Twitter bots have evolved from easily-detectable, simple content spammers with bogus identities to sophisticated players embedded in deep levels of social networks, silently promoting affiliate campaigns, marketing various products and services, and orchestrating or coordinating political activities. Much research has been reported on building accurate machine learning classifiers to identifying bots in social networks; recent works on social bots have started the new line of research on the existence, placement, and functions of the bots in a collective manner. In this paper, we study two families of Twitter bots which have been studied previously with respect to spamming activities through advertisement and political campaigns, and perform an evolutionary comparison with the new waves of bots currently found in Twitter. We uncover various evolved tendencies of the new social bots under social, communication, and behavioral patterns. Our findings show that these bots demonstrate evolved core-periphery structure; are deeply embedded in their networks of communication; exhibit complex information diffusion and heterogeneous content authoring patterns; perform mobilization of leaders across communication roles; and reside in niche topic communities. These characteristics make them highly deceptive as well as more effective in achieving operational goals than their traditional counterparts. We conclude by discussing some possible applications of the discovered behavioral and social traits of the evolved bots, and ways to build effective bot detection systems.

Characterizing, predicting, and quantifying the impact of postings, tweets, messages, etc. on social media platforms is a topic of growing interest due to the increasing reliance on using social media as a means for various purposes by individuals and organizations alike. In this paper, we describe an information diffusion model on the social network of Twitter. The model treats information diffusion on social media as a multivariate time series problem and deals mainly with three different dimensions of Twitter data and the different patterns of information diffusion. These dimensions are the volume of tweets, the sentiment of tweets and influence of tweets. To discover different patterns of information diffusion on Twitter, time series clustering is used where Dynamic Time Warping distance is adopted as the distance measure. To predict different parameters of each of the three dimensions, the linear time series model of Autoregressive Integrated Moving Average (ARIMA) and the non-linear time series model of Long Short-Term Memory (LSTM) Recurrent Neural Networks are used and their performance is compared. Results indicate that LSTM models achieve far better performance and hold great potential to be utilized for real-world applications.

Inpainting, originally designed in computer vision to reconstruct lost or deteriorated parts of images and videos, has been used for image tampering, including region filling and object removal to alter the truth. While several types of tampering including copy-move and seam carving forgery can now be successfully exposed in image forensics, there has been very little study to tackle inpainting forgery in JPEG images, the detection of which is extremely challenging due to the post-recompression attacks performed to cover or compromise original inpainting traces. To date, there is no effective way to detect inpainting image forgery under combined recompression attacks. To fill such a gap in image forensics and reveal inpainting forgery from the post-recompression attacks in JPEG images, we propose in this paper an approach that begins with large feature mining in discrete transform domain, ensemble learning is then applied to deal with the high feature dimensionality and to prevent the overfitting that generally happens to some regular classifiers under high feature dimensions. Our study shows the proposed approach effectively exposes inpainting forgery under post recompression attacks; especially, it noticeably improves the detection accuracy while the recompression quality is lower than the original JPEG image quality, and thus bridges a gap in image forgery detection.

With the booming of smart phone and high-speed wireless networks in recent years, applications and data have been shifting from desktop to mobile devices at a vigorous pace. Although mobile computing provides great convenience in daily life, it becomes vulnerable to various types of emerging attacks. User authentication plays an indispensable role in protecting computer systems and applications, but the development of touch screen hardware and user habit change post requirements for new authentication methods for mobile and tablets devices. In this paper, we present a robust user authentication scheme using both static and dynamic features of touch gestures. We take advantage of the pressure sensitivity of multi-touch screens to obtain irreproducible biometric patterns. Discriminative features such as distance, angle, and pressure are extracted from the touch-point data, and used in statistical analysis for verification. We tested our scheme in a variety of experiments that involved multiple volunteers to perform various gestures. The analysis of experimental results and user feedback indicate the proposed scheme delivers comprehensive measurements and accurate pattern classification for touch gestures. Based on these results, we conclude that the proposed scheme overcomes the limitations of the existing user authentication methods, and shows great potential to provide robust protection against unauthorized access.

Proliferation of phishing attacks in recent years has presented an important cyber security research area. Over the years, there has been an increase in the technology, diversity, and sophistication of these attacks in response to increased user awareness and countermeasures. In this paper, we propose a novel scheme to automatically detect phishing URLs by mining and extracting Meta data on URLs from various Web services. Applying the proposed approach on real-world data sets, it is demonstrated that Logistic Regression classifier can achieve an overall accuracy of 97.2-99.8%, false positive rate of 0.1-1% and false negative rate of 0.7-6.5% in detecting phishing and non-phishing URLs.

Critical dimension is the minimum number of features that is required to ensure the performance of a learning machine to be “high”. This critical dimension is usually unique to the learning machine and the ranking algorithm combination. Medical- and bio-informatics datasets are different from most other datasets in that there is an imbalance in most of these datasets and a high prediction accuracy often depends upon not just the overall accuracy but also the true positive and the false negative rates. To find a medically and bio-informatically accurate critical dimension and for better analysis of such datasets we develop two evaluation models, one using all features and the other using critical number of features. The performance measurements such as accuracy, specificity, sensitivity, area under the curve, F-score and kappa values are compared. This paper shows that at the critical dimension the evaluation model shows good results for all performance measurements measured on most datasets studied. The difference in performance measurements obtained using only critical number and using all features is significantly less, i.e., there is not much difference in sensitivity, specificity and other measurements calculated.

The "curse of dimensionality" problem, which occurs in many applications involving data mining such as biomedical informatics, digital forensics, risk management, etc., makes it difficult to develop accurate learning machine classifiers when the dataset includes too many irrelevant or insignificant features. Therefore, finding the smallest set of features necessary to obtain the most accurate classifier is an issue of great theoretical and practical interest. In efforts toward developing formal methods for finding the "critical dimension", this paper presents an empirical study of the minimum number of features that are required for a learning machine to perform accurately. The dataset is first featured ranked; then, iteratively, the least important feature is removed and the performance is plotted against the number of features; the point at which the performance curve drops significantly and does not rise again gives the critical dimension, which is a unique number for each specific combination of learning machine and feature ranking method. It is shown in this paper that the critical dimension phenomenon indeed exists for several of the bioinformatics datasets studied.

The threat posed by hackers, spies, terrorists, and criminals, etc. using steganography for stealthy communications and other illegal purposes is a serious concern of cyber security. Several steganographic systems that have been developed and made readily available utilize JPEG images as carriers. Due to the popularity of JPEG images on the Internet, effective steganalysis techniques are called for to counter the threat of JPEG steganography. In this article, we propose a new approach based on feature mining on the discrete cosine transform (DCT) domain and machine learning for steganalysis of JPEG images. First, neighboring joint density features on both intra-block and inter-block are extracted from the DCT coefficient array and the absolute array, respectively; then a support vector machine (SVM) is applied to the features for detection. An evolving neural-fuzzy inference system is employed to predict the hiding amount in JPEG steganograms. We also adopt a feature selection method of support vector machine recursive feature elimination to reduce the number of features. Experimental results show that, in detecting several JPEG-based steganographic systems, our method prominently outperforms the well-known Markov-process based approach.

This article presents a second-order derivative-based audio steganalysis. First, Mel-cepstrum coefficients and Markov transition features from the second-order derivative of the audio signal are extracted; a support vector machine is then applied to the features for discovering the existence of hidden data in digital audio streams. Also, the relation between audio signal complexity and steganography detection accuracy, which is an issue relevant to audio steganalysis performance evaluation but so far has not been explored, is analyzed experimentally. Results demonstrate that, in comparison with a recently proposed signal stream-based Mel-cepstrum method, the second-order derivative-based audio steganalysis method gains a considerable advantage under all categories of signal complexity--especially for audio streams with high signal complexity, which are generally the most challenging for steganalysis-and thereby significantly improves the state of the art in audio steganalysis.

MP3 is the most popular format for audio storage and a de facto standard of digital audio compression for the transfer and playback. The flexibility of compression ratio of MP3 coding enables users to choose their customized configuration in the trade-off between file size and quality. Double MP3 compression often occurs in audio forgery, steganography and quality faking by transcoding an MP3 audio to a different compression ratio. To detect double MP3 compression, in this paper, we extract the statistical features on the modified discrete cosine transform, and apply support vector machines and a dynamic evolving neuron-fuzzy inference system to the extracted features for classification. Experimental results show that our method effectively and accurately detects double MP3 compression for both up-transcoded and down-transcoded MP3 files. Our study also indicates the potential for mining the audio processing history for forensic purposes.

In this article, we propose a scheme for detecting hidden messages in compressed audio files produced by MP3Stego, as our literature search has found no previous work on successful steganalysis of MP3Stego. We extract moment statistical features on the second derivatives, as well as Markov transition features and neighboring joint density of the MDCT coefficients based on each specific frequency band on MPEG-1 audio layer 3. A support vector machine is applied to different feature sets for classification. Experimental results show that our approach is successful to discriminate MP3 covers and the steganograms generated by using MP3Stego.

In this paper, we present a novel stream data mining for audio steganalysis, based on second order derivative of audio streams. We extract Mel-cepstrum coefficients and Markov transition features on the second order derivative, a support vector machine is applied to the features for discovery of the existence of covert message in digital audios. We also explore the relation between signal complexity and detection performance on digital audios, which has not been studied previously. Our study shows that, in comparison with a recently proposed signal stream based Mel-cepstrum steganalysis, our method prominently improves the detection performance, which is not only related to information-hiding ratio but also signal complexity. Generally speaking, signal stream based Mel-cepstrum audio steganalysis performs well in steganalysis of audios with low signal complexity; it does not work so well on audios with high signal complexity. Our stream mining approach for audio steganalysis gains significant advantage in each category of signal complexity - especially in audios with high signal complexity, and thus improves the state of the art in audio steganalysis.

Detection of information-hiding in JPEG images is actively delivered in steganalysis community due to the fact that JPEG is a widely used compression standard and several steganographic systems have been designed for covert communication in JPEG images. In this paper, we propose a novel method of JPEG steganalysis. Based on an observation of bi-variate generalized Gaussian distribution in Discrete Cosine Transform (DCT) domain, neighboring joint density features on both intra-block and inter-block are extracted. Support Vector Machines (SVMs) are applied for detection. Experimental results indicate that this new method prominently improves a current art of steganalysis in detecting several steganographic systems in JPEG images. Our study also shows that it is more accurate to evaluate the detection performance in terms of both image complexity and information hiding ratio.

To improve a recently developed mel-cepstrum audio steganalysis method, we present in this paper a method based on Fourier spectrum statistics and mel-cepstrum coefficients, derived from the second-order derivative of the audio signal. Specifically, the statistics of the high-frequency spectrum and the mel-cepstrum coefficients of the second-order derivative are extracted for use in detecting audio steganography. We also design a wavelet-based spectrum and mel-cepstrum audio steganalysis. By applying support vector machines to these features, unadulterated carrier signals (without hidden data) and the steganograms (carrying covert data) are successfully discriminated. Experimental results show that proposed derivative-based and wavelet-based approaches remarkably improve the detection accuracy. Between the two new methods, the derivative-based approach generally delivers a better performance.

Mass spectrometry becomes the most widely used measurement in proteomics research. High dimensionality of features and small dataset are two major limitations restrict the accuracy of classification in mass spectrum data analysis. To improve the data mining result, two major issues need to be highlighted, which are feature extraction and feature selection. The quality of the feature set determines the reliability of the prediction of disease status. A well-known approach is to detect peak values and apply support vector machine recursive feature elimination (SVMRFE) to choose feature sets for classification. In this article, we successfully apply a distance metric learning to classify proteomics mass spectrometry data. Experimental results show that distance metric learning can successfully be applied to the classification of proteomics data and the results are comparable to the best results by applying SVM to the feature sets chosen with the use of SVMRFE.

In this article, we propose a scheme of detecting the information-hiding in videos based on the pairs of condition and joint distributions in the transform domains. Specifically, based on the approach of the Markov-process in JPEG image steganalysis and our previous work, we propose the pairs of condition and joint distribution of the neighbor difference in the transform domains, including discrete cosine transform (DCT) and the discrete wavelet transform (DWT). We apply learning classifiers to the pairs extracted from the video covers and the video steganograms produced by MSU Video Steganograms. Experimental results show that this approach is very successful in detecting the information-hiding in MSU stego video steganograms.

In this article, we propose a steganalysis method for detecting the presence of information-hiding behavior in wav audios. We extract the neighboring joint distribution features and the Markov features of the second order derivative, and combine these features with the error response by randomly modifying the least significant bit, then apply learning machines to the features for distinguishing the stegoaudios from cover videos. Experimental results show that our method performs well in steganalysis of the audio stegograms that are produced by using Hide4PGP, Invisible Secrets and S-tools4.

One of the Internet’s hallmark is the rapid spread of the use of information and communication technology. This has boosted methods for hiding stego information inside digital cover content images which is a concerning issue in information security. On the other hand, attack of steganographic schemes has leveraged methods for steganalysis which is a challenging problem. In this paper, first we look at the design of classifiers, such as, Support Vector Machines (SVM) and neural networks (RBF and MLP) which are able to detect the presence of Least Significant Bit (LSB) matching steganography of gray scale images. Second, by combining with feature ranking methods (SVM-Recursive Feature Elimination, Kruskal Wallis) and reduction techniques (PCA) pattern classification of stego is successfully achieved. It is of utmost importance to look at the large set of features extracted from images and find ranking methods able, namely, to exclude correlated and redundant features, avoid the curse of dimensionality or circumvent the need of the steganalyzer to be re-designed. Results show that desirable properties of robustness and resilience are attained by designing classifiers able to deal with redundancy and noise. Moreover, comparison of classifiers performance emphasizes the chosen model for the steganalyser.

In this article, based on the Markov approach proposed by shietal., we expand it to the inter-blocks of the DCT domain, calculate the difference of the expanded Markov features between the testing image and the calibrated version, and combine these difference features and the polynomial fitting features on the histogram of the DCT coefficients as detectors. We reasonably improve the detection performance in multi-class JPEG images. We also compare the steganalysis performance among the feature reduction/selection methods based on principal component analysis, singular value decomposition, and Fisherpsilas linear discriminant.

Security requirements and power management have become important criteria for data storage systems in today's world of information security. There exist many security approaches and power optimization techniques for storage systems but most of the existing approaches either concentrate on security or power management. Our approach integrates the power optimization with confidentiality services to maintain the secrecy of the data. Several traditional power optimization techniques involve stopping the disk completely when the loads on the storage disks are really low. Our approach makes use of the new evolving technique, Dynamic Speed Control for power management (DRPM), when the idle times between the requests are not very high. There are numerous security services like confidentiality, integrity, authentication and non-repudiation that can be provided to secure the data or information communication between parties. We concentrate on confidentiality which is one of the most popular requirements for security services.

The goal of the proposed coordinated distributed multiple attack (CDMA) is to strike a selected adversarial network and render its services useless. In this attack a number of compromised systems are used as facilitators in a coordinated manner to launch an attack on a victim's host or network. By distributing the attack and varying the type of attack the source attacker exhibits a decreased intensity of activity; therefore, the attack becomes harder to detect. Meanwhile, the concentrated effect on the victim is sufficient to overload network peripherals and systems, resulting in denial of service. In CDMAs an adversary can target a wide range of vulnerabilities present in victims' operating systems, protocol stacks, applications, network infrastructure, etc

Class prediction and feature selection are two learning tasks that are strictly paired in the search of molecular profiles from microarray data [21]. In this paper, we present a scheme of recursive feature addition for gene selection combining classifiers for the purpose of classifying tumor tissues using DNA microarray data. Based on the highest train accuracy, the next gene is added into the feature set according to the measures of the correlation / mutual information between chosen genes and candidate genes. In comparison with the well-known gene selection methods of T-TEST and SVM-RFE using different classifiers, our method, on the average, performs the best regarding the classification accuracy under different feature dimensions.

This paper describes results concerning the robustness and generalization capabilities of artificial neural networks in detecting intrusions using network audit trails. Through a variety of comparative experiments, it is found that neural network performs the best for intrusion detection. Feature selection is as important for intrusion detection as it is for many other problems. We present our work of identifying intrusion and normal pertinent features and evaluating the applicability of these features in detecting intrusions. We also present different feature selection methods for intrusion detection. It is demonstrated that, with appropriately chosen features, intrusions can be detected in real time or near real time.

Microarray gene expression data has high dimension and small samples, the gene selection is very important to the classification accuracy. In this paper, we present a scheme of recursive feature addition for microarray gene expression classification based on supervised learning and the similarity measure between chosen genes and candidates. In comparison with the well-known gene selection methods of T-TEST and SVM-RFE using different classifiers, our method, on the average, performs the best regarding the classification accuracy under different feature dimensions, the mean test accuracy and the highest test accuracy under the highest train accuracy, and the highest test accuracy in the experiments.

Security requirements of security-critical real-time applications must be met in addition to satisfying timing constraints. However, conventional real-time scheduling algorithms ignore the applications' security requirements. In recognition that an increasing number of applications running on clusters demand both real-time performance and security, we investigate the problem of scheduling a set of independent real-time tasks with various security requirements. We propose a security overhead model that is capable of measuring security overheads incurred by security-critical tasks. Further, we propose a security-aware scheduling strategy, or SAREC, which integrates security requirements into scheduling for real-time applications by employing our security overhead model. To evaluate the effectiveness of SAREC, we implement a security-aware real-time scheduling algorithm (SAREC-EDF), which incorporates the earliest deadline first (EDF) scheduling algorithm into SAREC Extensive simulation experiments show that SAREC-EDF significantly improves overall system performance over three baseline scheduling algorithms (variations of EDF) by up to 72.55%.

Software security assurance and malware (Trojans, worms, and viruses, etc.) detection are important topics of information security. Software obfuscation, a general technique that is useful for protecting software from reverse engineering, can also be used by hackers to circumvent the malware detection tools. Current static malware detection techniques have serious limitations, and sandbox testing also fails to provide a complete solution due to time constraints. In this paper, we present a robust signature-based malware detection technique, with emphasis on detecting obfuscated (or polymorphic) malware and mutated (or metamorphic) malware. The hypothesis is that all versions of the same malware share a common core signature that is a combination of several features of the code. After a particular malware has been first identified, it can be analyzed to extract the signature, which provides a basis for detecting variants and mutants of the same malware in the future. Encouraging experimental results on a large set of recent malware are presented.

Classifying Web site visitors allows organizations to present customized content and effectively allocate resources. Traditional methods of visitor classification involve tracking individual users over many sessions via a unique identifier such as the IP address or a cookie. These methods are either too general or strip the visitor of a level of privacy. In this paper we use machine learning techniques to classify visitors of a data-centric Web site using a minimal amount of information and without a unique identifier. We are able to group visitors into groups without extended user tracking.

The proliferation of malware (viruses, Trojans, and other malicious code) in recent years has presented a serious threat to enterprises, organizations, and individuals. Polymorphic (or variant versions of) computer viruses are more complex and difficult than their original versions to detect, often requiring antivirus companies to spend much time to create the routines needed to catch them. In this paper, we propose a new approach for detecting polymorphic malware in the Windows platform. Our approach rests on an analysis based on the Windows API calling sequence that reflects the behavior of a piece of particular code. The analysis is carried out directly on the PE (portable executable) code. It is achieved in two major steps: construct the API calling sequences for both the known virus and the suspicious code, and perform a similarity measurement between the two sequences after a sequence realignment operation is done. Favorable experimental results are obtained and presented.

The complexity, openness, and increasing accessibility of the Internet have all greatly increased the risk of information system security availability. A serious type of network attacks is Denial of Service (DoS), which is performed against an information system to prevent legitimate users from accessing the compromised system for service. This paper concerns detecting DoS attacks using Support Vector Machines (SVMs). The key idea is to train SVMs using already discovered patterns (signatures) that represent DoS attacks. Using a benchmark data from a KDD competition designed by DARPA (U.S. Defense Advanced Research Projects Agency), we demonstrate that highly efficient and accurate classifiers can be constructed by using SVMs to detect DoS attacks. Further, we also perform feature ranking of the DARPA intrusion data to identify the key features that are important to DoS detection.

Due to increasing incidents of cyber attacks and heightened concerns for cyber terrorism, implementing effective intrusion detection systems (IDSs) is an essential task for protecting cyber security--as well as physical security because of the great dependence on networked computers for the operational control of various infrastructures. Building effective IDSs, unfortunately, has remained an elusive goal owing to the great technical challenges involved; and applied AI techniques are increasingly being utilized in attempts to overcome the difficulties. This paper presents a comparative study of using support vector machines (SVMs), artificial neural networks (ANNs), multivariate adaptive regression splines (MARS) and linear genetic programs (LGPs) for intrusion detection. We investigate and compare the performance of IDSs based on the mentioned techniques, with respect to a well-known set of intrusion evaluation data gathered by Lincoln Labs. Through a variety of experiments and analysis, it is found that, with appropriately chosen population size, program size, crossover rate and mutation rate, LGPs outperform other techniques in terms of detection accuracy at the expense of time. SVMs outperform MARS and ANNs in three critical aspects of intrusion detection: accuracy, training time, and testing time.

This paper concerns using support vector machines (SVMs) and artificial neural networks (ANNs) for intrusion detection. We investigate and compare the performance of IDSs using SVMs and ANNs, using a well-known set of intrusion evaluation data gathered by DARPA. Through a variety of comparative experiments, it is found that, with appropriately chosen kernel functions, SVMs outperform ANNs in at least three critical aspects of IDS performance: (1) Accuracy - SVMs achieve very-high accuracy (in the high 90% range) than the best-trained ANNs, (2) Training Time and Testing Time - SVMs' training time and testing time are an order of magnitude faster than ANNs', and (3) Scalability - SVMs scale much better than ANNs. SVMs, therefore, provide suitable tools for building signature-based IDSs. We describe our investigation methodology, report experimental results, and conclude by describing an ongoing effort of a SVM and agents-based IDS that delivers enhanced performance, that possesses enhanced intrusion response capability and that is applicable to wireless networks.

A long-standing reservoir simulation problem in petroleum engineering is history matching, where a reservoir simulator is "calibrated" in some way to model the reservoir under study. A correctly calibrated simulator can be used for reservoir characterization and provides a cost-effective way of obtaining essential information about the reservoir. The history matching problem seeks to find a set of suitably adjusted input parameters of the simulator such that the simulator correctly predicts the fluid (oil, gas, water, etc.) outputs of the wells on the reservoir, over the period of time of interest. The history-matching problem is theoretically simple but frequently intractable in practice because of three significant issues: the scale of the problem; lack of reasonably affordable computational resources for many oil operators who need to do the simulation; and the need for human intervention in the process. This paper presents a solution by utilizing soft computing and Web computing techniques.

This paper presents an approach of using neural networks to select starting points for iterative methods for optimization problems. Since input/output training data are often available or easily obtained from the problem description, a neural network can be trained to provide a rough model of the optimization problem. After the neural network is trained, it is used to select starting points for the iterative algorithm. We illustrate the potential of this approach with examples.

A self-organizing neural network performing learning vector quantization (LVQ) is proposed in this paper to compress image data in still pictures. The advantages of our model are its low training time complexity, high utilization of neurons, robust clustering capability, and simple computation; further, a VLSI implementation is highly feasible. By unsupervised learning, our LVQ neural model finds near-optimal clustering from image data and builds a compression codebook in the synaptic weights. The compression results are competitive comparing with the currently popular transform codings such as JPEG and wavelet methods. The neural codebook trained by a few pictures can be used to compression other pictures efficiently. Special image types such as the fingerprints exhibit this property in our experiments. Other experiments involve some filtering effects and techniques to enhance the neural codebook learning to yield higher picture quality.>