An eclipse attack is a strategy where attackers control communication between nodes in peer-to-peer networks, such as Ethereum, using compromised nodes to escalate further attacks. Given the vast and complex nature of big data in Ethereum networks, detecting these attacks is challenging. This paper aims to identify effective features for eclipse attack detection by analyzing large volumes of network traffic data. We simulate an Ethereum network, conducting eclipse attacks to generate datasets where 28% of the traffic consists of malicious packets. We apply five feature extraction methods—common network traffic, Entropy, φ-Divergence, packet communication statistics, and packet characteristics statistics—leveraging big data analysis techniques to process and refine extensive traffic data. To address the challenges posed by imbalanced and overlapping data, SMOTE and Tomek link algorithms are used, and Mutual Information selects the most significant features to enhance classifier performance. We evaluate five machine learning models, including XGBoost, kNN, and Random Forest, finding that XGBoost achieves the highest performance, with 99.25% accuracy and a computational time of 184 ms when processing the top 25 features, which indicates real-time detection could be possible.

Android devices continue to dominate the mobile device market. However, ever-increasing reverse engineering capabilities and the ability to repackage apps to include malicious code with relative ease introduce significant challenges for marketplace providers. This research investigates the idea that system stats generated from running apps can be utilized to identify apps. The stats are collected from the host system while apps are running in an Android Virtual Device environment. The dataset comprises 998 repackaged apps, 1,533 malicious apps, and 2,130 normal apps. The results were analyzed using a J48 decision tree and achieved 99% accuracy.

Action rule mining seeks to generate rules that indicate what changes can be made to move an object from one class (state) to another class. An action rule is composed of the changes, known as actions, that correlate with the change in the class value. The current work in action rule mining focuses on frequent, or highly occurring, action rules. The working assumption is that the end user is interested in class transitions that move a large number of objects from the initial class to the new (final) class with a high degree of confidence. Currently, very little work focuses on rare action rules; that is, classes which occur infrequently. In this paper, we provide a definition for a rare action rule and then propose a consequent-constraint based algorithm for generating these rare action rules.

Classification uses a predictive model to predict labels for previously unseen data. Classifier ensembling techniques are used to combine the predictive outputs of multiple classifiers into one final predictive output in order to increase the accuracy of the predictive output. These techniques tend to assume every member classifier will always be available to make a prediction. This paper examines the effects missing members have on the prediction accuracy of a Stacking based ensemble and a Voting based ensemble. To determine the impact, 20 datasets were randomly selected from the UCI Machine Learning Repository; these datasets were used to create multiple Stacking and Voting models. Results indicate that the Stacking ensemble performs poorly in the face of even one missing member, while the Voting ensemble has very little issue with missing members.

Optimal inventory management always requires the right number and types of parts to be available at the right time at the right place. However, this has become even more critical in the age of prescriptive maintenance, which seeks to predict an impending failure along with what part(s) are about to fail. To take advantage of these predictions, it is essential that the parts, personnel and time frame are made available in a timely fashion to keep the operation going uninterrupted. Usually, the level of parts maintained in a part warehouse is determined using static thresholding where quantities of each part is determined and is fixed for a given part. In literature, such methods are known as static thresholding. While work has been done to accommodate unpredictability of parts usage in supply chain, there is lack of attention that has been paid to consider the demand of parts in future due to prediction of impending failure. To address this, this paper introduces a noble method and system, entitled dynamic thresholding, to ensure the part inventory adapts to predicted usage while maintaining minimum inventory management cost. The feasibility of the concept and system is demonstrated using simulated datasets.

Detecting anomalies, in many cases, is only the first step. Often, it is merely the first step in a process that seeks to recover from an anomalous situation so that the system is back to a normal state. Manual analysis is a possible approach; however, this can be time consuming and error prone. Ideally, it would be desirable to have an automated means for resolving anomalies, which is invoked whenever one or more anomalies are detected. In this paper, we present a tool, TADS (Transformation of Anomalies in Data Streams), that creates automated recommendations based upon the observed streaming data. This is accomplished by utilizing the recently introduced concept of dynamic action rules with the Massive Online Analysis (MOA) data streaming platform. In experimental results, we demonstrate that TADS is able to correctly generate recommendations 100% of the time for over half the experiments and over 90% for all but two experimental conditions. In addition, only seconds are required to generate the personalized recommendation for each anomaly. Hence, the results indicate that TADS is a viable approach for correcting anomalies within a streaming environment.

The concept of equipment maintenance is as old, if not older, as industrial revolution. However, the mode, medium and timing of maintenance during equipment life cycle have evolved from reactive maintenance to prescriptive maintenance. Reactive maintenance was the main approach practiced until 1980s. The proactive maintenance was introduced in 1990s to insulate customers from equipment failures by using equipment data and fixing problems remotely. Prescriptive maintenance, which incorporates the Internet of Things, digitization and artificial intelligence, especially machine learning, has gained importance as in intelligent approach to equipment maintenance and has the potential to greatly improve upon proactive maintenance. However, existing prescriptive maintenance solutions are piece-meal and lack complete solutions to keep equipment in working conditions most of the time at optimal cost. We propose a Holistic End to End Prescriptive Maintenance (HeePMF) framework resulting in much reduced unplanned equipment downtime at optimal cost. This framework provides solution by integrating maintenance needs analysis, equipment and operational data, predictive technologies with feedback, personnel scheduling, supply chain improvement, part management, process improvement and knowledge management. The working of framework is demonstrated by providing a case study.

Association mining is the process of discovering relationships between items in a data set, where a group of items forms an itemset. A problem with the typical association mining approach is a large number of the generated frequent itemsets typically do not contain any items of interest to the user. Targeted association mining solves this by only deriving itemsets that include the items specified within a user's query. A popular targeted approach is the Itemset Tree, which consists of an index tree structure and algorithms for search and rule generation. Numerous enhancements to improve the Itemset Tree efficiency or extend its capability have been proposed. However, two major problems exist. First, the itemset generation process utilized by the Itemset Tree does not leverage the Apriori Principle, resulting in the unnecessary and costly generation of infrequent itemsets. Second, the Itemset Tree rule generation process has restrictions that prevent some rules containing the user query from being generated; as a result, the user misses useful information. In this paper, we offer a redesigned generation process resulting in faster itemset generation (milliseconds versus minutes) and expanded rulesets.

When analyzing streaming data, the results can depreciate in value faster than the analysis can be completed and results deployed. This is certainly the case in the area of anomaly detection, where detecting a potential problem as it is occurring (or in the early stages) can permit corrective behavior. However, most anomaly detection methods focus on point anomalies, whilst many fraudulent behaviors could be detected only through collective analysis of sequences of data in practice. Moreover, anomaly detection systems often stop at detecting anomalies; they typically do not provide information about how the features (attributes) of anomalies relate to each other or to those in normal states. The goal of this research is to create a distributed system that allows for the detection of collective anomalies from streaming data, and to provide a richer context of information about the anomalies besides their presence. To accomplish this, we (a) re-engineered an online sequence anomaly detection algorithm and (b) designed new algorithms for targeted association mining to run on a streaming, distributed environment. Our experiments, conducted on both synthetic and real-world data sets, demonstrated that the proposed framework is able to achieve near real-time response in detecting anomalies and extracting information pertaining to the anomalies.

Recently, with companies and government agencies saving large repositories of time stream/temporal data, there is a large push for adapting association rule mining algorithms for dynamic, targeted querying. In addition, issues with data processing latency and results depreciating in value with the passage of time, create a need for swifter and more efficient processing. The aim of targeted association mining is to find potentially interesting implications in large repositories of data. Using targeted association mining techniques, specific implications that contain items of user interest can be found faster and before the implications have depreciated in value beyond usefulness. In this paper, the DynTARM algorithm is proposed for the discovery of targeted and rare association rules. DynTARM has the flexibility to discover strong and rare association rules from data streams within the user's sphere of interest. By introducing a measure, called the Volatility Index, to assess the fluctuation in the confidence of rules, rules conforming to different temporal patterns are discovered.