Malware Detection Method using Tree-based Machine Learning Algorithms

With the wide application of information technolo-gies in communication based train control (CB TC) systems, the information security risks it confronts to are ever increasing. It is very difficult to design an intrusion detection system (IDS) which can detect both known and unknown cyber attacks with high true positive rate (TPR) and low false positive rate (FPR), simultaneously. In this paper, we propose a hybrid intrusion detection system (RIDS) which is composed of a signature-based intrusion detection system (SIDS) and an anomaly-based intrusion detection system (AIDS). An improved stacking ensemble algorithm (ISEA) is proposed to enhance the TPR of the SIDS which uses weighted classification probabilities outputted by base-classifiers to generate meta-features for the meta-classifier. The FPR of the AIDS is significantly reduced through adopting the proposed false positive elimination strategy (FPES). In addition, a Bayesian optimization algorithm is used for hyper-parameters adjustment to optimize the overall performance of the RIDS. The proposed RIDS is evaluated using both a KDD99 dataset and a CBTC dataset collected on a hardware-in-the-Ioop simulation platform. For the KDD99 dataset, the TPR and FPR of the proposed RIDS are 98.6% and 1.3%, respectively. For the CBTC dataset, the TPR and FPR are 98.1% and 1.1 %, respectively. Based on the performance comparison among different RIDSs, it is can be concluded that the proposed RIDS is superior to the existing RIDS in both TPR and FPR.

Introduction: Studies that examine the role of rare variants in both simple and complex disease are increasingly common. Though the usual approach of testing rare variants in aggregate sets is more powerful than testing individual variants, it is of interest to identify the variants that are plausible drivers of the association. We present a novel method for prioritization of rare variants after a significant aggregate test by quantifying the influence of the variant on the aggregate test of association. Methods: In addition to providing a measure used to rank variants, we use outlier detection methods to present the computationally efficient Rare Variant Influential Filtering Tool (RIFT) to identify a subset of variants that influence the disease association. We evaluated several outlier detection methods that vary based on the underlying variance measure: interquartile range (Tukey fences), median absolute deviation, and SD. We performed 1,000 simulations for 50 regions of size 3 kb and compared the true and false positive rates. We compared RIFT using the Inner Tukey to 2 existing methods: adaptive combination of p values (ADA) and a Bayesian hierarchical model (BeviMed). Finally, we applied this method to data from our targeted resequencing study in idiopathic pulmonary fibrosis (IPF). Results: All outlier detection methods observed higher sensitivity to detect uncommon variants (0.001 < minor allele frequency, MAF > 0.03) compared to very rare variants (MAF <0.001). For uncommon variants, RIFT had a lower median false positive rate compared to the ADA. ADA and RIFT had significantly higher true positive rates than that observed for BeviMed. When applied to 2 regions found previously associated with IPF including 100 rare variants, we identified 6 polymorphisms with the greatest evidence for influencing the association with IPF. Discussion: In summary, RIFT has a high true positive rate while maintaining a low false positive rate for identifying polymorphisms influencing rare variant association tests. This work provides an approach to obtain greater resolution of the rare variant signals within significant aggregate sets; this information can provide an objective measure to prioritize variants for follow-up experimental studies and insight into the biological pathways involved.

Future emerging technologies in upper limb neuroprosthetic devices will require decoding and executing the user's intended movement. Previous studies, using invasive and non-invasive brain signals, have shown promising results in decoding movement directions during movement execution. Intracortical recordings also allow for decoding of target directions before the actual movement in a reaction task. This thesis contributes to the exciting endeavor of designing practical upper limb neuroprosthetics by investigating the potential of using brain signals recorded non-invasively for detecting the intention to move and decoding directions of a self-paced reaching task before movement initiation. This work has the potential towards a more intuitive and coupled neuro-motor rehabilitation tools. The thesis provides three major contributions: (i) it proposes the use of data-driven and machine learning methods for localizing the regions of interests from scalp surface signals, (ii) it reports on successful detection of movement intention before a self-paced reaching task using amplitudes of on-going slow cortical potentials (SCPs) which is consistent across healthy subjects and chronic stroke patients and (ii) it proposes the use of amplitudes and phase of on-going SCPs for decoding movement directions before the reaching task. First, we reported a method for single trial detection of movement intention before a self-paced reaching task using signal processing and machine learning techniques. We used the movement-related potentials (MRPs) in a narrow frequency range between 0.1 to 1Hz for early detection of movement intention in the first study with 8 healthy subjects using scalp EEG. Movement intention can be detected on average 460ms before the actual onset. The average maximum true positive rates across subjects was 76% peaking at time 167ms before onset. These findings are coherent with the next study on stroke patients and control subjects. In the second study, movement intention can be detected as early as 600ms before the actual onset. More interestingly, the true positive rate reached above 80% for one of the stroke patients (both the paretic and healthy arm) and healthy control subjects. The low false positive rate before the detection of movement intention suggested that the method is promising for future online implementation using appropriate tasks (i.e. goal-oriented reaching). Second, we proposed a method for decoding reaching movement directions before onset using feature selection method called canonical variants analysis (CVA). Across all the subjects, the best selected features are mostly from the frontoparietal regions, which is consistent with previous neurophysiological studies on arm reaching tasks. The results of single trial decoding of movement directions are also promising, with a decoding accuracy before the onset for one of the control healthy subjects was of 71% using the amplitude of on-going SCPs. In addition, at 250ms before onset, the decoding accuracy peaks at 65% with the use of instantaneous phase features. The decoding accuracy for the stroke patients was 40-50% with their paretic arms. Thus, we observe that using phase features has two advantages: (i) the possibility to decode directions earlier and (ii) higher decoding accuracy. The thesis also validates the findings from scalp EEG with the invasive intra-cranial local field potentials recorded from an epileptic patient. We report that movement intention can be detected as early as 2000ms before the onset of movement with accuracy above 90%. The use of electrodes implanted in the supplementary motor area (SMA) for detecting intention with near perfection single trial classification has strengthen the theory that movement preparation starts as early as 1500ms before execution. As for movement directions, the decoding capability is rather low. It should be noticed that there are no electrode implanted in the parietal region that, as we have found in the two EEG studies and has been previously reported, are key for decoding reaching directions. In summary, the work in this thesis suggests that it is possible to recognize above chance level both the intention and direction of a self-paced reaching movement. In particular, movement intention detection can be used for the purpose of early activation of neuro-motor prosthetic devices that could enhance the recovery of stroke patients. In addition, future work derived from this thesis can harness the full potential of early intention detection from human voluntary movement for BCI and neuroprosthetics.

In noninferiority studies, a limit of indifference is used to express a tolerance in results such that the clinician would regard such results as being acceptable or 'not worse'. We applied this concept to a measure of accuracy, the Receiver Operating Characteristic (ROC) curve, for a sequence of tests. We expressed a limit of indifference for the range of acceptable sensitivity values and examined the associated cost of testing within this range. In doing so, we generated the minimum cost maximum ROC (MCMROC) curve, which reflects the reduced sensitivity and cost of testing. We compared the MCMROC and its associated cost curve between limits of indifference set to 0.999 [a 0.1% reduction in true positive rate (TPR)], 0.95 (a 5% reduction in TPR), and 1 (no reduction in TPR). The limit of indifference tended to have less of an effect on the MCMROC curves than on the associated cost curves that were greatly affected. Cost was reduced at high false positive rates (FPRs) at higher limit of indifference (0.999) and at small FPRs as the limit of indifference decreased (0.95). These patterns were also observed as applied to sequential strategies used to diagnose diabetes in the Pima Indians.

Objective To evaluate the performance of three antibody kits for novel coronavirus (SARS-CoV-2) and to investigate the feasibility and advantages of them in clinical application. Methods A total of 104 patients who were admitted to Guangzhou Eighth People's Hospital with COVID-19 from January to February 2020 were selected as research group. Fifty-one healthy subjects were selected during the same period as negative control group. Serum antibodies (IgM/IgG) against SARS-CoV-2 were detected using two kinds of colloidal gold kits (A and B kits) and one chemiluminescence kit (C kit). The positive rates of SARS-CoV-2 nucleic acid in different samples from patients with COVID-19 were retrospectively analyzed. Results The clinical sensitivity of A kit to detect SARS-CoV-2-specific IgM and IgG was 77.88% (81/104) and 65.38% (68/104), respectively, and the clinical specificity was 70.59% (36/51) and 100.00% (51/51). However, the false positive rate in IgM detection was as high as 29.41% (15/51). The sensitivity of B kit to test total antibodies to SARS-CoV-2 was 63.46% (66/104), and the clinical specificity was 94.12% (48/51). The clinical sensitivity of C kit to detect SARS-CoV-2-specific IgM and IgG were respectively 31.73% (33/104) and 64.42% (67/104), and the clinical specificity were both 98.04% (50/51). There was a moderate correlation between the detection results of two colloidal gold kits and the chemiluminescence kit with the Kappa values of 0.462 and 0.587 (Z=6.157, P<0.01; Z=7.345, P<0.01). C kit had the highest positive detection rate for IgG, and would be more reliable to be used for IgG detection in COVID-19 patients 14 d after onset. The total positive detection rate of nucleic acid in all types of samples was 63.46% (66/104). The highest positive detection rate was in throat swabs or sputum samples, followed by those in blood samples and anal swabs. No viral nucleic acid was detected in urine samples for the time being. Conclusions SARS-CoV-2-specific antibodies could be detected in the early or late stage of COVID-19. The method of antibody detection has the advantages of shorter detection time, simple operation and high biological safety, indicating that it could be used as a supplementary or auxiliary detection for the diagnosis of suspected COVID-19 cases with negative nucleic acid test results. The chemiluminescence kit has good sensitivity and specificity, and is well recommended for clinical laboratories. Key words: SARS-CoV-2; Chemiluminescence immunoassay; Colloidal gold immunoaasay; Nucleic acid detection; Performance evaluation; Clinical application

Classification requirements for real-world classification problems are often constrained by a given true positive or false positive rate to ensure that the classification error for the most important class is within a desired limit. For a sufficiently high true positive rate, this may result in the set-point being located somewhere in the flat portion of the ROC curve where the associated false positive rate is high. Any further classifier design will then attempt to reduce the false positive rate while maintaining the desired true positive rate is. We call this type of performance requirements for classifier design the constrained performance requirement. This type of performance requirements is different from the accuracy maximization requirement and thus requires different strategies for classifier design. This paper is concerned with designing classifier ensembles under such constrained performance requirements. Classifier ensembles are one of the most significant advances in pattern recognition/classification in recent years and have been actively studied by many researchers. However, not much attention has been given to designing ensembles to satisfy constrained performance requirements. This paper attempts to identify and address some of design related issues associated with the constrained performance requirement. Specifically, we present a design strategy for designing neural network ensembles to satisfy constrained performance requirements, which is illustrated by designing a real-world classification problem. The results are compared to those from conventional design method.

Large variability in thresholds to sensory stimuli is observed frequently even in healthy populations. Much of this variability is attributed to genetics and day-to-day fluctuation in sensitivity. However, false positives are also contributing to the variability seen in these tests. In this study, random number generation was used to simulate responses in threshold methods using different "stopping rules": ascending 2-alternative forced choice (AFC) with 5 correct responses; ascending 3-AFC with 3 or 4 correct responses; staircase 2-AFC with 1 incorrect up and 2 incorrect down, as well as 1 up 4 down and 5 or 7 reversals; staircase 3-AFC with 1 up 2 down and 5 or 7 reversals. Formulas are presented for rates of false positives in the ascending methods, and curves were generated for the staircase methods. Overall, the staircase methods generally had lower false positive rates, but these methods were influenced even more by number of presentations than ascending methods. Generally, the high rates of error in all these methods should encourage researchers to conduct multiple tests per individual and/or select a method that can correct for false positives, such as fitting a logistic curve to a range of responses.

Background Blast cells are immature white blood cells (WBC). The presence of blasts in the peripheral blood may be associated with certain diseases such as myelodysplastic syndrome and acute myelogenous leukemia. Variant lymphocytes (i.e., reactive lymphocytes, atypical lymphocytes) are WBCs produced by the immune system in reaction to infections caused by pathogens such as Epstein-Barr virus, cytomegalovirus, etc. It is clinically useful that the automated hematology analyzer is capable of flagging these cells. In this study, the blast (shown as ‘BLAST’ on the Alinity hq and ‘Blast/Abn Lympho?’ or ‘Blast?’ on XN-1000) and variant lymphocyte (shown as ‘VAR LYM’ on the Alinity hq, and ‘Atypical Lympho?’ on XN-1000) flagging was compared between the Alinity hq from Abbott and XN-1000 from Sysmex. Alinity hq has different sensitivity settings available for BLAST and VAR LYM flagging. In this study, the default setting for Alinity hq was used. For XN-1000, the Q-Flag default setting is 100. In this study, the setting was 120 for ‘Blast/Abn Lympho’ and 100 for “Atypical lympho?’. Methods Blood specimens were tested on the Alinity hq and XN-1000 analyzers. Two smears per specimen were made manually or by the Alinity hs slide maker stainer and read by two independent readers. The specimens showing any of the following flagging were included in the analysis: ‘BLAST’ on Alinity hq, ‘VAR LYM’ on Alinity hq, ‘Blast/Abn Lympho?’ or ‘Blast?’ on XN-1000, ‘Atypical lympho?’ on XN-1000. The flagging reports of these samples from both analyzers were compared to the smear review to determine if each analyzer's blast and variant lymphocyte flagging were true positive, false positive, true negative, or false negative. Results A total of 520 specimens were tested, yielding 41 specimens for blast flagging analysis and 80 specimens for variant lymphocyte flagging analysis. Due to the scarce availability of true positive samples from the manual review, true positive and false negative rate were not compared. For blast flagging using smear results of &amp;gt;=1% or &amp;gt;=5% as the positive criterion, Alinity hq yielded a 9.8% (=4/41) false positive rate and 87.8% (=36/41) true negative rate. XN-1000 yielded a 75.6% (=31/41) false positive rate and 22.0% (=9/41) true negative rate. For variant lymphocyte flagging using smear results of &amp;gt;=5% as the positive criterion, Alinity hq yielded a 6.3% (=5/80) false positive rate and 92.5% (=74/80) true negative rate. XN-1000 yielded a 91.3% (=73/80) false positive rate and 7.5% (=6/80) true negative rate. Conclusions This study demonstrated that Alinity hq achieved a much lower false positive rate and much higher true negative rate for both blast and variant lymphocyte flagging when compared to the XN-1000. Manual blast and variant lymphocyte morphology classification is laboratory- and technician-dependent. Both analyzers allow different sensitivity/specificity levels to flag blasts and variant lymphocytes. Each individual laboratory should evaluate and choose the setting that is most suitable for their specific patient populations to obtain the desired flagging rate.

To identify radiologists' characteristics associated with interpretive performance in screening mammography. The study was approved by institutional review boards of University of Washington (Seattle, Wash) and institutions at seven Breast Cancer Surveillance Consortium sites, informed consent was obtained, and procedures were HIPAA compliant. Radiologists who interpreted mammograms in seven U.S. regions completed a self-administered mailed survey; information on demographics, practice type, and experience in and perceptions of general radiology and breast imaging was collected. Survey data were linked to data on screening mammograms the radiologists interpreted between January 1, 1998, and December 31, 2005, and included patient risk factors, Breast Imaging Reporting and Data System assessment, and follow-up breast cancer data. The survey was returned by 71% (257 of 364) of radiologists; in 56% (205 of 364) of the eligible radiologists, complete data on screening mammograms during the study period were provided; these data were used in the final analysis. An evaluation of whether the radiologists' characteristics were associated with recall rate, false-positive rate, sensitivity, or positive predictive value of recall (PPV(1)) of the screening examinations was performed with logistic regression models that were adjusted for patients' characteristics and radiologist-specific random effects. Study radiologists interpreted 1 036 155 screening mammograms; 4961 breast cancers were detected. Median percentages and interquartile ranges, respectively, were as follows: recall rate, 9.3% and 6.3%-13.2%; false-positive rate, 8.9% and 5.9%-12.8%; sensitivity, 83.8% and 74.5%-92.3%; and PPV(1), 4.0% and 2.6%-5.9%. Wide variability in sensitivity was noted, even among radiologists with similar false-positive rates. In adjusted regression models, female radiologists or fellowship-trained radiologists had significantly higher recall and false-positive rates (P < .05, all). Fellowship training in breast imaging was the only characteristic significantly associated with improved sensitivity (odds ratio, 2.32; 95% confidence interval: 1.42, 3.80; P < .001) and the overall accuracy parameter (odds ratio, 1.61; 95% confidence interval: 1.05, 2.45; P = .028). Fellowship training in breast imaging may lead to improved cancer detection, but it is associated with higher false-positive rates.

Static, machine-learning based malware detection is widely deployed in Android security products, where even small increases in the false-positive rate can lead to substantial analyst workload and unacceptable disruption for benign users. Recent research has explored deep-learning models such as Sherlock that operate on image-like representations of binaries, while earlier systems, such as EMBER, rely on hand-crafted tabular features. However, most public benchmarks focus on Windows binaries, report only aggregate accuracy, and do not provide paired tabular and image representations of the same samples. As a result, there is limited empirical evidence on how tabular and vision-based models compare for Android malware detection at the extremely low false-positive rates required in practice. This thesis investigates two fundamental research questions: (1) whether carefully engineered, domain-specific tabular features can match or exceed the performance of state-of-the-art deep vision models for Android malware detection under strict false-positive rate constraints, and (2) whether model ensembles justify their additional complexity. To address these questions, I construct a large corpus of Android applications with paired static representations, including extended EMBER-style tabular features that capture Android-specific structure and behavior, as well as image-based encodings suitable for vision transformers. Using this corpus, I train and evaluate gradient-boosted decision trees and neural tabular models on the feature representations, vision transformers on the image representations, and multimodal ensembles that combine the two modalities. The experimental evaluation focuses on metrics that reflect real deployment constraints, including ROC AUC, F1 score, and the true positive rate at fixed false-positive rates relevant to security operations. I also compare performance against a state-of-the-art model, SHERLOCK. The results show that models trained on the extended tabular features achieve competitive or even superior detection performance at low false-positive rates while requiring substantially less labeled data than SHERLOCK. Vision transformers provide some complementary signal, but simple ensembles yield only modest additional gains relative to their substantial computational and engineering costs. Overall, the findings suggest that for static Android malware detection, investing in better feature engineering and strong tabular models offers greater practical value than combining multiple model architectures.

Exponential growth experienced in Internet usage has paved the way to exploit users of the Internet, a phishing attack is one of the means that can be used to obtained victim confidential details unwittingly across the Internet. A high false-positive rate and low accuracy have been a setback in phishing detection. In this research 17 different supervised learning techniques such as RandomForest, Systematically Developed Forest (SysFor), Spectral Areas and Ratios Classifier (SPAARC), Reduces Error Pruning Tree (RepTree), RandomTree, Logic Model Tree (LMT), Forest by Penalizing Attributes (ForestPA), JRip, PART, Nearest Neighbor with Generalization (NNge), One Rule (OneR), AdaBoostM1, RotationForest, LogitBoost, RseslibKnn, Library for Support Vector Machine (LibSVM), and BayesNet were employed to achieve the comparative analysis of machine classifier. The performance of the classifier algorithms was rated using Accuracy, Precision, Recall, F-Measure, Root Mean Squared Error, Receiver Operation Characteristics Area, Root Relative Squared Error False Positive Rate and True Positive Rate using WEKA data mining tool. The research revealed that quite several classifiers also exist which if properly explored will yield more accurate results for phishing detection. RandomForest was found to be an excellent classifier that gives the best accuracy of 0.9838 and a false positive rate of 0.017. The comparative analysis result indicates the achievement of low false-positive rate for phishing classification which suggests that anti-phishing application developer can implement the machine learning classification algorithm that was discovered to be the best in this study to enhance the feature of phishing attack detection and classification.

Rapid HIV vs. ELISA screening in a low risk mexican american population presenting in labor: A cost-effectiveness analysis

Password-based authentication system has been praised for its user-friendly, cost-effective, and easily deployable features. It is arguably the most commonly used security mechanism for various resources, services, and applications. On the other hand, it has well-known security flaws, including vulnerability to guessing attacks. Present state-of-the-art approaches have high overheads, as well as difficulties and unreliability during training, resulting in a poor user experience and a high false positive rate. As a result, a lightweight authentication compromise detection model that can make accurate detection with a low false positive rate is required.In this paper we propose – LOG-OFF – a behavior-based authentication compromise detection model. LOG-OFF is a lightweight model that can be deployed efficiently in practice because it does not include a labeled dataset. Based on the assumption that the behavioral pattern of a specific user does not suddenly change, we study the real-world authentication traffic data. The dataset contains more than 4 million records. We use two features to model the user behaviors, i.e., consecutive failures and login time, and develop a novel approach. LOG-OFF learns from the historical user behaviors to construct user profiles and makes probabilistic predictions of future login attempts for authentication compromise detection. LOG-OFF has a low false positive rate and latency, making it suitable for real-world deployment. In addition, it can also evolve with time and make more accurate detection as more data is being collected.

BackgroundVenous thromboembolism (VTE) is a common complication of hospitalized trauma patients and has an adverse impact on patient outcomes. However, there is still a lack of appropriate tools for effectively predicting VTE for trauma patients. We try to verify the accuracy of the Caprini score for predicting VTE in trauma patients, and further improve the prediction through machine learning algorithms.MethodsWe retrospectively reviewed emergency trauma patients who were admitted to a trauma center in a tertiary hospital from September 2019 to March 2020. The data in the patient’s electronic health record (EHR) and the Caprini score were extracted, combined with multiple feature screening methods and the random forest (RF) algorithm to constructs the VTE prediction model, and compares the prediction performance of (1) using only Caprini score; (2) using EHR data to build a machine learning model; (3) using EHR data and Caprini score to build a machine learning model. True Positive Rate (TPR), False Positive Rate (FPR), Area Under Curve (AUC), accuracy, and precision were reported.ResultsThe Caprini score shows a good VTE prediction effect on the trauma hospitalized population when the cut-off point is 11 (TPR = 0.667, FPR = 0.227, AUC = 0.773), The best prediction model is LASSO+RF model combined with Caprini Score and other five features extracted from EHR data (TPR = 0.757, FPR = 0.290, AUC = 0.799).ConclusionThe Caprini score has good VTE prediction performance in trauma patients, and the use of machine learning methods can further improve the prediction performance.

PURPOSE: Muscular and cardiorespiratory fitness are associated with adiposity and cardiovascular disease risk in youth. The degree to which these measures discriminate obesity is not lucid. This study investigated muscular and cardiorespiratory fitness capacities to discriminate obesity. METHODS: Participants (N = 210; 116 males) (9.7 ± 1.08 years; 138.6 ± 9.4 cm; 42.3 ± 14.4 kg) (84% Hispanic/Latino) muscular and cardiorespiratory fitness were assessed using the 20-meter Progressive Aerobic Cardiovascular Endurance Run (PACER) and 90o push-up test, respectively, per FITNESSGRAM® protocols. Weight status was classified using CDC Growth Charts. Non-obesity was coded as “0” and obesity was coded as “1.” A Receiver Operating Characteristics (ROC) curve analysis was performed to identify the True Positive Rate (TPR) (i.e., Sensitivity) and False Positive Rate (FPR) (i.e., 1 - Specificity) using SPSS. The area under the curve (AUC) indicated the degree to which each fitness measure distinguishes between the presence and absence of obesity. The measurement threshold with the greatest TPR-FPR distance was considered optimally discriminative. Statistical significance was set at P < .05. RESULTS: Of the sample, 43% had obesity and 55% did not. PACER was fairly discriminative of obesity in girls (AUC = .748; P = .000; 95% CI [.651, .845]) and boys (AUC = .755; P = .000; 95% CI [.665, .845]). 90o push-up was fairly discriminative in girls (AUC = .732; P = .000; 95% CI [.632, .831]) and boys (AUC = .789; P = .000; 95% CI [.703, .876]). PACER thresholds of 8 and 8 laps were optimally discriminative in girls (TPR = .714, FPRs = .352) and boys (TPR = .635, FPRs = .190), respectively. 90o push-up thresholds of 7 and 5 repetitions were optimally discriminative in girls (TPR = .714, FPRs = .333) and boys (TPR = .692, FPRs = .175), respectively. CONCLUSIONS: Based on the probability of classifying individuals with and without obesity as having obesity (i.e., TPRs and FPRs, respectively), PACER and 90o push-up appear similarly discriminative of obesity. Notably, the optimal PACER threshold to discriminate obesity was considerably lower than cut-off scores (23 for boys and 15 for girls) for HFZ classification in the same age group. Cardiorespiratory-related disease risk may persist in subpopulations of Hispanic/Latino youth without obesity.