Unsupervised Learning for Lateral-Movement-Based Threat Mitigation in Active Directory Attack Graphs

Active Directory Domain is a Microsoft service that allows and facilitates the centralized administration of all workstations and servers in any environment. Due to the wide use and adoption of this service, it has become a target for many attackers. Active Directory attacks have evolved through years. The attacks target different functions and features provided by Active Directory. In this paper, we provide insights on the criticality, impact, and detection of Active Directory attacks. We review the different Active Directory attacks. We introduce the steps of the Active Directory attack and the Kerberos authentication workflow, which is abused in most attacks to compromise the Active Directory environment. Further, we conduct experiments on two attacks that are based on privilege escalation in order to examine the attack signatures on Windows event logs. The content designed in this paper may serve as a baseline for organizations implementing detection mechanisms for their Active Directory environments.

Customer relationship management (CRM) is the tool to enhance customer relationship in any business. Due to the exponential growth of data volume, in any field, it is significant to develop new techniques to discover the customer knowledge, automation of the system and moreover customer satisfaction to win customer lifetime value. CRM with machine learning could bring a catalytic change in business. Several supervised and unsupervised machine learning techniques are utilized to improve the customer experience and profitability of business. This paper reviews the available literature on the CRM with machine learning techniques for customer identification, customer attraction, and customer retention and customer development. This study reveals that supervised learning techniques are 48.48% utilized, unsupervised learning techniques are utilized 15.15%, and 9.09% utilized other techniques in CRM. Paradigm is also shifted toward the deep learning from machine learning as 28.28% text has been reported to deep learning. Decision tree-based algorithm and support vector machine algorithms are most utilized algorithm of supervised learning. E-commerce and telecommunication sectors are the most important areas identified with the exponential growth of the users and hence need a suitable machine learning techniques for customer satisfaction and business profitability.

While machine learning and artificial intelligence have long been applied in networking research, the bulk of such works has focused on supervised learning. Recently there has been a rising trend of employing unsupervised machine learning using unstructured raw network data to improve network performance and provide services such as traffic engineering, anomaly detection, Internet traffic classification, and quality of service optimization. The interest in applying unsupervised learning techniques in networking emerges from their great success in other fields such as computer vision, natural language processing, speech recognition, and optimal control (e.g., for developing autonomous self-driving cars). Unsupervised learning is interesting since it can unconstrain us from the need of labeled data and manual handcrafted feature engineering thereby facilitating flexible, general, and automated methods of machine learning. The focus of this survey paper is to provide an overview of the applications of unsupervised learning in the domain of networking. We provide a comprehensive survey highlighting the recent advancements in unsupervised learning techniques and describe their applications for various learning tasks in the context of networking. We also provide a discussion on future directions and open research issues, while also identifying potential pitfalls. While a few survey papers focusing on the applications of machine learning in networking have previously been published, a survey of similar scope and breadth is missing in literature. Through this paper, we advance the state of knowledge by carefully synthesizing the insights from these survey papers while also providing contemporary coverage of recent advances.

Kenya is experiencing a significant increase in the prevalence of non-communicable diseases (NCDs) such as cardiovascular diseases, hypertension, Type 2 diabetes, and certain cancers (bowel, lung, prostate, and uterine). This case is not unique to Kenya but is common in many Low and Middle-Income Countries (LMICs) in Africa. Many NCDs, are linked to diets high in added sugars, sodium, saturated fat, and low in fiber. There is a notable lack of information regarding the demographic differences among supermarket customers and their purchasing habits of healthy versus unhealthy foods in some parts of Africa. This gap in knowledge hinders the ability to connect grocery purchase patterns to NCDs, including obesity. Supermarkets in LMICs offer valuable demographic insights through grocery data. This research utilizes NOVA classification tool, data mining and unsupervised machine learning techniques to analyze grocery purchase patterns in 10 supermarkets across 5 counties in Kenya between 2022 and 2023. The apriori algorithm was used to create association rules and an analysis was done on the association rules to find out the relationship between demography (location, gender, and age) with purchase patterns. Individual data was collected along with transaction data, since the supermarkets logged transactions done by loyalty card customers. The main aim is to provide guidance to policymakers in public health. We collected 3 934 122 unique transactions and each transaction was associated with a customer who was identified with a unique customer ID. Findings from this research demonstrate that 53% of food purchases from these transactions were mainly industrially processed food items and males above the age of 50 years were the main consumers of these food items. The findings lead to the conclusion that this purchase trend has a chance of rising NCDs in older people. Therefore we recommend that policymakers adopt our recommendations to safeguard public health.

Face recognition has always been a potential research area because of its demand for reliable identification of a human being especially in government and commercial sectors, such as security systems, criminal identification, border control, etc. where a large number of people interact with each other and/or with the system. The last two decades have witnessed many supervised and unsupervised learning techniques proposed by different researchers for the face recognition system. Principal component analysis (PCA), self‐organizing map (SOM), and independent component analysis (ICA) are the most widely used unsupervised learning techniques reported by research community. This article presents an analysis and comparison of these techniques. The article also includes two SOM processing methods global SOM (GSOM) and local SOM (LSOM) for performance evaluation along with PCA and ICA. We have used two different databases for our analysis. The simulation result establishes the supremacy of GSOM in general among all the unsupervised techniques. © 2010 Wiley Periodicals, Inc. Int J Imaging Syst Technol, 20, 261–267, 2010

Soybean yield components and agronomic traits are connected through physiological pathways that impose tradeoffs through genetic and environmental constraints. Our primary aim is to assess the interdependence of soybean traits by using unsupervised machine learning techniques to divide phenotypic associations into environmental and genetic associations. This study was performed on large scale, jointly analyzing 14 quantitative traits in a large multi-parental population designed for genetic studies. We collected phenotypes from 2012 to 2015 from a soybean nested association panel with 40 families of approximately 140 individuals each. Pearson and Spearman correlations measured phenotypic associations. A multivariate mixed linear model provided genotypic and environmental correlations. To evaluate relationships among traits, the study used principal component and undirected graphical models from phenotypic, genotypic, and environmental correlation matrices. Results indicate that high phenotypic correlation occurs when traits display both genetic and environmental correlations. In genetic terms, length of reproductive period, node number, and canopy coverage play important roles in determining yield potential. Optimal grain yield production occurs when the growing environment favors faster canopy closure and extended reproductive length. Environmental associations found among yield components give insight into the nature of yield component compensation. The use of unsupervised learning methods provides a good framework for investigating interactions among various quantitative traits and defining target traits for breeding.

Chapter 8 - Managing Microsoft Active Directory

Operational modal analysis (OMA) is required to maintain large-scale and necessary civil infrastructures. The non-contact method of OMA using digital image correlation and point tracking algorithms requires a speckle pattern placed on the structure. Alternatively, advanced computer vision methods like optical flow and phase-based video motion magnification (PBVMM) techniques are used to measure modal parameters. Despite the importance of PBVMM, the users should know the range of frequencies in which the natural structure frequency lies. A methodology based on an unsupervised machine learning technique is developed to extract the modal parameters blindly from its recorded digital video. The proposed methodology uses complex steerable pyramids and an unsupervised machine learning technique, also known as principal component analysis, and analytical mode decomposition with a random decrement technique to blindly extract the modal parameters of a structure. This study validated the proposed methodology using a multi-degree of freedom (DOF) numerical model. The results are compared with theoretical and estimated values and are in good agreement. Furthermore, it is implemented on a laboratory benchmark SDOF, MDOF, and real-time videos of the London Millennium and Tacoma Narrows bridges for blindly extracting the modal frequencies and damping ratios.

Developing the utilized intelligent systems is increasingly important to learn effective text representations, especially extract the sentence features. Numerous previous studies have been concentrated on the task of sentence representation learning based on deep learning approaches. However, the present approaches are mostly proposed with the single task or replied on the labeled corpus when learning the embedding of the sentences. In this paper, we assess the factors in learning sentence representation and propose an efficient unsupervised learning framework with multi-task learning (USR-MTL), in which various text learning tasks are merged into the unitized framework. With the syntactic and semantic features of sentences, three different factors to some extent are reflected in the task of the sentence representation learning that is the wording, or the ordering of the neighbored sentences of a target sentence in other words. Hence, we integrate the word-order learning task, word prediction task, and the sentence-order learning task into the proposed framework to attain meaningful sentence embeddings. Here, the process of sentence embedding learning is reformulated as a multi-task learning framework of the sentence-level task and the two word-level tasks. Moreover, the proposed framework is motivated by an unsupervised learning algorithm utilizing the unlabeled corpus. Based on the experimental results, our approach achieves the state-of-the-art performances on the downstream natural language processing tasks compared to the popular unsupervised representation learning techniques. The experiments on representation visualization and task analysis demonstrate the effectiveness of the tasks in the proposed framework in creating reasonable sentence representations proving the capacity of the proposed unsupervised multi-task framework for the sentence representation learning.

Tropical cyclone (TC) track forecasts have improved in recent decades while intensity forecasts, particularly predictions of rapid intensification (RI), continue to show low skill. Many statistical methods have shown promise in predicting RI using environmental fields, although these methods rely heavily upon supervised learning techniques such as classification. Advances in unsupervised learning techniques, particularly those that integrate nonlinearity into the class separation problem, can improve discrimination ability for difficult tasks such as RI prediction. This study quantifies separability between RI and non-RI environments for 2004–16 Atlantic Ocean TCs using an unsupervised learning method that blends principal component analysis with k-means cluster analysis. Input fields consisted of TC-centered 1° Global Forecast System analysis (GFSA) grids (170 different variables and isobaric levels) for 3605 TC samples and five domain sizes. Results are directly compared with separability offered by operational RI forecast predictors for eight RI definitions. The unsupervised learning procedure produced improved separability over operational predictors for all eight RI definitions, five of which showed statistically significant improvement. Composites from these best-separating GFSA fields highlighted the importance of mid- and upper-level relative humidity in identifying the onset of short-term RI, whereas long-term, higher-magnitude RI was generally associated with weaker absolute vorticity. Other useful predictors included optimal thermodynamic RI ingredients along the mean trajectory of the TC. The results suggest that the orientation of a more favorable thermodynamic environment relative to the TC and midlevel vorticity magnitudes could be useful predictors for RI.

Online discussion forums play an important role in building and sharing domain knowledge. An extensive amount of information can be found in online forums, covering every aspect of life and professional discourse. This chapter introduces the application of supervised and unsupervised machine learning techniques to analyze forum questions. This chapter starts with supervised machine learning techniques to classify forum posts into pre-defined topic categories. As a supporting technique, web scraping is also discussed to gather data from an online forum. After this, this chapter introduces unsupervised learning techniques to identify latent topics in documents. The combination of supervised and unsupervised machine learning approaches offers us deeper insights of the data obtained from online forums. This chapter demonstrates these techniques through a case study on a very large online discussion forum called LabVIEW from the systems modeling community. In the end, the authors list future trends in applying machine learning to understand the expertise captured in online expert communities.

Spatial Data Infrastructures often maintain directories of public geospatial Web Services built from Web services listed in their registries. However, registry data may be stale and incomplete because their maintenance depends on service owners. A solution is to back the registry with an active directory, or index, that lists Web services found by a Web crawler focused on geospatial Web services. The problem of the identification of the geospatial nature of a Web service appears when such crawler finds a service described in the Web Services Description Language (WSDL). This paper presents two components required to build an active directory: a crawler focused on Open Geospatial Consortium and WSDL-based Web services, and an unsupervised classifier of geospatial Web services described in WSDL.

In rarefied gas flows, discontinuity phenomena such as velocity slip and temperature jump commonly appear in the gas layer adjacent to a solid boundary. Due to the physical complexity of the interactions at the gas-solid interface, particularly in the case of systems with local nonequilibrium state, boundary models with limited number of parameters cannot completely describe the reflection of gas molecules at the boundary. In this work, the Gaussian mixture (GM) model, which is an unsupervised machine learning technique, is employed to construct a statistical gas-solid surface scattering model based on the collisional data obtained from molecular dynamics (MD) simulations. The GM model is applied to study Couette flow for different inert gases (Ar and He) confined between two parallel infinite gold walls at different temperatures. A direct comparison between the results obtained from the GM model and the Cercignani-Lampis-Lord (CLL) scattering kernel against the MD collisional data in terms of the distribution of the predicted postcollisional velocities, and accommodation coefficients has shown that the results from the GM model are an excellent match with the MD results outperforming the CLL scattering kernel. As an example, for He gas, while the predicted energy accommodation coefficient by the CLL model is more than two times higher than the MD predictions, the value computed by the GM model is in excellent agreement with the MD results. This superior performance of the GM model confirms its high potential to derive a generalized boundary condition in systems encountered with highly nonequilibrium and complex gas flow conditions.

Technological developments have affected the decision-making phase in football matches. The viewing pleasure of fans and the result of the match is a matter of debate determined by the referees. Throughout time, the objectiveness of referees was questioned by the technological tools. Video Assistant Referee (VAR) is an example approach to ensure whether the referees react to similar positions of different matches in the same manner or not. One of the problems of this topic is the controversial decisions of some referees leading to unexpected results. In this research, as a different approach to the referees’ objectivity problem, referees are tried to be classified based on the statistical outcome of the matches using unsupervised machine learning techniques. Meaningful clusters should not be found to be able to state the referees are objective. This study is conducted on 10-years English Premier League between 2009–2018 data. Principal Component Analysis is going to be used for grouping the variables to perform exploratory data analysis. K-Means, hierarchical clustering, and Fuzzy C-Means are going to be used for dividing the referees into various subgroups. R programming language is used for examining data. In conclusion of the analysis, four different referee groups are defined.KeywordsFootballEnglish Premier LeagueRefereeClusteringMachine learningUnsupervised learning

ML-Diabetes is a machine learning-based predictive model for the early detection of diabetes. Diabetes is a chronic metabolic disorder that affects millions of people worldwide. Early detection of diabetes can help prevent its complications and improve patient outcomes. ML-Diabetes is designed to use demographic and clinical data to predict the likelihood of a patient developing diabetes. The model uses a combination of supervised and unsupervised machine learning techniques to analyse and classify data. ML-Diabetes uses a dataset containing demographic and clinical information of patients, including age, sex, BMI, blood pressure, and glucose levels. The dataset is preprocessed and cleaned to remove missing values and outliers. The processed data is then split into training and testing sets, and the model is trained on the training set. The model uses a combination of supervised and unsupervised machine learning techniques, including logistic regression, decision trees, and k-means clustering, to predict the likelihood of a patient developing diabetes. The model is evaluated on the testing set using various performance metrics, including accuracy, precision, recall, and F1-score. The results show that ML-Diabetes is a reliable and accurate predictive model for the early detection of diabetes. The model achieves an accuracy of 85%, precision of 90%, recall of 80%, and F1-score of 85%. The model can be used by healthcare professionals to screen patients for diabetes and provide early interventions to prevent complications.