Many sophisticated cyberattacks (e.g., advanced persistent threat (APT), supply chain attacks) used command and control (C2) channel to remotely explore and control the compromised systems. As domain name system (DNS) is almost always needed everywhere on the Internet and DNS traffic is allowed by almost all network security systems (e.g., firewall), sophisticated malware have used DNS traffic to disguise their C2 channels.In this paper, we investigate how deep learning techniques can be used to detect DNS based C2 traffic. Specifically, we have analyzed Sliver DNS C2 activities and have identified machine learning features that can effectively distinguish DNS C2 from normal DNS activities. We have built and trained LSTM RNN model and empirically validated the effectiveness of our trained LSTM RNN model with large amount of benign and Sliver DNS C2 records. Our LSTM RNN model is able to achieve 96.889% TPR, 0.001% FPR and 99.98% accuracy in detecting beacon mode DNS C2 activities and 99.34% TPR, 0.001% FPR and 99.99% accuracy in detecting interactive mode DNS C2 activities.

Automated assessment of affect and arousal level can help psychologists and psychiatrists in clinical diagnoses; and may enable affect-aware robot-human interaction. This work identifies major difficulties in automating affect and arousal assessment and attempts to overcome some of them. We first analyze thermal infrared images and examine how changes in affect and/or arousal level would cause hæmodynamic variations, concentrated along certain facial muscles. These concentrations are used to measure affect/arousal induced facial thermal variations. In step-1 of a 2-step pattern recognition schema, `between-affect' and `between-arousal-level' variations are used to derive facial thermal features as Principal Components (PCs) of the facial thermal measurements. The most influential of these PCs are used to cluster the feature space for different affects and subsequently assign a set of thermal features to an affect cluster. In step-2, affect clusters are partitioned into high, medium and mild arousal levels. The distance between a test face vector and the centroids of sub-clusters at three arousal levels belonging to a single affective state, identified from step-1, is used to determine the arousal level of the identified affective state.

Earlier researchers were able to extract the transient facial thermal features from thermal infrared images (TIRIs) to make binary distinctions between the expressions of affective states. However, effective human-computer interaction would require machines to distinguish between the subtle facial expressions of affective states. This work, for the first time, attempts to use the transient facial thermal features for recognizing a much wider range of facial expressions. A database of 324 time-sequential, visible-spectrum, and thermal facial images was developed representing different facial expressions from 23 participants in different situations. A novel facial thermal feature extraction, selection, and classification approach was developed and invoked on various Gaussian mixture models constructed using: neutral and pretended happy and sad faces, faces with multiple positive and negative facial expressions, faces with neutral and six (pretended) basic facial expressions, and faces with evoked happiness, sadness, disgust, and anger. This work demonstrates that (1) infrared imaging can be used to observe the affective-state-specific facial thermal variations, (2) pixel-grey level analysis of TIRIs can help localise significant facial thermal feature points along the major facial muscles, and (3) cluster-analytic classification of transient thermal features can help distinguish between the facial expressions of affective states in an optimized eigenspace of input thermal feature vectors. The observed classification results exhibited influence of a Gaussian mixture model's structure on classifier-performance. The work also unveiled some pertinent aspects of future research on the use of facial thermal features in automated facial expression classification and affect recognition.

Machines would require the ability to perceive and adapt to affects for achieving artificial sociability. Most autonomous systems use Automated Facial Expression Classification (AFEC) and Automated Affect Interpretation (AAI) to achieve sociability. Varying lighting conditions, occlusion, and control over physiognomy can influence the real life performance of vision-based AFEC systems. Physiological signals provide complementary information for AFEC and AAI. We employed transient facial thermal features for AFEC and AAI. Infrared thermal images with participants' normal expression and intentional expressions of happiness, sadness, disgust, and fear were captured. Facial points that undergo significant thermal changes with a change in expression termed as Facial Thermal Feature Points (FTFPs) were identified. Discriminant analysis was invoked on principal components derived from the Thermal Intensity Values (TIVs) recorded at the FTFPs. The cross-validation and person-independent classification respectively resulted in 66.28% and 56.0% success rates. Classification significance tests suggest that (1) like other physiological cues, facial skin temperature also provides useful information about affective states and their facial expression; (2) patterns of facial skin temperature variation can complement other cues for AFEC and AAI; and (3) infrared thermal imaging may help achieve artificial sociability in robots and autonomous systems.

We describe an experiment in which the eye movements of participants, carrying out tasks using two contrasting graph designs, were recorded by means of a remote eye tracking device. A variety of eye movement properties were measured and analysed both temporally and spatially. Both graph designs were based on specific psychological theories and established graph design guidelines. One incorporated attributes thought likely to enhance usability, the other included attributes likely to have the opposite effect. The results demonstrate that the design and location of a graph's legend and its spatial relationship to the data area are extremely important in determining a graph's usability. The incorporation of these and other design features may promote or detract from perceptual proximity and therefore influence a display's usability. The paper demonstrates that this influence is reflected in eye movement patterns, which can be readily monitored by means of a remote eye tracking system, and that a relatively simple temporal analysis of the results can give important insights as to how the usability of visual displays has been influenced.

Although we share the optimistic vision of affective computing presented in Interacting with Computers 14(2), we question the extent to which affective sensing can support the kinds of applications proposed in the literature. These applications depend upon the detection of affective reactions to HCI situations and events, but it has yet to be shown that such reactions can reliably be detected in subtle and natural situations. We also point out that, in human–human interaction, intentional commmunicative affect is both easier to recognise and more important than reactive affect. We suggest exploration of this idea may lead to more fruitful applications of affective computing.