Abstract Android OS is today the most used Operating System for mobile devices. However, it is susceptible to several malware attacks that may seriously compromise the privacy and security of individuals and organizations. This paper proposes an approach based on a static analysis of decompiled Android PacKages (APKs) to extract critical APIs and detect Android malware. The main contributions lie in the adoption of a graph-based data engineering schema to represent APIs taken from the Function Call Graphs of decompiled APKs and the formulation of a graph-based deep learning approach for explainable malware detection. In particular, the proposed approach, named , implements a Graph Neural Network (GNN) for binary classification (malware versus goodware), and integrates algorithm to disclose how specific API classes and control-flow edges between API calls influence malware alerts. The proposed approach was evaluated by considering 26,527 Android APKs. The results of an extensive and in-depth evaluation show that the presented GNN model achieves higher accuracy than deep neural models trained with traditional API call sequence representations and publicly available related methods. On the other hand, it produces decision explanations that yield interesting insights into the malicious patterns of APKs and support root cause analysis of missed malware alarms.

Open remote sensing science has been recently boosted by the free availability of Sentinel-2 images of planet Earth acquired with the Copernicus programme. In particular, processing open Sentinel-2 images with Artificial Intelligence (AI) techniques holds great potential for revolutionizing data science applications in many domains of Earth sciences. In this paper, we explore the potential of an unsupervised learning method designed to process Sentinel-2 images of Earth’s forest scenes and automate the inventory of forest tree dieback caused by bark beetle outbreaks. Specifically, we describe PHANTASM: a method to identify forest tree dieback patches performing the Change Vector Analysis (CVA) of bi-temporal Sentinel-2 images of forest scenes. While the traditional CVA strategy is based on the analysis of pixel-wise differences in spectral values, we enrich the Sentinel-2 spectrum with both a selection of Spectral Vegetation Indexes and a Spectral-Spatial Deep Embedding. The Spectral Vegetation Indexes are pre-defined combinations of spectral bands commonly designed to enhance the accuracy of semantic segmentation models trained to map bark beetle stress in spectral data. The Deep Embedding is a spectral-spatial representation of Sentinel-2 pixels trained with a deep neural network. In particular, we use a pre-trained, semantic segmentation U-Net to obtain the Deep Embedding that models the spatial relationship among neighbouring spectral pixels. We assess the effectiveness of the proposed method in a case study regarding bark beetle outbreaks in Sentinel-2 images of forest scenes in the Czech Republic.

Abstract Artificial Intelligence (AI) is transforming cybersecurity practices thanks to the amazing accuracy performance achieved with several AI-based malware detection systems. However, several recent studies have shown that AI decision models can be vulnerable to adversarial attacks. In malware detection scenarios, adversarial attacks are realistic manipulations of existing malware, which preserve the executable and malicious behaviour but evade the malware detection measures. In this study, we consider Windows Portable Executable (PE) malware, which is currently trending to prominent malware types, and we show that counterfactual explanations can be used to drive the generation of realistic adversarial Windows PE malware to evade AI-based detection. In particular, the proposed method OLIVANDER works in a black-box manner, which is the most restrictive attack option, as the evasion method interacts with the target decision system to evade by merely knowing the model input and output. The evaluation study explores the effectiveness of the proposed evasion method in terms of evasion ability, efficiency of computation, and attack transferability compared to two state-of-the-art evasion methods. In addition, the performed evaluation accounts for performances on commercial anti-malware systems.

Abstract Forests play a key role in maintaining the balance of ecosystems, regulating climate, conserving biodiversity, and supporting various ecological processes. However, insect outbreaks, particularly bark beetle outbreaks, pose a significant threat to European spruce forest health by causing an increase in forest tree mortality. Therefore, developing accurate forest disturbance inventory strategies is crucial to quantifying and promptly mitigating outbreak diseases and boosting effective environmental management. In this paper, we propose a deep learning-based approach, named , that implements a CNN to detect tree dieback events in Sentinel-2 images of forest areas. To this aim, each pixel of a Sentinel-2 image is transformed into an imagery representation that sees the pixel within its surrounding pixel neighbourhood. We incorporate an attention mechanism into the CNN architecture to gain accuracy and achieve useful insights from the explanations of the spatial arrangement of model decisions. We assess the effectiveness of the proposed approach in two case studies regarding forest scenes in the Northeast of France and the Czech Republic, which were monitored using Sentinel-2 satellite in October 2018 and September 2020, respectively. Both case studies host bark beetle outbreaks in the considered periods.

Forest tree dieback inventory plays a crucial role to improve forest management strategies. In this study, we explore the performance of a spectral-spatial machine learning approach used to analyse Sentinel-2 images to detect forest tree dieback events due to bark beetle infestation. We analyse the performance of classification models trained with Random Forest, XGBoost and Multi-Layer Perceptron, as well as semantic segmentation models trained with U-Net by accounting for both spectral and spatial information contained in the remote sensing data. We consider a set of Sentinel-2 images acquired in non-overlapping forest scenes from a region located in the Northeast of France. The selected scenes host bark beetle infestation hotspots originated from the mass reproduction of the bark beetle in the 2018 infestation. Results show that the U-Net model, trained accounting for spectral and spectral-spatial data, achieves the best performance. However, the simpler Random Forest model achieves competitive results with respect to the more complex one, namely U-Net.

Vision Transformers (ViTs) denote a family of attention-based deep learning techniques that have recently achieved amazing results in various problems related to the field of computer vision. In this paper, we explore the use of ViTs in problems of cyber-threat detection related to malware and network intrusion detection. In particular, we propose VINCENT, that is a novel deep neural method, which resorts to a color imagery representation of cyber-data by encoding related cyber-data features into neighboring color pixels. ViTs are trained from cyber-data images as teacher models, to extract explainable imagery signatures of cyber-data classes. This knowledge is extracted by leveraging the self-attention mechanism to give paired attention values between pairs of imagery patches. The signature knowledge, extracted through the ViT teacher, is, finally, used to train a smaller neural student model according to the knowledge distillation theory. Experiments with various benchmark cybersecurity datasets assess the accuracy of the student model VINCENT also compared to that of several state-of-the-art methods. In addition, it shows that VINCENT can obtain insights from explanations recovered through the self-attention mechanism of the ViT teacher.

Abstract Forest tree dieback inventory has a crucial role in improving forest management strategies. This inventory is traditionally performed by forests through laborious and time-consuming human assessment of individual trees. On the other hand, the large amount of Earth satellite data that are publicly available with the Copernicus program and can be processed through advanced deep learning techniques has recently been established as an alternative to field surveys for forest tree dieback tasks. However, to realize its full potential, deep learning requires a deep understanding of satellite data since the data collection and preparation steps are essential as the model development step. In this study, we explore the performance of a data-centric semantic segmentation approach to detect forest tree dieback events due to bark beetle infestation in satellite images. The proposed approach prepares a multisensor data set collected using both the SAR Sentinel-1 sensor and the optical Sentinel-2 sensor and uses this dataset to train a multisensor semantic segmentation model. The evaluation shows the effectiveness of the proposed approach in a real inventory case study that regards non-overlapping forest scenes from the Northeast of France acquired in October 2018. The selected scenes host bark beetle infestation hotspots of different sizes, which originate from the mass reproduction of the bark beetle in the 2018 infestation.

Abstract Ensemble learning is a strategy commonly used to fuse different base models by creating a model ensemble that is expected more accurate on unseen data than the base models. This study describes a new cyber-threat detection method, called , that uses ensemble learning coupled with adversarial training in deep learning, in order to gain accuracy with neural models trained in cybersecurity problems. The selection of the base models is one of the main challenges to handle, in order to train accurate ensembles. This study describes a model ensemble pruning approach based on eXplainable AI (XAI) to increase the ensemble diversity and gain accuracy in ensemble classification. We base on the idea that being able to identify base models that give relevance to different input feature sub-spaces may help in improving the accuracy of an ensemble trained to recognise different signatures of different cyber-attack patterns. To this purpose, we use a global XAI technique to measure the ensemble model diversity with respect to the effect of the input features on the accuracy of the base neural models combined in the ensemble. Experiments carried out on four benchmark cybersecurity datasets (three network intrusion detection datasets and one malware detection dataset) show the beneficial effects of the proposed combination of adversarial training, ensemble learning and XAI on the accuracy of multi-class classifications of cyber-data achieved by the neural model ensemble.

This study describes a new cyber-threat detection method, named PANACEA, that uses Ensemble Deep Learning coupled with Adversarial Training and XAI, to gain accuracy with neural models trained in cybersecurity problems.

Abstract Various applications in remote sensing demand automatic detection of changes in optical satellite images of the same scene acquired over time. This paper investigates how to leverage autoencoders in change vector analysis, in order to better delineate possible changes in a couple of co-registered, optical satellite images. Let us consider both a primary image and a secondary image acquired over time in the same scene. First an autoencoder artificial neural network is trained on the primary image. Then the reconstruction of both images is restored via the trained autoencoder so that the spectral angle distance can be computed pixelwise on the reconstructed data vectors. Finally, a threshold algorithm is used to automatically separate the foreground changed pixels from the unchanged background. The assessment of the proposed method is performed in three couples of benchmark hyperspectral images using different criteria, such as overall accuracy, missed alarms and false alarms. In addition, the method supplies promising results in the analysis of a couple of multispectral images of the burned area in the Majella National Park (Italy).