Generating virtual organ populations that capture sufficient variability while remaining plausible is essential to conduct in silico trials (ISTs) of medical devices. However, not all anatomical shapes of interest are always available for each individual in a population. The imaging examinations and modalities used can vary between subjects depending on their individualized clinical pathways. Different imaging modalities may have various fields of view and are sensitive to signals from other tissues/organs, or both. Hence, missing/partially overlapping anatomical information is often available across individuals. We introduce a generative shape model for multipart anatomical structures, learnable from sets of unpaired datasets, i.e., where each substructure in the shape assembly comes from datasets with missing or partially overlapping substructures from disjoint subjects of the same population. The proposed generative model can synthesize complete multipart shape assemblies coined virtual chimeras (VCs). We applied this framework to build VCs from databases of whole-heart shape assemblies that each contribute samples for heart substructures. Specifically, we propose a graph neural network-based generative shape compositional framework, which comprises two components, a part-aware generative shape model that captures the variability in shape observed for each structure of interest in the training population and a spatial composition network that assembles/composes the structures synthesized by the former into multipart shape assemblies (i.e., VCs). We also propose a novel self-supervised learning scheme that enables the spatial composition network to be trained with partially overlapping data and weak labels. We trained and validated our approach using shapes of cardiac structures derived from cardiac magnetic resonance (MR) images in the UK Biobank (UKBB). When trained with complete and partially overlapping data, our approach significantly outperforms a principal component analysis (PCA)-based shape model (trained with complete data) in terms of generalizability and specificity. This demonstrates the superiority of the proposed method, as the synthesized cardiac virtual populations are more plausible and capture a greater degree of shape variability than those generated by the PCA-based shape model.

The surge in global digitalization triggered by COVID-19 has led to a significant increase in internet traffic and has precipitated a rapid transformation of the network security landscape. Despite being increasingly difficult, accurate traffic inspection is vital for ensuring productivity while reliably protecting internal assets. Endpoint application identification enables high accuracy inspection and detection by providing network security solutions with specific context on individual connections. However, achieving it in real-time with standard fingerprinting methods based only on client-side traffic has proven to be a challenging problem with no comprehensive solution thus far. In this article, we present a new methodology for identifying endpoint applications from network traffic, utilising machine learning. Our methodology leverages similarities in the pre-hash string of the JA3 algorithm for fingerprinting application specific TLS Client Hello messages. By utilising well-known clustering algorithms it is possible to identify the underlying TLS libraries and the application from the traffic remarkably better than with simple string-based matching. Our model can categorize 99,5% of the traffic in a controlled network, and 93,8% in an uncontrolled network, compared to 0,1% and 0,2% using simple string matching. Our methodology is especially effective for enhancing Zero Trust models, calculating a risk score for network events, and improving threat detection accuracy in network security solutions.

Given the global increase in remote work with the COVID-19 pandemic and deperimeterization due to cloud deployment of next generation firewalls, the concept of a next generation firewall is at a breaking point. It is becoming more difficult to define the barrier between the good and the bad. To provide the best security for an endpoint with minimal false positives or false negatives it is often necessary to identify the communicating endpoint application. In this study, we present an analysis of key research and methods for providing endpoint aware protection in the context of a next generation firewall. We examine both academic research as well as state-of-the-art of the existing next generation firewall implementations. We divide endpoint application identification into passive and active methods. For passive endpoint application identification, we study several traffic fingerprinting methods for different protocols. For active methods we consider active scanning, endpoint metadata analysis and content injection and reference existing implementations. We conclude that there are several open areas for future research, and that none of the considered methods is a silver bullet solution for endpoint aware inspection in the context of a next generation firewall. To our best knowledge, this is the first study to examine current research and existing implementations of endpoint aware inspection.

In this paper, we present a systematic methodology for continuous surveying and analysis of 802.11 Wireless Local Area Network (WLAN) abundance and security, based on the passive wireless network scanning technique called wardriving. The objective is to provide an efficient, scalable, and easily accessible methodology for collecting, analysing and storing WLAN survey data. To adhere to these set requirements, the presented survey and analysis processes can be carried out with freely available open-source software and common off-the-shelf hardware. While extensive literature has been produced on wardriving and numerous WLAN survey studies have been documented in previous works, to our knowledge, no similar comprehensive methodology for systematic WLAN surveying and analysis has been previously presented. To further rationalise the need for surveying and analysing WLAN networks, an investigation on the related literature and the current state of the WLAN networking landscape has been conducted. Furthermore, as surveying WLAN networks via the wardriving technique undoubtedly raises legal and moral concerns, the legitimacy and ethics of wardriving have been examined. To test the effectiveness of the proposed methodology, a primary test and calibration WLAN survey was conducted in three separate locations within a middle-sized city located in Southwest Finland. Based on the survey results, WLAN security in Finland is in a relatively good state. During the test survey, we successfully collected and analysed data from 720 WLAN networks, proving the effectiveness of the proposed methodology. From the 720 detected WLAN networks, 6% used insecure encryption protocols, 12.8% were unencrypted and a clear majority of 81.3% used the WPA2 encryption protocol. Results also show that wireless network device owners in the surveyed areas are not inclined to alter the factory-set default settings of their wireless networks. It was noted that roughly 40% of the surveyed networks used easily identifiable factory-set SSIDs and only 5.4% of the networks had a cloaked SSID. Furthermore, the survey data shows that WLAN devices from 38 different manufacturers were detected. Three of the most popular manufacturers in the surveyed area were Cisco with 28.3%, Huawei with 15.7% and Ruckus Networks with 9.7%.

We introduce a novel state space model for a set of sequentially time-stamped partial rankings of items and textual descriptions for the items. Based on the data, the model infers text-based themes that are predictive of the rankings enabling forecasting tasks and performing trend analysis. We propose a scaled Gamma process based prior for capturing the underlying dynamics. Based on two challenging and contemporary real data collections, we show the model infers meaningful and useful textual themes as well as performs better than existing related dynamic models.

Designing a cybersecurity course for a big cohort of students from the different educational background is a challenging job. Examined in this study are the perceptions, preferences and performance of students who have participated in a strategic blended learning initiative aimed at preparing students for their working lives. For this purpose, both self-reported and observational data were collected from 115 students who voluntarily registered for the pilot run of the course. Self-reported data was used to measure students’ preferences as well as perceptions related to satisfaction, engagement, convenience, interaction and views on learning. Observational data measuring students’ performance was directly extracted from the collaborative learning platform on which the course was hosted. The results show that overall students liked the blended design of the course. They were satisfied with the format of the course, they felt engaged, and most of them secured good grades. Moreover, no significant difference in perceptions and preferences were found when controlled for gender, educational discipline, and overall performance, showing that the blended design of the course was accepted across the board.

Topic models are becoming increasingly relevant probabilistic models for dimensionality reduction of text data, inferring topics that capture meaningful themes of frequently co-occurring terms. We formulate topic modelling as an information retrieval task, where the goal is, based on the latent topic representation, to capture relevant term co-occurrence patterns. We evaluate performance for this task rigorously with regard to two types of errors, false negatives and positives, based on the well-known precision-recall trade-off and provide a statistical model that allows the user to balance between the contributions of the different error types. When the user focuses solely on the contribution of false negatives ignoring false positives altogether our proposed model reduces to a standard topic model. Extensive experiments demonstrate the proposed approach is effective and infers more coherent topics than existing related approaches.

We present a hybrid internal anomaly detection system that shares detection tasks between router and nodes. It allows nodes to react instinctively against the anomaly node by enforcing temporary communication ban on it. Each node monitors its own neighbors and if abnormal behavior is detected, the node blocks the packets of the anomaly node at link layer and reports the incident to its parent node. A novel RPL control message, Distress Propagation Object (DPO), is formulated and used for reporting the anomaly and network activities to the parent node and subsequently to the router. The system has configurable profile settings and is able to learn and differentiate between the nodes normal and suspicious activities without a need for prior knowledge. It has different subsystems and operation phases that are distributed in both the nodes and router, which act on data link and network layers. The system uses network fingerprinting to be aware of changes in network topology and approximate threat locations without any assistance from a positioning subsystem. The developed system was evaluated using test-bed consisting of Zolertia nodes and in-house developed PandaBoard based gateway as well as emulation environment of Cooja. The evaluation revealed that the system has low energy consumption overhead and fast response. The system occupies 3.3 KB of ROM and 0.86 KB of RAM for its operations. Security analysis confirms nodes reaction against abnormal nodes and successful detection of packet flooding, selective forwarding, and clone attacks. The system’s false positive rate evaluation demonstrates that the proposed system exhibited 5% to 10% lower false positive rate compared to simple detection system.

In this paper, two different electrocardiogram (ECG) based cryptographic key generation approaches are proposed. The aim is to enhance the security of body area networks through robust key generation where keys are generated on the fly without requiring key pre-distribution solutions. The Interpulse Interval (IPI) feature of ECG underlays both of the proposed approaches. The first approach is realized by using a pseudo-random number and consecutive IPI sequences. The second approach is realized by utilizing the Advanced Encryption Standard (AES) algorithm and IPI as the seed generator for the AES algorithm. The efficiency of the proposed approaches is evaluated using real ECG data of 15 patients obtained from the MIT-BIH Arrhythmia dataset of PhysioBank. The security analyses of the generated keys are carried out in terms of distinctiveness, randomness, and temporal variance as well as using the NIST benchmark. The analyses show that our key generation approaches provide a higher security level in comparison to existing approaches relying only on singleton IPI sequences. The execution times required to generate the cryptographic keys on different processors are also examined. The results reveal that the security level improvement comes with a reasonable increase in key generation execution time. Comparing to existing IPI-based approaches, our approaches require 12.3% and 41.2% more execution time, respectively.

We present overview of a distributed internal anomaly detection system for Internet-of-things. In the detection system, each node monitors its neighbors and if abnormal behavior is detected, the monitoring node will block the packets from the abnormally behaving node at the data link layer and reports to its parent node. The reporting propagates from child to parent nodes until it reaches the root. A novel control message, distress propagation object (DPO), is devised to report the anomaly to the subsequent parents and ultimately the edge-router. The DPO message is integrated to routing protocol for low-power and lossy networks (RPL). The system has configurable profile settings and it is able to learn and differentiate the nodes' normal and suspicious activities without a need for prior knowledge. It has different subsystems and operation phases at data link and network layers, which share a common repository in a node. The system uses network fingerprinting to be aware of changes in network topology and nodes' positions without any assistance from a positioning system.

A main goal of data visualization is to find, from among all the available alternatives, mappings to the 2D/3D display which are relevant to the user. Assuming user interaction data, or other auxiliary data about the items or their relationships, the goal is to identify which aspects in the primary data support the user's input and, equally importantly, which aspects of the user's potentially noisy input have support in the primary data. For solving the problem, we introduce a multi-view embedding in which a latent factorization identifies which aspects in the two data views (primary data and user data) are related and which are specific to only one of them. The factorization is a generative model in which the display is parameterized as a part of the factorization and the other factors explain away the aspects not expressible in a two-dimensional display. Functioning of the model is demonstrated on several data sets.

We present a novel class of mixed membership models for joint distributions of groups of observations that co-occur with ordinal response variables for each group for learning statistical associations between the ordinal response variables and the observation groups. The class of proposed models addresses a requirement for predictive and diagnostic methods in a wide range of practical contemporary applications. In this work, by way of illustration, we apply the models to a collection of consumer-generated reviews of mobile software applications, where each review contains unstructured text data accompanied with an ordinal rating, and demonstrate that the models infer useful and meaningful recurring patterns of consumer feedback. We also compare the developed models to relevant existing works, which rely on improper statistical assumptions for ordinal variables, showing significant improvements both in predictive ability and knowledge extraction.

The purpose of this study is to examine genderwise differences in information security awareness (ISA) among university students. 614 usable responses were collected using survey from the students of eight different disciplines in a university. ISA is considered as combination of knowledge and behavior, and called computed ISA. Knowledge and behavior is assessed using vocabulary test and scenario based questions, whereas perceived ISA (PISA) is measured on 5-point Liker type question. The application of t-test and Cohen's d values show that both the genders differ significantly from each other in their Knowledge, Behavior, computed ISA and PISA. In comparison to female students, male students are found better in terms of aforementioned variables. The study also shows that unlike male students, female students prefer to utilize their social circle to accumulate information security knowledge. Moreover, the male students prefer to learn security related issues by self-exploration, whereas, the female students prefer formal educational methods for similar learning.

Factor analysis (FA) provides linear factors that describe the relationships between individual variables of a data set. We extend this classical formulation into linear factors that describe the relationships between groups of variables, where each group represents either a set of related variables or a data set. The model also naturally extends canonical correlation analysis to more than two sets, in a way that is more flexible than previous extensions. Our solution is formulated as a variational inference of a latent variable model with structural sparsity, and it consists of two hierarchical levels: 1) the higher level models the relationships between the groups and 2) the lower models the observed variables given the higher level. We show that the resulting solution solves the group factor analysis (GFA) problem accurately, outperforming alternative FA-based solutions as well as more straightforward implementations of GFA. The method is demonstrated on two life science data sets, one on brain activation and the other on systems biology, illustrating its applicability to the analysis of different types of high-dimensional data sources.

We present a work in progress of an adaptive security management scheme for wireless sensor networks. The unique characteristics of these networks place great demands on their design and operation in terms of resource and security management. Resource and security adaptability achieved through self- and context-awareness will take the feasibility of the networks to a new level. The scheme has self- and context-awareness in addition to a holistic view of security services at each layer of the communication stack. It uses distributed agents and intrusion detection systems to monitor the security threats and then dynamically adapts its security level by jointly considering several dimensions. This translates into optimal security-energy under a given resource and context. The key dimensions are energy budget, computing power and memory size of nodes, location-based security threat levels, data coherence, and data lifetime. Trust management is used to test the integrity of untrusted nodes which further assist the adaptation decision.

MOTIVATION: Analysis of relationships of drug structure to biological response is key to understanding off-target and unexpected drug effects, and for developing hypotheses on how to tailor drug therapies. New methods are required for integrated analyses of a large number of chemical features of drugs against the corresponding genome-wide responses of multiple cell models. RESULTS: In this article, we present the first comprehensive multi-set analysis on how the chemical structure of drugs impacts on genome-wide gene expression across several cancer cell lines [Connectivity Map (CMap) database]. The task is formulated as searching for drug response components across multiple cancers to reveal shared effects of drugs and the chemical features that may be responsible. The components can be computed with an extension of a recent approach called Group Factor Analysis. We identify 11 components that link the structural descriptors of drugs with specific gene expression responses observed in the three cell lines and identify structural groups that may be responsible for the responses. Our method quantitatively outperforms the limited earlier methods on CMap and identifies both the previously reported associations and several interesting novel findings, by taking into account multiple cell lines and advanced 3D structural descriptors. The novel observations include: previously unknown similarities in the effects induced by 15-delta prostaglandin J2 and HSP90 inhibitors, which are linked to the 3D descriptors of the drugs; and the induction by simvastatin of leukemia-specific response, resembling the effects of corticosteroids. AVAILABILITY AND IMPLEMENTATION: Source Code implementing the method is available at: http://research.ics.aalto.fi/mi/software/GFAsparse. SUPPLEMENTARY INFORMATION: Supplementary data are available at Bioinformatics online.

We present a case study in finding optimized processor architectures for a given protocol processing application. The process involves application analysis, hardware/software partitioning and optimization, and evaluation of design quality through simulations, estimations and synthesis. The case study was targeted at processing key IPv6 routing functions at 200 MHz using 0.18 /spl mu/m CMOS technology. A comparison to an implementation on a commercial processor revealed that the captured architectures provided similar or better performance. Especially checksum calculation was efficient in the captured architectures.

We present a methodology for synthesizing TTA protocol processors onto CMOS and FPGA from application specifications with reduced designer intervention and a short turn-around time. The methodology builds up on our earlier work in generating synthesizable processor models from system level specifications for 0.18 /spl mu/m CMOS technology. We test the application level methodology by comparing results obtained from a generated FPGA synthesis model to results obtained from a generated CMOS synthesis model. We synthesized an architecture for processing the IPv6 protocol, which resulted in an implementation that achieved the clock speed of 45 MHz. Due to the scalable parallelism of TTA architectures, this corresponds to an approximate throughput of 500 Mbps for IPv6 routing. From the results we were able to conclude that the critical delay in our generated FPGA implementations is formed inside our protocol processing functional units.

In this paper we present a design case study in configuring our protocol processor architecture to meet the performance requirements of IPv6 routing at gigabit speeds. Our methodology makes it possible to make fast reliable analyses of the problem on a high level and to find its key bottlenecks and design constraints. Based on the analyses we suggest architectural configurations for the target application. The best configurations can then be further analyzed in more detailed system-level simulations and physical estimations.