Evaluation of anomaly‐based IDS for mobile devices using machine learning classifiers

Gesture recognition is a topic in computer science and language technology that aims to interpret human gestures with computer programs and many different algorithms. It can be seen as the way computers can understand human body language. Today, the main interaction tools between computers and humans are still the keyboard and mouse. Gesture recognition can be used as a tool for communication with the machine and interaction without any mechanical device such as a keyboard or mouse. In this paper, we present the results of a comparison of eight different machine learning (ML) classifiers in the task of human hand gesture recognition and classification to explore how to efficiently implement one or more tested ML algorithms on an 8-bit AVR microcontroller for on-line human gesture recognition with the intention to gesturally control the mobile robot. The 8-bit AVR microcontrollers are still widely used in the industry, but due to their lack of computational power and limited memory, it is a challenging task to efficiently implement ML algorithms on them for on-line classification. Gestures were recorded by using inertial sensors, gyroscopes, and accelerometers placed at the wrist and index finger. One thousand and eight hundred (1800) hand gestures were recorded and labelled. Six important features were defined for the identification of nine different hand gestures using eight different machine learning classifiers: Decision Tree (DT), Random Forests (RF), Logistic Regression (LR), Linear Discriminant Analysis (LDA), Support Vector Machine (SVM) with linear kernel, Naïve Bayes classifier (NB), K-Nearest Neighbours (KNN), and Stochastic Gradient Descent (SGD). All tested algorithms were ranged according to Precision, Recall, and F1-score (abb.: P-R-F1). The best algorithms were SVM (P-R-F1: 0.9865, 0.9861, and 0.0863), and RF (P-R-F1: 0.9863, 0.9861, and 0.0862), but their main disadvantage is their unusability for on-line implementations in 8-bit AVR microcontrollers, as proven in the paper. The next best algorithms have had only slightly poorer performance than SVM and RF: KNN (P-R-F1: 0.9835, 0.9833, and 0.9834) and LR (P-R-F1: 0.9810, 0.9810, and 0.9810). Regarding the implementation on 8-bit microcontrollers, KNN has proven to be inadequate, like SVM and RF. However, the analysis for LR has proved that this classifier could be efficiently implemented on targeted microcontrollers. Having in mind its high F1-score (comparable to SVM, RF, and KNN), this leads to the conclusion that the LR is the most suitable classifier among tested for on-line applications in resource-constrained environments, such as embedded devices based on 8-bit AVR microcontrollers, due to its lower computational complexity in comparison with other tested algorithms.

The detection accuracy and model building time of machine learning (ML) classifiers are vital aspects for an intrusion detection system (IDS) to predict attacks in real life. Recently, researchers have introduced feature selection methods to increase the detection accuracy and minimize the model building time of a limited number of ML classifiers. Therefore, identifying more ML classifiers with very high detection accuracy and the lowest possible model building time is necessary. In this study, the authors tested six supervised classifiers on a full NSL-KDD training dataset (a benchmark record for Internet traffic) using 10-fold cross-validation in the Weka tool with and without feature selection/reduction methods. The authors aimed to identify more options to outperform and secure classifiers with the highest detection accuracy and lowest model building time. The results show that the feature selection/reduction methods, including the wrapper method in combination with the discretize filter, the filter method in combination with the discretize filter, and the discretize filter, can significantly decrease model building time without compromising detection accuracy. The suggested ML algorithms and feature selection/reduction methods are automated pattern recognition approaches to detect network attacks, which are within the scope of the Symmetry journal.

The rapid growth of network traffic and the number of attack vectors, and the ever more advanced nature of cyberattacks have imposed serious difficulties on traditional Intrusion Detection Systems (IDS). High traffic and newer network requirements for real-time processing can often burden these systems. Smart Network Interface Cards (SmartNICs), which free CPUs from data-plane tasks, are the best candidate to help strengthen network security by accelerating packet processing with higher throughput and lower latency. However, offloading ML algorithms on SmartNICs suffers from limitations such as computational efficiency and resource constraints. This work presented a comparative study on three typical ML classifiers decision tree (DT), random forest (RF) and K-Nearest Neighbor (KNN) for SmartNIC-based real-time intrusion detection and compared them systematically. On the NSL-KDD dataset, a standard benchmark dataset for network traffic analysis demonstrates the performance, efficiency, and hardware viability of all models. The experimental results demonstrate that RF provides the best trade-off between accuracy and inference time, compared with DT and KNN. Secondly, this study also highlights the significance of the data preprocessing, including feature selection and encoding, that contributes to tuning the model performance under resource-constrained SmartNIC platforms. This study aims to help researchers and practitioners in designing scalable, low-latency IDSs that are more insightful toward the deployment of Machine Learning (ML) powered security on SmartNICs and moving cyber security towards more robust and efficient infrastructures.

Image classification is a highly significant field in machine learning (ML), especially when applied to address longstanding and challenging issues in the biological sciences, such as specie recognition and biodiversity conservation. In this study, we present the development of a hybrid machine learning-based tool suitable for deployment on mobile devices. This tool is aimed at processing and classifying three-dimensional samples of endemic lizard species from the Amazon rainforest. The dataset used in our experiment was collected at the Museu Paraense Emílio Goeldi (MPEG), Belém-PA, Brazil, and comprises three species: (a) Anolis fuscoauratus; (b) Hoplocercus spinosus; and (c) Polychrus marmoratus. We compared the effectiveness of four artificial neural networks (ANN) for feature extraction: (a) MobileNet; (b) MobileNetV2; (c) MobileNetV3-Small; and (d) MobileNetV3-Large. Additionally, we evaluated five classical ML models for classifying the extracted patterns: (a) Support Vector Machine (SVM); (b) GaussianNB (GNB); (c) AdaBoost (ADB); (d) K-Nearest Neighbors (KNN); and (e) Random Forest (RF). The performance metrics of all classifiers were very close, we used the McNemar’s test on each model’s confusion matrix to evaluate and compare their statistical significance. Our best model was a combination of a 2.9 million parameters MobileNetV3-Small as the feature extractor, with a linear kernel-based SVM as the classifier, which achieved accuracy of 0.955, precision of 0.948, recall of 0.948, and f1-score of 0.948. The results indicated that the use of a small deep learning (DL) model, in combination with a classical ML algorithm, emerges as a viable technique for classifying three-dimensional representations of lizard species samples. Such an approach facilitates taxonomic identification work for professionals in the field and provides a tool adaptable for integration into mobile data recording equipment, such as smartphones, and benefiting from more morphological features extracted from three-dimensional samples instead of two-dimensional images.

In the realm of software development, detecting code smells is a critical task for ensuring good code quality. God class code smell specifically has a specific nature associated with a great deal of subjectivity due to the levels of coupling and cohesion associated to it. Automated techniques for code smell detection aim to resolve this subjectivity. Machine learning techniques have shown promising results that tend to improve accuracy and reduce the bias associated with other techniques for God class identification. This is due to their pattern recognition capabilities making them more objective in identifying patterns that indicate code smells. However, current results need to be further improved in terms of both accuracy and generalizability. The challenge in the use of machine learning is not only in selecting the most appropriate technique but also lies in effectively representing source code as input patterns fed to Machine Learning (ML) classifier(s). Code representation plays a pivotal role in encoding source code for ML algorithms. This study aims improving the accuracy and generalizability of God class code smell detection via exploring the effect of using various code representation techniques, namely, tree-based, metric-based, code embedding, and token-based code representation techniques on the ML detection results. The study is conducted on the MLCQ dataset, and applies various ML algorithms (specifically: Logistic Regression, Random Forest, SVM, Decision Tree, Naive Bayes, Gradient Boosting, XGBoost). The evaluation results show how different code representation techniques influence ML detection outcomes and the comparative performance of ML algorithms. The study findings reveal that the F1-score achieved outperforms prior studies on the MLCQ dataset, indicating the effectiveness of the proposed approach. The presented results reveal how the code representation technique used makes a significant impact on the ML classifier results. This paves the way for developing intelligent IDE plugins for just in time God Class code smell detection among other code smells.

An intrusion detection system (IDS) is an important protection instrument for detecting complex network attacks. Various machine learning (ML) or deep learning (DL) algorithms have been proposed for implementing anomaly-based IDS (AIDS). Our review of the AIDS literature identifies some issues in related work, including the randomness of the selected algorithms, parameters, and testing criteria, the application of old datasets, or shallow analyses and validation of the results. This paper comprehensively reviews previous studies on AIDS by using a set of criteria with different datasets and types of attacks to set benchmarking outcomes that can reveal the suitable AIDS algorithms, parameters, and testing criteria. Specifically, this paper applies 10 popular supervised and unsupervised ML algorithms for identifying effective and efficient ML-AIDS of networks and computers. These supervised ML algorithms include the artificial neural network (ANN), decision tree (DT), k-nearest neighbor (k-NN), naive Bayes (NB), random forest (RF), support vector machine (SVM), and convolutional neural network (CNN) algorithms, whereas the unsupervised ML algorithms include the expectation-maximization (EM), k-means, and self-organizing maps (SOM) algorithms. Several models of these algorithms are introduced, and the turning and training parameters of each algorithm are examined to achieve an optimal classifier evaluation. Unlike previous studies, this study evaluates the performance of AIDS by measuring the true positive and negative rates, accuracy, precision, recall, and F-Score of 31 ML-AIDS models. The training and testing time for ML-AIDS models are also considered in measuring their performance efficiency given that time complexity is an important factor in AIDSs. The ML-AIDS models are tested by using a recent and highly unbalanced multiclass CICIDS2017 dataset that involves real-world network attacks. In general, the k-NN-AIDS, DT-AIDS, and NB-AIDS models obtain the best results and show a greater capability in detecting web attacks compared with other models that demonstrate irregular and inferior results.

Intrusion detection systems (IDS) are used in analyzing huge data and diagnose anomaly traffic such as DDoS attack; thus, an efficient traffic classification method is necessary for the IDS. The IDS models attempt to decrease false alarm and increase true alarm rates in order to improve the performance accuracy of the system. To resolve this concern, three machine learning algorithms have been tested and evaluated in this research which are decision jungle (DJ), random forest (RF) and support vector machine (SVM). The main objective is to propose a ML-based network intrusion detection system (ML-based NIDS) model that compares the performance of the three algorithms based on their accuracy and precision of anomaly traffics. The knowledge discovery in databases (KDD) methodology and intrusion detection evaluation dataset (CIC-IDS2017) are used in the testing which both are considered as a benchmark in the evaluation of IDS. The average accuracy results of the SVM is 98.18%, RF is 96.76% and DJ is 96.50% in which the highest accuracy is achieved by the SVM. The average precision results of the SVM is 98.74, RF is 97.96 and DJ is 97.82 in which the SVM got a higher average precision compared with the other two algorithms. The average recall results of the SVM is 95.63, RF is 97.62 and DJ is 95.77 in which the RF achieves the highest average of recall than SVM and DJ. In overall, the SVM algorithm is found to be the best algorithm that can be used to detect an intrusion in the system.

Background Current heart failure guidelines emphasize the importance of timely detection of subclinical left ventricular (LV) remodelling and dysfunction for more precise risk stratification of asymptomatic subjects. Both LV diastolic dysfunction (LVDD) and LV hypertrophy (LVH) as assessed by echocardiography are known independent prognostic markers of future cardiovascular events in the community. However, selective screening strategies of individuals at risk who would benefit most from in-depth cardiac phenotyping are lacking. Purpose We assess the utility of several Machine Learning (ML) classifiers built on clinical and biochemical features for detecting subclinical LV abnormalities. Methods We included 1407 participants (mean age, 51 years, 51% women) randomly recruited from the general population. We used echocardiographic parameters reflecting LV diastolic function and structure to define LV abnormalities (LVDD, n=239; LVH, n=135). After that four supervised ML algorithms (Random Forest (RF), Gradient Boosting (GD), Stochastic Gradient Descent (SGD) and Support Vector Machines (SV)) were built based on routine clinical, hemodynamic and laboratory data (features; n=61) to categorize LVDD and LVH (two prediction tasks). We applied a 10-fold stratified cross-validation set-up. Results ML classifiers exhibited a high area under the ROC (AUC) for predicting LVDD with values between 88.5% and 93.1% (Figure, left panel). Age, BMI, different components of blood pressure, antihypertensive treatment, routine biomarkers such as serum electrolytes, creatinine, blood sugar, leptin, uric acid, lipid profile, as well as blood cell counts were the top selected features for predicting LVDD. Prediction AUC of ML algorithms for detection of LVH was somewhat lower than for LVDD and ranged from 72.5% to 78.7% (Figure, right panel). The top selected features for LVH classifier were similar to those of LVDD, but also included social class, serum gamma-glutamyl transferase, fasting insulin, plasma renin activity and cortisol. ROC curves (sensitivity-1-specificity) Conclusions ML algorithms combining routinely measured clinical and laboratory data have shown high accuracy of LVDD and LVH prediction. These ML classifiers might be useful to preselect individuals at risk for further in depth echocardiographic examination, monitoring and implementation of preventive strategies in order to delay transition to disease symptoms.

The Internet of Things (IoT) is an interconnected framework of computer devices, software, and sensors to work collectively to automate and monitor different tasks and procedures without human intervention. IoTs provide benefits and ease in performing operations for various industries and home and health stakeholders. Still, it faces security threats and challenges that make the IoT framework unreliable regarding security and privacy. Intrusion detection systems have been designed and deployed to overcome these security challenges. Over the past few years, for making the IDS intelligent artificial intelligence has been integrated with them. Besides this, different feature selection techniques are also being used to make the datasets appropriate for Machine Learning (ML) classifiers. This research uses a filter-based feature selection technique to select the important features from two datasets, UNSW-NB15 and NSL-KDD. After that, datasets with selected features are given to the classifiers as input. This work also evaluates different ML classifiers such as Multiple Layers Perceptron (MLP), CatBoost, Light Gradient Boosting (LGBM), Extra-Tree Classifier (ETC), Random Forest (RF), and K-nearest neighbor (KNN). Different metrics, Accuracy, Precision, Recall, F1, Detection Rate, and FAR, have been used for performance analysis. Evaluation results proved the LGBM classifier effective among other classifiers with 98.70% accuracy on the UNSW-NB15 dataset and 99.8% on the NSL-KDD dataset after feature selection with mean absolute difference (MAD) feature selection technique. Results are also compared with existing models to provide the efficiency of the proposed model.

Machine learning (ML) techniques are essential in the detection of network attacks and enhancing network security. A device or software that recognizes any unusual pattern in the network and alerts the user about the same is an intrusion detection system (IDS). In this chapter, we have described the use of ML classification algorithms on the UNSW-NB15 dataset, leading to the generation of a network intrusion detection model which classifies incoming traffic into malicious or non-malicious traffic and issues an alert to the user. We have implemented the following ML algorithms – support vector machine, artificial neural network, and one-class support vector machine with an average accuracy of 89.25%, 91.54%, and 93.05%, respectively. Two graphical user interfaces (online and offline versions) have been developed for the system. Thus, the chapter proposes an optimized intrusion detection system that improves upon the existing intrusion detection systems which detect malicious packets in the network.

The research relevance is determined by the growing threats in cybersecurity, which require improved methods of detecting vulnerabilities in software, with the help of the latest technologies such as artificial intelligence (AI). The study aimed to determine the effectiveness of AI for vulnerability testing as an alternative to traditional security testing methods, particularly pentesting. To achieve this goal, machine learning algorithms were analysed, a hybrid model for vulnerability detection was developed, and the use of intrusion detection and prevention systems, automated approaches to software testing, and application interface security was addressed. The study determined that decision trees quickly classify traffic but overlearn; support vector machines accurately analyse logs but are sensitive to settings; naive Bayesian classifiers effectively filter messages but are limited by assumptions; neural networks and deep learning detect complex threats but require a lot of data; the k-nearest neighbours’ algorithm is suitable for small systems but slow; and random forests are accurate in code analysis but less interpretable. AI is fast and scalable but limited in understanding context and responding to new threats. The results showed that pentesting prevailed in detecting complex vulnerabilities, and the hybrid machine learning model achieved 93% accuracy and 100% prediction accuracy but missed 17% of vulnerabilities. For their part, cybersecurity technologies such as application interface testing, bug bounty programmes, security integration into development, intrusion detection systems, end-to-end encryption, IoT security and phishing are also effective, but need to be adapted to new threats. The results of the study can be used by cybersecurity companies, software developers, and security engineers to improve vulnerability testing and cyber threat protection processes, including with the help of AI-based tools

Intrusion Detection Systems are of paramount importance in the present-day network security environment. By analyzing and predicting the behavior of incoming data, IDS helps in classifying it as either a benign or dangerous activity. In this paper, implementation of multiple Intrusion Detection Systems is done using different machine learning algorithms like KNN, AdaBoost, SVM, Logistic Regression, Random Forest, Artificial Neural Networks and Naive Bayes. The class imbalance in the dataset, caused by innate mannerisms of network analysis, is corrected using Synthetic Minority Oversampling Technique (SMOTE). The dataset is then reduced using three different Dimensionality Reduction Techniques namely PCA, t-SNE, and UMAP. The three datasets produced by these techniques are then used to build the Intrusion Detection System, using the machine learning algorithms. The models will implement binary classification to classify the incoming attacks between benign activity and DDoS Attacks.

Prediction is an important way to analyse stroke risk management. This study explored the critical influencing factors of stroke, used the classical multilayer perception (MLP) and radial basis function (RBF) machine learning (ML) algorithms to develop the model for stroke prediction. The two models were trained with Bagging and Boosting ensemble learning algorithms. The performances of the prediction models were also compared with other classical ML algorithms. The result showed that (1) total cholesterol (TC) and other nine factors were selected as principal factors for the stroke prediction; (2) the MLP model outperformed RBF model in terms of accuracy, generalization and inter-rater reliability; (3) ensemble algorithm was superior to single algorithms for high-dimension dataset in this study. It may come to the conclusion that this study improved the stroke prediction methods and contributed much to the prevention of stroke.

BackgroundNearly 20% of pregnancies in patients with Systemic lupus erythematosus (SLE) result in an adverse pregnancy outcome (APO); early identification of women with SLE who are at high risk of...

SummaryAccurate prediction of the solubility of chemical substances in solvents remains a challenge. The sparsity of high-quality solubility data is recognized as the biggest hurdle in the development of robust data-driven methods for practical use. Nonetheless, the effects of the quality and quantity of data on aqueous solubility predictions have not yet been scrutinized. In this study, the roles of the size and the quality of data sets on the performances of the solubility prediction models are unraveled, and the concepts of actual and observed performances are introduced. In an effort to curtail the gap between actual and observed performances, a quality-oriented data selection method, which evaluates the quality of data and extracts the most accurate part of it through statistical validation, is designed. Applying this method on the largest publicly available solubility database and using a consensus machine learning approach, a top-performing solubility prediction model is achieved.