Workplace stress significantly affects employee well-being and task efficiency yet current stress recognition approaches remain impractical for real-world deployment. Existing methods mostly depend on intrusive physiological signals which require sensors attached to the body. Inspired by how humans naturally infer stress through observable behavior this PhD proposes a non-intrusive multimodal deep learning approach. This method uses overt expressive cues combining facial expressions to identify emotional valence with voice tone to capture emotional intensity and eye movements to monitor mental fatigue. To ensure reliability the system incorporates facial thermal imaging as a covert but non-intrusive cue to detect involuntary heat changes that reveal genuine stress even when a user attempts to mask their outward expression.

While deep learning techniques are nowadays a powerful field to automatically learn and perform accurate EEG data classification in the clinical context, they still lack wide acceptance within the medical and health research community. This lack of trust is associated with the high complexity deep learning algorithms typically have, which contributes to a low level of interpretability of the outcome and predictions. This survey aims to provide a comprehensive discussion of the latest advancements in deep learning models applied to EEG analysis, while also emphasizing research in explainable AI within this domain. It explores commonly used algorithms in EEG analysis, their main application areas, and the insights provided by XAI. Moreover, the survey addresses current limitations, such as the evaluation of XAI methods and the need for clinical validation, as well as ongoing challenges in this field. One critical insight from this review is the relative paucity of clinical evaluations of the rich stock of proposed techniques and methods for AI explainability. By showcasing various applications and breakthroughs in EEG analysis facilitated by XAI, the survey underscores the potential of these technologies to revolutionize neurological diagnosis and treatment, paving the way for wider acceptance and implementation in clinical settings.

Tsetlin Machines (TMs) have garnered increasing interest for their ability to learn concepts via propositional formulas and their proven efficiency across various application domains. Despite this, the convergence proof for the TMs, particularly for the AND operator (conjunction of literals), in the generalized case (inputs greater than two bits) remains an open problem. This paper aims to fill this gap by presenting a comprehensive convergence analysis of Tsetlin automaton-based Machine Learning algorithms. We introduce a novel framework, referred to as Probabilistic Concept Learning (PCL), which simplifies the TM structure while incorporating dedicated feedback mechanisms and dedicated inclusion/exclusion probabilities for literals. Given n features, PCL aims to learn a set of conjunction clauses Ci each associated with a distinct inclusion probability pi. Most importantly, we establish a theoretical proof confirming that, for any clause k, PCL converges to a conjunction of literals when pk is between 0.5 and 1. This result serves as a stepping stone for future research on the convergence properties of Tsetlin automaton-based learning algorithms. Our findings not only contribute to the theoretical understanding of Tsetlin automaton-based learning algorithms but also have implications for their practical application, potentially leading to more robust and interpretable machine learning models.

Transformer-based architectures have advanced text summarization, yet their quadratic complexity limits scalability on long documents. This paper introduces BiSparse-AAS (Bilinear Sparse Attention with Adaptive Spans), a novel framework that combines sparse attention, adaptive spans, and bilinear attention to address these limitations. Sparse attention reduces computational costs by focusing on the most relevant parts of the input, while adaptive spans dynamically adjust the attention ranges. Bilinear attention complements both by modeling complex token interactions within this refined context. BiSparse-AAS consistently outperforms state-of-the-art baselines in both extractive and abstractive summarization tasks, achieving average ROUGE improvements of about 68.1% on CNN/DailyMail and 52.6% on XSum, while maintaining strong performance on OpenWebText and Gigaword datasets. By addressing efficiency, scalability, and long-sequence modeling, BiSparse-AAS provides a unified, practical solution for real-world text summarization applications. For reproducibility, our source code is available at this link11https://osf.io/enyv5/?view _only=079db437e94147a489626f275bed90c7.

Schizophrenia is a complex neuropsychiatric disorder that affects cognitive function and brain activity. Electroencephalography (EEG) has emerged as a valuable tool for detecting schizophrenia-related neural patterns, but accurate classification remains a challenge due to the intricate nature of EEG signals. In this study, we propose a Hybrid Visibility Graph and Long Short-Term Memory (VG-LSTM) framework for schizophrenia detection. Our approach transforms EEG time series into graph structures using visibility graphs (VGs) to capture the underlying topological properties of brain activity. We then employ LSTM networks to model sequential dependencies, effectively integrating both structural and sequential information for robust classification. Experimental results on publicly available schizophrenia EEG datasets demonstrate that our VG-LSTM framework achieves superior performance compared to conventional deep learning approaches. The results highlight the potential of combining graph-theoretic and deep sequential modeling techniques for EEG-based neuropsychiatric disorder detection. The full code of this research work is available on https://github.com/YousIA/VG-LSTM.

EEG data classification plays a pivotal role in understanding brain activity and its applications in various domains. Deep learning has emerged as a powerful paradigm for automatically learning complex patterns from raw data, eliminating the need for manual feature extraction. However, in the context of medical data, and in particular for EEG analysis, the use of deep learning approaching while having been very successful is not being included in medical diagnosis routines, yet. The aim of this survey is twofold. On one side, it provides a comprehensive overview of the current state-of-the-art in EEG data classification, with a specific focus on the use of deep learning techniques. On the other side, it also addresses the clinician community, explaining the power and trustfulness of such new approaches. The survey begins with an introduction highlighting the limitations of traditional model-based approaches and the potential of deep learning in EEG data classification. The fundamental principles and architectures of deep learning models are presented, including convolutional neural networks (CNNs), recurrent neural networks (RNNs), and graph convolution neural networks (GCNNs) that have been successfully applied to EEG data classification tasks. A detailed review and analysis of existing literature on deep learning-based EEG data classification are provided, categorizing the studies based on the type of the input data, e.g., sequences, images, graphs, or multi-modalities. We also discuss about the existing tools and technologies for EEG data classification and highlights the challenges and limitations associated with deep learning in EEG data classification, including limited data availability, interpretability of deep models, and bias mitigation. Potential solutions and ongoing research efforts to overcome these challenges are explored, providing insights into the future directions of this field. This survey serves as a valuable resource for researchers, practitioners, and healthcare professionals involved in EEG data classification. It provides an extensive understanding of the advancements, challenges, and potential applications of deep learning techniques in this domain, guiding further research and development of accurate and interpretable approaches for EEG data analysis and interpretation.

This article offers an extensive survey of one of the fundamental aspects of the trustworthiness of AI in healthcare, namely uncertainty, focusing on the large panoply of recent studies addressing the connection between uncertainty, AI, and healthcare. The concept of uncertainty is a recurring theme across multiple disciplines, with varying focuses and approaches. Here, we focus on the diverse nature of uncertainty in medical applications, emphasizing the importance of quantifying uncertainty in model predictions and its advantages in specific clinical settings. Questions that emerge in this context range from the guidelines for AI integration in the healthcare domain to the ethical deliberations and their compatibility with cutting-edge AI research. Together with a description of the main specific works in this context, we also discuss that, as medicine evolves and introduces novel sources of uncertainty, there is a need for more versatile uncertainty quantification methods to be developed collaboratively by researchers and healthcare professionals. Finally, we acknowledge the limitations of current uncertainty quantification methods in addressing the different facets of uncertainty within the medical domain. In particular, we identify from this survey a relative paucity of approaches that focus on the user’s perception of uncertainty and accordingly of trustworthiness.

This article presents a highly efficient technique for pattern mining in the realm of customer behavior analysis, termed hybrid clustering patterns for customer behavior analysis (HCP-CBA). It leverages decomposition techniques to uncover relevant patterns by examining correlations among customer transactions within the dataset. Initially, the transaction dataset undergoes decomposition, grouping together transactions exhibiting high correlations. Subsequently, relevant patterns are extracted by applying a pattern mining algorithm represented by Apriori to each group. It incorporates both groups of transactions and shared items between groups. To assess the effectiveness of the HCP-CBA framework, extensive experiments are conducted across customer behavior dataset. The experimental results demonstrate notable reductions in both runtime and scalability. The full code of this research work is available onhttps://github.com/YousIA/ConsumerAnalytics.

Human brain signals are highly complex and dynamic in nature. Electroencephalogram (EEG) devices capture some of this complexity, both in space and in time, with a certain resolution. Recently, transformer-based models have been explored in various applications with different modalities of data. In this work, we introduce a transformer-based model for the classification of EEG signals, inspired by the recent success of the Vision Transformer (ViT) in image classification. Driven by the distinctive characteristics of the EEG data, we design a module that enables us to (1) extract spatio-temporal tokens inherent in the EEG signals and (2) integrate additional non-linearities to capture intricate and non-linear patterns in EEG signals. To that end, we introduce a new lightweight architectural component that combines our proposed attention model with convolution. This convolutional tokenization module forms the basis of our vision backbone referred to as Brain Signal Vision Transformer (BSVT). This architecture takes into account the spatial and temporal features in EEG datasets, leading to token embeddings that effectively capture the fusion of spatial-temporal information. Moreover, while transformer-based models typically perform well when provided with large datasets, here we show that our combination of the inherent inductive bias of Convolutional Neural Networks (CNN) with the transformer enables efficient training from scratch using relatively small datasets, with as few as 0.75M parameters. On the publicly available EEG dataset from Temple University Hospital (TUH Abnormal), our model achieves results comparable or superior to its counterpart ViT model with patchify stem. The implementation is available at https://github.com/IamRabin/BSVT.git

The manifold hypothesis posits that high-dimensional data often lies on a lower-dimensional manifold and that utilizing this manifold as the target space yields more efficient representations. While numerous traditional manifold-based techniques exist for dimensionality reduction, their application in self-supervised learning has witnessed slow progress. The recent MSimCLR method combines manifold encoding with SimCLR but requires extremely low target encoding dimensions to outperform SimCLR, limiting its applicability. This paper introduces a novel learning paradigm using an unbalanced atlas (UA), capable of surpassing state-of-the-art self-supervised learning approaches. We investigated and engineered the DeepInfomax with an unbalanced atlas (DIM-UA) method by adapting the Spatiotemporal DeepInfomax (ST-DIM) framework to align with our proposed UA paradigm. The efficacy of DIM-UA is demonstrated through training and evaluation on the Atari Annotated RAM Interface (AtariARI) benchmark, a modified version of the Atari 2600 framework that produces annotated image samples for representation learning. The UA paradigm improves existing algorithms significantly as the number of target encoding dimensions grows. For instance, the mean F1 score averaged over categories of DIM-UA is~75% compared to ~70% of ST-DIM when using 16384 hidden units.

Abstract In this paper, we present a novel paradigm for disease detection. We build an artificial intelligence based system where various biomedical data are retrieved from distributed and homogeneous sensors. We use different deep learning architectures (VGG16, RESNET, and DenseNet) with ensemble learning and attention mechanisms to study the interactions between different biomedical data to detect and diagnose diseases. We conduct extensive testing on biomedical data. The results show the benefits of using deep learning technologies in the field of artificial intelligence of medical things to diagnose diseases in the healthcare decision‐making process. For example, the disease detection rate using the proposed methodology achieves 92%, which is greatly improved compared to the higher‐level disease detection models.

A large number of emerging applications, such as autonomous navigation, space exploration, surveillance, military target detection, and remote sensing, use outdoor images to monitor various activities of interest. However, images acquired under unfavorable weather conditions usually suffer from atmospheric scattering due to environmental pollution causing color-shift and low-contrast images. Dehazing is an emerging research area in the computer vision domain that intends to restore the visibility of images by eliminating the latter types of degradation. Single image dehazing, on the other hand, is more challenging since it necessitates a precise assessment of atmospheric light and transmission map. This study aims to design a dual-channel deep neural network (DCD-Net) for estimating the transmission map, further utilized to compute atmospheric light. Finally, a dehazed image is generated using the obtained atmospheric light and the transmission map. The experimental results are compared qualitatively and quantitatively with eight existing dehazing approaches based on ten metrics on six publicly available standard datasets: Foggy Road Image DAtabase, HazeRD, REalistic Single Image DEhazing, NYU-Depth, O-HAZE, I-HAZE, a few natural hazy images, and underwater images. The DCD-Net outperforms conventional techniques, according to extensive studies. Moreover, a range of relative improvements of the proposed method over other approaches is calculated for better analysis of the results. A visual internet of things (VIoT) framework employing a PYNQ-Z2 board is presented in addition to the DCD-Net. It can be applied in real-time applications, particularly in the transportation and surveillance industries. The DCD-Net is suitable for image dehazing by virtue of its multilayered structure. The VIoT uses the DCD-Net for dehazing, while the PYNQ-Z2 board serves as the central processing unit. Note to Practitioners—This paper is motivated by the problems occurring due to haze. Haze reduces the visibility of a scene, causing major concerns in transportation and surveillance. Existing approaches have attempted to address this issue, albeit the methods are limited. As a result, this study proposes a new dual-channel CNN model with two modules, where the first module calculates fine details of the image and the second module estimates the transmission map. Furthermore, both features are combined to produce a more reliable transmission map. The training process highly influences the resulting output of the network. Therefore, an algorithm explaining the training instructions for the practitioners is given in the appendix. The obtained transmission map is further used to estimate atmospheric light. The images are then dehazed using atmospheric light and transmission maps. In addition, we have designed a framework for image dehazing using VIoT with a PYNQ-Z2 board. Experimental results suggest that this approach gives expected results, yet, there is one limitation. This method requires a haze image and a corresponding transmission map, which is not always possible. Therefore, we will attempt to design a semi-supervised learning approach in the future.

In this article, we present a new propagation paradigm based on the principle of Hyperlink-Induced Topic Search (HITS) algorithm. The HITS algorithm utilizes the concept of a “self-reinforcing” relationship of authority-hub. Using HITS, the centrality of nodes is determined via repeated updates of authority-hub scores that converge to a stationary distribution. Unlike PageRank-based propagation methods, which rely solely on the idea of authorities (in-links), HITS considers the relevance of both authorities (in-links) and hubs (out-links), thereby allowing for a more informative graph learning process. To segregate node prediction and propagation, we use a Multilayer Perceptron in combination with a HITS-based propagation approach and propose two models: HITS-GNN and HITS-GNN+. We provided additional validation of our models’ efficacy by performing an ablation study to assess the performance of authority-hub in independent models. Moreover, the effect of the main hyper-parameters and normalization is also analyzed to uncover how these techniques influence the performance of our models. Extensive experimental results indicate that the proposed approach significantly improves baseline methods on the graph (citation network) benchmark datasets by a decent margin for semi-supervised node classification, which can aid in predicting the categories (labels) of scientific articles not exclusively based on their content but also based on the type of articles they cite.

Since the early 1960s, the paradigm of learning automata (LA) has experienced abundant interest. Arguably, it has also served as the foundation for the phenomenon and field of reinforcement learning (RL). Over the decades, new concepts and fundamental principles have been introduced to increase the LA's speed and accuracy. These include using probability updating functions, discretizing the probability space, and using the "Pursuit" concept. Very recently, the concept of incorporating "structure" into the ordering of the LA's actions has improved both the speed and accuracy of the corresponding hierarchical machines, when the number of actions is large. This has led to the ϵ -optimal hierarchical continuous pursuit LA (HCPA). This article pioneers the inclusion of all the above-mentioned phenomena into a new single LA, leading to the novel hierarchical discretized pursuit LA (HDPA). Indeed, although the previously proposed HCPA is powerful, its speed has an impediment when any action probability is close to unity, because the updates of the components of the probability vector are correspondingly smaller when any action probability becomes closer to unity. We propose here, the novel HDPA, where we infuse the phenomenon of discretization into the action probability vector's updating functionality, and which is invoked recursively at every stage of the machine's hierarchical structure. This discretized functionality does not possess the same impediment, because discretization prohibits it. We demonstrate the HDPA's robustness and validity by formally proving the ϵ -optimality by utilizing the moderation property. We also invoke the submartingale characteristic at every level, to prove that the action probability of the optimal action converges to unity as time goes to infinity. Apart from the new machine being ϵ -optimal, the numerical results demonstrate that the number of iterations required for convergence is significantly reduced for the HDPA, when compared to the state-of-the-art HCPA scheme.

In this article, we introduce a novel learning automata (LA) solution to the nonlinear stochastic proportional polling (NSPP) problem. The only available solution to this problem in the literature is that given by Nicopolitidis et al. (2003), Obaidat et al. (2002), and Papadimitriou et al. (2002). It was shown to solve a large set of the adaptive resource allocation problems under noisy environments (Nicopolitidis et al., 2003; Obaidat et al., 2002; Papadimitriou and Pomportsis, 2000 and 1999; Nicopolitidis et al., 2004; Obaidat et al., 2001; and Papadimitriou and Pomportsis, 2000). We make a threefold contribution. First, we take a two-timescale approach to the field of LA by estimating the reward probabilities on a faster timescale than the timescale for updating the polling probabilities. Second, by making a not-obvious choice of the objective function, we show that the NSPP problem is indeed an instantiation of the stochastic nonlinear fractional equality knapsack (NFEK) problem, which is a substantial resource allocation problem based on the incomplete and noisy information (Granmo and Oommen, 2010). Third, in contrast to the legacy approach taken by Papadimitriou and Maritsas (1992 and 1996), we show through the extensive experimental results that our solution is remarkably robust to the choice of tuning parameters and that it outperforms the state of the art solution in terms of the Bayesian expected loss.

The paper gives an overview of a machine learning-based system developed to support systematic literature reviews (SLR). The objective of the system is to provide scientists and anyone else who gives scientific advice supporting policy development with a tool for literature search and appraisal that reduces the human effort. The structure of the system is presented along with the description of the communication between modules and data storage methods. The Kafka technology is used for inter-module communication and the system consists of several independent modules which can be easily expanded with new modules without the need to introduce significant changes. We propose to semi–automate the SLR processes by applying an active learning approach which is based on machine learning classification models and on manual screening by experts of a subset of articles. Using classification algorithms requires a numerical representations of articles. This work investigates the utility of bag of concepts approach for text representations in order to create classification models used as components of automated systematic literature review systems. The presented study uses the bag of concepts approach in which a set of concepts identified by an annotator is extended by the concepts which lie, within a given distance, on paths from the originally identified concepts to the root of the ontology tree. Experiments are performed on datasets from systematic literature reviews in the medical domain. We summarize the performance of the proposed system by evaluating the WSS@95% metrics of active learning processes for several SLR case studies.

For many use cases, combining information from different datasets can be of interest to improve a machine learning model's performance, especially when the number of samples from at least one of the datasets is small. An additional challenge in such cases is that the features from these datasets are not identical, even though there are some commonly shared features among the datasets. To tackle this, we propose a novel framework called Combine datasets based on Imputation (ComImp). In addition, we propose PCA-ComImp, a variant of ComImp that utilizes Principle Component Analysis (PCA), where dimension reduction is conducted before combining datasets. This is useful when the datasets have a large number of features that are not shared across them. Furthermore, our framework can also be utilized for data preprocessing by imputing missing data, i.e., filling in the missing entries while combining different datasets. To illustrate the performance and practicability of the proposed methods and their potential usages, we conduct experiments for various tasks (regression, classification) and for different data types (tabular data, time series data) when the datasets to be combined have missing data. We also investigate how the devised methods can be used with transfer learning to provide even further model training improvement. Our results indicate that can provide extra improvement when being used in combination with transfer learning.

Abstract Concept drift is a well-known issue that arises when working with data streams. In this paper, we present a procedure that allows a quantile tracking procedure to cope with concept drift. We suggest using expected quantile loss, a popular loss function in quantile regression, to monitor the quantile tracking error, which, in turn, is used to efficiently adapt to concept drift. The suggested procedures adapt efficiently to concept drift, and the tracking performance is close to theoretically optimal. The procedures were further applied to three real-life streaming data sets related to Twitter event detection, activity recognition, and stock trading. The results show that the procedures are efficient at adapting to concept drift, thereby documenting the real-world applicability of the procedures. We further used asymptotic theory from statistics to show the appealing theoretical property that, if the data stream distribution is stationary over time, the procedures converge to the true quantile.

This paper presents a new framework for intrusion detection in the next-generation Internet of Things. MinMax normalization strategy is used to collect and preprocess data. The Marine Predator algorithm is then used to select relevant features to be used in the learning process. The selected features are then trained with an advanced and state-of-the-art recurrent neural network that includes an attention mechanism. Finally, Shapely values are calculated to determine how much each feature contributes to the final output. The dataset NSL-KDD was used for intensive simulations. The results show the advantages of the proposed system as well as its superiority over state-of-the-art methods. In fact, the proposed solution achieved a rate of more than 94% for both true negative and true position, while the rates of the existing solutions are below 90% for the challenging NSL-KDD datasets.

Q-learning is one of the most well-known reinforcement learning algorithms. There have been tremendous efforts to develop this algorithm using neural networks. Bootstrapped deepQ-learning network is amongst them. It utilizes multiple neural network heads to introduce diversity intoQ-learning. Diversity can sometimes be viewed as the amount of reasonable moves an agent can take at a given state, analogous to the definition of the exploration ratio in RL. Thus, the performance of bootstrapped deepQ-learning network is deeply connected with the level of diversity within the algorithm. In the original research, it was pointed out that a random prior could improve the performance of the model. In this article, we further explore the possibility of replacing priors with noise and sample the noise from a Gaussian distribution to introduce more diversity into this algorithm. We conduct our experiment on the Atari benchmark and compare our algorithm to both the original and other related algorithms. The results show that our modification of the bootstrapped deepQ-learning algorithm achieves significantly higher evaluation scores across different types of Atari games. Thus, we conclude that replacing priors with noise can improve bootstrapped deepQ-learning's performance by ensuring the integrity of diversities.

Learning automata (LA) with artificially absorbing barriers was a completely new horizon of research in the 1980s (Oommen, 1986). These new machines yielded properties that were previously unknown. More recently, absorbing barriers have been introduced in continuous estimator algorithms so that the proofs could follow a martingale property, as opposed to monotonicity (Zhang et al., 2014), (Zhang et al., 2015). However, the applications of LA with artificial barriers are almost nonexistent. In that regard, this article is pioneering in that it provides effective and accurate solutions to an extremely complex application domain, namely that of solving two-person zero-sum stochastic games that are provided with incomplete information. LA have been previously used (Sastry et al., 1994) to design algorithms capable of converging to the game’s Nash equilibrium under limited information. Those algorithms have focused on the case where the saddle point of the game exists in a pure strategy. However, the majority of the LA algorithms used for games are absorbing in the probability simplex space, and thus, they converge to an exclusive choice of a single action. These LA are thus unable to converge to other mixed Nash equilibria when the game possesses no saddle point for a pure strategy. The pioneering contribution of this article is that we propose an LA solution that is able to converge to an optimal mixed Nash equilibrium even though there may be no saddle point when a pure strategy is invoked. The scheme, being of the linear reward-inaction ($L_{R-I}$) paradigm, is in and of itself, absorbing. However, by incorporating artificial barriers, we prevent it from being “stuck” or getting absorbed in pure strategies. Unlike the linear reward-$\epsilon $penalty ($L_{R-\epsilon P}$) scheme proposed by Lakshmivarahan and Narendra almost four decades ago, our new scheme achieves the same goal with much less parameter tuning and in a more elegant manner. This article includes the nontrial proofs of the theoretical results characterizing our scheme and also contains experimental verification that confirms our theoretical findings.

In recent years, Graph Neural Networks (GNNs) have gained popularity for solving a wide range of problems, primarily due to the proliferation of graph data across various domains. GNNs offer expressive power but are computationally expensive at the same time. Some studies have suggested that altering their traditional message passing mechanism with Personalized PageRank as a propagation scheme reduces the computational complexity, improves performance, and optimizes scalability in semi-supervised learning problems. This paper presents a propagation mechanism based on the Hyperlink-Induced Topic Search (HITS) algorithm. The HITS-based approach propagates information in a graph by using a recursive update of authority and hub scores. Using this terminology, Personalized PageRank based propagation considers only in-links, thus, embraces the concept of authority (in-links) scores while ignoring the important concept of hub (out-links), which leads to trailing down some valuable information. According to our approach, a Multi-Layer Perceptron (MLP) is applied in combination with a HITS-based propagation algorithm to separate node prediction and propagation. Experimental results demonstrate that the proposed method outperforms baseline methods on graph benchmark datasets with a significant margin for semi-supervised node classification.

This research work introduces a new intelligent framework for infectious disease detection by exploring various emerging and intelligent paradigms. We propose new deep learning architectures such as entity embedding networks, long-short term memory, and convolution neural networks, for accurately learning heterogeneous medical data in identifying disease infection. The multi-agent system is also consolidated for increasing the autonomy behaviours of the proposed framework, where each agent can easily share the derived learning outputs with the other agents in the system. Furthermore, evolutionary computation algorithms, such as memetic algorithms, and bee swarm optimization controlled the exploration of the hyper-optimization parameter space of the proposed framework. Intensive experimentation has been established on medical data. Strong results obtained confirm the superiority of our framework against the solutions that are state of the art, in both detection rate, and runtime performance, where the detection rate reaches 98% for handling real use cases.

Summary With the proliferation of technologies such as wireless sensor networks (WSNs) and the Internet of things (IoT), we are moving towards the era of automation without any human intervention. Sensors are the principal components of the WSNs that bring the idea of IoT into reality. Over the last decade, WSNs are being used in many application fields such as target coverage, battlefield surveillance, home security, health care monitoring, and so on. However, the energy efficiency of the sensor nodes in WSN remains a challenging issue due to the use of a small battery. Moreover, replacing the batteries of the sensor nodes deployed in a hostile environment frequently is not a feasible option. Therefore, intelligent scheduling of the sensor nodes for optimizing its energy‐efficient operation and thereby extending the life‐time of WSN has received a lot of research attention lately. In particular, this article investigates extending the lifetime of the WSN in the context of target coverage problems. To tackle this problem, we propose a scheduling technique for WSN based on a novel concept within the theory of learning automata (LA) called pursuit LA. Each sensor node in the WSN is equipped with an LA so that it can autonomously select its proper state, that is, either sleep or active, with an aim to cover all targets with the lowest energy cost possible. Our comprehensive experimental testing of the proposed algorithm not only verifies the efficiency of our algorithm, but it also demonstrates its ability to yield a near‐optimal solution. The results are promising, given the low computational footprint of the algorithm.

Troubleshooting in SDN-based networks is still a cumbersome task that can overwhelm human attention. Various anomalies, such as installation failure, disordered rules, and loops, remain unnoticed even when the most recent detection methods are used. In this paper, we address the issue of verifying SDN policies by actively probing the data plane. SDN Spotlight is presented as an anomaly detection framework that tries to detect installation failures, rule conflicts, and loops. In contrast to recent work, such as Monocle and Pronto, SDN Spotlight verifies a chain of rules using a single probing packet. This approach also reduces the number of monitoring rules, which has a direct effect on saving TCAM memory usage and minimizing the packet matching time. SDN Spotlight addresses two problems: verifying rule installation and forwarding behavior verification. Within the SDN Spotlight framework, we introduce two different approaches for forwarding anomaly detection: Hedge-SDN Spotlight and Open-SDN Spotlight. Furthermore, we devise an efficient and fast probe generation algorithm that generates one single probing packet per chain of rules. As opposed to other related work, Hedge-SDN Spotlight does not yield false positives and false negatives when detecting loops and forwarding failures. The results of the experiment demonstrate that SDN Spotlight is much faster than the SDNProbe and SDN traceroute method, in some cases by a factor of up to seven times as fast.

Human personality plays a crucial role in decision-making and it has paramount importance when individuals negotiate with each other to reach a common group decision. Such situations are conceivable, for instance, when a group of individuals want to watch a movie together. It is well known that people influence each other’s decisions, the more assertive a person is, the more influence they will have on the final decision. In order to obtain a more realistic group recommendation system (GRS), we need to accommodate the assertiveness of the different group members’ personalities. Although pairwise preferences are long-established in group decision-making (GDM), they have received very little attention in the recommendation systems community. Driven by the advantages of pairwise preferences on ratings in the recommendation systems domain, we have further pursued this approach in this paper, however we have done so for GRS. We have devised a three-stage approach to GRS in which we 1) resort to three binary matrix factorization methods, 2) develop an influence graph that includes assertiveness and cooperativeness as personality traits, and 3) apply an opinion dynamics model in order to reach consensus. We have shown that the final opinion is related to the stationary distribution of a Markov chain associated with the influence graph. Our experimental results demonstrate that our approach results in high precision and fairness.

In group decision-making (GDM), fuzzy preference relations (FPRs) refer to pairwise preferences in the form of a matrix. Within the field of GDM, the problem of estimating missing values is of utmost importance, since many experts provide incomplete preferences. In this paper, we propose a new method called the entropy-based method for estimating the missing values in the FPR. We compared the accuracy of our algorithm for predicting the missing values with the best candidate algorithm from state of the art achievements. In the proposed entropy-based method, we took advantage of pairwise preferences to achieve good results by storing extra information compared to single rating scores, for example, a pairwise comparison of alternatives vs. the alternative’s score from one to five stars. The entropy-based method maps the prediction problem into a matrix factorization problem, and thus the solution for the matrix factorization can be expressed in the form of latent expert features and latent alternative features. Thus, the entropy-based method embeds alternatives and experts in the same latent feature space. By virtue of this embedding, another novelty of our approach is to use the similarity of experts, as well as the similarity between alternatives, to infer the missing values even when only minimal data are available for some alternatives from some experts. Note that current approaches may fail to provide any output in such cases. Apart from estimating missing values, another salient contribution of this paper is to use the proposed entropy-based method to rank the alternatives. It is worth mentioning that ranking alternatives have many possible applications in GDM, especially in group recommendation systems (GRS).

Measures of distance or how data points are positioned relative to each other are fundamental in pattern recognition. The concept of depth measures how deep an arbitrary point is positioned in a dataset, and is an interesting concept in this regard. However, while this concept has received a lot of attention in the statistical literature, its application within pattern recognition is still limited. To increase the applicability of the depth concept in pattern recognition, we address the well-known computational challenges associated with the depth concept, by suggesting to estimate depth using incremental quantile estimators. The suggested algorithm can not only estimate depth when the dataset is known in advance, but can also track depth for dynamically varying data streams by using recursive updates. The tracking ability of the algorithm was demonstrated based on a real-life application associated with detecting changes in human activity from real-time accelerometer observations. Given the flexibility of the suggested approach, it can detect virtually any kind of changes in the distributional patterns of the observations, and thus outperforms detection approaches based on the Mahalanobis distance.

With the advent of deep learning, the research on facial expression recognition (FER) has received a lot of interest. Different deep convolutional neural network (DCNN) architectures have been developed for real-time and efficient FER. One of the challenges in FER is obtaining trustworthy features that are strongly associated with facial expression changes. Furthermore, traditional DCNNs for FER problems have two significant issues: insufficient training data, which leads to overfitting, and intra-class facial appearance variations. FLEPNet, a texture-based feature-level ensemble parallel network for FER, is proposed in this study and proved to solve the aforementioned problems. Our parallel network FLEPNet uses multi-scale convolutional and multi-scale residual block-based DCNN as building blocks. First, we consider modified homomorphic filtering to normalize the illumination effectively, which minimizes the intra-class difference. The deep networks are then protected against having insufficient training data by using texture analysis on face expression images to identify multiple attributes. Four texture features are extracted and combined with the image's original characteristics. Finally, the integrated features retrieved by two networks are used to classify seven facial expressions. Experimental results reveal that the proposed technique achieves an average accuracy of 0.9914, 0.9894, 0.9796, 0.8756, and 0.8072 on Japanese Female Facial Expressions, Extended CohnKanade, Karolinska Directed Emotional Faces, Real-world Affective Face Database, and Facial Expression Recognition 2013 databases, respectively. Moreover, experimental outcomes depict significant reliability when compared to competing approaches.

In this article, we consider an emergent problem in the sensor fusion area in which unreliable sensors need to be identified in the absence of the ground truth. We devise a novel solution to the problem using the theory of replicator dynamics that require mild conditions compared to the available state-of-the-art approaches. The solution has a low computational complexity that is linear in terms of the number of involved sensors. We provide some sound theoretical results that catalog the convergence of our approach to a solution where we can clearly unveil the sensor type. Furthermore, we present some experimental results that demonstrate the convergence of our approach in concordance with our theoretical findings.

DoS and DDoS attacks have been growing in size and number over the last decade and existing solutions to mitigate these attacks are largely inefficient. Compared to other types of malicious cyber attacks, DoS and DDoS attacks are particularly challenging to combat. Because of their ability to mask themselves as legitimate traffic, it has proven difficult to develop methods to detect these types of attacks on a packet or flow level. In this paper, we explore the potential of Variational Autoencoders to serve as a component within an intelligent security solution that differentiates between normal and malicious traffic. The motivation behind resorting to Variational Autoencoders is that unlike normal encoders that would code an input flow as a single point, they encode a flow as a distribution over the latent space which avoids overfitting. Intuitively, this allows a Variational Autoencoder to not only learn latent representations of seen input features, but to generalize in a way that allows for an interpretation of unseen flows and flow features with slight variations. Two methods based on the ability of Variational Autoencoders to learn latent representations from network traffic flows of both benign and malicious traffic, are proposed. The first method resorts to a classifier based on the latent encodings obtained from Variational Autoencoders learned from traffic traces. The second method is an anomaly detection method, where the Variational Autoencoder is used to learn the abstract feature representations of exclusively legitimate traffic. Anomalies are then filtered out by relying on the reconstruction loss of the Variational Autoencoder. In this sense, the construction loss of the autoencoder is fed as input to a classifier that outputs the class of the traffic including benign and malign, and eventually the attack type. Thus, the second approach operates with two separate training processes on two separate data sources: the first training involving only legitimate traffic, and the second training involving all traffic classes. This is different from the first approach which operates only a single training process on the whole traffic dataset. Thus, the autoencoder of the first approach aspires to learn a general feature representation of the flows while the autoencoder of the second approach aims to exclusively learn a representation of the benign traffic. The second approach is thus more susceptible to finding zero day attacks and discovering new attacks as anomalies. Both of the proposed methods have been thoroughly tested on two separate datasets with a similar feature space. The results show that both methods are promising, with the classifier-based method being slightly superior to the anomaly-based one.

Summary As the policies of a software‐defined networking (SDN) network can be updated dynamically and often at a high pace, conflicts between policies can easily occur. Due to the large number of switches and heterogeneous policies within a typical SDN network, detecting those conflicts is a laborious and challenging task. This article presents three main contributions. First, we devise an offline method for detecting unmatched OpenFlow rules, that is, rules that are never fired. In our taxonomy such anomalies can stem from eitherinvalidorirrelevantunmatched rules. Second, we introduce a new set of definitions for the intraanomalies between rules in the same table, which might occur when using themultiactionfeature of an OpenFlow rule. Third, our detection method has been enhanced to support parallel execution, which makes it a viable solution for troubleshooting large‐scale networks. We provide some comprehensive experimental results based on both synthetic and real‐life setup the synthetic set up is designed in such a way that the rule matching takes place in the last rules of the switch and thus putting more stress on the rule detection process. The parallel method is shown to outperform the single‐threaded checking method by order of magnitude up to 21.

A Network Intrusion Detection System (NIDS) is a fundamental security tool. However, under heavy network traffic, a NIDS might become a bottleneck. In an overloaded state, incoming and outgoing packets in the network might suffer from long delays since previous packets are still being inspected, and eventually the NIDS starts to drop packets when it runs out of hardware resources. Although many solutions have been suggested in the literature to counter this problem, they are not completely reliable as each of them has limitations. This paper investigates the design of a lightweight elastic architecture which allows parallel processing in an existing NIDS while maintaining the filtering integrity. Furthermore, we propose two adaptive algorithms which dynamically adjust and divide the signature rules evenly across NIDS nodes using a node level parallelism method in order to achieve intelligent rule ordering. We test our approaches in real-life settings by implementing a functioning prototype involving different modern networking technologies. The prototype presented is a Network Function Virtualization (NFV) of an intrusion detection system which utilizes Open vSwitch and Docker containers running Snort in order to provide an elastic system. To the best of our knowledge, there has been no work that orchestrates both scaling and rule splitting and re-ordering of IDS signatures as a part of a holistic elastic IDS solution. The results of this study show that the proposed algorithms are able to equally split the IDS workload and thereby enabling the system to scale by adjusting the number of virtual components which analyse the network traffic. At the same time the experiments indicate that the algorithms can be tuned by a single parameter in order to avoid that some packets go unexamined while simultaneously craving a minimum of the dynamically available computer resources.

With the emergence of Internet of Things (IoT), securing and managing large, complex enterprise network infrastructure requires capturing and analyzing network traffic traces in real time. An accurate passive operating system (OS) fingerprinting plays a critical role in effective network management and cybersecurity protection. Passive fingerprinting does not send probes that introduce extra load to the network and hence it has a clear advantage over active fingerprinting since it also reduces the risk of triggering false alarms. This article proposes and evaluates an advanced classification approach to passive OS fingerprinting by leveraging state-of-the-art classical machine learning and deep learning techniques. Our controlled experiments on benchmark data, emulated, and realistic traffic is performed using two approaches. Through an Oracle-based machine learning approach, we found that the underlying TCP variant is an important feature for predicting the remote OS. Based on this observation, we develop a sophisticated tool for OS fingerprinting that first predicts the TCP flavor using passive traffic traces and then uses this prediction as an input feature for another machine learning algorithm for predicting the remote OS from passive measurements. This article takes the passive fingerprinting problem one step further by introducing the underlying predicted TCP variant as a distinguishing feature. In terms of accuracy, we empirically demonstrate that accurately predicting the TCP variant has the potential to boost the evaluation performance from 84% to 94% on average across all our validation scenarios and across different types of traffic sources. We also demonstrate a practical example of this potential, by increasing the performance to 91.2% and 95.3% on average using a tool for loss-based and delay-based TCP variants prediction in an emulated setting. To the best of our knowledge, this is the first study that explores the potential for using the knowledge of the TCP variant to significantly boost the accuracy of passive OS fingerprinting.

The estimation of quantiles is one of the most fundamental data mining tasks. As most real-time data streams vary dynamically over time, there is a quest for adaptive quantile estimators. The most well-known type of adaptive quantile estimators is the incremental one which documents the state-of-the art performance in tracking quantiles. However, the absolute vast majority of incremental quantile estimators fail to jointly estimate multiple quantiles in a consistent manner without violating the monotone property of quantiles. In this paper, first we introduce the concept of conditional quantiles that can be used to extend incremental estimators to jointly track multiple quantiles. Second, we resort to the concept of conditional quantiles to propose two new estimators. Extensive experimental results, based on both synthetic and real-life data, show that the proposed estimators clearly outperform legacy state-of-the-art joint quantile tracking algorithms in terms of accuracy while achieving faster adaptivity in the face of dynamically varying data streams.

Associative memories enjoy many interesting properties in terms of error correction capabilities, robustness to noise, storage capacity, and retrieval performance, and their usage spans over a large set of applications. In this letter, we investigate and extend tournament-based neural networks, originally proposed by Jiang, Gripon, Berrou, and Rabbat (2016), a novel sequence storage associative memory architecture with high memory efficiency and accurate sequence retrieval. We propose a more general method for learning the sequences, which we call feedback tournament-based neural networks. The retrieval process is also extended to both directions: forward and backward-in other words, any large-enough segment of a sequence can produce the whole sequence. Furthermore, two retrieval algorithms, cache-winner and explore-winner, are introduced to increase the retrieval performance. Through simulation results, we shed light on the strengths and weaknesses of each algorithm.

Formation of stimulus equivalence classes has been recently modeled through equivalence projective simulation (EPS), a modified version of a projective simulation (PS) learning agent. PS is endowed with an episodic memory that resembles the internal representation in the brain and the concept of cognitive maps. PS flexibility and interpretability enable the EPS model and, consequently the model we explore in this letter, to simulate a broad range of behaviors in matching-to-sample experiments. The episodic memory, the basis for agent decision making, is formed during the training phase. Derived relations in the EPS model that are not trained directly but can be established via the network's connections are computed on demand during the test phase trials by likelihood reasoning. In this letter, we investigate the formation of derived relations in the EPS model using network enhancement (NE), an iterative diffusion process, that yields an offline approach to the agent decision making at the testing phase. The NE process is applied after the training phase to denoise the memory network so that derived relations are formed in the memory network and retrieved during the testing phase. During the NE phase, indirect relations are enhanced, and the structure of episodic memory changes. This approach can also be interpreted as the agent's replay after the training phase, which is in line with recent findings in behavioral and neuroscience studies. In comparison with EPS, our model is able to model the formation of derived relations and other features such as the nodal effect in a more intrinsic manner. Decision making in the test phase is not an ad hoc computational method, but rather a retrieval and update process of the cached relations from the memory network based on the test trial. In order to study the role of parameters on agent performance, the proposed model is simulated and the results discussed through various experimental settings.

Sensor fusion has attracted a lot of research attention during the few last years. Recently, a new research direction has emerged dealing with sensor fusion without knowledge of the ground truth. In this article, we present a novel solution to the latter pertinent problem. In contrast to the first reported solutions to this problem, we present a solution that does not involve any assumption on the group average reliability which makes our results more general than previous works. We devise a strategic game where we show that a perfect partitioning of the sensors into reliable and unreliable groups corresponds to a Nash equilibrium of the game. Furthermore, we give sound theoretical results that prove that those equilibria are indeed the unique Nash equilibria of the game. We then propose a solution involving a team of learning automata (LA) to unveil the identity of each sensor, whether it is reliable or unreliable, using game-theoretic learning. The experimental results show the accuracy of our solution and its ability to deal with settings that are unsolvable by legacy works.

In this article, we consider the problem of load balancing (LB), but, unlike the approaches that have been proposed earlier, we attempt to resolve the problem in a fair manner (or rather, it would probably be more appropriate to describe it as an ϵ -fair manner because, although the LB can, probably, never be totally fair, we achieve this by being "as close to fair as possible"). The solution that we propose invokes a novel stochastic learning automaton (LA) scheme, so as to attain a distribution of the load to a number of nodes, where the performance level at the different nodes is approximately equal and each user experiences approximately the same Quality of the Service (QoS) irrespective of which node that he/she is connected to. Since the load is dynamically varying, static resource allocation schemes are doomed to underperform. This is further relevant in cloud environments, where we need dynamic approaches because the available resources are unpredictable (or rather, uncertain) by virtue of the shared nature of the resource pool. Furthermore, we prove here that there is a coupling involving LA's probabilities and the dynamics of the rewards themselves, which renders the environments to be nonstationary. This leads to the emergence of the so-called property of "stochastic diminishing rewards." Our newly proposed novel LA algorithm ϵ -optimally solves the problem, and this is done by resorting to a two-time-scale-based stochastic learning paradigm. As far as we know, the results presented here are of a pioneering sort, and we are unaware of any comparable results.

Securing and managing large, complex enterprise network infrastructure requires capturing and analyzing network traffic traces in real-time. An accurate passive Operating System (OS) fingerprinting plays a critical role in effective network management and cybersecurity protection. Passive fingerprinting doesn't send probes that introduce extra load to the network and hence it has a clear advantage over active fingerprinting since it also reduces the risk of triggering false alarms. This paper proposes and evaluates an advanced classification approach to passive OS fingerprinting by leveraging state-of-the-art classical machine learning and deep learning techniques. Our controlled experiments on benchmark data, emulated and realistic traffic is performed using two approaches. Through an Oracle-based machine learning approach, we found that the underlying TCP variant is an important feature for predicting the remote OS. Based on this observation, we develop a sophisticated tool for OS fingerprinting that first predicts the TCP flavor using passive traffic traces and then uses this prediction as an input feature for another machine learning algorithm for predicting the remote OS from passive measurements. This paper takes the passive fingerprinting problem one step further by introducing the underlying predicted TCP variant as a distinguishing feature. In terms of accuracy, we empirically demonstrate that accurately predicting the TCP variant has the potential to boost the evaluation performance from 84% to 94% on average across all our validation scenarios and across different types of traffic sources. We also demonstrate a practical example of this potential, by increasing the performance to 91.3% on average using a tool for TCP variant prediction in an emulated setting. To the best of our knowledge, this is the first study that explores the potential for using the knowledge of the TCP variant to significantly boost the accuracy of passive OS fingerprinting.

Policy anomalies are frequent in nowadays's computer networks due to their increasing configuration complexity. Resolving policy anomalies usually requires network administrator intervention, which is a time-intensive and error-prone process. In this paper, we present Net Auto-Solver, a formal approach for automatic resolution of OpenFlow anomalies. The approach resorts to the concept of high-level policies to not only detect policy violations but also correct them on-the-fly. Our approach is fully automated and does not require interaction with the network administrator. Although there is a multitude of research works on detecting anomalies in SDN, research to correct those anomalies in an automatic manner is extremely scarce. At the heart of our approach, we propose two inference systems to perform corrective actions to the policy. We provide some experimental results involving real-life network configurations to show the performance of our approach. The first results are very promising.

Optimal power allocation problem in wireless networks is known to be usually a complex optimization problem. In this paper, we present a simple and energy-efficient distributed power control in downlink Non-Orthogonal Multiple Access (NOMA) using a Reinforcement Learning (RL) based game theoretical approach. A scenario consisting of multiple Base Stations (BSs) serving their respective Near User(s) (NU) and Far User(s) (FU) is considered. The aim of the game is to optimize the achievable rate fairness of the BSs in a distributed manner by appropriately choosing the power levels of the BSs using trials and errors. By resorting to a subtle utility choice based on the concept of marginal price costing where a BS needs to pay a virtual tax offsetting the result of the interference its presence causes for the other BS, we design a potential game that meets the latter objective. As RL scheme, we adopt Learning Automata (LA) due to its simplicity and computational efficiency and derive analytical results showing the optimality and convergence of the game to a Nash Equilibrium (NE). Numerical results not only demonstrate the convergence of the proposed algorithm to a desirable equilibrium maximizing the fairness, but they also demonstrate the correctness of the proposal followed by thorough comparison with random and heuristic approaches.

Abstract Learning Automata (LA) is a popular decision-making mechanism to “determine the optimal action out of a set of allowable actions” [1]. The distinguishing characteristic of automata-based learning is that the search for an optimal parameter (or decision) is conducted in the space of probability distributions defined over the parameter space, rather than in the parameter space itself [2]. In this paper, we propose a novel LA paradigm that can solve a large class of deterministic optimization problems. Although many LA algorithms have been devised in the literature, those LA schemes are not able to solve deterministic optimization problems as they suppose that the environment is stochastic. In this paper, our proposed scheme can be seen as the counterpart of the family of pursuit LA developed for stochastic environments [3]. While classical pursuit LAs can pursue the action with the highest reward estimate, our pursuit LA rather pursues the collection of actions that yield the highest performance by invoking a team of LA. The theoretical analysis of the pursuit scheme does not follow classical LA proofs, and can pave the way towards more schemes where LA can be applied to solve deterministic optimization problems. Furthermore, we analyze the scheme under both a constant learning parameter and a time-decaying learning parameter. We provide some experimental results that show how our Pursuit-LA scheme can be used to solve the Maximum Satisfiability (Max-SAT) problem. To avoid premature convergence and better explore the search space, we enhance our scheme with the concept of artificial barriers recently introduced in [4]. Interestingly, although our scheme is simple by design, we observe that it performs well compared to sophisticated state-of-the-art approaches.

Summary Hybrid cloud technology is becoming increasingly popular as it merges private and public clouds to bring the best of two worlds together. However, due to the heterogeneous cloud installation, facilitating a hybrid cloud setup is not simple. Despite some commercial solutions being available to build a hybrid cloud, an open‐source implementation is still unavailable. In this paper, we try to bridge the gap by providing an open‐source implementation using the power of Apache Mesos. We build a hybrid cloud on top of multiple cloud platforms, private and public. Through comprehensive experimental results, we show that our solution is able to ensure resource bursting by leveraging the power of the public cloud.

Summary Distributed denial of service (DDoS) attacks have for the last two decades been among the greatest threats facing the internet infrastructure. Mitigating DDoS attacks is a particularly challenging task as an attacker tries to conceal a huge amount of traffic inside a legitimate traffic flow. This article proposes to use data mining approaches to find unique hidden data structures which are able to characterize the normal traffic flow. This will serve as a mean for filtering illegitimate traffic under DDoS attacks. In this endeavor, we devise three algorithms built on previously uncharted areas within mitigation techniques where clustering techniques are used to create geographical clusters in regions which are likely to contain legitimate traffic. We argue through extensive experimental results that establishing clusters around this narrative is a superior solution to clustering algorithms which rely on bitwise distances between IP addresses. In addition, the DDoS filtering algorithm is deployed in a virtual Linux environment using Nfqueue and tested in a simulated real‐life DDoS attack.

Stimulus equivalence (SE) and projective simulation (PS) study complex behavior, the former in human subjects and the latter in artificial agents. We apply the PS learning framework for modeling the formation of equivalence classes. For this purpose, we first modify the PS model to accommodate imitating the emergence of equivalence relations. Later, we formulate the SE formation through the matching-to-sample (MTS) procedure. The proposed version of PS model, called the equivalence projective simulation (EPS) model, is able to act within a varying action set and derive new relations without receiving feedback from the environment. To the best of our knowledge, it is the first time that the field of equivalence theory in behavior analysis has been linked to an artificial agent in a machine learning context. This model has many advantages over existing neural network models. Briefly, our EPS model is not a black box model, but rather a model with the capability of easy interpretation and flexibility for further modifications. To validate the model, some experimental results performed by prominent behavior analysts are simulated. The results confirm that the EPS model is able to reliably simulate and replicate the same behavior as real experiments in various settings, including formation of equivalence relations in typical participants, nonformation of equivalence relations in language-disabled children, and nodal effect in a linear series with nodal distance five. Moreover, through a hypothetical experiment, we discuss the possibility of applying EPS in further equivalence theory research.

Although the field of learning automata (LA) has made significant progress in the past four decades, the LA-based methods to tackle problems involving environments with a large number of actions is, in reality, relatively unresolved. The extension of the traditional LA to problems within this domain cannot be easily established when the number of actions is very large. This is because the dimensionality of the action probability vector is correspondingly large, and so, most components of the vector will soon have values that are smaller than the machine accuracy permits, implying that they will never be chosen. This paper presents a solution that extends the continuous pursuit paradigm to such large-actioned problem domains. The beauty of the solution is that it is hierarchical, where all the actions offered by the environment reside as leaves of the hierarchy. Furthermore, at every level, we merely require a two-action LA that automatically resolves the problem of dealing with arbitrarily small action probabilities. In addition, since all the LA invoke the pursuit paradigm, the best action at every level trickles up toward the root. Thus, by invoking the property of the “max” operator, in which the maximum of numerous maxima is the overall maximum, the hierarchy of LA converges to the optimal action. This paper describes the scheme and formally proves its E-optimal convergence. The results presented here can, rather trivially, be extended for the families of discretized and Bayesian pursuit LA too. This paper also reports extensive experimental results (including for environments having 128 and 256 actions) that demonstrate the power of the scheme and its computational advantages. As far as we know, there are no comparable pursuitbased results in the field of LA. In some cases, the hierarchical continuous pursuit automaton requires less than 18% of the number of iterations than the benchmark LR-Ischeme, which is, by all metrics, phenomenal.

In this paper, we propose an adaptive fuzzy user profiling method for SPARQL: an RDF query language [1]. This work extends the study [2] where we proposed a manner by which we enrich SPARQL with fuzzy user preferences expression. According to our approach, users issue generic fuzzy quantified queries that are further refined based on his/her past interactions with the system. Unlike [2], we avoid prompting the user for manual expression of his/her preferences. Online preference learning approaches are by definition adaptive to changes over time of the user preferences which make them more attractive than their static counter-part. In order to achieve online learning, we resort to stochastic search and propose to integrate two different types of user feedback, namely rank-based and score-based. The efficiency of this approach was validated by some experimental results.

The Round-Trip Time (RTT) is a property of the path between a sender and a receiver communicating with Transmission Control Protocol (TCP) over an IP network and over the public Internet. The end-to-end RTT value influences significantly the dynamics and performance of TCP, which is by far the most used communication protocol. Thus, in communication networks, RTT is an important network performance variable. By measuring the traffic at an intermediate node, a network operator or service provider can estimate the RTT and use the estimation to study and troubleshoot the per-connection characteristics and performance. This paper aims at improving the accuracy and timeliness of the RTT estimation, to help network operators improving their analysis. We propose and evaluate a novel deep learning-based model capable of dynamically predicting at real-time the RTT between the sender and receiver with high accuracy based on passive measurements collected at an intermediate node, taking advantage of the commonly used TCP timestamps. We validate extensively our prediction methodology in a controlled experimental testbed and in a realistic scenario on the Google Cloud platform. We show that our model, which is based on classical deep learning algorithms, gives reasonably effective state-of-the-art performance results across multiple TCP congestion control variants. We also show that the model works well for transfer learning. Even though the RTT prediction model was trained on an emulated network, it performs well also when applied to a realistic scenario setting, as demonstrated in our experimental evaluation.

During maintenance and disaster recovery scenarios, Virtual Machine (VM) inter-site migrations usually take place over limited bandwidth-typically Wide Area Network (WAN)-which is highly affected by the amount of inter-VM traffic that becomes separated during the migration process. This causes both a degradation of the Quality of Service (QoS) of inter-communicating VMs and an increase in the total migration time due to congestion of the migration link. We consider the problem of scheduling VM migration in those scenarios. In the first stage, we resort to graph partitioning theory in order to partition the VMs into groups with high intra-group communication. In the second stage, we devise an affinity-based scheduling algorithm for controlling the order of the migration groups by considering their inter-group traffic. Comprehensive real-life experimental results and simulations show that our approach in some cases is able to decrease the volume of separated traffic by a factor larger than 60%.

Troubleshooting in SDN-based networks tends to be a cumbersome task that might overwhelm human attention. Researchers have uncovered various misconfiguration errors such as faulty rules and anomalous forwarding logic caused by missing batch-update acknowledgements and faulty protocol implementations. In this paper, we address the issue of inspecting entries in SDN flow tables by actively probing the data plane. iRecent works such as Monocle and Pronto address this by inserting a test rule per OpenFlow entry. However, this leads to an excessive increase in the size of the OpenFlow tables and unfortunately a wastage of the already scarce TCAM memory and an increase in the packet matching time. We present an efficient testing approach that uses a minimal number of test rules, as large as the number of the neighboring switches which is a handful number compared to Monocle and Pronto where the number of test of rules can be in the order of thousands depending on the size of the OpenFlow table. Furthermore, we devise an efficient and fast probe generation algorithm that generates one single probe packet per rule. Our experiment demonstrates that it takes approximately 1 second to test 3000 rules.

With the exponential growth in cloud computing, the steadily increasing amount of power consumption due to the use of physical and virtual machines is becoming a serious challenge. In this context, we report a study on optimizing the power and energy efficiency of physical and virtual machines in a cloud computing environment. The energy profile of different workloads is thoroughly investigated under different configurations. This paper presents the findings from our study which provides a good understanding of how different workloads affect power and energy efficiency of both physical and virtual machines.

Running a sheer virtualized data center with the help of Virtual Machines (VM) is the de facto-standard in modern data centers. Live migration offers immense flexibility opportunities as it endows the system administrators with tools to seamlessly move VMs across physical machines. Several studies have shown that the resource utilization within a data center is not homogeneous across the physical servers. Load imbalance situations are observed where a significant portion of servers are either in overloaded or underloaded states. Apart from leading to inefficient usage of energy by underloaded servers, this might lead to serious QoS degradation issues in the overloaded servers.

Virtual Machine (VM) migration is an important feature for ensuring smooth operations during maintenance and disaster recovery scenarios. The migration might be inter-site and in such a case the inter-site bandwidth which is typically Wide Area Network (WAN) might be a bottleneck. In such a case, the bandwidth is affected by the amount of inter-VM traffic that becomes separated during the migration process. The amount of separated traffic might not only cause degradation of the of the Quality of Service (QoS) of inter-communicating VMs but can also delay the migration process due to the congestion of the migration link. The state-of-the-art algorithm due to Yazidi et al. is an affinity aware algorithm that does not consider the completion time of the migration. The first stage of our algorithm is identical to Yazidi et al. where we resort to graph partitioning theory in order to partition the VMs into groups with high intra-group communication. In the second stage, we devise a greedy algorithm for controlling the order of the migration groups by considering their inter-group traffic that greedily selects groups with the lowest impact in terms of volume of separated traffic which we denominate Minimum-Impact First (MIF). We also design a latency-aware algorithm that only schedules the quickest migration first. The latter simple heuristic interestingly outperforms legacy works in the case of migration over a non-dedicated link. We find that our MIF algorithm consistently outperforms the state-of-the-art algorithms by a clear margin using real-traffic traces by a margin larger than 40%. We show that the MIF algorithm ensures the lowest amount of separated traffic in both dedicated-link and non-dedicated-link scenarios.

Identifying the underlying TCP variant from passive measurements is important for several reasons, e.g., exploring security ramifications, traffic engineering in the Internet, etc. In this paper, we are interested in investigating the delay characteristics of widely used TCP algorithms that exploit queueing delay as a congestion signal. Hence, we present an effective TCP variant identification methodology from traffic measured passively by analyzing β, the multiplicative back-off factor to decrease the cwnd on a loss event, and the queueing delay values. We address how β varies as a function of queueing delay and how the TCP variants of delay-based congestion control algorithms can be predicted both from passively measured traffic and real measurements over the Internet. We further employ a novel non-stationary time series approach from a stochastic nonparametric perspective using a two-sided Kolmogorov-Smirnov test to classify delay-based TCP algorithms based on the α, the rate at which a TCP sender's side cwnd grows per window of acknowledged packets, parameter. Through extensive experiments on emulated and realistic scenarios, we demonstrate that the data-driven classification techniques based on probabilistic models and Bayesian inference for optimal identification of the underlying delay-based TCP congestion algorithms give promising results. We show that our method can also be applied equally well to loss-based TCP variants.

With the emergence of the concept of big data, Hadoop MapReduce has been the de facto standard programming model for processing a large amount of data stored on the different cluster nodes in a distributed manner. It is known that the implementation of MapReduce operation with the default configuration yields a low number of parallel running jobs. In fact, poor resource utilization and overall low performance are usually induced by the default configuration. Although a myriad of works has been carried out in the literature for optimally configuring Hadoop MapReduce, the absolute vast majority of those works only consider offline and static configuration. Those approaches are clearly ineffective as the load might change during execution requiring tuning again the configuration parameters. In this work, we rather focus on dynamical and adaptively configuring Hadoop MapReduce by changing the system level Maximum Application Master Resource in Percent (MARP) parameter on the fly. We show that adaptively tuning the MARP parameter yields a good trade-off between job parallelism and throughput. To achieve this, an optimal design which we call Adaptive Parameter Tuning of Hadoop (APTH) based on a novel variant of the Tsetlin Automata is devised. Comprehensive experimental results show that the resources are optimally and appropriately utilized, resulting in better job parallelism and throughput. Furthermore, it is found that our APTH approach spends 47% less time for job execution as compared to the default configuration.

We present a novel lightweight incremental quantile estimator which possesses far less complexity than the Tierney's estimator and its extensions. Notably, our algorithm relies only on tuning one single parameter which is a plausible property which we could only find in the discretized quantile estimator Frugal. This makes our algorithm easy to tune for better performance. Furthermore, our algorithm is multiplicative which makes it highly suitable to handle quantile estimation in systems in which the underlying distribution varies with time. Unlike Frugal and our legacy work which are randomized algorithms, we suggest deterministic updates where the step size is adjusted in a subtle manner to ensure the convergence. The deterministic algorithm is more efficient since the estimate is updated at every iteration. The convergence of the proposed estimator is proven using the theory of stochastic learning. Extensive experimental results show that our estimator clearly outperforms legacy works.

Different end-to-end Transmission Control Protocol (TCP) algorithms widely in use behave differently under network congestion. The TCP congestion control itself has grown increasingly complex which in practice makes predicting TCP per-connection states from passive measurements a challenging task. In this paper, we present a robust, scalable and generic machine learning-based model which may be of interest for network operators that experimentally infers the underlying variant of loss-based TCP algorithms within a flow from passive traffic measurements collected at an intermediate node. We believe that our study has also a potential benefit and opportunity for researchers and scientists in the networking community from both academia and industry who want to assess the characteristics of TCP transmission states related to network congestion. We validate the robustness and scalability approach of our prediction model through several controlled experiments. It turns out, surprisingly enough, that the learned prediction model performs reasonably well by leveraging knowledge from the emulated network when it is applied on a real-life scenario setting bearing similarity to the concept of transfer learning in the machine learning community. The accuracy of our experimental results both in an emulated network, realistic and combined scenario settings and across multiple TCP variants demonstrate that our model is effective and has considerable potential.

Software Defined Networking (SDN) is designed for dynamic policy update where frequent changes are pushed to the forwarding devices. Different offline approaches for detecting misconfiguration anomalies in SDN by taking a snapshot of the state of the network have been developed in the literature. However, the detection process is time-consuming and unfeasible in the case of frequent changes to the OpenFlow tables as well in big size networks containing a large number of rules. This paper presents an incremental method for detecting potential anomalies in an online manner, i.e., after one or multiple simultaneous updates in the SDN policy. Whenever the OpenFlow tables are dynamically changed, a static approach that rechecks the whole policy is unnecessarily redundant in a sense that most of the policy remains intact. Hence the need for incremental verification method to reduce this overhead, and only the subset of the policy that is affected by the update is checked. Two different solutions are proposed based on whether the policy modifications take place in the ingress switches or in the middle switches. We provide some comprehensive experiments to demonstrate the detection performance for the case of single or multiple simultaneous changes in forwarding devices. The experiment results show that the incremental method is drastically faster than the static parallel approach, with a factor up to about 450 times in some cases.

Long Short-Term Memory (LSTM) neural networks are a state-of-the-art techniques when it comes to sequence learning and time series prediction models. In this paper, we have used LSTM-based Recurrent Neural Networks (RNN) for building a generic prediction model for Transmission Control Protocol (TCP) connection characteristics from passive measurements. To the best of our knowledge, this is the first work that attempts to apply LSTM for demonstrating how a network operator can identify the most important system-wide TCP per-connection states of a TCP client that determine a network condition (e.g., cwnd) from passive traffic measured at an intermediate node of the network without having access to the sender. We found out that LSTM learners outperform the state-of-the-art classical machine learning prediction models. Through an extensive experimental evaluation on multiple scenarios, we demonstrate the scalability and robustness of our approach and its potential for monitoring TCP transmission states related to network congestion from passive measurements. Our results based on emulated and realistic settings suggest that Deep Learning is a promising tool for monitoring system-wide TCP states from passive measurements and we believe that the methodology presented in our paper may strengthen future research work in the computer networking community.

Enterprise networks constantly face new security challenges. Obtaining complete network security is almost impossible, especially when usability requirements are taken into account. Previous research has provided ways to identify multi-stage attacks caused by network vulnerabilities and misconfigurations, but few have addressed ways to circumvent those multi-stage attacks, especially when usability requirements are taken into account. The latter problem is reckoned as Network Hardening problem [10] and is known to be an NP hard combinatorial problem. In this paper, we map the network hardening problem to a constrained optimization problem and resort to the theory of Population-Based Incremental Learning (PBIL) in order to solve it. We devise two approaches based on the PBIL, namely the Acceptance-Rejection approach, and the Penalty-based approach. Our aim is to tighten the security of the network by minimizing the number of privileges that an attacker can gain over network under some usability constraints measured in terms of the number of configurations in a network that can be activated or cannot be deactivated. The Acceptance-Rejection approach disqualifies configurations that violate the usability constraint while the Penalty-based approach relaxes the latter constraint by attempting to find a compromise between security and usability of the configuration. While the Acceptance-Rejection approach can be seen as a simple alternative to the state of the art MinCostSAT solution adopted in [10], the Penalty-based approach is, to the best of our knowledge, the first solution in the literature that tries to find such compromise. Experimental results show that the devised approaches are computationally efficient, scalable and reliable.

With the increasing threats of security attacks, Machine learning (ML) has become a popular technique to detect those attacks. However, most of the ML approaches are black-box methods and their inner-workings are difficult to understand by human beings. In the case of network security, understanding the dynamics behind the classification model is a crucial element towards creating safe and human-friendly systems. In this article, we investigate the most important features in identifying well-known security attacks by using Support Vector Machines (SVMs) and l1-regularized method with Least Absolute Shrinkage and Selection Operator (LASSO) for robust regression both to binary and multiclass attack classification. SVMs are one of the standards of ML classification techniques that give a reasonably good performance but with some drawbacks in terms of interpretability. On the other hand, LASSO is a regularized regression method often performing comparably well and it has extra compelling advantages of being very easily interpretable. LASSO provides coefficients that contribute how individual features affect the probability of specific security attack classes to occur. Hence, we finally use LASSO in particular for multiclass classification to help us better understand which actual features shared by attacks in a network are the most important ones. To perform our analysis, we use the recent NSL-KDD intrusion detection public dataset where the data are labeled into either anomalous (denial-of-service (DoS), remote-to-local (R2L), user-to-root (U2R) and probe attack classes) or normal. Empirical results of the analysis and computational performance comparison over the competing methods used are also presented and discussed. We believe that the methodology presented in this paper may strengthen a future research in network intrusion detection settings.

Amazon spot instances have become a very popular alternative for cost-saving in the cloud. The spot instances are prone to abrupt termination whenever the spot market price exceeds the bid price. In this paper, spot instances are resorted to in task instances' group of Amazon Elastic MapReduce (EMR) cluster to process batch jobs with deadline. Amazon EMR makes it convenient to process Big Data with the aid of the Hadoop framework. However, the processed intermediate results in the task nodes of the cluster are lost if the spot instances gets terminated which can cause processing delay. The cost efficiency can be realized by exploiting the non-real time nature of batch computing for Big Data. Two algorithms are devised for achieving cost efficient processing in Hadoop MapReduce. Both algorithms process data in divisions such that abrupt termination of spot instances only affects the last division. Based on monitoring the progress at given checkpoints, task group's capacity is resized to complete the processing within the deadline. Progress is measured in terms of the number of completed work divisions. The first algorithm begins with some spot instances whose number is initially estimated. To complete processing of all data in time, on-demand instances are deployed after a certain threshold time. The second algorithm starts by using higher number of spot instances than required to complete the work within the given deadline. Therefore, it has higher chance to rely solely on instances during the whole execution of the batch job. On-demand instances are deployed only in case of slow progress caused by termination of the spot instances combined with subsequent unsuccessful bids. The experiments show that both algorithms are able to minimize the processing cost. The second algorithm further minimizes the cost in most cases

The classification of dynamical data streams is among the most complex problems encountered in classification. This is, firstly, because the distribution of the data streams is non-stationary, and it changes without any prior “warning”. Secondly, the manner in which it changes is also unknown. Thirdly, and more interestingly, the model operates with the assumption that the correct classes of previously-classified patterns become available at a juncture after their appearance. This paper pioneers the use of unreported novel schemes that can classify such dynamical data streams by invoking the recently-introduced “Anti-Bayesian” (AB) techniques. Contrary to the Bayesian paradigm, that compare the testing sample with the distribution's central points, AB techniques are based on the information in the distant-from-the-mean samples. Most Bayesian approaches can be naturally extended to dynamical systems by dynamically tracking the mean of each class using, for example, the exponential moving average based estimator, or a sliding window estimator. The AB schemes introduced by Oommen et al., on the other hand, work with a radically different approach and with the non-central quantiles of the distributions. Surprisingly and counter-intuitively, the reported AB methods work equally or close-to-equally well to an optimal supervised Bayesian scheme on a host of accepted PR problems. This thus begs its natural extension to the unexplored arena of classification for dynamical data streams. Naturally, for such an AB classification approach, we need to track the non-stationarity of the quantiles of the classes. To achieve this, in this paper, we develop an AB approach for the online classification of data streams by applying the efficient and robust quantile estimators developed by Yazidi and Hammer [3], [13]. Apart from the methodology itself, in this paper, we compare the Bayesian and AB approaches. The results demonstrate the intriguing and counter-intuitive results that the AB approach shows competitive results to the Bayesian approach. Furthermore, the AB approach is much more robust against outliers, which is an inherent property of quantile estimators [3], [13], which is a property that the Bayesian approach cannot match, since it rather tracks the mean.

Cloud service providers are trying to reduce their operating costs while offering their services with a higher quality via resorting to the concept of elasticity. However, the vast majority of related work focuses solely on guaranteeing the quality of service (QoS) of interactive applications such as Web services. Nevertheless, a broad range of applications have different QoS constraints that do not fall under the same class of latency-critical applications. For instance, batch processing possesses QoS requirements that are latency-tolerant and usually defined in terms of job progress. In this sense, a possible manner to quantify the performance of a batch processing application is to estimate its job progress so that to determine if future deadlines can be met. The novelty of this work is two-fold. First, we propose a hybrid controller coordinating resource allocation between interactive and batch applications running at the same infrastructure. The intuition is to deploy a controller for the interactive application at a faster time-scale than the batch application. Second, we bridge the gap between vertical and horizontal scaling under the same framework. In this perspective, vertical scaling is used for small fluctuations in the load, while horizontal scaling handles larger load changes. Comprehensive experimental results demonstrate the feasibility of our approach and its efficiency in ensuring a high CPU utilization across all experiments consisting of 83.70% for the Web service and 89.51% for the batch service, while meeting the respective QoS requirements of both services.

SDN network's policies are updated dynamically at a high pace. As a result, conflicts between policies are prone to occur. Due to the large number of switches and heterogeneous policies within a typical SDN network, detecting those conflicts is a laborious and challenging task. This paper presents two-fold contributions. First, we devise an offline method for detecting unmatched OpenFlow rules, i.e., those rules that are never fired. At the heart of our scheme is a formal approach for predicting the packet's path inside a SDN network. In this perspective, we proffer the taxonomy: invalid and irrelevant anomalies for the unmatched rules. Second, we introduce a new set of definitions for the intra-anomalies, which might occur when using the OpenFlow rule's multi-action feature. We provide some comprehensive experimental results that show the feasibility of our approach and its ability to scale within large SDN network.

Virtual Machine (VM) consolidation in the cloud has received significant research interest. A large body of approaches for VM consolidation in data centers resort to variants of the bin packing problem which tries to minimize the number of deployed physical machines while meeting the Service-Level-Agreement (SLA) constraints. In this paper we introduce the concept of workload delay as a Quality-of-Service (QoS) metric that captures directly the resulting degradation that a cloud user would experience in the case where the SLA is violated. Our results, that are based on real-life trace-based simulations, show that consolidating VMs based on the level of utilization results in little control over the resulting delay, a particularly significant drawback when running jobs with deadline requirements, while we are able to control the delay much better if we take into account our suggested metric of the delay.

The purpose of this paper is to propose a solution to an extremely pertinent problem, namely, that of identifying unreliable sensors (in a domain of reliable and unreliable ones) without any knowledge of the ground truth. This fascinating paradox can be formulated in simple terms as trying to identify stochastic liars without any additional information about the truth. Though apparently impossible, we will show that it is feasible to solve the problem, a claim that is counter-intuitive in and of itself. One aspect of our contribution is to show how redundancy can be introduced, and how it can be effectively utilized in resolving this paradox. Legacy work and the reported literature (for example, in the so-called weighted majority algorithm) have merely addressed assessing the reliability of a sensor by comparing its reading to the ground truth either in an online or an offline manner. Unfortunately, the fundamental assumption of revealing the ground truth cannot be always guaranteed (or even expected) in many real life scenarios. While some extensions of the Condorcet jury theorem [9] can lead to a probabilistic guarantee on the quality of the fused process, they do not provide a solution to the unreliable sensor identification problem. The essence of our approach involves studying the agreement of each sensor with the rest of the sensors, and not comparing the reading of the individual sensors with the ground truth-as advocated in the literature. Under some mild conditions on the reliability of the sensors, we can prove that we can, indeed, filter out the unreliable ones. Our approach leverages the power of the theory of learning automata (LA) so as to gradually learn the identity of the reliable and unreliable sensors. To achieve this, we resort to a team of LA, where a distinct automaton is associated with each sensor. The solution provided here has been subjected to rigorous experimental tests, and the results presented are, in our opinion, both novel and conclusive.

In this paper, we propose a novel classifier in two-dimensional feature spaces based on the theory of Learning Automata (LA). The essence of our scheme is to search for a separator in the feature space by imposing a LA based random walk in a grid system. To each node in the gird we attach an LA, whose actions are the choice of the edges forming the separator. The walk is self-enclosing, i.e, a new random walk is started whenever the walker returns to starting node forming a closed classification path yielding a many edged polygon. In our approach, the different LA attached at the different nodes search for a polygon that best encircles and separates each class. Based on the obtained polygons, we perform classification by labelling items encircled by a polygon as part of a class using ray casting function. From a methodological perspective, PolyLA has appealing properties compared to SVM. In fact, unlike PolyLA, the SVM performance is dependent on the right choice of the kernel function (e.g. Linear Kernel, Gaussian Kernel) - which is considered a “black art”. PolyLA can find arbitrarily complex separator in the feature space. Experimental results show that our scheme is able to perfectly separate both simple and complex patterns outperforming existing classifiers, such as polynomial and linear SVM, without the need of a “kernel trick”. We believe that the results are impressive given the simplicity of PolyLA compared to other approaches such as SVM.

With the dramatic growth of network attacks, a new set of challenges has raised in the field of electronic security. Undoubtedly, firewalls are core elements in the network security architecture. However, firewalls may include policy anomalies resulting in critical network vulnerabilities. A substantial step towards ensuring network security is resolving packet filter conflicts. Numerous studies have investigated the discovery and analysis of filtering rules anomalies. However, no such emphasis was given to the resolution of these anomalies. Legacy work for correcting anomalies operate with the premise of creating totally disjunctive rules. Unfortunately, such solutions are impractical from implementation point of view as they lead to an explosion of the number of firewall rules. In this paper, we present a new approach for performing assisted corrective actions, which in contrast to the-state-of-the-art family of radically disjunctive approaches, does not lead to a prohibitive increase of the firewall size. In this sense, we allow relaxation in the correction process by clearly distinguishing between constructive anomalies that can be tolerated and destructive anomalies that should be systematically fixed. This distinction between constructive and destructive anomalies is assisted by the network administrator which supports the fact that he has a major role in the heart of the corrective process. To the best of our knowledge, such assisted approach for relaxed resolution of packet filter conflicts was not investigated before. We provide theoretical analysis that demonstrate that our scheme results is sound and indeed result into a conflict-free policy. In addition, we have implemented our solution in a user friendly tool.

Legacy work on correcting firewall anomalies operate with the premise of creating totally disjunctive rules. Unfortunately, such solutions are impractical from implementation point of view as they lead to an explosion of the number of firewall rules. In a related previous work, we proposed a new approach for performing assisted corrective actions, which in contrast to the-state-of-the-art family of radically disjunctive approaches, does not lead to a prohibitive increase of the configuration size. In this sense, we allow relaxation in the correction process by clearly distinguishing between constructive anomalies that can be tolerated and destructive anomalies that should be systematically fixed. However, a main disadvantage of the latter approach was its dependency on the guided input from the administrator which controversially introduces a new risk for human errors. In order to circumvent the latter disadvantage, we present in this paper a Firewall Policy Query Engine (FPQE) that renders the whole process of anomaly resolution a fully automated one and which does not require any human intervention. In this sense, instead of prompting the administrator for inserting the proper order corrective actions, FPQE executes those queries against a high level firewall policy. We have implemented the FPQE and the first results of integrating it with our legacy anomaly resolver are promising.

The fusioning of data from unreliable sensors has received much research attention. The main stream of research assesses the reliability of a sensor by comparing its readings to the ground truth in an online or offline manner. For instance, the Weighted Majority Algorithm is a representative example of a large class of similar legacy algorithms. Recently, some advances have been achieved in identifying unreliable sensors without any knowledge of the ground truth which seems a paradox in itself. In this paper, we present a simple mechanism for solving the problem using Tsetlin-like Learning Automata (LA). Our approach leverages a Random Walk (RW) inspired by Tsetlin LA so that to gradually learn the identity of the reliable and unreliable sensors. In this perspective, we resort to a team of RWs, where a distinct RW is associated with each sensor. By virtue of the limited memory requirement of our devised LA, we achieve adaptive behavior at the cost of negligible loss in the accuracy.

Generally speaking, research in the field of estimation involves designing strong estimators, i.e., those which converge with probability 1, as the number of samples increases indefinitely. But when the underlying distribution is nonstationary, one should rather seek for weak estimators, i.e., those which can unlearn when the distribution has changed. One such estimator, the so-called stochastic learning weak estimator (SLWE) was based on the principles of continuous stochastic learning automata (LA). A problem that has been unsolved has been that of designing such weak estimators in the context of systems with finite memory, which is what we investigate here. In this paper, we propose a new family of stochastic discretized weak estimators which can track time-varying binomial distributions. As opposed to the SLWE, our proposed estimator is discretized, i.e., the estimate can assume only a finite number of values. By virtue of discretization, our estimator realizes extremely fast adjustments of the running estimates by executing jumps, and it is thus able to robustly, and very quickly, track changes in the parameters of the distribution after a switch has occurred. The design principle of our strategy is based on a solution for the stochastic search on the line problem. In order to achieve efficient estimation, we have to first infer (or rather simulate) an Artificial Oracle which informs the LA whether to go right or left, which is then utilized to infer whether we are to increase the current estimate or to decrease it. This paper briefly reports pioneering and conclusive experimental results that demonstrate the ability of the proposed estimator to cope with nonstationary environments.

Greener cloud computing has recently become an extremely pertinent research topic in academy and among practitioners. Despite the abundance of the state of the art studies that tackle the problem, the vast majority of them solely rely on simulation, and do not report real settings experience. Thus, the theoretical models might overlook some of the practical details that might emerge in real life scenarios. In this paper, we try to bridge the aforementioned gap in the literature by devising and also deploying algorithms for saving power in real-life cloud environments based on variants of the 2D/3D bin packing algorithms. The algorithms are tested on a large Open Stack deployment in use by staff and students at Oslo and Akers us University College, Norway. We present three different adoptions of 2D and 3D bin packing, incorporating different aspects of the cloud as constraints. Our real-life experimental results show that although the three algorithms yield a decrease in power consumption, they distinctly affect the way the cloud has to be managed. A simple bin packing algorithm provides useful mechanism to reduce power consumption while more sophisticated algorithms do not merely achieve power savings but also minimize the number of migrations.

Stochastic point location (SPL) deals with the problem of a learning mechanism (LM) determining the optimal point on the line when the only input it receives are stochastic signals about the direction in which it should move. One can differentiate the SPL from the traditional class of optimization problems by the fact that the former considers the case where the directional information, for example, as inferred from an Oracle (which possibly computes the derivatives), suffices to achieve the optimization-without actually explicitly computing any derivatives. The SPL can be described in terms of a LM (algorithm) attempting to locate a point on a line. The LM interacts with a random environment which essentially informs it, possibly erroneously, if the unknown parameter is on the left or the right of a given point. Given a current estimate of the optimal solution, all the reported solutions to this problem effectively move along the line to yield updated estimates which are in the neighborhood of the current solution(1) This paper proposes a dramatically distinct strategy, namely, that of partitioning the line in a hierarchical tree-like manner, and of moving to relatively distant points, as characterized by those along the path of the tree. We are thus attempting to merge the rich fields of stochastic optimization and data structures. Indeed, as in the original discretized solution to the SPL, in one sense, our solution utilizes the concept of discretization and operates a uni-dimensional controlled random walk (RW) in the discretized space, to locate the unknown parameter. However, by moving to nonneighbor points in the space, our newly proposed hierarchical stochastic searching on the line (HSSL) solution performs such a controlled RW on the discretized space structured on a superimposed binary tree. We demonstrate that the HSSL solution is orders of magnitude faster than the original SPL solution proposed by Oommen. By a rigorous analysis, the HSSL is shown to be optimal if the effectiveness (or credibility) of the environment, given by p , is greater than the golden ratio conjugate. The solution has been both analytically solved and simulated, and the results obtained are extremely fascinating, as this is the first reported use of time reversibility in the analysis of stochastic learning. The learning automata extensions of the scheme are currently being investigated. As we shall see later, hierarchical solutions have been proposed in the field of LA.

Discovering and tracking of spatiotemporal patterns in noisy sequences of events are difficult tasks that have become increasingly pertinent due to recent advances in ubiquitous computing, such as community-based social networking applications. The core activities for applications of this class include the sharing and notification of events, and the importance and usefulness of these functionalities increase as event sharing expands into larger areas of one's life. Ironically, instead of being helpful, an excessive number of event notifications can quickly render the functionality of event sharing to be obtrusive. Indeed, any notification of events that provides redundant information to the application/user can be seen to be an unnecessary distraction. In this paper, we introduce a new scheme for discovering and tracking noisy spatiotemporal event patterns, with the purpose of suppressing reoccurring patterns, while discerning novel events. Our scheme is based on maintaining a collection of hypotheses, each one conjecturing a specific spatiotemporal event pattern. A dedicated learning automaton (LA)--the spatiotemporal pattern LA (STPLA)--is associated with each hypothesis. By processing events as they unfold, we attempt to infer the correctness of each hypothesis through a real-time guided random walk. Consequently, the scheme that we present is computationally efficient, with a minimal memory footprint. Furthermore, it is ergodic, allowing adaptation. Empirical results involving extensive simulations demonstrate the superior convergence and adaptation speed of STPLA, as well as an ability to operate successfully with noise, including both the erroneous inclusion and omission of events. An empirical comparison study was performed and confirms the superiority of our scheme compared to a similar state-of-the-art approach. In particular, the robustness of the STPLA to inclusion as well as to omission noise constitutes a unique property compared to other related approaches. In addition, the results included, which involve the so-called " presence sharing" application, are both promising and, in our opinion, impressive. It is thus our opinion that the proposed STPLA scheme is, in general, ideal for improving the usefulness of event notification and sharing systems, since it is capable of significantly, robustly, and adaptively suppressing redundant information.