Minimized feature overhead malware detection machine learning model employing MRMR‐based ranking

The increasing prevalence of malware presents a critical challenge to cybersecurity, emphasizing the need for robust detection methods. This study uses a binary tabular classification dataset to evaluate the impact of feature selection, feature scaling, and machine learning (ML) models on malware detection. The methodology involves experimenting with three feature scaling techniques (no scaling, normalization, and min-max scaling), three feature selection methods (no selection, Linear Discriminant Analysis (LDA), and Principal Component Analysis (PCA)), and twelve ML models, including traditional algorithms and ensemble methods. A publicly available dataset with 11,598 samples and 139 features is utilized, and model performance is assessed using metrics such as accuracy, precision, recall, F1-score, and AUC-ROC. Results reveal that the Light Gradient Boosting Machine (LGBM) achieves the highest accuracy of 97.16% when PCA and either min-max scaling or normalization are applied. Additionally, ensemble models consistently outperform traditional ML models, demonstrating their effectiveness in enhancing malware detection. These findings offer valuable insights into optimizing preprocessing and model selection strategies for developing reliable and efficient malware detection systems.

During the last decade, the cybersecurity literature has conferred a high-level role to machine learning as a powerful security paradigm to recognise malicious software in modern anti-malware systems. However, a non-negligible limitation of machine learning methods used to train decision models is that adversarial attacks can easily fool them. Adversarial attacks are attack samples produced by carefully manipulating the samples at the test time to violate the model integrity by causing detection mistakes. In this paper, we analyse the performance of five realistic target-based adversarial attacks, namely Extend, Full DOS, Shift, FGSM padding + slack and GAMMA, against two machine learning models, namely MalConv and LGBM, learned to recognise Windows Portable Executable (PE) malware files. Specifically, MalConv is a Convolutional Neural Network (CNN) model learned from the raw bytes of Windows PE files. LGBM is a Gradient-Boosted Decision Tree model that is learned from features extracted through the static analysis of Windows PE files. Notably, the attack methods and machine learning models considered in this study are state-of-the-art methods broadly used in the machine learning literature for Windows PE malware detection tasks. In addition, we explore the effect of accounting for adversarial attacks on securing machine learning models through the adversarial training strategy. Therefore, the main contributions of this article are as follows: (1) We extend existing machine learning studies that commonly consider small datasets to explore the evasion ability of state-of-the-art Windows PE attack methods by increasing the size of the evaluation dataset. (2) To the best of our knowledge, we are the first to carry out an exploratory study to explain how the considered adversarial attack methods change Windows PE malware to fool an effective decision model. (3) We explore the performance of the adversarial training strategy as a means to secure effective decision models against adversarial Windows PE malware files generated with the considered attack methods. Hence, the study explains how GAMMA can actually be considered the most effective evasion method for the performed comparative analysis. On the other hand, the study shows that the adversarial training strategy can actually help in recognising adversarial PE malware generated with GAMMA by also explaining how it changes model decisions.

For the various climatic zones of India, machine learning (ML) models are created in the current work to forecast monthly-average diffuse solar radiation (DSR). The long-term solar radiation data are taken from Indian Meteorological Department (IMD), Pune, provided for 21 cities that span all of India’s climatic zones. The diffusion coefficient and diffuse fraction are the two groups of ML models with dual input parameters (sunshine ratio and clearness index) that are built and compared (each category has seven models). To create ML models, two well-known ML techniques, random forest (RF) and k-nearest neighbours (KNN), are used. The proposed ML models are compared with well-known models that are found in the literature. The ML models are ranked according to their overall and within predictive power using the Global Performance Indicator (GPI). It is discovered that KNN models generally outperform RF models. The results reveal that in diffusion coefficient models perform well than diffuse fraction models. Moreover, functional form 2 is the best followed by form 6. The ML models created here can be effectively used to accurately forecast DSR in various climates.

12074 Background: Skeletal-related events (SREs) are detrimental clinical events in bone metastasis from advanced cancer, defined by pathologic fracture, spinal cord compression, and inevitable surgical or radiational intervention to the bone. Given their negative impact on quality of life and prognosis and interpatient heterogeneity in the SRE risk, accurate identification of patients with high SRE risk is critical. Methods: The patient-level data from three randomized clinical trials that administered zoledronic acid (ZA) to patients with bone-metastatic breast cancer, castration-resistant prostate cancer (CRPC), and other types of cancer were analyzed. (N = 460, 452, and 315, respectively) Machine learning (ML) models to predict SREs within 18 months (breast cancer), 12 months (CRPC), and 9 months (other cancers) were developed based on more than 40 baseline clinical and laboratory data. Seven ML algorithms and five feature selection methods were utilized to develop multiple models. The ML model with the best performance was identified based on the F1 score and the area under the receiver operating characteristic curve (AUC-ROC) for each cancer type and interrogated for important features with Shapley additive explanations. Lastly, the ML models’ ability to stratify patients by the cumulative SRE risk was evaluated by calculating hazard ratio (HR) with Cox-proportional hazards models. Results: Among the multiple ML models developed with different algorithms and feature selection methods, the model developed utilizing the random forests algorithm and the Boruta method for selecting features demonstrated the best performance in all types of cancer (F1 0.70, 0.67, and 0.67, and AUC-ROC 0.72, 0.68, and 0.73 for breast cancer, CRPC, and other cancers, respectively). In the ML model for breast cancer, performance status (PS), history of SRE, serum alkaline phosphatase (ALP), history of anti-neoplastic surgery, radiation therapy, and pathologic fracture were included as important features. Serum ALP, albumin, sodium, Gleason scores, and geographic regions were shown to be relevant in the CRPC model. For other cancers, serum ALP, albumin, total protein, phosphorus, red blood cell count, white blood cell count, visceral metastases, and history of arthritis were incorporated in the ML model. The ML model prediction successfully stratified the patients for cumulative SRE risk in all three cohorts. (HR with 95% confidence interval: 2.43 [1.86 – 3.18], 1.92 [1.51 – 2.45], and 3.06 [2.29 – 4.09] for breast cancer, CRPC, and other types of cancer, respectively). Conclusions: ML models incorporating baseline clinical and laboratory data can identify patients with bone metastasis on ZA harboring a high SRE risk.

Propofol is a widely used sedative-hypnotic agent for critically-ill patients requiring invasive mechanical ventilation (IMV). Despite its clinical benefits, propofol is associated with increased risks of hypertriglyceridemia. Early identification of patients at risk for propofol-associated hypertriglyceridemia is crucial for optimizing sedation strategies and preventing adverse outcomes. Machine learning (ML) models offer a promising approach for predicting individualized patient risks of propofol-associated hypertriglyceridemia. We propose the development of a ML model aimed at predicting the risk of propofol-associated hypertriglyceridemia in ICU patients receiving IMV. The study will utilize retrospective data from four Mayo Clinic sites. Nested cross-validation (CV) will be employed, with a 10-fold inner CV loop for model tuning and selection as well as an outer loop using leave-one-site-out CV for external validation. Feature selection will be conducted using Boruta and LASSO-penalized logistic regression. Data preprocessing steps include missing data imputation, feature scaling, and dimensionality reduction techniques. Six ML algorithms will be tuned and evaluated. Bayesian optimization will be used for hyperparameter selection. Global model explainability will be assessed using permutation importance, and local model explainability will be assessed using SHapley Additive exPlanations (SHAP). The proposed ML model aims to provide a reliable and interpretable tool for clinicians to predict the risk of propofol-associated hypertriglyceridemia in ICU patients. The final model will be deployed in a web-based clinical risk calculator. The model development process and performance measures obtained during nested cross-validation will be described in a study publication to be disseminated in a peer-reviewed journal. The proposed study has received ethics approval from the Mayo Clinic Institutional Review Board (IRB #23-007416). Robust external validation using a nested cross-validation (CV) framework will help assess the generalizability of models produced from the modeling pipeline across different hospital settings.A diverse set of machine learning (ML) algorithms and advanced hyperparameter tuning techniques will be employed to identify the most optimal model configuration.Integration of feature explainability will enhance the clinical applicability of the ML models by providing transparency in predictions, which can improve clinician trust and encourage adoption.Reliance on retrospective data may introduce biases due to inconsistent or erroneous data collection, and the computational intensity of the validation approach may limit replication and future model expansion in resource-constrained settings.

PurposeChronic diseases are considered as one of the serious concerns and threats to public health across the globe. Diseases such as chronic diabetes mellitus (CDM), cardio vasculardisease (CVD) and chronic kidney disease (CKD) are major chronic diseases responsible for millions of death. Each of these diseases is considered as a risk factor for the other two diseases. Therefore, noteworthy attention is being paid to reduce the risk of these diseases. A gigantic amount of medical data is generated in digital form from smart healthcare appliances in the current era. Although numerous machine learning (ML) algorithms are proposed for the early prediction of chronic diseases, these algorithmic models are neither generalized nor adaptive when the model is imposed on new disease datasets. Hence, these algorithms have to process a huge amount of disease data iteratively until the model converges. This limitation may make it difficult for ML models to fit and produce imprecise results. A single algorithm may not yield accurate results. Nonetheless, an ensemble of classifiers built from multiple models, that works based on a voting principle has been successfully applied to solve many classification tasks. The purpose of this paper is to make early prediction of chronic diseases using hybrid generative regression based deep intelligence network (HGRDIN) model.Design/methodology/approachIn the proposed paper generative regression (GR) model is used in combination with deep neural network (DNN) for the early prediction of chronic disease. The GR model will obtain prior knowledge about the labelled data by analyzing the correlation between features and class labels. Hence, the weight assignment process of DNN is influenced by the relationship between attributes rather than random assignment. The knowledge obtained through these processes is passed as input to the DNN network for further prediction. Since the inference about the input data instances is drawn at the DNN through the GR model, the model is named as hybrid generative regression-based deep intelligence network (HGRDIN).FindingsThe credibility of the implemented approach is rigorously validated using various parameters such as accuracy, precision, recall, F score and area under the curve (AUC) score. During the training phase, the proposed algorithm is constantly regularized using the elastic net regularization technique and also hyper-tuned using the various parameters such as momentum and learning rate to minimize the misprediction rate. The experimental results illustrate that the proposed approach predicted the chronic disease with a minimal error by avoiding the possible overfitting and local minima problems. The result obtained with the proposed approach is also compared with the various traditional approaches.Research limitations/implicationsUsually, the diagnostic data are multi-dimension in nature where the performance of the ML algorithm will degrade due to the data overfitting, curse of dimensionality issues. The result obtained through the experiment has achieved an average accuracy of 95%. Hence, analysis can be made further to improve predictive accuracy by overcoming the curse of dimensionality issues.Practical implicationsThe proposed ML model can mimic the behavior of the doctor's brain. These algorithms have the capability to replace clinical tasks. The accurate result obtained through the innovative algorithms can free the physician from the mundane care and practices so that the physician can focus more on the complex issues.Social implicationsUtilizing the proposed predictive model at the decision-making level for the early prediction of the disease is considered as a promising change towards the healthcare sector. The global burden of chronic disease can be reduced at an exceptional level through these approaches.Originality/valueIn the proposed HGRDIN model, the concept of transfer learning approach is used where the knowledge acquired through the GR process is applied on DNN that identified the possible relationship between the dependent and independent feature variables by mapping the chronic data instances to its corresponding target class before it is being passed as input to the DNN network. Hence, the result of the experiments illustrated that the proposed approach obtained superior performance in terms of various validation parameters than the existing conventional techniques.

Couplings connect the spinning shafts of driving and driven machines in the industry. A coupling guard encloses the coupling to protect personnel from the high-speed rotating coupling. The American Petroleum Institute API publishes standards that restrict the overheating of the coupling guards due to windage caused by the spinning shaft. Based on the most recent version of API 671, the peak temperature for the coupling guard should not exceed 60 °C. This paper proposes a machine learning (ML) model and an empirical formula to predict the maximum guard temperature and power loss. The ML models use a database obtained from simulated computational fluid dynamics (CFD) cases for different coupling guards under various conditions. Also, the paper provides validation for the CFD models with experimental tests for different cases. The proposed ML model uses eight different input parameters to predict temperature and power loss. The model shows an accurate prediction for a varied number of CFD cases. The performance of the generated model has been verified with the experimental results. Also, an empirical formula has been created using the same database from CFD results. The results show that the ML model has better prediction accuracy than the empirical formula for predicting peak temperature and power loss for all cases.

PurposeAtherosclerosis plays a significant role in the initiation of coronary artery aneurysms (CAA). Although the treatment options for this kind of vascular disease are developing, there are challenges and limitations in both selecting and applying sufficient medical solutions. For surgical interventions, that are novel therapies, non-invasive specific patient-based studies could lead to obtaining more promising results. Despite medical and pathological tests, these pre-surgical investigations require special biomedical and computer-aided engineering techniques. In this study, a machine learning (ML) model is proposed for the non-invasive detection of atherosclerotic CAA for the first time.MethodsThe database for study was collected from hemodynamic analysis and computed tomography angiography (CTA) of 80 CAAs from 61 patients, approved by the Institutional Review Board (IRB). The proposed ML model is formulated for learning by a one-class support vector machine (1SVM) that is a field of ML to provide techniques for outlier and anomaly detection.ResultsThe applied ML algorithms yield reasonable results with high and significant accuracy in designing a procedure for the non-invasive diagnosis of atherosclerotic aneurysms. This proposed method could be employed as a unique artificial intelligence (AI) tool for assurance in clinical decision-making procedures for surgical intervention treatment methods in the future.ConclusionsThe non-invasive diagnosis of the atherosclerotic CAAs, which is one of the vital factors in the accomplishment of endovascular surgeries, is important due to some clinical decisions. Although there is no accurate tool for managing this kind of diagnosis, an ML model that can decrease the probability of endovascular surgical failures, death risk, and post-operational complications is proposed in this study. The model is able to increase the clinical decision accuracy for low-risk selection of treatment options.

In recent years, infections and damage caused by malware have increased at exponential rates. At the same time, machine learning (ML) techniques have shown tremendous promise in many domains, often out performing human efforts by learning from large amounts of data. Results in the open literature suggest that ML is able to provide similar results for malware detection, achieving greater than 99% classification accuracy [49]. However, the same detection rates when applied in deployed settings have not been achieved. Malware is distinct from many other domains in which ML has shown success in that (1) it purposefully tries to hide, leading to noisy labels and (2) often its behavior is similar to benign software only differing in intent, among other complicating factors. This report details the reasons for the difficultly of detecting novel malware by ML methods and offers solutions to improve the detection of novel malware. We propose to detect malware by detecting behaviors commonly exhibited by malware such as DLL injection, and process hollowing. This is based on the assumption that there is a set of behaviors that are common to most malware samples and detecting them will generalize to novel malware. Additionally, detected behaviors point analysts toward appropriate handling and mitigation strategies, which is not the case with a binary benign/malicious classification. A behavior labeling method was developed and was used to label an existing malware dataset. Results show that detecting malicious behaviors is much more difficult than simply classifying malware and goodware?achieving 80% accuracy compared to reported 99% accuracy from classifying malware and goodware. This drop is due to several reasons which are detailed in the report. We also propose to evaluate the performance of detecting novel malware by holding out a malware family for testing and training on the other families. Traditional ML evaluation will shuffle the data and then split the data into training and testing. Our method addresses the use-case when novel malware families are encountered and they require more than just a malicious or benign designation. Our results suggest that this type of evaluation is much more difficult than traditional methods and provides more realistic results, albeit, significantly worse. For our behavior detection, accuracy decreases from 80% to 68% across all behaviors when holding out a malware family from training. We show that the degradation in performance is because each malware family has distinct characteristics resulting in high extrapolations by an ML model. Here, an ML model should return an "I do not know" response and request further analysis from an analyst. We run a number of experiments that compare novel malware families to the training data using different feature representations including a genomics-inspired distance measure and features extracted by deep learning. Generally, held-out families are significantly different from the training data, resulting in unpredictable results. This has been observed generally in the ML community [22, 9]. We empirically demonstrate this in the domain of malware detection. In an attempt to improve the detection of malware behaviors, we examine the impact that additional synthetic data has on the performance of an ML model in detecting behaviors in novel malware families. We find that while synthetic data does improve the performance of ML models, often simpler methods perform better than more complicated ones. Two generative modeling techniques were examined to produce synthetic malware samples such that the behaviors present are able to be specified externally. The difficulty is due to finer grained analysis of the executable and modifying the problem from a binary classification problem to a multi-label problem. The addition of synthetic data increases the overall accuracy from 68% to 70%. While far less accurate than measures presented in academic analyses, we believe that this is more representative of real-world performance and allows models to be properly placed within a malware detection system. We suggest that in highly dynamic environments ML pipelines should determine whether an ML model is competent in the area of new data and should involve mechanisms to improve over time with a human in the loop.

Over the past few decades, the construction industry has been suffering from project delays. It remains a recognized challenge to accurately predict the actual project’s progress, despite the vast amount of field data and scheduling methods available. In this paper, four different machine learning (ML) models including K-nearest neighbor (KNN), support vector regression (SVR), gradient boosting trees (GBT), and artificial neural network (ANN) were used for forecasting the construction duration of work areas. Field data were collected, including progress, workload, labor, weather, planned days, and location, as inputs and construction days as output for each work area to develop the models. A simple and widely used baseline model was used to confirm the accuracy and generalization capability of ML models. The comparison of the results revealed that ANN and GBT models produced significantly superior results. Additionally, the GBT model is substantially more computationally efficient. In conclusion, the GBT model could be successfully and effectively applied to improve the prediction of construction duration. The proposed ML models could be utilized as a decision support tool for construction project managers to adjust construction site resource allocation.

Objective: To investigate the feasibility of a machine learning (ML) model based on radiomic features to identify active giant cell arteritis (GCA) in the aorta and differentiate it from atherosclerosis in follow-up [18F]FDG-PET/CT images for therapy monitoring. Methods: To train the ML model, 64 [18F]FDG-PET scans of 34 patients with proven GCA and 34 control subjects with type 2 diabetes mellitus were retrospectively included. The aorta was delineated into the ascending, arch, descending, and abdominal aorta. From each segment, 95 features were extracted. All segments were randomly split into a training/validation (n = 192; 80%) and test set (n = 46; 20%). In total, 441 ML models were trained, using combinations of seven feature selection methods, seven classifiers, and nine different numbers of features. The performance was assessed by area under the curve (AUC). The best performing ML model was compared to the clinical report of nuclear medicine physicians in 19 follow-up scans (7 active GCA, 12 inactive GCA). For explainability, an occlusion map was created to illustrate the important regions of the aorta for the decision of the ML model. Results: The ten-feature model with ANOVA as the feature selector and random forest classifier demonstrated the highest performance (AUC = 0.92 ± 0.01). Compared with the clinical report, this model showed a higher PPV (0.83 vs. 0.80), NPV (0.85 vs. 0.79), and accuracy (0.84 vs. 0.79) in the detection of active GCA in follow-up scans. Conclusions: The current radiomics ML model was able to identify active GCA and differentiate GCA from atherosclerosis in follow-up [18F]FDG-PET/CT scans. This demonstrates the potential of the ML model as a monitoring tool in challenging [18F]FDG-PET scans of GCA patients.

In recent years, a significant amount of research has focused on analyzing the effectiveness of machine learning (ML) models for malware detection. These approaches have ranged from methods such as decision trees and clustering to more complex approaches like support vector machine (SVM) and deep neural networks. In particular, neural networks have proven to be very effective in detecting complex and advanced malware. This, however, comes with a caveat. Neural networks are notoriously complex. Therefore, the decisions that they make are often just accepted without questioning why the model made that specific decision. The black box characteristic of neural networks has challenged researchers to explore methods to explain black-box models such as SVM and neural networks and their decision-making process. Transparency and explainability give the experts and malware analysts assurance and trustworthiness about the ML models’ decisions. In addition, it helps in generating comprehensive reports that can be used to enhance cyber threat intelligence sharing. As such, this much needed analysis drives our work in this paper to explore the explainability and interpretability of ML models in the field of online malware detection. In this paper, we used the Shapley Additive exPlanations (SHAP) explainability technique to achieve efficient performance in interpreting the outcome of different ML models such as SVM Linear, SVM-RBF (Radial Basis Function), Random Forest (RF), Feed-Forward Neural Net (FFNN), and Convolutional Neural Network (CNN) models trained on an online malware dataset. To explain the output of these models, explainability techniques such as KernalSHAP, TreeSHAP, and DeepSHAP are applied to the obtained results.

Flood prediction is an important task, which helps local decision-makers in taking effective measures to reduce damage to the people and economy. Currently, most studies use machine learning to predict flooding in a given region; however, the extrapolation problem is considered a major challenge when using these techniques and is rarely studied. Therefore, this study will focus on an approach to resolve the extrapolation problem in flood depth prediction by integrating machine learning (XGBoost, Extra-Trees (EXT), CatBoost (CB), and light gradient boost machines (LightGBM)) and hydraulic modeling under MIKE FLOOD. The results show that the hydraulic model worked well in providing the flood depth data needed to build the machine learning model. Among the four proposed machine learning models, XGBoost was found to be the best at solving the extrapolation problem in the estimation of flood depth, followed by EXT, CB, and LightGBM. Quang Binh province was hit by floods with depths ranging from 0 to 3.2 m. Areas with high flood depths are concentrated along and downstream of the two major rivers (Gianh and Nhat Le – Kien Giang).

The coupling machine learning for microstructural evolution and rolling force during hot strip rolling of steels

Advancements in machine learning techniques for coal and gas outburst prediction in underground mines