An Intrusion Detection System (IDS) is vital for monitoring network traffic and alerting users to threats. Unlike traditional IDS, which relies on centralized data processing and raises privacy concerns, Federated Learning (FL)-based IDSs enable collaborative model training among multiple clients while keeping user data private. However, explaining model behavior in FL using Explainable AI (XAI) is challenging due to its distributed nature and lack of access to client data. Traditional XAI methods like LIME and SHAP require input data, which conflicts with FL’s privacy constraints. In this work, we develop a deep neural network (DNN)-based IDS in FL setup in Non-IID (non-independent and identically distributed) settings. Our FL-DNN model achieves high performance in binary classification for detecting malicious network traffic. In this work, we propose a novel privacy-preserving, explainable federated learning framework that uses high-quality synthetic data to enable explainability of the Global DNN model without exposing client data to the server. To generate synthetic data, we train multiple federated generative models in Non-IID settings. Among them, the Federated Wasserstein Conditional GAN with Gradient Penalty (FL-WCGAN-GP) produces synthetic samples with high data quality at the server. These synthetic samples on the server side are then used as reference inputs for post-hoc XAI methods for explaining the global DNN model. We assess the sufficiency of synthetic data-based explanations for the Global DNN model using SHAP, showing that Synthetic data-based explanations closely approximate the explanations derived from real client data. Further, we quantitatively evaluate post-local explanations of LIME and SHAP based on faithfulness and robustness. Results show that SHAP provides more faithful and robust explanations than LIME for client-side models using real data and server-side models using synthetic data, supporting privacy-preserving explainability in trustworthy FL-based IDS.

A Network Intrusion Detection System (NIDS) monitors networks for cyber attacks and other unwanted activities. However, NIDS solutions often generate an overwhelming number of alerts daily, making it challenging for analysts to prioritize high-priority threats. While deep learning models promise to automate the prioritization of NIDS alerts, the lack of transparency in these models can undermine trust in their decision-making. This study highlights the critical need for explainable artificial intelligence (XAI) in NIDS alert classification to improve trust and interpretability. We employed a real-world NIDS alert dataset from Security Operations Center (SOC) of TalTech (Tallinn University Of Technology) in Estonia, developing a Long Short-Term Memory (LSTM) model to prioritize alerts. To explain the LSTM model's alert prioritization decisions, we implemented and compared four XAI methods: Local Interpretable Model-Agnostic Explanations (LIME), SHapley Additive exPlanations (SHAP), Integrated Gradients, and DeepLIFT. The quality of these XAI methods was assessed using a comprehensive framework that evaluated faithfulness, complexity, robustness, and reliability. Our results demonstrate that DeepLIFT consistently outperformed the other XAI methods, providing explanations with high faithfulness, low complexity, robust performance, and strong reliability. In collaboration with SOC analysts, we identified key features essential for effective alert classification. The strong alignment between these analyst-identified features and those obtained by the XAI methods validates their effectiveness and enhances the practical applicability of our approach.

This paper introduces a framework for analyzing cerebral palsy (CP) gait using a markerless 3D computer vision system equipped with two RGB cameras. The system employs advanced pose estimation algorithms and machine learning techniques to analyze gait dynamics. Although limited by the model’s simplicity at certain joints—particularly the pelvis, which is represented by just two points—the system integrates the four most clinically relevant out of 11 measured kinematic variables. The system excels in capturing large joint angles like knee flexion/extension but faces challenges with smaller angles such as hip abduction/adduction due to the limitations of single-point representation. Comprehensive gait metrics, including cadence and walking speed, are derived by projecting foot movements onto the floor plane, providing valuable insights into gait mechanics. This research simplifies the technology required for precise gait analysis and enhances its accessibility in clinical settings, offering significant advancements in the diagnosis and treatment of movement disorders.

The present paper discusses the adaptation of the transformer model for the case of numerical data. Although transformers are usually associated with large language models, there are many areas where the dependencies between the numeric input and the numeric output are too complex for statistical machine learning techniques. To apply a transformer for the numeric case, alternations of tokenizer and encoder-decoder mechanisms have been made. The proposed technique has been tested to estimate the wave specter of coastal seas on the basis of satellite-based synthetic aperture radar imagery and has demonstrated high accuracy. The mean correlation coefficient of 0.71 was achieved.

Internet of Medical Things (IoMT) systems have brought transformative benefits to patient monitoring and remote diagnosis in healthcare. However, these systems are prone to various cyber attacks that have a high impact on security and privacy. Detecting such attacks is crucial for implementing timely and effective countermeasures. Machine learning methods have been applied for intrusion detection tasks in various networks, but explaining the reasons for detection decisions remains an obstacle for security analysts. In this paper, we demonstrate that Transformer architecture, the core of the recent revolutionary large language models, constitutes a promising solution for intrusion detection in IoMT networks. We utilized a comprehensive dataset, CICIoMT2024, recently released specifically for these networks. We created a binary classification model for discriminating attacks from benign traffic and a multi-class model for the identification of specific attack types. We applied Explainable AI (XAi) methods such as LIME and SHAP to generate posthoc explanations for the model decisions. We evaluated and compared the quality of explanations based on three metrics: faithfulness, sensitivity, and complexity. Our findings demonstrate that the applied XAI methods enhance transparency in the predictions of Transformer-based intrusion detection models for IoMT networks, proving that both transparency and high performance can be achieved simultaneously.

Detecting botnets is an essential task to ensure the security of IoT systems. Machine learning-based approaches have been widely used for this purpose, but the lack of interpretability and transparency of the models often limits their effectiveness. In this research paper, our aim is to improve the transparency and interpretability of high-performance machine learning models for IoT botnet detection by selecting higher-quality explanations using explainable artificial intelligence (XAI) techniques. We used three datasets to induce binary and multiclass classification models for IoT botnet detection, with Sequential Backward Selection employed as the feature selection technique. We then use two post hoc XAI techniques such as LIME and SHAP, to explain the behaviour of the models. To evaluate the quality of explanations generated by XAI methods, we employed faithfulness, monotonicity, complexity, and sensitivity metrics. ML models employed in this work achieve very high detection rates with a limited number of features. Our findings demonstrate the effectiveness of XAI methods in improving the interpretability and transparency of machine learning-based IoT botnet detection models. Specifically, explanations generated by applying LIME and SHAP to the XGBoost model yield high faithfulness, high Consistency, low complexity, and low sensitivity. Furthermore, SHAP outperforms LIME by achieving better results in these metrics.

In recent years, deep learning methods have achieved great success in various fields due to their strong performance in practical applications. In this paper, we present a light-weight neural network for Parkinson's disease diagnostics, in which a series of hand-drawn data are collected to distinguish Parkinson's disease patients from healthy control subjects. The proposed model consists of a convolution neural network (CNN) cascading to long-short-term memory (LSTM) to adapt the characteristics of collected time-series signals. To make full use of their advantages, a multilayered LSTM model is firstly used to enrich features which are then concatenated with raw data and fed into a shallow one-dimensional (1D) CNN model for efficient classification. Experimental results show that the proposed model achieves a high-quality diagnostic result over multiple evaluation metrics with much fewer parameters and operations, outperforming conventional methods such as support vector machine (SVM), random forest (RF), lightgbm (LGB) and CNN-based methods.

Ensuring the utmost security of loT systems is imperative, and robust botnet detection plays a pivotal role in achieving this goal. Deep learning-based approaches have been widely employed for botnet detection. However, the lack of interpretability and transparency in these models can limit these models' effectiveness. In this research, we present a Deep Neural Network (DNN) model specifically designed for the detection of loT botnet attack types. Our model performs exceptionally, demonstrating outstanding performance of classification metrics with 99% accuracy, F1 score, recall, and precision. To gain deeper insights into our DNN model's behaviour, we employ seven different post hoc explanation techniques to provide local expla-nations. We evaluate the quality of Explainable AI (XAI) methods using metrics such as high faithfulness, monotonicity, complexity, and sensitivity. Our findings highlight the effectiveness of XAI techniques in enhancing the interpretability and transparency of the DNN model for loT botnet detection. Specifically, our results indicate that DeepLIFT yields high faithfulness, high consistency, low complexity, and low sensitivity among all the explainers.

This research paper focuses on the analysis of various segments of Luria's alternating series drawing test as a diagnostic support for Parkinson's disease. Digitization of drawing tests has allowed capturing pen movement parameters imperceptible to the naked eye, enabling precise neurological disorder diagnosis. However, this analysis of parameters presents a disparity between the pre-digital era's human-assisted assessment and the machine learning algorithm employed today. While human practitioners primarily emphasized overall performance and subject errors, the machine learning method relies on kinematic and pressure features to characterize pen tip movements. The paper aims to bridge this gap by utilizing the deep learning object detection algorithm to identify test elements and classical machine learning techniques to analyze kinematic and pressure parameters associated with drawing these elements. The main research contribution centers around two key aspects: 1) evaluating the individual informativeness of test elements at different stages, i.e., beginning, middle, and final parts of the test, and 2) establishing an efficient automatic segmentation framework aimed at enhancing decision support systems in the context of Parkinson's disease diagnosis,

Android malware evolution has been neglected by the available data sets, thus providing a static snapshot of a non-stationary phenomenon. The impact of the time variable has not had the deserved attention by the Android malware research, omitting its degenerative impact on the performance of machine learning-based classifiers (i.e., concept drift). Besides, the sources of dynamic data and their particularities have been overlooked (i.e., real devices and emulators). Critical factors to take into account when aiming to build more effective, robust, and long-lasting Android malware detection systems. In this research, different sources of benign and malware data are merged, generating a data set encompassing a larger time frame and 489 static and dynamic features are collected. The particularities of the source of the dynamic features (i.e., system calls) are attended using an emulator and a real device, thus generating two equally featured sub-datasets. The main outcome of this research is a novel, labeled, and hybrid-featured Android dataset that provides timestamps for each data sample, covering all years of Android history, from 2008-2020, and considering the distinct dynamic data sources. The emulator data set is composed of 28,745 malicious apps from 209 malware families and 35,246 benign samples. The real device data set contains 41,382 malware, belonging to 240 malware families, and 36,755 benign apps. Made publicly available as KronoDroid, in a structured format, it is the largest hybrid-featured Android dataset and the only one providing timestamped data, considering dynamic sources’ particularities and including samples from over 209 Android malware families.

Timely detection of intrusions is essential in IoT networks, considering the massive attacks launched by the huge-sized botnets which are composed of insecure devices. Machine learning methods have demonstrated promising results for the detection of such attacks. However, the effectiveness of such methods may greatly benefit from the reduction of feature set size as this may prevent the impeding impact of unnecessary features and minimize the computational resources required for intrusion detection in such networks having several limitations. This paper elaborates on feature selection methods applied to machine learning models which are induced for botnet detection in IoT networks. A particular attention is devoted to the use of wrapper methods and their combination with filter methods. While filter-based feature selection methods provide a computationally light approach to select the most informative features, it is shown that their utilization in combination with wrapper methods boosts up the detection accuracy.

Fine motor tests have been a workhorse in neurology, psychology and psychiatry nearly for one hundred years. In spite of its simplicity, just paper and pen required to conduct the test, their results were proven to be reliable and accepted by the medical community. Nevertheless, it should be noted that assessment of the testing results was and is performed visually by the practitioner, whereas no measurable numeric parameters are used. Such setting inevitably introduces a subjective component to the assessment. Introduction of digital tables and later tablet computers has opened new frontiers in the fine motor analysis. Nowadays tablet computer equipped with stylus pen allows collecting kinematic and pressure parameters describing aspects of the test invisible to the naked eye. In spite of the recent achievements in the digitisation of fine motor tests, very few attention was paid to the parameters of the tests itself. In this paper, the length of the alternating series test is investigated with respect to the accuracy of the classifiers, used to support diagnostics of the Parkinson's disease.

New malware detection techniques are highly needed due to the increasing threat posed by mobile malware. Machine learning techniques have provided promising results in this problem domain. However, feature selection, which is an essential instrument to overcome the curse of dimensionality, presenting higher interpretable results and optimizing the utilization of computational resources, requires more attention in order to induce better learning models for mobile malware detection. In this paper, in order to find out the minimum feature set that provides higher accuracy and analyze the discriminatory powers of different features, we employed feature selection and ranking methods to datasets characterized by system calls and permissions. These features were extracted from malware application samples belonging to two different time-frames (2010-2012 and 2017-2018) and benign applications. We demonstrated that selected feature sets with small sizes, in both feature categories, are able to provide high accuracy results. However, we identified a decline in the discriminatory power of the selected features in both categories when the dataset is induced by the recent malware samples instead of old ones, indicating a concept drift. Although we plan to model the concept drift in our future studies, the feature selection results presented in this study give a valuable insight regarding the change occurred in the best discriminating features during the evolvement of mobile malware over time.

The analysis of the interplay between the feature selection and the post-hoc local interpretation steps in a machine learning workflow followed for IoT botnet detection constitutes the research scope of the present paper. While the application of machine learning-based techniques has become a trend in cyber security, the main focus has been almost on detection accuracy. However, providing the relevant explanation for a detection decision is a vital requirement in a tiered incident handling processes of the contemporary security operations centers. Moreover, the design of intrusion detection systems in IoT networks has to take the limitations of the computational resources into consideration. Therefore, resource limitations in addition to human element of incident handling necessitate considering feature selection and interpretability at the same time in machine learning workflows. In this paper, first, we analyzed the selection of features and its implication on the data accuracy. Second, we investigated the impact of feature selection on the explanations generated at the post-hoc interpretation phase. We utilized a filter method, Fisher's Score and Local Interpretable Model-Agnostic Explanation (LIME) at feature selection and post-hoc interpretation phases, respectively. To evaluate the quality of explanations, we proposed a metric that reflects the need of the security analysts. It is demonstrated that the application of both steps for the particular case of IoT botnet detection may result in highly accurate and interpretable learning models induced by fewer features. Our metric enables us to evaluate the detection accuracy and interpretability in an integrated way.

The rapid development of the internet of things caused severe security problems such as the cyber attacks launched by extremely huge botnets comprised of IoT devices. The detection of these devices is essential for protecting the networks. Recently, some of the studies have demonstrated the high accuracy of machine learning methods, including deep learning, in detecting IoT botnets. However, the minimizing of the required features for classification is highly needed for overcoming scalability and computation resource problems in IoT environments. Having results which can be readily interpretable by cyber security analysts and producing signatures for the contemporary intrusion detection or network monitoring systems are other significant factors in this area in which quick and widespread security adaption is highly required. In this study, we applied feature selection to minimize the number of features in detecting the IoT bots. It is shown that fewer features can achieve very high accuracy rates and afford interpretable results with a multi-class classifier based on a shallow method, decision tree.

Modelling of the fine motor motions during digital clock drawing test is performed within frameworks of the present studies to facilitate computer-aided diagnostics of the Parkinsons disease. Clock drawing test has been used to diagnose and monitor neurodegenerative diseases for a long period of time. It was one of the first tests to be digitalized. Nevertheless, its natural complexity causes many problems for the analysis of test results. Unlike simpler tests clock test drawing consists of many different elements. Therefore, it requires one to identify all the elements of the drawing and then proceed with the analysis of different elements. The presence of different elements, in turn, leads the idea to model test results on different levels. Low-level where modelling is performed on the basis of kinematic, pressure and temporal parameters describing fine motor movements. And higher level, where relative positions of elements, drawing quality and presence of the different elements are analyzed. Low-level analysis constitutes the scope of the present paper. Based on the clock drawing test results obtained for the groups of patients with diagnosed Parkinsons disease and similar, by age and size, healthy individuals. Features describing fine motor motions are constructed, whereas special attention is paid to the so-called set of motion mass parameters. Then features possessing the highest discriminative power to distinguish between Parkinsons disease patients and healthy control individuals are selected. Finally based on the selected subset of features applicability of different machine learning algorithms to support diagnostics process is evaluated.

Anomaly-based detection of the IoT botnets with emphasis on feature selection is elaborated in this paper. Due to the rapid growth of the Internet of Things technology, the number of vulnerable devices that become a part of a botnet has grown significantly. The detection of such malicious traffic is essential for taking timely countermeasures. While the idea of anomaly-based attack detection is not new and has been extensively studied, much less attention has been paid to dimensionality reduction in learning models induced for IoT networks. In this paper, we showed that it is possible to induce high accurate unsupervised learning models with reduced feature set sizes, which enables to decrease the required computational resources. Training one common model for all IoT devices, instead of dedicated model for each device, is another design option that is evaluated for resource optimization.

Patterns drawn by the patients during digital Luria's alternating series tests are analysed in this paper to support diagnostics of the Parkinson's disease. There are two main components that distinguish the approach proposed in this paper. The first one is the application of digital Luria's alternating series tests. In spite of its simplicity battery of the Luria's alternating series, tests allow not only to diagnose the disease but also may help to uncover on which level motor functions are affected. The second component is that kinematic and geometric features are computed not on the basis of the entire pattern but its "logical" constituents. Such an approach is justified by the fact that there is no formal description of the errors possible during the testing. Finally, it is demonstrated that classification decisions may be traced and interpreted.

Motion mass based approach is adopted in this paper to describe gait movements of patients with Parkinson's disease. In spite of the recent advances in the areas of motion capture and motion analysis, medical community remains sceptical about applying computer aided systems to support modelling and diagnostics of the Parkinson's disease. The set of measurable parameters is limited by the time, step lengths and in some cases angles between the limbs. To complement these data, motion mass parameters describing amount and smoothness of the motions, are computed for each step. Decision tree classifiers a trained to distinguish between the gait motions of patients with diagnosed Parkinson's disease and healthy individuals of the same age. Moreover it is demonstrated that inclusion of the time does not increase model quality.

The focus of the present research is on the kinematic features describing performance of the tested individual during the digital Luria's alternating series tests. First goal is to demonstrate that the features computed for the Parkinson Disease patients differ from those of healthy individuals. The secondary goal is to find the subset of features allowing to distinguish disorders on the level of motion planning from those on the level of motion execution. There are two novel properties of the proposed approach, which distinguish it from the previously published techniques. The first one is, that digital Luria's alternating series tests consist of different exercises targeted to distinguish disorders on the different levels, planning the motion and executing the motion. The second one is, that the set of kinematic features which is usually used in this area will be complimented by Motion Mass parameters describing amount and smoothness of the motion.

This study aims to digitalize the Poppelreuter's overlapping figures test. The Poppelreuter's test used in psychology and neurology to assess visual perceptual function. Its recent modification performed with pencil and paper. Replacing the pencil and paper by the tablet computer equipped with the stylus, allows recording and analyzing fine motor motions observed during the test. On the one hand, this provides an opportunity to compute the measures describing condition of the participant. On the other hand, this possess two major problems to be tackled. The first one is to recognize the contours of the overlapping objects drawn by the participant. In the case of severe neurologic disorder, dissimilarity between the etalon shape and drawn contour may be very high. The second problem is to identify errors made during the drawing. The both problems are addressed within this study. Traditional machine learning techniques K-means, k-nearest neighbors and random forest used in this study to identify drawn contours and drawing mistakes. Finally, to demonstrate applicability of the proposed approach, kinematic parameters analyzed for the pilot groups of Parkinson Disease patients and healthy individuals.

This paper is devoted to application of artificial Neural Network based Simplified Additive Autoregressive exogenous model for identification and control of a liquid level tank system consisting of three water reservoirs. A specific restricted connectivity structure of the neural network is trained on input-output data set to identify a nonlinear dynamic single-input single-output model of the liquid level tank system. Parameters of the identified neural network based model can be used to design a dynamic controller for the system. The designed neural network based controller is verified on mathematical model inMATLAB/Simulink environment and applied to the real-time control of the plant. The goal of the control algorithm is to track the desired level of liquid in the upper tank. Experimental result have shown a very good performance of the proposed technique. The designed nonlinear controller is capable of tracking the desired water level for all set points with high degree of accuracy, maximally fast and without significant overshoot.

Present paper focuses its attention on the application of genetic algorithm to adjust the NN-ANARX type structure improving performance of the identified model. Namely constructive procedure is proposed to choose parameters of the multi-criteria fitness function. Whereas main goal of present research is to find optimal linear combination of three qualitative parameters: ODCCF based criteria, mean square error and model order, those parameters are commonly used to evaluate model performance and validity. Numeric values of the fitness function coefficients for the most common classes of nonlinear systems proposed as a secondary result of the research.

A correlation-test-based validation procedure is applied in this study to compare neural networks based nonlinear autoregressive exogenous model class to its subclass of additive nonlinear autoregressive exogenous models.

In the paper a problem of analyzing surgeon's right hand wrist trajectory during laparoscopic operation is considered. Based on the results of the analysis detection algorithms to recognize six motions are developed. The motions can be considered as primitives of a surgery from the human scrub nurse point of view. In the analysis, to represent motions the third order polynomials are used. The two proposed algorithms are based on Kohonen maps and boosted decision trees. The performance of the algorithms is tested on surgical operation data.

Segmentation of the surgeon’s hand movements during the surgery into more primitive parts and recognition of those parts using Kohonen map is discussed in present paper. Main advantages of the proposed approach are that it allows to take into account dynamical characteristics of the hand movements and exclude probability of human error in building etalon segmentation. Ability to recognize current action of the surgeon has a crucial importance in developing a robot able to assist surgeon during the endoscopic surgical operation. One of the possible ways is to predefine a set of possible surgeon’s actions and provide a recognition algorithm explored in the framework of present contribution.

The purpose of this paper is to present necessary and sufficient condition for irreducibility of continuous-time nonlinear multi-input multi-output system. The condition is presented in terms of the greatest common left divisor of two polynomial matrices related to the input-output equations of the system. The basic difference is that unlike the linear case the elements of the polynomial matrices belong to a non-commutative polynomial ring. This condition provides a basis for finding the equivalent minimal irreducible representation of the I/O equations which is a suitable starting point for constructing an observable and accessible state space realization

This article is devoted to the training and application of neural networks based additive nonlinear autoregressive exogenous (NN-based ANARX) model. Training of NN-based ANARX model with MATLAB is discussed in detail and illustrated by examples. Dynamic state feedback linearization control algorithm is then applied for control of unknown nonlinear system