Abstract Anonymous communication serves as the preferred tool for cyber attackers to evade detection, posing a serious threat to cyberspace security. Accurately tracking the attackers in anonymous communication is crucial for defending against attacks. Flow correlation is an effective method that can link flows in the anonymous network. Existing flow correlation methods usually rely on a long observation, resulting in reduced correlation precision and limited generalization ability within anonymous communication. To address this issue, we propose a robust two-stage flow correlation method called RTsFCM via Siamese network and ensemble voting scheme. In the first stage, a Siamese network with shared weights is utilized to automatically extract the multilevel features from ingress flow and egress flow, respectively. Further, they are concatenated to generate a more expressive feature set to enhance true positive rate (TPR). In the second stage, flow pairs are firstly divided into a series of partially overlapping sub-flows(windows) in view of flow duration. Then, pairwise comparison for each window is conducted independently and the ensemble voting scheme is adopted across these windows to reduce the false positive rate (FPR) significantly. Experimental results show that RTsFCM is superior to the state of the art, achieving over a 4% increase in both TPR and F1_score. Simultaneously, it obtains an FPR as low as 0.68%, utilizing the packet timing characteristics within the initial portion of a flow.
146A multi-resolution approach for spinal metastasis detection using deep Siamese neural networks
A multi-resolution approach for spinal metastasis detection using deep Siamese neural networks
2A Framework for Analyzing Anonymous Network Topology
Nowadays, Internet privacy becomes more and more important and sensitive, and has been one of the latest buzz words to hit the Internet world. In response to protect the privacy of Internet users, a variety of privacy enhancing technologies (PETs) have emerged. As one of privacy enhancing technologies, anonymous communication has been extensively studied from various aspects by researchers. Node churn is frequent in anonymous network, which make it difficult to maintain a stable network topology, therefore it is necessary to get more insight into the overall anonymous network topology. In this work, in order to better grasp the present situation of research, we investigate existing organizations and universities which study anonymous communication from the perspective of network topology, and related projects. Then we survey related papers to anonymous communication published in recent years, which focus on the analysis of node selection (especially in the Tor). In addition, we present a framework of anonymous communication network topology, and a visual illustration of this analysis that shows the progression of the research of network topology and node discovery in anonymous communication. Finally, some related problems and follow-up study are presented to be studied deeply in future.
Read more36Synchronous egress and ingress fluid flow related to compressional reactivation of basement faults: the Phoenix and Gryphon uranium deposits, southeastern Athabasca Basin, Saskatchewan, Canada
Previous studies on unconformity-related uranium deposits in the Athabasca Basin (Canada) suggest that egress flow and ingress flow can develop along single fault systems at different stages of compressional deformation. This research aims to examine whether or not both ingress and egress flow can develop at the same time within an area under a common compressional stress field, as suggested by the reverse displacement of the unconformity surface by the basement faults. The study considers the Phoenix and Gryphon uranium deposits in the Wheeler River area in the southeastern part of the Athabasca Basin. Two-dimensional numerical modeling of fluid flow, coupled with compressional deformation and thermal effects, was carried out to examine the fluid flow pattern. The results show that local variations in the basement geology under a common compressional stress field can result in both egress and ingress flow at the same time. The fault zone at Phoenix underwent a relatively low degree of deformation, as reflected by minor reverse displacement of the unconformity, and egress flow developed, whereas the fault zone at Gryphon experienced a relatively high degree of deformation, as demonstrated by significant reverse displacement of the unconformity, and ingress flow was dominant. The correlation between strain development and location of uranium mineralization, as exemplified by Gryphon and Phoenix uranium deposits, suggests that the localization of dilation predicted by numerical modeling may represent favourable sites for uranium mineralization in the Athabasca Basin.
Read more1A1-G11 一つのLRFを用いた人追跡に関する一考察(車輪型/クローラ型移動ロボット(1))
The objective of this study is to develop a robust human tracking method for mobile robot using only one laser range finder (LRF). When a mobile robot runs along a human, it is always necessary to observe positions of the human. Therefore, the LRF must be mounted on a position easy to recognize human. Furthermore, the LRF may lose the position of the target human, and another human might enter between the robot and the target human. Therefore, this paper discusses the mounting position of the LRF, as well as a robust tracking method using the LRF.
Read moreComparative Discrimination Of Obesity By Muscular And Cardiorespiratory Fitness: A Receiver Operating Characteristics Curve Analysis.
PURPOSE: Muscular and cardiorespiratory fitness are associated with adiposity and cardiovascular disease risk in youth. The degree to which these measures discriminate obesity is not lucid. This study investigated muscular and cardiorespiratory fitness capacities to discriminate obesity. METHODS: Participants (N = 210; 116 males) (9.7 ± 1.08 years; 138.6 ± 9.4 cm; 42.3 ± 14.4 kg) (84% Hispanic/Latino) muscular and cardiorespiratory fitness were assessed using the 20-meter Progressive Aerobic Cardiovascular Endurance Run (PACER) and 90o push-up test, respectively, per FITNESSGRAM® protocols. Weight status was classified using CDC Growth Charts. Non-obesity was coded as “0” and obesity was coded as “1.” A Receiver Operating Characteristics (ROC) curve analysis was performed to identify the True Positive Rate (TPR) (i.e., Sensitivity) and False Positive Rate (FPR) (i.e., 1 - Specificity) using SPSS. The area under the curve (AUC) indicated the degree to which each fitness measure distinguishes between the presence and absence of obesity. The measurement threshold with the greatest TPR-FPR distance was considered optimally discriminative. Statistical significance was set at P < .05. RESULTS: Of the sample, 43% had obesity and 55% did not. PACER was fairly discriminative of obesity in girls (AUC = .748; P = .000; 95% CI [.651, .845]) and boys (AUC = .755; P = .000; 95% CI [.665, .845]). 90o push-up was fairly discriminative in girls (AUC = .732; P = .000; 95% CI [.632, .831]) and boys (AUC = .789; P = .000; 95% CI [.703, .876]). PACER thresholds of 8 and 8 laps were optimally discriminative in girls (TPR = .714, FPRs = .352) and boys (TPR = .635, FPRs = .190), respectively. 90o push-up thresholds of 7 and 5 repetitions were optimally discriminative in girls (TPR = .714, FPRs = .333) and boys (TPR = .692, FPRs = .175), respectively. CONCLUSIONS: Based on the probability of classifying individuals with and without obesity as having obesity (i.e., TPRs and FPRs, respectively), PACER and 90o push-up appear similarly discriminative of obesity. Notably, the optimal PACER threshold to discriminate obesity was considerably lower than cut-off scores (23 for boys and 15 for girls) for HFZ classification in the same age group. Cardiorespiratory-related disease risk may persist in subpopulations of Hispanic/Latino youth without obesity.
Read more2Malware Detection Method using Tree-based Machine Learning Algorithms
Malware detection engines are required a high True Positive Rate (TPR) and low False Positive rate (FPR). For example, to obtain the VB100 certification conducted by Virus Bulletin in the U.K., the detector's TPR must be 99.5% or higher, and FPR less than 0.01%. However, it is difficult for signature-based malware detection engines to detect zero-day or new variants of malware. For such malware, an approach based on machine learning is considered effective because the features of specimens are analyzed in a complex manner. Therefore, we created a malware detection model from surface analysis logs, and PE header dumps by machine learning using the FFRI Dataset 2018. Furthermore, we verified the accuracy under the constraint that the FPR is less than a certain value. As a result, we succeeded in creating a new model with high accuracy: when FPR is set to be less than 1%, TPR is 99.7%, when FPR is set to be less than 0.1%, TPR is 98.7%, and when FPR is set to be less than 0.01% and TPR is 94.5%. In addition, we revealed features with high contribution to malware detection in this model.
Read more6IM session identification by outlier detection in cross-correlation functions
The identification of encrypted Instant Messaging (IM) channels between users is made difficult by the presence of variable and high levels of uncorrelated background traffic. In this paper, we propose a novel Cross-correlation Outlier Detector (CCOD) to identify communicating end-users in a large group of users. Our technique uses traffic flow traces between individual users and IM service provider's data center. We evaluate the CCOD on a data set of Yahoo! IM traffic traces with an average SNR of −6.11dB (data set includes ground truth). Results show that our technique provides 88% true positives (TP) rate, 3% false positives (FP) rate and 96% ROC area. Performance of the previous correlation-based schemes on the same data set was limited to 63% TP rate, 4% FP rate and 85% ROC area.
Read more18Designing classifier ensembles with constrained performance requirements
Classification requirements for real-world classification problems are often constrained by a given true positive or false positive rate to ensure that the classification error for the most important class is within a desired limit. For a sufficiently high true positive rate, this may result in the set-point being located somewhere in the flat portion of the ROC curve where the associated false positive rate is high. Any further classifier design will then attempt to reduce the false positive rate while maintaining the desired true positive rate is. We call this type of performance requirements for classifier design the constrained performance requirement. This type of performance requirements is different from the accuracy maximization requirement and thus requires different strategies for classifier design. This paper is concerned with designing classifier ensembles under such constrained performance requirements. Classifier ensembles are one of the most significant advances in pattern recognition/classification in recent years and have been actively studied by many researchers. However, not much attention has been given to designing ensembles to satisfy constrained performance requirements. This paper attempts to identify and address some of design related issues associated with the constrained performance requirement. Specifically, we present a design strategy for designing neural network ensembles to satisfy constrained performance requirements, which is illustrated by designing a real-world classification problem. The results are compared to those from conventional design method.
Read more265Variability in Interpretive Performance at Screening Mammography and Radiologists’ Characteristics Associated with Accuracy
To identify radiologists' characteristics associated with interpretive performance in screening mammography. The study was approved by institutional review boards of University of Washington (Seattle, Wash) and institutions at seven Breast Cancer Surveillance Consortium sites, informed consent was obtained, and procedures were HIPAA compliant. Radiologists who interpreted mammograms in seven U.S. regions completed a self-administered mailed survey; information on demographics, practice type, and experience in and perceptions of general radiology and breast imaging was collected. Survey data were linked to data on screening mammograms the radiologists interpreted between January 1, 1998, and December 31, 2005, and included patient risk factors, Breast Imaging Reporting and Data System assessment, and follow-up breast cancer data. The survey was returned by 71% (257 of 364) of radiologists; in 56% (205 of 364) of the eligible radiologists, complete data on screening mammograms during the study period were provided; these data were used in the final analysis. An evaluation of whether the radiologists' characteristics were associated with recall rate, false-positive rate, sensitivity, or positive predictive value of recall (PPV(1)) of the screening examinations was performed with logistic regression models that were adjusted for patients' characteristics and radiologist-specific random effects. Study radiologists interpreted 1 036 155 screening mammograms; 4961 breast cancers were detected. Median percentages and interquartile ranges, respectively, were as follows: recall rate, 9.3% and 6.3%-13.2%; false-positive rate, 8.9% and 5.9%-12.8%; sensitivity, 83.8% and 74.5%-92.3%; and PPV(1), 4.0% and 2.6%-5.9%. Wide variability in sensitivity was noted, even among radiologists with similar false-positive rates. In adjusted regression models, female radiologists or fellowship-trained radiologists had significantly higher recall and false-positive rates (P < .05, all). Fellowship training in breast imaging was the only characteristic significantly associated with improved sensitivity (odds ratio, 2.32; 95% confidence interval: 1.42, 3.80; P < .001) and the overall accuracy parameter (odds ratio, 1.61; 95% confidence interval: 1.05, 2.45; P = .028). Fellowship training in breast imaging may lead to improved cancer detection, but it is associated with higher false-positive rates.
Read moreA-156 Comparison of blast and variant lymphocyte flagging between the Alinity hq from Abbott and XN-1000 from Sysmex
Background Blast cells are immature white blood cells (WBC). The presence of blasts in the peripheral blood may be associated with certain diseases such as myelodysplastic syndrome and acute myelogenous leukemia. Variant lymphocytes (i.e., reactive lymphocytes, atypical lymphocytes) are WBCs produced by the immune system in reaction to infections caused by pathogens such as Epstein-Barr virus, cytomegalovirus, etc. It is clinically useful that the automated hematology analyzer is capable of flagging these cells. In this study, the blast (shown as ‘BLAST’ on the Alinity hq and ‘Blast/Abn Lympho?’ or ‘Blast?’ on XN-1000) and variant lymphocyte (shown as ‘VAR LYM’ on the Alinity hq, and ‘Atypical Lympho?’ on XN-1000) flagging was compared between the Alinity hq from Abbott and XN-1000 from Sysmex. Alinity hq has different sensitivity settings available for BLAST and VAR LYM flagging. In this study, the default setting for Alinity hq was used. For XN-1000, the Q-Flag default setting is 100. In this study, the setting was 120 for ‘Blast/Abn Lympho’ and 100 for “Atypical lympho?’. Methods Blood specimens were tested on the Alinity hq and XN-1000 analyzers. Two smears per specimen were made manually or by the Alinity hs slide maker stainer and read by two independent readers. The specimens showing any of the following flagging were included in the analysis: ‘BLAST’ on Alinity hq, ‘VAR LYM’ on Alinity hq, ‘Blast/Abn Lympho?’ or ‘Blast?’ on XN-1000, ‘Atypical lympho?’ on XN-1000. The flagging reports of these samples from both analyzers were compared to the smear review to determine if each analyzer's blast and variant lymphocyte flagging were true positive, false positive, true negative, or false negative. Results A total of 520 specimens were tested, yielding 41 specimens for blast flagging analysis and 80 specimens for variant lymphocyte flagging analysis. Due to the scarce availability of true positive samples from the manual review, true positive and false negative rate were not compared. For blast flagging using smear results of &gt;=1% or &gt;=5% as the positive criterion, Alinity hq yielded a 9.8% (=4/41) false positive rate and 87.8% (=36/41) true negative rate. XN-1000 yielded a 75.6% (=31/41) false positive rate and 22.0% (=9/41) true negative rate. For variant lymphocyte flagging using smear results of &gt;=5% as the positive criterion, Alinity hq yielded a 6.3% (=5/80) false positive rate and 92.5% (=74/80) true negative rate. XN-1000 yielded a 91.3% (=73/80) false positive rate and 7.5% (=6/80) true negative rate. Conclusions This study demonstrated that Alinity hq achieved a much lower false positive rate and much higher true negative rate for both blast and variant lymphocyte flagging when compared to the XN-1000. Manual blast and variant lymphocyte morphology classification is laboratory- and technician-dependent. Both analyzers allow different sensitivity/specificity levels to flag blasts and variant lymphocytes. Each individual laboratory should evaluate and choose the setting that is most suitable for their specific patient populations to obtain the desired flagging rate.
Read more13Securing Anonymous Communication Channels under the Selective DoS Attack
Anonymous communication systems are subject to selective denial-of-service (DoS) attacks. Selective DoS attacks lower anonymity as they force paths to be rebuilt multiple times to ensure delivery, which increases the opportunity for more attack. We present a detection algorithm that filters out compromised communication channels for one of the most widely used anonymity networks, Tor. Our detection algorithm uses two levels of probing to filter out potentially compromised tunnels. We probabilistically analyze our detection algorithm and show its robustness against selective DoS attacks through simulation. We also analyze the overhead of our algorithm and show that we can achieve better security guarantee than the conventional Tor path selection algorithm, while adding only approximately 5% bandwidth overhead to the Tor network. Finally, we validate our design with experiments using the live Tor network.
Read more4Identification of Influential Variants in Significant Aggregate Rare Variant Tests
Introduction: Studies that examine the role of rare variants in both simple and complex disease are increasingly common. Though the usual approach of testing rare variants in aggregate sets is more powerful than testing individual variants, it is of interest to identify the variants that are plausible drivers of the association. We present a novel method for prioritization of rare variants after a significant aggregate test by quantifying the influence of the variant on the aggregate test of association. Methods: In addition to providing a measure used to rank variants, we use outlier detection methods to present the computationally efficient Rare Variant Influential Filtering Tool (RIFT) to identify a subset of variants that influence the disease association. We evaluated several outlier detection methods that vary based on the underlying variance measure: interquartile range (Tukey fences), median absolute deviation, and SD. We performed 1,000 simulations for 50 regions of size 3 kb and compared the true and false positive rates. We compared RIFT using the Inner Tukey to 2 existing methods: adaptive combination of p values (ADA) and a Bayesian hierarchical model (BeviMed). Finally, we applied this method to data from our targeted resequencing study in idiopathic pulmonary fibrosis (IPF). Results: All outlier detection methods observed higher sensitivity to detect uncommon variants (0.001 < minor allele frequency, MAF > 0.03) compared to very rare variants (MAF <0.001). For uncommon variants, RIFT had a lower median false positive rate compared to the ADA. ADA and RIFT had significantly higher true positive rates than that observed for BeviMed. When applied to 2 regions found previously associated with IPF including 100 rare variants, we identified 6 polymorphisms with the greatest evidence for influencing the association with IPF. Discussion: In summary, RIFT has a high true positive rate while maintaining a low false positive rate for identifying polymorphisms influencing rare variant association tests. This work provides an approach to obtain greater resolution of the rare variant signals within significant aggregate sets; this information can provide an objective measure to prioritize variants for follow-up experimental studies and insight into the biological pathways involved.
Read moreEfficacy of multimodal intraoperative neurophysiology monitoring to distinguish the nervous system injury during surgery for chronic cervical compressive myelopathy
Objective To study the efficacy of intraoperative neuromonitoring with SEP, MEP and EMG to predict of spinal cord and nerve root injury during surgery for chronic cervical compressive myelopathy. Methods From October 2014 to June 2016, 107 patients (80 males, 27 females) who underwent surgery for chronic cervical compressive myelopathy and intra-operative neuromonitoring with SEP, MEP and EMG were enrolled in this study. The mean age was 53.36±11.35 years (24-79 years), and the mean follow-up time was 7.94±6.05 months (1-18 months). The monitoring method, abnormal alarm, treatment and outcome of intraoperative SEP, MEP and EMG were recorded in all patients. The preoperative, postoperative and last follow-up neurologic functions were compared. True positive, false positive, true negative and false negative cases were collected in all patients. Sensitivity, specificity, positive predictive value and negative predictive value were calculated, and the utility of monitor spinal cord and nerve root injury was analyzed. Results SEP, MEP and EMG baseline values of 107 patients were established at the end of exposure. A total of 8 patients with intraoperative neurophysiology monitoring were abnormal (4 cases of anterior surgery, 4 cases of posterior surgery), including 1 case with abnormal SEP and MEP, but EMG was normal, he became incomplete paralysis postoperatively; 4 cases with abnormal MEP and EMG, but SEP was normal, they suffered C5 nerve root palsy postoperatively; 2 cases with abnormal MEP, while SEP and EMG were normal, one was C5 nerve root palsy and another was incomplete paralysis for the right side of the limb postoperatively; 1 case with abnormal EMG, but SEP and MEP were normal, he was C5 nerve root palsy postoperatively. 1 patient with anterior surgery was false negative of intraoperative neurophysiology monitoring, it was not found abnormal during surgery, but the patient was C5 nerve root palsy after operation. The utility of monitor spinal cord injury, the sensitivity and specificity of SEP was 50% and 100%, respectively. The positive predictive value was 100% and the negative predictive value was 99.06%. The sensitivity and specificity of MEP were 100%, positive predictive value and negative predictive value were 100%. The effect of monitor nerve root injury, the sensitivity and specificity of SEP was 0 and 100%, respectively. The positive predictive value was 0 and the negative predictive value was 93.46%. The sensitivity and specificity of MEP was 71.43% and 100%, respectively. The positive predictive value was 100% and the negative predictive value was 98.04%. The sensitivity and specificity of EMG sensitivity was 71.43% and 100%, respectively. The positive predictive value was 100% and the negative predictive value was 98.04%. Conclusion During operation of chronic cervical compressive myelopathy, SEP and MEP for spinal cord injury monitoring, and MEP and EMG for nerve root injury monitoring were effective ways to promise comprehensive monitor the spinal cord and nerve root system. Key words: Cervical vertebrae; Spinal cord compression; Evoked potentials, somatosensory; Evoked potentials, motor; Electromyography
Read more7Hypothesis Testing Methods for Multivariate Multi-Occasion Intra-Individual Change
In psychological and educational measurement, it is often of interest to assess change in an individual. The current study expanded on previous research by introducing methods that can evaluate individual change on multiple latent traits measured on multiple occasions. The four methods considered are the likelihood ratio test (LRT), the multivariate Wald test (MWT), the modified multivariate Wald test (MMWT), and the score test (ST). Simulation studies were conducted to examine the true positive rate (TPR) and the false positive rate (FPR) of the new methods under a conventional fixed-form test and a computerized adaptive test (CAT). Manipulated variables included the number of occasions, change magnitudes, patterns of change, and correlations between latent traits. Results revealed that, in terms of FPR, all methods except MWT had close adherence to the nominal significance level. Among the three methods, the LRT is recommended as it provided a balance between FPR and TPR. Larger change magnitude yielded higher TPR, regardless of the remaining factors. With the same test length, a CAT yielded higher TPR than a conventional test. Real-data examples are provided of identifying psychometrically significant change across two to four occasions using a multivariate adaptive self-report medical outcomes measure from hospitalized patients. The detection of significant change among the three methods agreed highly, and those patients identified as having significant change exhibited large profile differences, which provided support for the valid performance of the proposed methods.
Read more8A Hybrid Intrusion Detection Method using Improved Stacking Ensemble Algorithm and False Positive Elimination Strategy for CBTC
With the wide application of information technolo-gies in communication based train control (CB TC) systems, the information security risks it confronts to are ever increasing. It is very difficult to design an intrusion detection system (IDS) which can detect both known and unknown cyber attacks with high true positive rate (TPR) and low false positive rate (FPR), simultaneously. In this paper, we propose a hybrid intrusion detection system (RIDS) which is composed of a signature-based intrusion detection system (SIDS) and an anomaly-based intrusion detection system (AIDS). An improved stacking ensemble algorithm (ISEA) is proposed to enhance the TPR of the SIDS which uses weighted classification probabilities outputted by base-classifiers to generate meta-features for the meta-classifier. The FPR of the AIDS is significantly reduced through adopting the proposed false positive elimination strategy (FPES). In addition, a Bayesian optimization algorithm is used for hyper-parameters adjustment to optimize the overall performance of the RIDS. The proposed RIDS is evaluated using both a KDD99 dataset and a CBTC dataset collected on a hardware-in-the-Ioop simulation platform. For the KDD99 dataset, the TPR and FPR of the proposed RIDS are 98.6% and 1.3%, respectively. For the CBTC dataset, the TPR and FPR are 98.1% and 1.1 %, respectively. Based on the performance comparison among different RIDSs, it is can be concluded that the proposed RIDS is superior to the existing RIDS in both TPR and FPR.
Read more
Copyright 2026 Cactus Communications. All rights reserved.
