Accurate and automated Range of Motion (ROM) assessment is essential for rehabilitation, physical therapy, and post-surgical recovery. Traditional manual goniometer-based evaluations suffer from subjectivity, inter-rater variability, and reliance on trained professionals. Although RGB-based computer vision enables markerless ROM estimation, it remains susceptible to occlusions, pose estimation errors, and difficulties detecting subtle joint movements. Furthermore, vision alone cannot capture neuromuscular activation, which is crucial for understanding joint dynamics. To address these challenges, we propose a multi-modal deep learning framework that integrates RGB-based motion tracking with electromyography (EMG) signals. EMG provides neuromuscular activation data, enhancing the robustness against visual occlusions and improving sensitivity to subtle joint displacements. Our method employs an Hourglass-based convolutional neural network (CNN) for spatial feature extraction and a gated recurrent unit (GRU)-based model for temporal EMG processing. To further enhance performance, we introduce feature-level and modality-level attention modules, dynamically emphasizing the most informative features and modality contributions. Experimental results demonstrate that our proposed model achieves an overall RMSE of 2.55, and improvements via the feature and modality attention mechanisms, respectively. Moreover, the fully fused RGB-EMG model outperforms RGB-only approaches, particularly in accurately predicting subtle ROM movements.

Distributed-memory graph applications are dominated by communication and synchronization overheads. For such applications, the communication pattern comprises of variable-sized data exchanges between process neighbors in a process graph topology. Unlike process grid for rectangular problems, it is much more difficult to optimize communication for the graph topology. Custom process assignment can improve the communication performance irrespective of the data partitioning strategy. Existing automated solutions are scarce and only caters to a cartesian process topology and not the graph topology which is induced by graph-based workloads. In this paper, we propose automated network-agnostic locality-aware process assignment heuristics for distributedmemory graph workloads, based on the structure of input graphs. For four communication intensive distributed-memory graph workloads - Breadth First Search (BFS), Louvain Clustering, Triangle Counting and Single Source Shortest Path (SSSP), we demonstrate up to$30-40 \%$improvements in the overall MPI communication times through proposed process remapping methodologies via packet-level simulations using Structural Simulation Toolkit (SST) and validate the strategies empirically on HPE Slingshot network of the NERSC Perlmutter supercomputer.

Static analysis is a widely used technique for analyzing various aspects of programs. However, as programs become more complex, static analysis tools require larger resources, such as CPU time and memory, to perform the same tasks. Moreover, the source code of programs may not always be accessible, requiring static analysis to be performed on the binary executable code directly. To overcome these challenges, we propose a lightweight static analysis framework called LSAFE, which constructs control flow graphs (CFGs) and data dependency graphs (DDGs) of target programs with optimized performance in terms of CPU and memory usage. We evaluated the proposed framework using both Spec benchmark programs and real-world industrial applications, and found that it outperformed Angr, an existing state-of-the-art static analysis tool. Additionally, we demonstrate a case study that utilizes the CFG generated by LSAFE to detect memory leaks.

Abstract Graphs are widely used to model real-life information, where graph similarity computation is one of the most significant applications, such as inferring the properties of a compound based on similarity to a known group. Definition methods (e.g., graph edit distance and maximum common subgraph) have extremely high computational cost, and the existing efficient deep learning methods suffer from the problem of inadequate feature extraction which would have a bad effect on similarity computation. In this paper, a double-branch model called DeepSIM was raised to deeply mine graph-level and node-level features to address the above problems. On the graph-level branch, a novel embedding relational reasoning network was presented to obtain interaction between pairwise inputs. Meanwhile, a new local-to-global attention mechanism is designed to improve the capability of CNN-based node-level feature extraction module on another path. In DeepSIM, double-branch outputs will be concatenated as the final feature. The experimental results demonstrate that our methods perform well on several datasets compared to the state-of-the-art deep learning models in related fields. Graphical abstract

Earth observation (EO) data provenance is vital for facilitating data sharing and cooperative processing. However, existing techniques for managing EO data provenance still have various weaknesses, including decentralization, traceability, transparency, tamper-proofing, and security protection. Despite being a transformative solution in various domains, the potential of blockchain technology in EO data provenance remains largely unexplored. This article introduces a blockchain-based solution for EO data provenance, aiming to facilitate data sharing and traceability. We have implemented a prototype based on the blockchain technology and conducted a performance evaluation. To the best of authors' knowledge, this is the first paper to explore the application of blockchain in the management of EO data provenance.

Abstract Triple‐negative breast cancer is the worst prognosis in breast cancer, accounting for 10.0–20.8% of all breast cancers. Considering that triple‐negative breast cancer has great heterogeneity and very poor prognosis, clinical medication guidance is in urgent need of a more detailed classification of breast cancer itself. Although many researchers have been dedicated to the clustering of triple‐negative breast cancer and have found possible targets based on typing, their results are not closely related to the prognosis. This paper utilizes three clustering methods to retype the patient data with triple‐negative breast cancer, and the results show that the triple‐negative breast cancer data could be classified into two categories. Eight important genes and three important clinical factors related to the prognosis of two types of triple‐negative breast cancer have been obtained. These genes have the following three characteristics: co‐expression, differential expression and interaction. In terms of breast cancer control, the prognosis can be controlled as much as possible by regulating gene levels, which provides new directions and ideas for related research on breast cancer prognosis.

Upper limb kinematic analysis that has been employed in the clinical assessment of motion functions or rehabilitation training is traditionally tested manually with a goniometer. Nowadays, it is a trend to deploy different technology and devices including low-cost but accurate RGB cameras in order to save manual efforts. Among these, a new method using deep learning-based cameras has been investigated to provide the same ease and accessibility as a manual handheld goniometer. The key to measuring upper limb Range of Motion (ROM) using a camera is to estimate upper limb joints accurately. Many existing joint estimation algorithms focus on improving the accuracy performance but put the efficiency concerns aside. It is still challenging to apply those algorithms to low-capacity and budget-friendly devices, which is highly demanding in clinical scenarios. We propose a lightweight and fast deep learning model to estimate human pose and then use predicted joints to measure the range of motion for upper limb joints. Unlike other human pose estimation methods that learn and predict all major joints of the human body, the proposed model only focuses on the upper limb, which improves the accuracy and reduces the overhead of prediction. To further reduce model size and latency, our model is based on a compact neural network architecture, and parameters in the network are quantized to 8-bit precision. As a result, our model runs 4.1 times faster and is 15.5 times smaller compared with a full sized state of the art human pose estimation model. The proposed method is further evaluated on different upper limb functional tasks. Results show that our new method achieves a satisfying accuracy in ROM measurement and a high degree of agreement with a goniometer. Compared with the goniometer to measure ROM, our presented method is easier to operate and can be performed remotely, while still retaining good accuracy.

Graph convolutional neural networks are designed to apply convolutional operations directly on non-Euclidean structure graph data, generating orderly arranged matrix representations of graphs. However, only node features are fully exploited even though edge features may also play an important role in some domains such as chemoinformatics. In this paper, we proposed two new approaches of utilizing edge features on graph convolutional neural networks, Feature embedding adjacent matrix and Reverse graph. Methodologies of basic graph convolutional neural networks only tend to propagate node features to neighbor nodes along edges by convolutional operations. By applying Feature embedding adjacent matrix, edge features are synthesized into node features and also propagated to neighbor nodes during propagation process. Reverse graph approach builds a special auxiliary graph to propagate edge features to neighbor edges. Therefore, a synthetical presentation including both edge features and node features is built. Experiments demonstrated our new approaches improve graph classification accuracies, especially on data sets with low accuracies on basic GCNs.

In recent years, a large number of Chinese electronic texts have been produced in the process of information construction in various fields. Identifying specific entities in these electronic texts has become a major research focus. Most existing research methods use radicals to extract the glyph features of Chinese characters but have seen its limitation. This paper extracts the features of Chinese characters from three aspects: glyph features, phonetic features, and character features, and improves conventional feature extraction methods for each kind of feature. A new named entity recognition method (AIP) is proposed by transforming Chinese characters into corresponding images for glyph feature extraction, dividing pinyin into initials, vowels, and tones for phonetic feature extraction, and fine-tuning the A Lite Bert model for character feature extraction to improve the performance of the model. This paper compares the performance of the AIP model and mainstream neural network models on Chinese named entity recognition tasks on commonly used data sets and the data sets in specific domains. The results showed that AIP achieved better results than the related work. The F1 values on the two data sets are 94.4% and 80.5%, respectively, which validates the model's versatility.

Matrix factorization is a powerful method to implement collaborative filtering recommender systems. This article addresses two major challenges, privacy and efficiency, which matrix factorization is facing. We based our work on DS-ADMM, a distributed matrix factorization algorithm with decent efficiency, to achieve the following two pieces of work: (1) Integrated local differential privacy paradigm into DS-ADMM to provide the privacy-preserving property; (2) Introduced a stochastic quantized function to reduce transmission overheads in ADMM to further improve efficiency. We named our work DS-ADMM++, in which one ’+’ refers to differential privacy, and the other ’+’ refers to quantized techniques. DS-ADMM++ is the first to perform efficient and private matrix factorization under the scenarios of differential privacy and DS-ADMM. We conducted experiments with benchmark data sets to demonstrate that our approach provides differential privacy and excellent scalability with a decent loss of accuracy.

With the rapid increase of text data generated by the Internet, the problem of text information overload is becoming more and more serious. Automatic text summarization provides a good method to simplify text information. Traditional methods are mainly divided into extractive and abstractive methods. However most extractive methods do not have too much context connection, which leads to unsmooth abstracts. Abstractive method is the mainstream method, but it also deviates from the text content and has the problem of poor readability. In this paper, a hybrid automatic text summarization method is proposed based on deep learning and a rapid self-attention mechanism. This mechanism is used to obtain a hybrid model DNM (Dilated Neural Random Attention with Minimal Risk Loss) by optimizing the network structure and combining it with a specific loss function. The ROUGE score of our model is compared with the extractive Neural Document Summarization (NEUSUM), the abstractive Graph-Based Attentional (GBA) and the hybrid model CopyNet on the LCSTS dataset so as to achieve more accurate and reasonable automatic text summarization.

With rapid industrial development, air pollution problems, especially in urban and metropolitan centers, have become a serious societal problem and require our immediate attention and comprehensive solutions to protect human and animal health and the environment. Because bad air quality brings prominent effects on our daily life, how to forecast future air quality accurately and tenuously has emerged as a priority for guaranteeing the quality of human life in many urban areas worldwide. Existing models usually neglect the influence of wind and do not consider both distance and similarity to select the most related stations, which can provide significant information in prediction. Therefore, we propose a Geographic Self-Organizing Map (GeoSOM) spatiotemporal gated recurrent unit (GRU) model, which clusters all the monitor stations into several clusters by geographical coordinates and time-series features. For each cluster, we build a GRU model and weighted different models with the Gaussian vector weights to predict the target sequence. The experimental results on real air quality data in Beijing validate the superiority of the proposed method over a number of state-of-the-art ones in metrics, such as${R} ^{2}$, mean relative error (MRE), and mean absolute error (MAE). The MAE, MRE, and${R} ^{2}$are 16.1, 0.79, and 0.35 at the Gucheng station and 19.53, 0.82, and 0.36 at the Dongsi station.

Atmospheric visibility is an indicator of atmospheric transparency and its range directly reflects the quality of the atmospheric environment. With the acceleration of industrialization and urbanization, the natural environment has suffered some damages. In recent decades, the level of atmospheric visibility shows an overall downward trend. A decrease in atmospheric visibility will lead to a higher frequency of haze, which will seriously affect people's normal life, and also have a significant negative economic impact. The causal relationship mining of atmospheric visibility can reveal the potential relation between visibility and other influencing factors, which is very important in environmental management, air pollution control and haze control. However, causality mining based on statistical methods and traditional machine learning techniques usually achieve qualitative results that are hard to measure the degree of causality accurately. This article proposed the seq2seq-LSTM Granger causality analysis method for mining the causality relationship between atmospheric visibility and its influencing factors. In the experimental part, by comparing with methods such as linear regression, random forest, gradient boosting decision tree, light gradient boosting machine, and extreme gradient boosting, it turns out that the visibility prediction accuracy based on the seq2seq-LSTM model is about 10% higher than traditional machine learning methods. Therefore, the causal relationship mining based on this method can deeply reveal the implicit relationship between them and provide theoretical support for air pollution control.

The latest implementation of the fully homomorphic encryption algorithm (FHEW), FHEW-V2, takes about 0.12 s for a bootstrapping on a single-node computer. It seems much faster than the previous implementations. However, the 30-bit homomorphic addition requires 270 times of bootstrapping; plus those spent on key generation, the total elapsed time climbs to 55 seconds, which is unacceptable. In this article, we reveal how to further optimize FHEW-V2 by focusing on efficiently constructing homomorphic full adders. We tackle inefficiency in FHEW-V2 by massive efforts: First, we explore FHEW-V2 and locate hotspots; second, we leverage the heterogeneous parallel computing model of multicore CPU and GPUs to remove the hotspots to improve performance. The empirical results show that a 30-bit homomorphic addition is completed in 23.8753 s after optimization, gaining an overall speedup of 2.2845; and a 6-bit homomorphic multiplication costs 25.8438, gaining an overall speedup of 2.2435. The 2.2845 speedup is a rough integration of a 13.248 speedup for the key generation and a 1.672 speedup for the bootstrapping; the 2.2435 speedup is a rough integration of the same key generation and a 1.675 speedup for the bootstrapping. We also reveal the strengths and weaknesses of FHEW-V2 by comparing it with a state-of-the-art somewhat homomorphic encryption algorithm, microsoft's simple encrypted arithmetic library (SEAL).

Identifying if a subsurface target is salt or not automatically and accurately is of vital importance to oil drilling. But unfortunately, obtaining the precise position of large salt deposits is very difficult. Professional seismic imaging still requires the interpretation of salt bodies by experts. This leads to very subjective, highly variable renderings. More alarmingly, it leads to potentially dangerous situations for drillers in oil and gas companies. In this paper, a Squeeze-Extraction Feature Pyramid Networks (referred to as Se-FPN) was proposed to tackle the task of image segmentation of salt deposits. Specifically, we utilized SeNet as backbone so as to implicitly learn to suppress irrelevant regions in an input image while highlighting salient features useful for the task. Considering the importance of multi-scales information, we proposed an improved FPN to integrate information of different scales. In order to further fuse the information from multiple scales, the Hypercolumns module was inserted at the end of the network. The proposed Se-FPN has been applied to the TGS Salt Identification Challenge and achieved high quality segmentation effect. The Mean Intersection over Union value can reach 0.86.

Air pollution is threatening human's health since the industrial revolution, but there are not efficient ways to solve air pollution, so forecasting air quality has become an efficient measure to prevent citizens from hurting of heavy air pollution. In this paper, we proposed an advanced Seq2Seq (Sequence to Sequence) model called attention-based air quality forecasting model (ABAFM) whose RNN encoder is replaced by pure attention mechanism with position embedding. This improvement not only reduces the training time of Seq2Seq model with attention but also enhances the robustness of Seq2Seq models. We implemented ABAFM in Olympic center and Dongsi monitoring stations in Beijing to forecast PM2.5 in future 24 hours. The experimental results showed that the proposed model outperformed the related arts, especially in sudden changes.

Stacked or sequential convolutional layers in a Convolutional Neural Network (CNN) have shown state-of-the-art results in Image and Pattern Recognition. Recently, CNN's have shown promising results in Natural Language Processing (NLP) tasks. Using a CNN with concurrent convolutional layers, we conduct text categorization on a clinical narrative dataset with imbalance classes. Clinical narratives are written in natural language, documenting the clinical encounter as observed from the clinician along with the process of care. For this research, we experiment with various CNN architectures with a focus on the embedding layer, the first layer in an NLP-based CNN. The input to the embedding layer is the document matrix and the length is typically determined by a maximum document length. This may not be the best option in the case of highly imbalanced classes. Using simple data analysis, we obtain an optimal document length for the document matrix in the embedding layer of the CNN. Comparing the results from our previous published research on classifying clinical narratives, this CNN architecture provides a significant improvement in the F1-Score to our previous ensemble-based approach incorporating multiple methods.

Word embeddings are a low-dimensional vector representation of words that incorporates context. TWo popular methods are word2vec and global vectors (GloVe). Word2vec is a single-hidden layer feedforward neural network (SLFN) that has an auto-encoder influence for computing a word context matrix using backpropagation for training. GloVe computes the word context matrix first then performs matrix factorization on the matrix to arrive at word embeddings. Backpropagation is a typical training method for SLFN's, which is time consuming and requires iterative tuning. Extreme learning machines (ELM) have the universal approximation capability of SLFN's, based on a randomly generated hidden layer weight matrix in lieu of backpropagation. In this research, we propose an efficient method for generating word embeddings that uses an auto-encoder architecture based on ELM that works on a word context matrix. Word similarity is done using the cosine similarity measure on a dozen various words and the results are reported.

This work seeks to improve upon the accuracy of birdsong analysis based species recognition. We intend to accomplish this by creating a more effective bird syllable segmentation algorithms (MIRS), Support Vector machine based classifiers are used to train the features of IRS and MIRS. The experimental results show the effectiveness of the proposed algorithm.

Clinical texts are inherently complex due to the medical domain expertise required for content comprehension. In addition, the unstructured nature of these narratives poses a challenge for automatically extracting information. In natural language processing, the use of word embeddings are an effective approach to generate word representations (vectors) in a low dimensional space. In this paper we use a log-linear model (a type of neural language model) and Linear Discriminant Analysis with a kernel-based Extreme Learning Machine (ELM) to map the clinical texts to the medical code. Experimental results on clinical texts indicate improvement with ELM in comparison to SVM and neural network approaches.

Although social-aware opportunistic networking paradigms are considered to have broad potential applications, so far very little is known about which nodes are more important in both sustaining the network topology and forwarding or disseminating messages. To address this issue, this paper redefines the concept of walk and extends traditional Katz Centrality measurement to dynamic opportunistic social networks. Based on the Time Evolving Graph model, we derive a convenient formula to identify each node's information dissemination capability through computing the product of the adjacent matrix of each snapshot along the direction of time. The resulting matrix, in which the spatial and temporal dependency of the network nodes are fully captured, can conveniently be used to evaluate each node's relative dissemination capability. We apply our method to two real experiment trace datasets and the results show that, several mobile nodes with highest communicability identified by our method are more efficient in message dissemination than the others in the whole network. Those nodes can be chosen as good candidates when some interventions, such as accelerating or suppressing the speed of information spreading in network, are required to be made on network.

Electronic medical records provide us with an enormous amount of data with vast potential. If properly analyzed, medical data can be converted to knowledge that improves treatment, uncovers unexpected associations, and supports the personal experience of doctors and nurses, allowing them to make more informed decisions. Medical data is often generated by monitoring across a period of time, whether new data arrives quickly or slowly, consistently or sporadically, but many data mining methods are not designed to consider the temporal aspect of a data set. Besides the extra dimension of time, medical processes often involve interaction between many attributes at once, complicating the discovery of relevant patterns and associations. Specialized methods to interpret medical data can improve the quality of knowledge extracted from it. Tensors are appropriate data structures to represent our data in a multi-dimensional format, taking into account the relationship between many dimensions at once. We can further segment our data into discrete temporal chunks, creating a sequence of tensors. By applying dynamic tensor analysis to our tensor sequence, we can reveal patterns and associations within our data set and capture their change over time. This information can be developed into medical knowledge that can be used to support future treatment.

Recently, research on complex network theory and applications draws a lot of attention in both academy and industry. In mobile ad hoc networks (MANETs) area of research, a critical issue is to design the most effective topology for given problems. It is natural and significant to consider complex networks topology when optimising the MANET topology. Current works usually transform MANET or sensor network topologies into either small-world or scale-free. However, some fundamental problems remain unsolved. Specifically, what are the average shortest path length, degree distribution and clustering characteristics of MANETs? Do MANETs have small-world effect and scale-free property? In this work, the authors introduce complex networks theory into the context of MANET topology and study complex network properties of the MANETs to answer the above questions. The authors have theoretically analysed the degree distribution and clustering coefficient of MANETs and proposed approach to computing them. The degree distribution and clustering coefficient of MANETs are theoretically deduced from node space probability distribution on different mobility models (including but not limited to random waypoint model). Simulation results on average shortest path length, clustering coefficient and degree distribution show that in most cases MANETs do not have the small-world effect and scale-free property.

A VANET consists of vehicles equipped with on board units (OBUs) that can communicate with each other and the road side base stations. Due to the mobility and sparse distribution of vehicles, the delivery delay of messages in the VANET is mainly caused by the message transmissions between vehicles. The message delivery delay directly impacts the deployment of applications in VANET, and hence, an in-depth study of message delivery delay in the VANET is significant. In this paper, we focused on the investigation of the message delivery delay in the V2V stage with a bidirectional setting. The bidirectional traffic was modeled as a combination of two Poisson point processes. Based on the sub-additive ergodic theory, we found theoretically that the message delivery delay has a linear relationship with the message forwarding distance. Further, the upper bound of the coefficient of the linear relationship has an exponential polynomial relation with the density of vehicles on the road and decreases with the increment of the velocity of the traffic.

Classical network fluid model and RED algorithm are based on TCP flows in internet network, and they have not considered the UDP flows' effects in network. However, in real work of the network, the network link capacity is shared by the hybrid traffics: TCP flows and UDP flows, and UDP flows can occupy the original link capacity of TCP flow. Since there is no feedback control for UDP flows, the classical network fluid model and RED algorithm can not reflect and control the congestion of TCP/UDP networks. To solve the problem, we modify the classical AQM router into multiple queues AQM router with classifier. We express the proposed TCP/UDP AQM router by a linear time-delay system model. Then, by utilizing the 2-D Laplace-Z transform technique, we derive some explicit conditions that establish the relationship between the control parameter pmaxand the network stability. This paper first proposes parameter pmax's stability bounds for TCP/UDP routers for congestion control based on 2-D Hurwitz-Schur stability conditions. The simulation results verify that the proposed stability condition can gain the effective congestion control.

Neuropathic pain (NeuP) is often more difficult to treat than other types of chronic pain. The ability to predict outcomes in NeuP, such as response to specific therapies and return to work, would have tremendous value to both patients and society. In this work, we propose an adaptive clustering algorithm using the Neuropathic Pain Scale (NPS) to develop a set of standard patient templates. These templates may be useful in studying treatment response in NeuP. The approach is evaluated on 108 subjects' baseline data and results demonstrate the efficacy of utilizing neuropathic pain scale (NPS) metrics and our proposed method.

Rogue wireless access points (RWAPs) bypass physical endpoint security of local area networks and present significant security threats by creating network attack vectors behind firewalls, exposing confidential information, and allowing unauthorized utilization of network resources. A family of more promising methods detects RWAPs indirectly by identifying unauthorized wireless hosts through using temporal TCP/IP characteristics of SYN, FIN, and ACK local round trip times (LRTT). Thus any unauthorized wireless hosts found indicate the presence of a RWAP. With these session-based temporal characteristics, traffic from wireless and wired nodes can be differentiated by exploiting the fundamental differences between Ethernet and 802.11b/g/n. In this work, we empirically analyzed extensive LRTT data and designed a light system — RAPiD with several algorithms for effective wireless hosts detection. Ultimately, SYN, FIN, and ACK LRTTs can be compared against each other to discover wireless hosts regardless of network speeds. The results show first time how merging 802.11n wireless technology can still be accurately separated from Ethernet hosts, even as it continues to improve.

The proliferation of networked systems and services along with their exponential growth in complexity and size has increased the control and management complexity of such systems and services by several orders of magnitude. As a result, management tools have failed to cope with and handle the complexity, dynamism, and coordination among network attacks. In this paper, we present a self-configuration approach to control and manage the security mechanisms of large scale networks. Self-configuration enables the system to automatically configure security system and change the configuration of its resources and their operational policies at runtime in order to manage the system security. Our self-configuration approach is implemented using two software modules: component management interface (CMI) to specify the configuration and operational policies associated with each component that can be a hardware resource or a software component; and component runtime manager (CRM) that manages the component operations using the policies defined in CMI. We have used the self-configuration framework to experiment with and evaluate different mechanisms and strategies to detect and protect against a wide range of network attacks.

The exponential growth in wireless network faults, vulnerabilities, and attacks make the wireless local area network (WLAN) security management a challenging research area. Newer network cards implemented more security measures according to the IEEE recommendations [14]; but the wireless network is still vulnerable to denial of service attacks or to other traditional attacks due to existing wide deployment of network cards with well-known security vulnerabilities. The effectiveness of a wireless intrusion detection system (WIDS) relies on updating its security rules; many current WIDSs use static security rule settings based on expert knowledge. However, updating those security rules can be time-consuming and expensive. In this paper, we present a novel approach based on multi-channel monitoring and anomaly analysis of station localization, packet analysis, and state tracking to detect wireless attacks; we use adaptive machine learning and genetic search to dynamically set optimal anomaly thresholds and select the proper set of features necessary to efficiently detect network attacks. We present a self-protection system that has the following salient features: monitor the wireless network, generate network features, track wireless network state machine violations, generate wireless flow keys (WFK), and use the dynamically updated anomaly and misuse rules to detect complex known and unknown wireless attacks. To quantify the attack impact, we use the abnormality distance from the trained norm and multivariate analysis to correlate multiple selected features contributing to the final decision. We validate our wireless self protection system (WSPS) approach by experimenting with more than 20 different types of wireless attacks. Our experimental results show that the WSPS approach can protect from wireless network attacks with a false positive rate of 0.1209% and more than 99% detection rate.

Summary form only given. Detection and self-protection against viruses, worms, and network attacks is urgently needed to protect network systems and their applications from catastrophic failures. Once a network component is infected by viruses, worms, or became a target of network attacks, its operational state shifts from normal to abnormal state. Online monitoring mechanism can collect important aspects of network traffic and host data (CPU utilization, memory usage, etc.), that can be effectively used to detect abnormal behaviors caused by attacks. In this paper, we develop an online multivariate analysis algorithm to analyze the behaviors of system resources and network protocols in order to proactively detect network attacks. We have validated an algorithm and showed how it can proactively detect accurately well-known attacks such as distributed denial of service, SQL slammer worm, and email spam attacks.

The Internet has been growing at an amazing rate and concurrent with the growth, the vulnerability of the Internet is also increasing. Though the Internet has been designed to withstand various forms of failure, the intrusion tools and attacks are becoming increasingly sophisticated, exposing the Internet to new threats. To make networked systems reliable and robust it becomes highly essential to develop on-line monitoring, analysis and quantification of the behavior of networks under a wide range of attacks and to recover from these attacks. In this paper, we present a hybrid method based on information theory and genetic algorithm to detect network attacks. Our approach uses information theory to filter the traffic data and thus reduce the complexity. We use a linear structure rule to classify the network behaviors into normal and abnormal behaviors. We apply our approach to the kdd99 benchmark dataset and obtain high detection rate of 99.25% as well as low false alarm rate of 1.66%.

With increasing faults and attacks on the Internet infrastructure, there is an impending need to provide automatic techniques to detect and mitigate the impact of attacks on network services. Denial-of-service attacks have been successful in denying legitimate traffic access to its required resources because existing routing protocols treat the attacking traffic equally as any normal traffic. This paper presents a proactive network defense framework that can be integrated with existing quality-of-service (QoS) protocols to provide differentiated services to network traffic flows based on their distance from the normal behavior. We introduce a new metric that we refer to as abnormality distance (AD) metric that can be used to classify traffic into normal, probable normal, probable abnormal (suspicious traffic), and abnormal (attacking traffic). The AD metric can then be used in conjunction with any QoS protocol to give high priority to normal traffic and lower priority to abnormal traffic. We demonstrate through several examples, how our approach can dynamically detect attacks, quantify their impact, and how to reduce the impacts and recover from them.

The quality of the data being analyzed is a critical factor that affects the accuracy of data mining algorithms. There are two important aspects of the data quality, one is relevance and the other is data redundancy. The inclusion of irrelevant and redundant features in the data mining model results in poor predictions and high computational overhead. This paper presents an efficient method concerning both the relevance of the features and the pairwise features correlation in order to improve the prediction and accuracy of our data mining algorithm. We introduce a new feature correlation metric Q/sub Y/(X/sub i/,X/sub j/) and feature subset merit measure e(S) to quantify the relevance and the correlation among features with respect to a desired data mining task (e.g., detection of an abnormal behavior in a network service due to network attacks). Our approach takes into consideration not only the dependency among the features, but also their dependency with respect to a given data mining task. Our analysis shows that the correlation relationship among features depends on the decision task and, thus, they display different behaviors as we change the decision task. We applied our data mining approach to network security and validated it using the DARPA KDD99 benchmark data set. Our results show that, using the new decision dependent correlation metric, we can efficiently detect rare network attacks such as User to Root (U2R) and Remote to Local (R2L) attacks. The best reported detection rates for U2R and R2L on the KDD99 data sets were 13.2 percent and 8.4 percent with 0.5 percent false alarm, respectively. For U2R attacks, our approach can achieve a 92.5 percent detection rate with a false alarm of 0.7587 percent. For R2L attacks, our approach can achieve a 92.47 percent detection rate with a false alarm of 8.35 percent.