapsNet) is then used to preserve spatial relationships and hierarchical dependencies among features. Meanwhile, the CNN-TE model extracts spatial features through convolutional layers and captures long-range dependencies using a Transformer Encoder with multi-head self-attention mechanisms. The models are trained using optimized hyperparameters and evaluated against baseline ML models (Random Forest, SVM, and standalone CNN). Performance metrics such as accuracy, precision, recall, F1-score, and AUC-ROC are used for comparison.Experimental evaluations demonstrate that the proposed hybrid models significantly outperform traditional approaches. The XGBoost-CapsNet model achieves an accuracy of 98.2%, while CNN-TE reaches 97.4%, both surpassing standalone CNN (95.1%), Random Forest (94.2%), and SVM (91.8%). The AUC-ROC scores further validate the robustness of the models, with XGBoost-CapsNet scoring 0.99 and CNN-TE achieving 0.98. The use of feature selection with XGBoost improves interpretability and computational efficiency, while the hybrid deep learning models enable better feature extraction and classification accuracy.