Protocol Reverse Engineering (PRE) serves as the foundation for numerous security analysis techniques, such as vulnerability mining and intrusion detection, etc. The PRE analysis precision can directly affect the accuracy of these downstream techniques. The network-trace-based PRE technique has become the mainstream PRE technique attributed to its ease of implementation. However, without the prerequisite of additional dedicated devices or knowledge of information, the analysis precision of existing network-trace-based PRE methods is often achievable at only byte or half-byte level but not the fine-grained bit-level, which makes it increasingly challenging to meet the precision requirements of those downstream security applications. In this work, we propose a fine-grained PRE scheme, named FineBID, which makes the identification capability in a fine-grained manner for existing network-trace-based PRE methods into bit-level fields. FineBID follows the global characteristics of protocol fields and constructively models the bit-level field identification problem as a multi-objective decision model, which thus effectively overcomes the insufficient representativeness of bit-level fields’ local characteristics. Then, the multi-objective decision model is solved to obtain the Pareto solution set for different field segmentation levels, and the utility value per bit is further computed. The utility value can be used as the immediate indicator to determine whether each bit is a field boundary or not. Meanwhile, we propose an Actual Ground Truth that is more in line with the actual usage of each bit. With extensive experiments on the Internet, wireless, and industrial protocols, we affirm that FineBID can not only significantly reduce the search space for Ground Truth or Actual Ground Truth with a space reduction of 95.3% compared to exhaustive search, but also identify Ground Truth or Actual Ground Truth more accurately than other similar methods.

When deep learning models are employed in Network Intrusion Detection Systems (NIDSs) to cope with a variety of rising attacks from network, the interpretability of these applications are not studied adequately, which result in the uncertainty of their classification basis and also can not give the warning for how to improve model decisions. In this paper, a new framework is designed to provide a NIDS with visual and quantitative analysis, including a modified ensemble Convolutional Neural Network (CNN) model and a novel explainable method. The ensemble model is used as a feature extractor and aims to make classification. The explainable method in combination with Gradient-weighted Class Activation Mapping (Grad-CAM) is made to calculate feature importance of network traffic from the aspect of spatial relations, and find out the key features for improving model performance. The results of the experiments on NSL-KDD and UNSW-NB15 datasets demonstrate that the new framework, which has a high accuracy comparing with the existing models, can explain the feature importance effectively, and also improve model performance.

Learning vector quantization (LVQ) network and back-propagation (BP) network are constructed easily making use of MATLAB toolbox on the basis of maintaining the recognition rate. Face images are randomly selected from images set as training data of LVQ network and BP network. LVQ algorithm and BP algorithm are used to train network. The automatic recognition of face orientation is realized when the system obtains convergence network. First, all images are processed by edge detection. Then feature vectors representing position of the eye were extracted from edge detected images. Feature vectors of training set are sent to network to adjust the parameters which ensures the convergence speed and performance of the network. Experimental results show that the constructed LVQ network and BP network can judge face orientation according to feature vectors of input images. Generally, the recognition rate of LVQ network is higher than that of BP network. The LVQ network and BP network are both feasible and effective for face orientation recognition to some extent. The advantage of this work is that the recognition system is efficient and easy to promote. This paper focuses on how to use MATLAB easily to design identification network rather than the complexity of identification system. The future research will focus on the stability and robustness of recognition network.

Database driven IP geolocation is a convenient and common way to determine geographic location of an IP address. However, the underlying problem is that it is often difficult for users to determine which provider is reliable enough to meet their own scenarios. In this paper, we tackle this challenge in a data fusion perspective. We first evaluate the consistency degree of data entries among 5 free geolocation databases and employ it as an indicator of data quality assessment. We find that this indicator varies by geographic scope and granularity for a certain provider. Therefore we are able to evaluate data quality for different parts and dimensions within a database. Then a data fusion method utilizing data consistency degree and quota-based votes is proposed and analyzed. Over 40 million IP geolocation ground truth data in China, i.e., more than 10% of the total address space allocated to China, is applied to verify the effectiveness and advantage of the proposed method. In this work, we provide insights into comprehensive utilization of multi-databases characteristics for data entry fusion in the absence of enough priori knowledge.

MOTIVATION: Protein expression profiling for differences indicative of early cancer holds promise for improving diagnostics. Due to their high dimensionality, statistical analysis of proteomic data from mass spectrometers is challenging in many aspects such as dimension reduction, feature subset selection as well as construction of classification rules. Search of an optimal feature subset, commonly known as the feature subset selection (FSS) problem, is an important step towards disease classification/diagnostics with biomarkers. METHODS: We develop a parsimonious threshold-independent feature selection (PTIFS) method based on the concept of area under the curve (AUC) of the receiver operating characteristic (ROC). To reduce computational complexity to a manageable level, we use a sigmoid approximation to the empirical AUC as the criterion function. Starting from an anchor feature, the PTIFS method selects a feature subset through an iterative updating algorithm. Highly correlated features that have similar discriminating power are precluded from being selected simultaneously. The classification rule is then determined from the resulting feature subset. RESULTS: The performance of the proposed approach is investigated by extensive simulation studies, and by applying the method to two mass spectrometry data sets of prostate cancer and of liver cancer. We compare the new approach with the threshold gradient descent regularization (TGDR) method. The results show that our method can achieve comparable performance to that of the TGDR method in terms of disease classification, but with fewer features selected. AVAILABILITY: Supplementary Material and the PTIFS implementations are available at http://staff.ustc.edu.cn/~ynyang/PTIFS. SUPPLEMENTARY INFORMATION: Supplementary data are available at Bioinformatics online.