Research in neural generative models for dynamic networks is constantly evolving, and sophisticated solutions have been exploited to characterize the long-term evolution of temporal graphs. Despite the efforts in the literature, state-of-the-art models face the problem of handling changes in the graph structure by relying on prior knowledge, compromising the model’s flexibility. In this paper, we propose a graph-size invariant probabilistic generative model, named $$\textrm{FuDGE}$$ , Fully Dynamic Graph Evolution, for predicting the graph evolution through step-wise changes in the graph structure. $$\textrm{FuDGE}$$ can generate evolving graphs by exploring the whole node space, thus ensuring fast and effective generation. We evaluate $$\textrm{FuDGE}$$ on real and synthetic benchmark datasets and compare its performance against state-of-the-art competitors. The results demonstrate that our approach offers a competitive advantage in generation and prediction quality compared to existing literature. The code is publicly available at https://github.com/FuDGE2023/fudge .

Adversarial attacks pose significant challenges to deep neural networks (DNNs) such as Transformer models in natural language processing (NLP). This article introduces a novel defense strategy, called GenFighter , which enhances adversarial robustness by learning and reasoning on the training classification distribution. GenFighter identifies potentially malicious instances deviating from the distribution, transforms them into semantically equivalent instances aligned with the training data, and employs ensemble techniques for a unified and robust response. By conducting extensive experiments, we show that GenFighter outperforms state-of-the-art defenses in accuracy under attack and attack success rate metrics while maintaining the same or superior generalization capabilities. Additionally, it requires a high number of queries per attack, making the attack more challenging in real scenarios. Finally, The ablation study shows that our approach proficiently integrates transfer learning, a generative/evolutive procedure, and an ensemble method, providing an effective defense against NLP adversarial attacks.

Voter registration in the United States involves maintaining state-controlled lists that record all legally eligible voters. Election fraud often centers around the manipulation and misuse of voter registration data, potentially allowing ineligible votes or denying legitimate voters the right to participate. Voter registration data, therefore, is part of the backbone of the United States democratic system to ensure election integrity. In today’s dynamic political landscape, sharing this data promotes transparency and accountability. However, accessing real voter registration records can be challenging due to privacy concerns about personally identifiable information.In this paper, we present the Idaho Voter Registration Election Dataset (IVRED), which contains anonymized records of real voter data from the Idaho Secretary of State and a curated set of synthetically generated fraudulent records. Although real instances of voter registration fraud are rare and difficult to identify, potential vulnerabilities are yet to be thoroughly explored. By consulting with domain experts, we have identified various scenarios in which voter registration data could be manipulated.Additionally, we provide a similarity graph for each significant attribute, illustrating the inter-relationships between attribute values. Combining these similarity graphs with our anonymized dataset enables the construction of a comprehensive graph, consisting of over 2.1 million nodes and 22 million edges. This allows for the application of advanced machine learning techniques, including spectral graph positioning—also known as positional embedding—which improves the classification of fraudulent voter records compared to baseline machine learning experiments (a classification model with no embedding features). This demonstrates the utility of our dataset and highlights its potential to detect election fraud, which will lead to increased confidence in our election process.To the best of our knowledge, this is the first released voter registration dataset that includes all fields. This resource will hopefully stimulate research in election security, enabling researchers to develop new analytical tools using machine learning techniques.

Graph representation learning has numerous applications, ranging from social networks to bioinformatics, with a major focus on Graph Neural Networks (GNNs). However, many GNN models face challenges in capturing intricate graph structures, such as cycles, and are prone to overfitting and high computational costs, limiting their scalability on medium to big graphs.In this paper, we propose 2FWL-SIRGN, a novel approach that integrates higher-order Weisfeiler-Lehman (WL) test algorithm while mitigating its computational challenges. Our method combines the Structural Iterative Representation Learning for Graph Nodes (SIRGN) framework with the 2-dimensional Folklore Weisfeiler-Lehman (2FWL) isomorphism test. The unsupervised training of the SIRGN component improves the model’s resistance to overfitting, while the 2FWL component enhances its expressive power, enabling it to capture complex patterns, such as cycle structures. However, the inclusion of 2FWL increases computational overhead. To address this, we introduce a Structural Graph Partitioning algorithm, which allows 2FWL-SIRGN to scale efficiently to big graphs.Extensive experiments demonstrate that 2FWL-SIRGN outperforms state-of-the-art methods by addressing key challenges in graph representation learning. Our model captures richer structural information while maintaining computational efficiency, surpassing other higher-order WL approaches. Additionally, our partitioning strategy enables 2FWL-SIRGN to effectively handle large-scale graphs, and its inherent resistance to overfitting addresses a common limitation of GNNs. These advancements position 2FWL-SIRGN as a robust solution for real-world applications where both scalability and accuracy are critical.

Phishing is a significant cybersecurity threat, with the financial impact of email security breaches and lack of awareness estimated to be between $50-100 billion in 2022. The advent of Large Language Models (LLMs) has further automated and intensified phishing attacks, posing greater challenges for defenders, especially large organizations being targeted by Advanced Persistent Threats (APT) at scale, such as Department of Energy National Labs. This study presents the development of two innovative algorithms. The first algorithm improves the efficacy of phishing attacks, while the second algorithm counteracts and defends against phishing attacks that leverage LLMs. The attack method takes detectable malicious phishing emails and rewrites them using an innovative LLM-based automatic output optimization technique, which includes Reflection and Beam Search, while preserving the original semantic meaning and Indicators Of Compromise (IOC). This approach bypasses most-commonly used institutional security tools, NLP and other LLM phishing detection systems. The results indicate that this attack algorithm increases the success rate of phishing attacks by up to 98%. The defensive algorithm presented in this research is also employed for defensive measures. When the proposed defensive algorithm is applied, it identifies malicious emails with 97% greater accuracy. The research detailed in this paper demonstrates that these algorithm serve dual purposes: one is utilized as an attack mechanism by altering the output, and the other as a defensive measure against phishing attacks by modifying the defensive prompt. Taking these algorithms and implementing them in the Department of Energy Laboratory (DOE) has demonstrated the effectiveness of applying these approaches to real world applications, and has been implemented into large-scale production environments.

The well-trained image classification neural networks are vulnerable to adversarial examples. An adversarial example is a malicious input carefully crafted by adding small perturbations to the original input, leading to misclassification. Despite advancements in generating adversarial examples, to the best of our knowledge, none of the well-known adversarial attacks can generate effective adversarial examples that work efficiently on large-scale datasets and very deep neural network architectures. In contrast to ordinary adversarial examples, effective adversarial examples have all the following four characteristics: (1) the ability to maximize the loss of DNNs, (2) the ability to cause a high misclassification rate for both undefended and defended DNN models using various defense methods, (3) minimal perturbations with low computational overhead on large-scale datasets, (4) the ability to be transferable across different DNN architectures.To fill this void, we propose Fool-X, an algorithm to generate effective adversarial examples with the least perturbations that can fool state-of-the-art image classification neural networks. To evaluate the performance of Fool-X, we have conducted extensive experiments using 12 baseline adversarial training defense methods and six state-of-the-art adversarial attacks. The results reported on ImageNet-ILSVRC, CIFAR-100, and CIFAR-10 demonstrate that the proposed Fool-X algorithm can generate effective adversarial examples on large-scale datasets that can successfully fool the well-trained, defended image classification neural networks and significantly outperform the state-of-the-art adversarial attacks. The code is available: https://github.com/LAiSR-SK/fool-X-Attack

The widespread use of social media has led to an increase in false and misleading information presented as legitimate news, also known as fake news. This poses a threat to societal stability and has led to the development of fake news de-tectors that use machine learning to flag suspicious information. However, existing fake news detection models are vulnerable to attacks by malicious actors who can manipulate data to change predictions. Research on attacks on news comments is limited, and current attack models are easily detectable. We propose two new attack strategies that instead use real, pre-existing comments from the same dataset as the news article to fool fake news detectors. Our experimental results show that fake news detectors are less robust to our proposed attack strategies than existing methods using pre-existing human-written comments, as well as a malicious synthetic comment generator.

We propose AGS-GNN, a novel attribute-guided sampling algorithm for Graph Neural Networks (GNNs). AGS-GNN exploits the node features and the connectivity structure of a graph while simultaneously adapting for both homophily and heterophily in graphs. In homophilic graphs, vertices of the same class are more likely to be adjacent, but vertices of different classes tend to be adjacent in heterophilic graphs. GNNs have been successfully applied to homophilic graphs, but their utility to heterophilic graphs remains challenging. The state-of-the-art GNNs for heterophilic graphs use the full neighborhood of a node instead of sampling it, and hence do not scale to large graphs and are not inductive. We develop dual-channel sampling techniques based on feature-similarity and feature-diversity to select subsets of neighbors for a node that capture adaptive information from homophilic and heterophilic neighborhoods. Currently, AGS-GNN is the only algorithm that explicitly controls homophily in the sampled subgraph through similar and diverse neighborhood samples. For diverse neighborhood sampling, we employ submodularity, a novel contribution in this context. We pre-compute the sampling distribution in parallel, achieving the desired scalability. Using an extensive dataset consisting of 35 small (< 100K nodes) and large (- 100K nodes) homophilic and heterophilic graphs, we demonstrate the superiority of AGS-GNN compared to the state-of-the-art approaches. AGS-GNN achieves test accuracy comparable to the best-performing heterophilic GNNs, even outperforming methods that use the entire graph for node classification. AGS-GNN converges faster than methods that sample neighborhoods randomly, and can be incorporated into existing GNN models that employ node or graph sampling.

The coronavirus pandemic has fostered an explosion of misinformation about the disease, including the risk and effectiveness of vaccination. AI tools for automatic Scientific Claim Verification (SCV) can be crucial to defeat misinformation campaigns spreading through social media channels. However, over the past years, many concerns have been raised about the robustness of AI to adversarial attacks, and the field of automatic SCV is not exempt. The risk is that such SCV tools may reinforce and legitimize the spread of fake scientific claims rather than refute them. This article investigates the problem of generating adversarial attacks for SCV tools and shows that it is far more difficult than the generic NLP adversarial attack problem. The current NLP adversarial attack generators, when applied to SCV, often generate modified claims with entirely different meaning from the original. Even when the meaning is preserved, the modification of the generated claim is too simplistic (only a single word is changed), leaving many weaknesses of the SCV tools undiscovered. We propose T5-ParEvo, an iterative evolutionary attack generator, that is able to generate more complex and creative attacks while better preserving the semantics of the original claim. Using detailed quantitative and qualitative analyses, we demonstrate the efficacy of T5-ParEvo in comparison with existing attack generators.

The presence of fake news on online social media is overwhelming and is responsible for having impacted several aspects of people’s lives, from health to politics, the economy, and response to natural disasters. Although significant effort has been made to mitigate fake news spread, current research focuses on single aspects of the problem, such as detecting fake news spreaders and classifying stories as either factual or fake. In this article, we propose a new method to exploit inter-relationships between stories, sources, and final users and integrate prior knowledge of these three entities to jointly estimate the credibility degree of each entity involved in the news ecosystem. Specifically, we develop a new graph convolutional network, namely, Role-Relational Graph Convolutional Networks (Role-RGCN), to learn, for each node type (or role), a unique node representation space and jointly connect the different representation spaces with edge relations. To test our proposed approach, we conducted an experimental evaluation on the state-of-the-art FakeNewsNet-Politifact dataset and a new dataset with ground truth on news credibility degrees we collected. Experimental results show a superior performance of our Role-RGCN proposed method at predicting the credibility degree of stories, sources, and users compared to state-of-the-art approaches and other baselines.

Graph Representation Learning (GRL) methods which effectively capture a node’s neighborhood structure in their representations can show excellent performance on important machine learning tasks such as node and graph classification. Recent work has focused on scaling GRL to massive graphs, but existing methods are transductive (must be re-trained for unseen nodes) and are often geared to learn proximity rather than node structure. Graph Neural Network methods can learn structure, but are often supervised, prone to learn proximity, and do not scale well for massive graphs. Transfer learning has the potential to enable scaling to massive graphs, while preventing overfitting, and creating universal models for use on a wide variety of datasets. We propose a novel method that enables transfer learning. Our model performs better at tasks which require capture of nodes’ structural information and scales as well as the current state of the art to very large graphs.

In the world of cyber defense, anticipating potential attacks or any increase in risk of attacks is one of the most advantageous pieces of knowledge one can have. However, little research has been done in examining the larger geopolitical environment and using data sources available at the geopolitical level to predict cyberattacks in advance. To this end, we combine the use of a geopolitical conflict dataset, ICEWS, in combination with a cyberattack dataset from the Council on Foreign Relations to determine if we can predict cyberattacks targeting a given nation. We present a novel approach to identify periods of increased likelihood of cyberattacks at the country, regional, and global levels. The approach involves creating a news-based political event graph, generating vectorial representations of the graph using the SIR-GN structural iterative representation learning approach, and applying novelty detection models to predict future nation-initiated attacks. The proposed approach outperforms existing baselines for majority of cases in terms of F1-score, demonstrating its effectiveness in predicting cyberattacks.

Node representation learning (NRL) generates numerical vectors (embeddings) for the nodes of a graph. Structural NRL specifically assigns similar node embeddings for those nodes that exhibit similar structural roles. This is in contrast with its proximity-based counterpart, wherein similarity between embeddings reflects spatial proximity among nodes. Structural NRL is useful for tasks such as node classification where nodes of the same class share structural roles, though there may exist a distant, or no path between them. Athough structural NRL has been well-studied in static graphs, it has received limited attention in the temporal setting. Here, the embeddings are required to represent the evolution of nodes' structural roles over time. The existing methods are limited in terms of efficiency and effectiveness: they scale poorly to even moderate number of timestamps, or capture structural role only tangentially. In this work, we present a novel unsupervised approach to structural representation learning for temporal graphs that overcomes these limitations. For each node, our approach clusters then aggregates the embedding of a node's neighbors for each timestamp, followed by a further temporal aggregation of all timestamps. This is repeated for (at most) d iterations, so as to acquire information from the d -hop neighborhood of a node. Our approach takes linear time in the number of overall temporal edges, and possesses important theoretical properties that formally demonstrate its effectiveness. Extensive experiments on synthetic and real datasets show superior performance in node classification and regression tasks, and superior scalability of our approach to large graphs.

In an age of the growing use of Machine-learning, it has become an imperative task to be able to explain the processes behind the functions of many "black box" models. The explainability feature of artificial intelligence is key to building trust between humans and computers' algorithmic predictions. One of the main ways to generate this interpretability is through attribution methods, which produce importance values of each feature for a single instance in a dataset. There are many different ways of attribution for various Machine-learning models, including ones designed for specific models or "model agnostic" attribution methods—ones that do not require a specific model to achieve importance values. These attribution methods are valued because of their easily understood nature. While evaluation procedures exist such as generality and precision for rule-based explanation methods, these have not been used on attribution methods until recently. A recent experiment by Ratul et al. [1] proved that the two most popular local model-agnostic attribution methods, LIME and SHAP, have poor precision and generality. In this paper, we propose a new attribution method, the Generality and Precision Shapley Attributions (GAPS). To evaluate these models, we use the generality and precision equations used previously to evaluate the other models. We present our findings that GAPS produces higher generality and precision scores than the existing LIME and SHAP models.

Defending cybersystems needs accurate mapping of software and hardware vulnerabilities to generalized descriptions of weaknesses, and weaknesses to exploits. These mappings enable cyber defenders to build plans for effective defense and assessment of potential risks to a cybersystem. With close to 200k vulnerabilities, manual mapping is not a feasible option. However, automated mapping is challenging due to limited training data, computational intractability, and limitations in computational natural language processing. Tools based on breakthroughs in Transformer-based language models have been demonstrated to classify vulnerabilities with high accuracy. We make three key contributions in this paper: (1) We present a new framework, VWC-BERT, that augments the Transformer-based hierarchical multi-class classification framework of Das et al. (V2W-BERT) with the ability to map weaknesses to exploits. (2) We implement VWC-BERT on modern AI accelerator platforms using two data parallel techniques for the pre-training phase and demonstrate nearly linear speedups across NVIDIA accelerator platforms. We observe nearly linear speedups for up to 16 V100 and 8 A100 GPUs, and about 3.4× speedup for A100 relative to V100 GPUs. Enabled by scaling, we also demonstrate higher accuracy using a larger language model, RoBERTa-Large. We show up to 87% accuracy for strict and up to 98% accuracy for relaxed classification. (3) We develop a novel parallel link manager for the link prediction phase and demonstrate up to 21× speedup with 16 V100 GPUs relative to one V100 GPU, and thus reducing the runtime from 2.5 hours to 10 minutes. We believe that generalizability and scalability of VWC-BERT will benefit both the theoretical development and practical deployment of novel cyberdefense solutions and vulnerability classification.

With the increasing prevalence of the internet, detecting malicious behavior is becoming a greater need. This problem can be formulated as an anomaly detection task on provenance data, where attacks are detectable as anomalies in the behavior of the system. While network data is quite prevalent, we focus on system logs and propose a novel approach with two main components. The first is to make use of the graph-like structure of the logs in which processes enact events and generate additional processes, using a graph neural network (GNN) to produce representations of each event which encode information about their neighboring events in an unsupervised manner. The second is to make use of the complex features such as command arguments which vary widely and cannot be used in the presented format as features in typical machine learning algorithms. If these features are instead encoded using transformer models, they can then be used in other algorithms such as a GNN or anomaly detector. These two approaches combined improve anomaly detection results for the BETH dataset by around 8 percent as compared to the manually engineered features alone.

In this study, we present an in-depth analysis of users’ propensity toward negative and hateful behavior during the COVID-19 pandemic. We analyze a large dataset extracted from Twitter from the months of January 2020 up until June 2020. The dataset includes 2,470,888 tweets from 3,269 users who are active over a period of six months. We model users’ propensity toward hateful content over time by leveraging Random Forest regressor model and Long Short-Term Memory (LSTM) based many-to-one and Sequence2Sequence models for both short and long-term predictions. Our models leverage a set of features for each user, including the user’s psychological traits. We also study the impact of external triggers, such as COVID-related news concurrent with the users’ activities. To encode popular news, we propose using encoder states of a Sequence2Sequence model as features for a Tree-based regressor. The regressor, when combined with the vectorized news, results in an accurate prediction of tweeter’s hateful behavior in the short (decoder size of four weeks) and long term (decoder size of 10 weeks) with a total training data of 15 weeks x 3269 users. We also show that our model accurately profiles selected groups of users, as they are defined by specific psychological traits.

Botnets are an ever-growing threat to private users, small companies, and even large corporations. They are known for spamming, mass downloads, and launching distributed denial-of-service (DDoS) attacks that have a destructive impact on large corporations. With the rise of internet-of-things (IoT) devices, they are also used to mine cryptocurrency, intercept data in transit and send logs containing sensitive information to the master botnet. Many approaches have been developed to detect botnet activities. A few approaches employ graph neural networks (GNN) to analyze the behavior of hosts using a directed graph to represent their communications. However, while designed to capture structural graph properties, GNN may overfit, and therefore fail to capture these properties when the network is unknown. In this work we hypothesize that structural graph patterns can be used to effectively detect Botnets. We then propose a structural iterative representation learning approach for graph nodes, which is designed to perform well on unseen data, called Inferential SIR-GN. Our model creates a vector representation for each node that epitomizes its structural information. We demonstrate that this set of node representation vectors can be used with a neural network classifier to identify bot nodes within an unknown network with better performance than the current state-of-the-art GNN based method.

Starting in 2013, the International Consortium of Investigative Journalists released a series of networks, known as the Offshore Leaks Networks, detailing the information of entities and transactions of offshore accounts. Through cross-referencing with known blacklists of entities, illicit individuals and transactions were able to be identified in the networks provided. In machine learning research, the Offshore Leaks Networks draws off of large databases of data to classify many nodes in high dimensional space. The chief problem with node classification is that the illicit entities are not always known, and techniques have been devised to tackle this problem, such as centrality and structural-based learning. In this paper, SparseStruct—the algorithm developed by Serra et al. [1]— is shown to achieve the best results. This is because it uses a structural node representational learning technique able to identify specific structural patterns in the graph. This technique achieved AUROC scores of between 0.61 and 0.81, with three of the four scores being the top score of all classifiers compared.

To mitigate a malware threat it is important to understand the malware’s behavior. The MITRE ATT&ACK ontology specifies an enumeration of tactics, techniques, and procedures (TTP) that characterize malware. However, absent are automated procedures that would characterize, given the malware executable, which part of the execution flow is connected with a specific TTP. This paper is the first in providing an automation methodology to locate TTP in a sub-part of the control flow graph that describes the execution flow of a mal-ware executable. This methodology merges graph representation learning and tools for machine learning explanation.

Developing techniques to identify malware is critical. The polymorphic nature of malware makes it difficult to detect, especially if the detection is done with Hash-based based techniques. Image-based binary representations have been shown to be more robust to popular polymorphic obfuscation techniques. In contrast to image-based techniques, in this paper, we employed a graph-based technique that extracts control flow graphs from Android APK binary. To process the resulting graph, we use a procedure combining a new graph representation learning method, called Inferential SIR-GN for Graph representation, that preserves graph structural similarities, with XGboost, which is a standard machine learning model. Then, we apply this procedure to MALNET, which is a publicly available cybersecurity database that provides image and graph-based Android APK binary representations for a total 1,262,024 million Android APK binary with 47 types and 696 families. Experimental results show that this graph-based procedure is even more accurate than the image-based approach. Moreover, this paper provides a procedure that, by leveraging Inferential SIR-GN is able to create malware polymorphic evolution representations to use during the train of the XGboost that strengthens the malware classification tasks when the train and test datasets are split temporally according to the binary creation date. This means that our procedure can predict malware polymorphic evolution.

Interpretability is a key feature to broaden a conscious adoption of machine learning models in domains involving safety, security, and fairness. To achieve the interpretability of complex machine learning models, one approach consists in explaining the outcome of machine learning models through input features attribution. Attribution consists in scoring the features of an input instance by establishing how important is each feature value in a fixed instance to obtain a specific classification outcome from the machine learning model. In literature, several attribution methods are defined for specific machine learning models (e.g., neural networks) or more general ones that are model agnostic (i.e., can interpret any machine learning models). Attribution is particularly appreciated for its easy understanding of the interpretation, which is the attribution. In domains involving safety, security, and fairness, properties of the explanation such as precision and generality are crucial to establish human trust in machine learning interpretability and then on the machine learning model itself. However, even if precision and generality are clearly defined in rule-based interpretation models, they are not defined or measure on attribution models. In this work, we propose a general methodology to estimate the degree of precision and generality in attribution methods. In addition, we propose a way to measured consistency in attribution between two attribution methods. Our experiments focus on the two most popular model agnostic attribution methods, SHAP and LIME, and we evaluate them to two real applications in the field of attack detection. Our proposed methodology shows in these experiments that both SHAP and LIME lack precision, generality, and consistency and that still more investigation in the attribution research field is required.

As online image sharing has become commonplace, researchers have acknowledged the need to assist users in detecting sensitive (or private) images. However, image privacy classification tasks have shown to be nontrivial, as the designation of an image sensitivity requires considerations of the visual concepts in the image. In this paper, we propose an innovative framework that combines the power of knowledge transfer for efficient, personalized learning of individuals’ privacy preferences toward images.Our approach defines a meta-model, which, given the query image and a small set of labeled images (used for the user-privacy customization), identifies if the query image is private for a target user. A generic user can efficiently customize this model by providing a small labeled training set. Moreover, our proposed framework includes transfer learning techniques to import basic patterns for image processing learned from other domains. Transfer learning enables fast and accurate processing of images, and allows few shot learning to focus on customization. This helps speed up the training process and avoid risk of overfitting. Our proposed framework significantly outperforms several baselines, including advanced object-oriented approaches and other CNN-based methods.

We consider the problem of automating the mapping of observed vulnerabilities in software listed in Common Vulnerabilities and Exposures (CVE) reports to weaknesses listed in Common Weakness Enumerations (CWE) reports, a hierarchically designed dictionary of software weaknesses. Mapping of CVEs to CWEs provides a means to understand how they might be exploited for malicious purposes, and to mitigate their impact. Since manual mapping of CVEs to CWEs is not a viable approach due to their ever-increasing sizes, automated approaches need to be devised but obtaining highly accurate mapping is a challenging problem. We present a novel Transformer-based learning framework (V2W-BERT) in this paper to solve this problem by bringing together ideas from natural language processing, link prediction and transfer learning. Our method outperforms previous approaches not only for CWE instances with abundant data to train, but also for rare CWE classes with little or no data. Using vulnerability and weakness reports from MITRE and the National Vulnerability Database, we achieve up to 97% prediction accuracy for randomly partitioned data and up to 94% prediction accuracy in temporally partitioned data. We demonstrate significant improvements in using historical data to predict weaknesses for future instances of CVEs. We believe that our work will would influence the design of better automated mapping approaches, and also that this technology could be deployed for more effective cybersecurity.

Graph representation learning methods have attracted an increasing amount of attention in recent years. These methods focus on learning a numerical representation of the nodes in a graph. Learning these representations is a powerful instrument for tasks such as graph mining, visualization, and hashing. They are of particular interest because they facilitate the direct use of standard machine learning models on graphs. Graph representation learning methods can be divided into two main categories: methods preserving the connectivity information of the nodes and methods preserving nodes’ structural information. Connectivity-based methods focus on encoding relationships between nodes, with connected nodes being closer together in the resulting latent space. While methods preserving structure generate a latent space where nodes serving a similar structural function in the network are encoded close to each other, independently of them being connected or even close to each other in the graph. While there are a lot of works that focus on preserving node connectivity, only a few works focus on preserving nodes’ structure. Properly encoding nodes’ structural information is fundamental for many real-world applications as it has been demonstrated that this information can be leveraged to successfully solve many tasks where connectivity-based methods usually fail. A typical example is the task of node classification, i.e., the assignment or prediction of a particular label for a node. Current limitations of structural representation methods are their scalability, representation meaning, and no formal proof that guaranteed the preservation of structural properties. We propose a new graph representation learning method, called Structural Iterative Representation learning approach for Graph Nodes ( SIR-GN ). In this work, we propose two variations ( SIR-GN: GMM and SIR-GN: K-Means ) and show how our best variation SIR-GN: K-Means : (1) theoretically guarantees the preservation of graph structural similarities, (2) provides a clear meaning about its representation and a way to interpret it with a specifically designed attribution procedure, and (3) is scalable and fast to compute. In addition, from our experiment, we show that SIR-GN: K-Means is often better or, in the worst-case comparable than the existing structural graph representation learning methods present in the literature. Also, we empirically show its superior scalability and computational performance when compared to other existing approaches.

The Panama Papers network maintained by the International Consortium of Investigative Journalists (ICIJ) represents a large set of relationships between people, companies, and organizations involved in the creation of offshore companies in tax-haven territories, mainly for hiding their assets. The Panama Papers network includes people or companies that had affairs with the Panamanian offshore law firm Mossack Fonseca, often with the purpose of laundering money. In our previous work, we proposed a ranking algorithm, namely the Suspiciousness Rank Back and Forth (SRBF) algorithm, that, given the Panama Papers network, leverages a blacklist of known bad entities to assign a degree of suspiciousness to each entity in the network. This algorithm proved to be efficient in detecting known bad entities in the Panama Papers, but we were not able to verify the accuracy of the produced entity ranking for non-blacklisted entities. In this paper, we propose to use the open-source intelligence (OSINT) methodology as a modern derivative of classical ethnographic and archaeological research methods that help us in validating with external open source data the ranking result of the Suspiciousness Rank Back and Forth algorithm. More specifically, we conduct a parallel, but independent, investigation using OSINT to assess the claims of SRBF algorithm. We identify positive outcomes from this study, describe current gaps in our process, and propose solutions to the gaps in order to better integrate the OSINT methodology with the SRBF ranking approach.

In this work, we propose a method based on Deep-Learning and Convolutional Neural Network (CNN) ensemble fine-tuning for the task of remote sensing imagery registration and processing. Our method is based on the CNN transfer learning technique that allows the use of large-scale models that are already pre-trained on big general datasets and fine-tunes them for a particular application area. This approach can significantly decrease the needed size of the training set, for cases where such big training datasets are not available, and improve the quality of classification using a larger CNN or an ensemble of CNNs. This paper addresses the challenges encountered at each stage of the proposed pipeline. For image registration, objects of predefined type are detected, such as roads with hardcover and buildings using a CNN ensemble. Also, a CNN ensemble is used to detect undesirable structures in the image, such as clouds or rocks on the agricultural fields. Our image segmentation method can be used for image matching and fusion. To test our approach, we use an annotated dataset from the Kaggle contest "Dstl Satellite Imagery Feature Detection," UC Merced Land Use Dataset, and a custom annotated dataset of remote sensing imagery of agricultural areas.

In the BigData era, large graph datasets are becoming increasingly popular due to their capability to integrate and interconnect large sources of data in many fields, e.g., social media, biology, communication networks, etc. Graph representation learning is a flexible tool that automatically extracts features from a graph node. These features can be directly used for machine learning tasks. Graph representation learning approaches producing features preserving the structural information of the graphs are still an open problem, especially in the context of largescale graphs. In this paper, we propose a new fast and scalable structural representation learning approach called SparseStruct. Our approach uses a sparse internal representation for each node, and we formally proved its ability to preserve structural information. Thanks to a light-weight algorithm where each iteration costs only linear time in the number of the edges, SparseStruct is able to easily process large graphs. In addition, it provides improvements in comparison with state of the art in terms of prediction and classification accuracy by also providing strong robustness to noise data.

Nowadays, there has been an increment in the use of machine learning methods for cyber-security applications. These methods can be prone to generalization, especially in a binary attack classification setting, where the objective is to differentiate between benign vs. malicious behavior. This generalization creates risky security blind-spot weaknesses that make the system vulnerable. Current attackers are well aware of these blind-spots and as a counter-strategy, they exploit such vulnerabilities to bypass security measures and achieve their nefarious objectives. In this work, we propose a methodology to mitigate the problem, RIsky Blind-Spot (RIBS), by making the classification more robust. Our proposed approach creates a generator model that can learn the real characteristics of the data, and consequently, sample real examples targeting the blind-spots of a classifier. We validate our methodology in the context of power grids, where we show how this framework can improve the detection of unknown malicious behavior. Our approach provides an increment of 10% in terms of accuracy and detected attacks when compared to the baseline method.

The Panama Papers represent a large set of relationships between people, companies, and organizations that had affairs with the Panamanian offshore law firm Mossack Fonseca, often due to money laundering. In this paper, we address for the first time the problem of searching the Panama Papers for people and companies that may be involved in illegal acts. We use a collection of international blacklists of sanctioned people and organizations as ground truth for bad entities. We propose a new ranking algorithm, named Suspiciousness Rank Back and Forth (SRBF), that leverages this ground truth to assign a degree of suspiciousness to each entity in the Panama Papers. We experimentally show that our algorithm achieves an AUROC of 0.85 and an Area Under the Recall Curve of 0.87 and outperforms existing techniques.

Unknown landscape identification is the problem of identifying an unknown landscape from a set of already provided landscape images that are considered to be known. The aim of this work is to extract the intrinsic semantic of landscape images in order to automatically generalize concepts like a stadium, roads, a parking lot etc., and use this concept to identify unknown landscapes. This problem can be easily extended to many security applications. We propose two effective semi-supervised novelty detection approaches for the unknown landscape identification problem using Convolutional Neural Network (CNN) Transfer Learning. This is based on the use of pre-trained CNNs (i.e. already trained on large datasets) already containing general image knowledge that we transfer to our domain. Our best values of AUROC and Average Precision scores for the identification problem are 0.96 and 0.94, respectively. In addition, we statistically prove that our semi-supervised methods outperform the baseline.

Count constraint is a data dependency that requires the results of given count operations on a relation to be within a certain range. By means of count constraints a new decisional problem, called the Inverse OLAP, has been recently introduced: given a flat fact table, does there exist an instance satisfying a set of given count constraints? This paper focuses on a special case of Inverse OLAP, called Inverse Tree-OLAP, for which the flat fact table key is modeled by a Dimensional Fact Model (DFM) with a tree structure. The count constraints define aggregation patterns to be respected by both the many-to-many relationship among the basic dimensions and the one-to-many relationships within dimension hierarchies. A count constraint is required to have a particular structure so that the problem of handling fact table projections with duplicates is avoided. The simplified structure enables the invention of an effective method for its solution that consists of three main steps: (1) using some of the count constraints to extract a subproblem that is formulated as a known data mining problem (inverse frequent itemset mining), (2) solving the subproblem using a recent method that has been shown to be effective in practical situations also for large size instances and (3) enforcing the remaining count constraints on the solution returned by step 2 using a system of linear equations. The overall proposed approach can be effectively used to generate OLAP cubes for benchmarking that reflect patterns of real datasets.

Nowadays, detecting health-violating restaurants is a serious problem due to the limited number of health inspectors in a city as compared to the number of restaurants. Rarely inspectors are helped by formal complains, but many complaints are reported as reviews on social media such as Yelp. In this paper we propose new predictors to detect health-violating restaurants based on restaurant sub-area location, previous inspections history, Yelp reviews content, and Yelp users behavior. The resulting method outperforms past work, with a percentage of improvement in Cohen's kappa and Matthews correlation coefficient of at least 16%. In addition, we define a new method that directly evaluates the benefit of a classifier on the ability of an inspector in detecting health-violating restaurants. We show that our classification method really improves the ability of the inspector and outperforms previous solutions.

Given a history of detected malware attacks, can we predict the number of malware infections in a country? Can we do this for different malware and countries? This is an important question which has numerous implications for cyber security, right from designing better anti-virus software, to designing and implementing targeted patches to more accurately measuring the economic impact of breaches. This problem is compounded by the fact that, as externals, we can only detect a fraction of actual malware infections. In this paper we address this problem using data from Symantec covering more than 1.4 million hosts and 50 malware spread across 2 years and multiple countries. We first carefully design domain-based features from both malware and machine-hosts perspectives. Secondly, inspired by epidemiological and information diffusion models, we design a novel temporal non-linear model for malware spread and detection. Finally we present ESM, an ensemble-based approach which combines both these methods to construct a more accurate algorithm. Using extensive experiments spanning multiple malware and countries, we show that ESM can effectively predict malware infection ratios over time (both the actual number and trend) upto 4 times better compared to several baselines on various metrics. Furthermore, ESM's performance is stable and robust even when the number of detected infections is low.

In recent years, probabilistic data management has received a lot of attention due to several applications that deal with uncertain data: RFID systems, sensor networks, data cleaning, scientific and biomedical data management, and approximate schema mappings. Query evaluation is a challenging problem in probabilistic databases, proved to be #P-hard. A general method for query evaluation is based on the lineage of the query and reduces the query evaluation problem to computing the probability of a propositional formula. The main approaches proposed in the literature to approximate probabilistic queries confidence computation are based on Monte Carlo simulation, or formula compilation into decision diagrams (e.g., d-trees). The former executes a polynomial, but with too many, iterations, while the latter is polynomial for easy queries, but may be exponential in the worst case. We designed a new optimized Monte Carlo algorithm that drastically reduces the number of iterations and proposed an efficient parallel version that we implemented on GPU. Thanks to the elevated degree of parallelism provided by the GPU, combined with the linear speedup of our algorithm, we managed to reduce significantly the long running time required by a sequential Monte Carlo algorithm. Experimental results show that our algorithm is so efficient as to be comparable with the formula compilation approach, but with the significant advantage of avoiding exponential behavior.

Inverse frequent set mining (IFM) is the problem of computing a transaction database D satisfying given support constraints for some itemsets, which are typically the frequent ones. This article proposes a new formulation of IFM, called IFM I (IFM with infrequency constraints ), where the itemsets that are not listed as frequent are constrained to be infrequent; that is, they must have a support less than or equal to a specified unique threshold. An instance of IFM I can be seen as an instance of the original IFM by making explicit the infrequency constraints for the minimal infrequent itemsets, corresponding to the so-called negative generator border defined in the literature. The complexity increase from PSPACE (complexity of IFM) to NEXP (complexity of IFM I ) is caused by the cardinality of the negative generator border, which can be exponential in the original input size. Therefore, the article introduces a specific problem parameter κ that computes an upper bound to this cardinality using a hypergraph interpretation for which minimal infrequent itemsets correspond to minimal transversals. By fixing a constant k , the article formulates a k -bounded definition of the problem, called k -IFM I , that collects all instances for which the value of the parameter κ is less than or equal to k —its complexity is in PSPACE as for IFM. The bounded problem is encoded as an integer linear program with a large number of variables (actually exponential w.r.t. the number of constraints), which is thereafter approximated by relaxing integer constraints—the decision problem of solving the linear program is proven to be in NP. In order to solve the linear program, a column generation technique is used that is a variation of the simplex method designed to solve large-scale linear programs, in particular with a huge number of variables. The method at each step requires the solution of an auxiliary integer linear program, which is proven to be NP hard in this case and for which a greedy heuristic is presented. The resulting overall column generation solution algorithm enjoys very good scaling as evidenced by the intensive experimentation, thereby paving the way for its application in real-life scenarios.

The inverse frequent set mining problem is the problem of computing a database on which a given collection of itemsets must emerge to be frequent. Earlier studies focused on investigating computational and approximability properties of this problem. In this paper, we face it under the pragmatic perspective of defining heuristic solution approaches that are effective and scalable in real scenarios. In particular, a general formulation of the problem is considered where minimum and maximum support constraints can be defined on each itemset, and where no bound is given beforehand on the size of the resulting output database. Within this setting, an algorithm is proposed that always satisfies the maximum support constraints, but which treats minimum support constraints as soft ones that are enforced as long as possible. A thorough experimentation evidences that minimum support constraints are hardly violated in practice, and that such negligible degradation in accuracy (which is unavoidable due to the theoretical intractability of the problem) is compensated by very good scaling performances.