Along with the rapid development of the Internet of Things (IoT), a massive number of IoT devices are connected to the Internet. Smartphones as typical IoT devices which collect valuable and important data from users. Based on data analysis, smartphones can provide valuable services to users, such as intelligent recommendations, location-based introductions, etc. Since smartphones are connected to the Internet, it increases the risks of attacks from adversaries. Android is one of the most popular mobile operating systems, the number of attacks targets Android systems increase significantly. However, there are some limitations of malware detection applications for Android systems, for example, it cannot identify new malware that was not signed by the malware database. In addition, it has a low detection rate in the dynamic detection process since the malware hides malicious activities. Therefore, it is necessary to develop a new malware detection scheme for Android systems. In this study, we propose a Cross Inspection Framework (CIF) to detect malware on Android systems. CIF enables both static and dynamic detections and the evaluation shows the proposed CIF has better performance than only executing static or dynamic detection on Android systems.

As a popular method for image and video retargeting, seam carving has been used for image/video forgery manipulation. Although significant advances have been made in detecting seam-carving forgery, there are very few contributions in exposing the forgery from recompressed JPEG images, especially the doctored images that are recompressed at the same or a lower quality. The detection is generally challenging because the recompression after tampering compromises the existing forgery traces. Aiming to address this problem, we propose a hybrid large-feature mining-based approach that contains multiple types of large features. Ensemble learning is used to deal with the high-feature dimensionality. This paper shows that the proposed approach effectively distinguishes the seam-carved JPEG images from untouched JPEG images and improves the detection accuracy. In our proposed multiple types of features, directional derivative-based feature set and Gabor residual-based feature set generally perform the best. This paper also indicates that feature selection may play an important role to greatly reduce the feature number while maintaining a better or comparable detection accuracy.

Inpainting, originally designed in computer vision to reconstruct lost or deteriorated parts of images and videos, has been used for image tampering, including region filling and object removal to alter the truth. While several types of tampering including copy-move and seam carving forgery can now be successfully exposed in image forensics, there has been very little study to tackle inpainting forgery in JPEG images, the detection of which is extremely challenging due to the post-recompression attacks performed to cover or compromise original inpainting traces. To date, there is no effective way to detect inpainting image forgery under combined recompression attacks. To fill such a gap in image forensics and reveal inpainting forgery from the post-recompression attacks in JPEG images, we propose in this paper an approach that begins with large feature mining in discrete transform domain, ensemble learning is then applied to deal with the high feature dimensionality and to prevent the overfitting that generally happens to some regular classifiers under high feature dimensions. Our study shows the proposed approach effectively exposes inpainting forgery under post recompression attacks; especially, it noticeably improves the detection accuracy while the recompression quality is lower than the original JPEG image quality, and thus bridges a gap in image forgery detection.

While seam carving has been widely used in computer vision and multimedia processing, it is also used for tampering illusions. Although several methods have been proposed to detect seam carving-based forgery, to this date, the detection of the seam carving forgery under recompression attacks in JPEG images has not been explored. To fill this gap, we proposed a hybrid large scale feature mining-based detection method to distinguish the doctored JPEG images from the untouched JPEG images under recompression attacks. Over one hundred thousand features from the spatial domain and from the DCT transform domain are extracted. Ensemble learning is used to deal with the high dimensionality and to avoid overfitting that may occur with some traditional learning classifier for the detection. Our study demonstrates the efficacy of proposed approach to exposing the seam-carving forgery under recompression attacks, especially from a lower quality level or on the same quality recompression.

With the booming of smart phone and high-speed wireless networks in recent years, applications and data have been shifting from desktop to mobile devices at a vigorous pace. Although mobile computing provides great convenience in daily life, it becomes vulnerable to various types of emerging attacks. User authentication plays an indispensable role in protecting computer systems and applications, but the development of touch screen hardware and user habit change post requirements for new authentication methods for mobile and tablets devices. In this paper, we present a robust user authentication scheme using both static and dynamic features of touch gestures. We take advantage of the pressure sensitivity of multi-touch screens to obtain irreproducible biometric patterns. Discriminative features such as distance, angle, and pressure are extracted from the touch-point data, and used in statistical analysis for verification. We tested our scheme in a variety of experiments that involved multiple volunteers to perform various gestures. The analysis of experimental results and user feedback indicate the proposed scheme delivers comprehensive measurements and accurate pattern classification for touch gestures. Based on these results, we conclude that the proposed scheme overcomes the limitations of the existing user authentication methods, and shows great potential to provide robust protection against unauthorized access.

BACKGROUND: Because of its important effects, as an epigenetic factor, on gene expression and disease development, DNA methylation has drawn much attention from researchers. Detecting differentially methylated loci is an important but challenging step in studying the regulatory roles of DNA methylation in a broad range of biological processes and diseases. Several statistical approaches have been proposed to detect significant methylated loci; however, most of them were designed specifically for case-control studies. RESULTS: Noticing that the age is associated with methylation level and the methylation data are not normally distributed, in this paper, we propose a nonparametric method to detect differentially methylated loci under multiple conditions with trend for Illumina Array Methylation data. The nonparametric method, Cuzick test is used to detect the differences among treatment groups with trend for each age group; then an overall p-value is calculated based on the method of combining those independent p-values each from one age group. CONCLUSIONS: We compare the new approach with other methods using simulated and real data. Our study shows that the proposed method outperforms other methods considered in this paper in term of power: it detected more biological meaningful differentially methylated loci than others.

BACKGROUND: Combining information from different studies is an important and useful practice in bioinformatics, including genome-wide association study, rare variant data analysis and other set-based analyses. Many statistical methods have been proposed to combine p-values from independent studies. However, it is known that there is no uniformly most powerful test under all conditions; therefore, finding a powerful test in specific situation is important and desirable. RESULTS: In this paper, we propose a new statistical approach to combining p-values based on gamma distribution, which uses the inverse of the p-value as the shape parameter in the gamma distribution. CONCLUSIONS: Simulation study and real data application demonstrate that the proposed method has good performance under some situations.

Steganalysis and forgery detection in image forensics are generally investigated separately. We have designed a method targeting the detection of both steganography and seam-carved forgery in JPEG images. We analyze the neighboring joint density of the DCT coefficients and reveal the difference between the untouched image and the modified version. In realistic detection, the untouched image and the modified version may not be obtained at the same time, and different JPEG images may have different neighboring joint density features. By exploring the self-calibration under different shift recompressions, we propose calibrated neighboring joint density-based approaches with a simple feature set to distinguish steganograms and tampered images from untouched ones. Our study shows that this approach has multiple promising applications in image forensics. Compared to the state-of-the-art steganalysis detectors, our approach delivers better or comparable detection performances with a much smaller feature set while detecting several JPEG-based steganographic systems including DCT-embedding-based adaptive steganography and Yet Another Steganographic Scheme (YASS). Our approach is also effective in detecting seam-carved forgery in JPEG images. By integrating calibrated neighboring density with spatial domain rich models that were originally designed for steganalysis, the hybrid approach obtains the best detection accuracy to discriminate seam-carved forgery from an untouched image. Our study also offers a promising manner to explore steganalysis and forgery detection together.

Detection of double compression in digital multimedia is considered to reveal the history of multimedia signal processing, which is very useful in digital forensics. In this paper, distributions of quantized DCT coefficients are analyzed in depth after double MPEG-2 compression with constant bit rate (CBR) mode, and a new algorithm is presented to detect double MPEG-2 compression based on convex patterns in the distribution of quantized DCT coefficients. In order to demonstrate the practical value of our proposed algorithm, two digital video cameras (DV) and two MPEG-2 software coders are utilized to simulate the general process of double MPEG-2 compression. Experiment results show that the proposed scheme can effectively detect doubly MPEG-2 compressed videos with CBR mode and the target output bit rate can vary in a large range.

Critical dimension is the minimum number of features that is required to ensure the performance of a learning machine to be “high”. This critical dimension is usually unique to the learning machine and the ranking algorithm combination. Medical- and bio-informatics datasets are different from most other datasets in that there is an imbalance in most of these datasets and a high prediction accuracy often depends upon not just the overall accuracy but also the true positive and the false negative rates. To find a medically and bio-informatically accurate critical dimension and for better analysis of such datasets we develop two evaluation models, one using all features and the other using critical number of features. The performance measurements such as accuracy, specificity, sensitivity, area under the curve, F-score and kappa values are compared. This paper shows that at the critical dimension the evaluation model shows good results for all performance measurements measured on most datasets studied. The difference in performance measurements obtained using only critical number and using all features is significantly less, i.e., there is not much difference in sensitivity, specificity and other measurements calculated.

MOTIVATION: As an epigenetic alteration, DNA methylation plays an important role in epigenetic controls of gene transcription. Recent advances in genome-wide scan of DNA methylation provide great opportunities in studying the impact of DNA methylation on many human diseases including various types of cancer. Due to the unique feature of this type of data, applicable statistical methods are limited and new sophisticated approaches are desirable. RESULTS: In this article, we propose a new statistical test to detect differentially methylated loci for case control methylation data generated by Illumina arrays. This new method utilizes the important finding that DNA methylation is highly correlated with age. The proposed method estimates the overall P-value by combining the P-values from independent individual tests each for one age group. Through real data application and simulation study, we show that the proposed test is robust and usually more powerful than other methods.

The "curse of dimensionality" problem, which occurs in many applications involving data mining such as biomedical informatics, digital forensics, risk management, etc., makes it difficult to develop accurate learning machine classifiers when the dataset includes too many irrelevant or insignificant features. Therefore, finding the smallest set of features necessary to obtain the most accurate classifier is an issue of great theoretical and practical interest. In efforts toward developing formal methods for finding the "critical dimension", this paper presents an empirical study of the minimum number of features that are required for a learning machine to perform accurately. The dataset is first featured ranked; then, iteratively, the least important feature is removed and the performance is plotted against the number of features; the point at which the performance curve drops significantly and does not rise again gives the critical dimension, which is a unique number for each specific combination of learning machine and feature ranking method. It is shown in this paper that the critical dimension phenomenon indeed exists for several of the bioinformatics datasets studied.

The threat posed by hackers, spies, terrorists, and criminals, etc. using steganography for stealthy communications and other illegal purposes is a serious concern of cyber security. Several steganographic systems that have been developed and made readily available utilize JPEG images as carriers. Due to the popularity of JPEG images on the Internet, effective steganalysis techniques are called for to counter the threat of JPEG steganography. In this article, we propose a new approach based on feature mining on the discrete cosine transform (DCT) domain and machine learning for steganalysis of JPEG images. First, neighboring joint density features on both intra-block and inter-block are extracted from the DCT coefficient array and the absolute array, respectively; then a support vector machine (SVM) is applied to the features for detection. An evolving neural-fuzzy inference system is employed to predict the hiding amount in JPEG steganograms. We also adopt a feature selection method of support vector machine recursive feature elimination to reduce the number of features. Experimental results show that, in detecting several JPEG-based steganographic systems, our method prominently outperforms the well-known Markov-process based approach.

This article presents a second-order derivative-based audio steganalysis. First, Mel-cepstrum coefficients and Markov transition features from the second-order derivative of the audio signal are extracted; a support vector machine is then applied to the features for discovering the existence of hidden data in digital audio streams. Also, the relation between audio signal complexity and steganography detection accuracy, which is an issue relevant to audio steganalysis performance evaluation but so far has not been explored, is analyzed experimentally. Results demonstrate that, in comparison with a recently proposed signal stream-based Mel-cepstrum method, the second-order derivative-based audio steganalysis method gains a considerable advantage under all categories of signal complexity--especially for audio streams with high signal complexity, which are generally the most challenging for steganalysis-and thereby significantly improves the state of the art in audio steganalysis.

MP3 is the most popular format for audio storage and a de facto standard of digital audio compression for the transfer and playback. The flexibility of compression ratio of MP3 coding enables users to choose their customized configuration in the trade-off between file size and quality. Double MP3 compression often occurs in audio forgery, steganography and quality faking by transcoding an MP3 audio to a different compression ratio. To detect double MP3 compression, in this paper, we extract the statistical features on the modified discrete cosine transform, and apply support vector machines and a dynamic evolving neuron-fuzzy inference system to the extracted features for classification. Experimental results show that our method effectively and accurately detects double MP3 compression for both up-transcoded and down-transcoded MP3 files. Our study also indicates the potential for mining the audio processing history for forensic purposes.

With the availability of powerful multimedia editing software, all types of personalized image and video resources are available in networks. Multimedia forensics technology has become a new topic in the field of information security. In this paper, a new source video system identification algorithm is proposed based on the features in the video stream; it takes full advantage of the different characteristics in the rate control module and the motion prediction module, which are two open parts in the MPEG-2 video compression standard, and combines a support vector machine classifier to build an intelligent computing system for video source identification. The experiments show this proposed algorithm can effectively identify video streams that come from a number of video coding systems.

A novel approach for detecting video logo-removal forgery is proposed by measuring inconsistency of blur. Our approach is based on the assumption that if a digital video undergoes logo-removal forgery; the blurriness of the forged region is expected to be different as compared to the nontampered parts of the video. Blurriness is first estimated by analyzing the spatial and temporal statistical property of logo areas, and suspicious areas are roughly located; then features are extracted and a fine classification is implemented by applying support vector machine (SVM) to extract features. If the suspicious areas and the reference areas are classified into different classes, the video is judged as a forged video. Experimental results show that our method is robust to video lossy compression for logo-removal forgery detection with the advantages of high classification accuracy and low computation cost.

In this article, we propose a scheme for detecting hidden messages in compressed audio files produced by MP3Stego, as our literature search has found no previous work on successful steganalysis of MP3Stego. We extract moment statistical features on the second derivatives, as well as Markov transition features and neighboring joint density of the MDCT coefficients based on each specific frequency band on MPEG-1 audio layer 3. A support vector machine is applied to different feature sets for classification. Experimental results show that our approach is successful to discriminate MP3 covers and the steganograms generated by using MP3Stego.

In this paper, we present a novel stream data mining for audio steganalysis, based on second order derivative of audio streams. We extract Mel-cepstrum coefficients and Markov transition features on the second order derivative, a support vector machine is applied to the features for discovery of the existence of covert message in digital audios. We also explore the relation between signal complexity and detection performance on digital audios, which has not been studied previously. Our study shows that, in comparison with a recently proposed signal stream based Mel-cepstrum steganalysis, our method prominently improves the detection performance, which is not only related to information-hiding ratio but also signal complexity. Generally speaking, signal stream based Mel-cepstrum audio steganalysis performs well in steganalysis of audios with low signal complexity; it does not work so well on audios with high signal complexity. Our stream mining approach for audio steganalysis gains significant advantage in each category of signal complexity - especially in audios with high signal complexity, and thus improves the state of the art in audio steganalysis.

Detection of information-hiding in JPEG images is actively delivered in steganalysis community due to the fact that JPEG is a widely used compression standard and several steganographic systems have been designed for covert communication in JPEG images. In this paper, we propose a novel method of JPEG steganalysis. Based on an observation of bi-variate generalized Gaussian distribution in Discrete Cosine Transform (DCT) domain, neighboring joint density features on both intra-block and inter-block are extracted. Support Vector Machines (SVMs) are applied for detection. Experimental results indicate that this new method prominently improves a current art of steganalysis in detecting several steganographic systems in JPEG images. Our study also shows that it is more accurate to evaluate the detection performance in terms of both image complexity and information hiding ratio.

To improve a recently developed mel-cepstrum audio steganalysis method, we present in this paper a method based on Fourier spectrum statistics and mel-cepstrum coefficients, derived from the second-order derivative of the audio signal. Specifically, the statistics of the high-frequency spectrum and the mel-cepstrum coefficients of the second-order derivative are extracted for use in detecting audio steganography. We also design a wavelet-based spectrum and mel-cepstrum audio steganalysis. By applying support vector machines to these features, unadulterated carrier signals (without hidden data) and the steganograms (carrying covert data) are successfully discriminated. Experimental results show that proposed derivative-based and wavelet-based approaches remarkably improve the detection accuracy. Between the two new methods, the derivative-based approach generally delivers a better performance.

Mass spectrometry becomes the most widely used measurement in proteomics research. High dimensionality of features and small dataset are two major limitations restrict the accuracy of classification in mass spectrum data analysis. To improve the data mining result, two major issues need to be highlighted, which are feature extraction and feature selection. The quality of the feature set determines the reliability of the prediction of disease status. A well-known approach is to detect peak values and apply support vector machine recursive feature elimination (SVMRFE) to choose feature sets for classification. In this article, we successfully apply a distance metric learning to classify proteomics mass spectrometry data. Experimental results show that distance metric learning can successfully be applied to the classification of proteomics data and the results are comparable to the best results by applying SVM to the feature sets chosen with the use of SVMRFE.

In this article, we propose a scheme of detecting the information-hiding in videos based on the pairs of condition and joint distributions in the transform domains. Specifically, based on the approach of the Markov-process in JPEG image steganalysis and our previous work, we propose the pairs of condition and joint distribution of the neighbor difference in the transform domains, including discrete cosine transform (DCT) and the discrete wavelet transform (DWT). We apply learning classifiers to the pairs extracted from the video covers and the video steganograms produced by MSU Video Steganograms. Experimental results show that this approach is very successful in detecting the information-hiding in MSU stego video steganograms.

In this article, we propose a steganalysis method for detecting the presence of information-hiding behavior in wav audios. We extract the neighboring joint distribution features and the Markov features of the second order derivative, and combine these features with the error response by randomly modifying the least significant bit, then apply learning machines to the features for distinguishing the stegoaudios from cover videos. Experimental results show that our method performs well in steganalysis of the audio stegograms that are produced by using Hide4PGP, Invisible Secrets and S-tools4.

One of the Internet’s hallmark is the rapid spread of the use of information and communication technology. This has boosted methods for hiding stego information inside digital cover content images which is a concerning issue in information security. On the other hand, attack of steganographic schemes has leveraged methods for steganalysis which is a challenging problem. In this paper, first we look at the design of classifiers, such as, Support Vector Machines (SVM) and neural networks (RBF and MLP) which are able to detect the presence of Least Significant Bit (LSB) matching steganography of gray scale images. Second, by combining with feature ranking methods (SVM-Recursive Feature Elimination, Kruskal Wallis) and reduction techniques (PCA) pattern classification of stego is successfully achieved. It is of utmost importance to look at the large set of features extracted from images and find ranking methods able, namely, to exclude correlated and redundant features, avoid the curse of dimensionality or circumvent the need of the steganalyzer to be re-designed. Results show that desirable properties of robustness and resilience are attained by designing classifiers able to deal with redundancy and noise. Moreover, comparison of classifiers performance emphasizes the chosen model for the steganalyser.

In this article, based on the Markov approach proposed by shietal., we expand it to the inter-blocks of the DCT domain, calculate the difference of the expanded Markov features between the testing image and the calibrated version, and combine these difference features and the polynomial fitting features on the histogram of the DCT coefficients as detectors. We reasonably improve the detection performance in multi-class JPEG images. We also compare the steganalysis performance among the feature reduction/selection methods based on principal component analysis, singular value decomposition, and Fisherpsilas linear discriminant.

MOTIVATION: Affymetrix GeneChip arrays require summarization in order to combine the probe-level intensities into one value representing the expression level of a gene. However, probe intensity measurements are expected to be affected by different levels of non-specific- and cross-hybridization to non-specific transcripts. Here, we present a new summarization technique, the Distribution Free Weighted method (DFW), which uses information about the variability in probe behavior to estimate the extent of non-specific and cross-hybridization for each probe. The contribution of the probe is weighted accordingly during summarization, without making any distributional assumptions for the probe-level data. RESULTS: We compare DFW with several popular summarization methods on spike-in datasets, via both our own calculations and the 'Affycomp II' competition. The results show that DFW outperforms other methods when sensitivity and specificity are considered simultaneously. With the Affycomp spike-in datasets, the area under the receiver operating characteristic curve for DFW is nearly 1.0 (a perfect value), indicating that DFW can identify all differentially expressed genes with a few false positives. The approach used is also computationally faster than most other methods in current use. AVAILABILITY: The R code for DFW is available upon request. SUPPLEMENTARY INFORMATION: Supplementary data are available at Bioinformatics online.

Class prediction and feature selection are two learning tasks that are strictly paired in the search of molecular profiles from microarray data [21]. In this paper, we present a scheme of recursive feature addition for gene selection combining classifiers for the purpose of classifying tumor tissues using DNA microarray data. Based on the highest train accuracy, the next gene is added into the feature set according to the measures of the correlation / mutual information between chosen genes and candidate genes. In comparison with the well-known gene selection methods of T-TEST and SVM-RFE using different classifiers, our method, on the average, performs the best regarding the classification accuracy under different feature dimensions.

Microarray gene expression data has high dimension and small samples, the gene selection is very important to the classification accuracy. In this paper, we present a scheme of recursive feature addition for microarray gene expression classification based on supervised learning and the similarity measure between chosen genes and candidates. In comparison with the well-known gene selection methods of T-TEST and SVM-RFE using different classifiers, our method, on the average, performs the best regarding the classification accuracy under different feature dimensions, the mean test accuracy and the highest test accuracy under the highest train accuracy, and the highest test accuracy in the experiments.