Current IoT infrastructures generate heterogeneous telemetry and primarily include network (inter-host information) and audit data (intra-host information). Most intrusion detection approaches use network or host information but not both. Specific to resource-constrained environments, like Internet of Things (IoT) systems, there remains a lack of anomaly detection research into multimodal techniques. We propose a multimodal fusion approach that combines network and host telemetry data to improve intrusion detection accuracy while maintaining computational efficiency. To address resource constraints, our approach applies dimensionality reduction to reduce memory and computational requirements. We evaluated our approach on a suitable IoT dataset with network and host (Windows 7 and 10) features already extracted. Our experimental evaluation demonstrates two critical findings. First, multi-modal fusion significantly improved detection accuracy across all evaluated models. The 1D-CNN mod el improved by 17.60 percentage points from 81.72% to 99.32%, while tree ensembles (XGBoost and Random Forest) achieved ideal accuracy. Unsupervised methods also benefited substantially, with Agglomerative Clustering increasing from 0.2173 to 0.6304 Adjusted Rand Index. Second, we demonstrate that the fused feature space can be dimensionally reduced to less than half the features while maintaining comparable accuracy performance, reducing computational requirements. We found that PCA performed as well as UMAP regarding accuracy but was considerably faster (54x speedup) at reducing the feature space. The proposed approach demonstrates robustness to class imbalance and provides practical deployment guidance for resource constrained IoT environments, with comprehensive benchmarking across over 15 model architectures including traditional machine learning, deep learning, and transformer-based approaches.

Machine Learning algorithms are envisioned to be used in harsh and/or safety critical environments such as self-driving cars, aerospace, and nuclear sites where the effects of radiation can cause errors in electronics known as Single Event Effects (SEEs). The effect of SEEs on machine learning models, such as neural networks composed of millions of parameters, is currently unknown. Understanding the models in terms of robustness and reliability is essential for their use in these environments. To facilitate this understanding, we propose a novel framework to simulate SEEs during model training and inference. Using the framework we investigate the robustness of the Convolutional Neural Network (CNN) architecture with dropout, regularisa-tion and activation functions under different error models. Two new activation functions are suggested that decrease error by up to 40% compared to ReLU. We also investigate an alternative pooling layer that can provide model robustness with a 16% decr ease in error with ReLU. Overall, our results confirm the efficacy of the framework for evaluating model robustness in harsh environments.

Recent theoretical machine learning research has shown that the traditional U-shaped bias-variance trade-off hypothesis is not correct for certain deep learning models. Complex models with more parameters will fit the training data well, often with zero training loss, but generalise poorly, a situation known as overfitting. However, some deep learning models have shown to generalise even after overfitting, a situation known as the double descent phenomenon. It is important to understand which deep learning models exhibit this phenomenon for practitioners to design and train these models effectively. It is not known if more recent deep learning models exhibit the phenomenon. In this study, we investigate double descent in three recent neural network architectures: Liquid Time-Constant Networks (LTCs), Quantised Neural Networks (QNNs), and Spiking Neural Networks (SNNs). We conducted experiments on the MNIST, Fashion MNIST, and CIFAR-10 datasets by varying hidden layer widths while keeping other factors constant. Our results show that LTC models exhibit a subtle form of double descent, while QNN models demonstrate a pronounced double descent on CIFAR-10. However, SNN models did not display a clear pattern. Interestingly, we found the learning rate scheduler, label noise, and training epochs can significantly affect the double descent phenomenon.

Policy analysis or formulation often requires evidence-based support to ensure the scientific rigor and rationality of the policy, increase public trust, and reduce risks and uncertainties. However, manually collecting policy-related evidence is a time-consuming and tedious process, making some automated collection methods necessary. This paper presents a novel approach for automating policy evidence collection through large language models (LLMs) combined with Reasoning and Acting (ReAct) prompting. The advantages of our approach lie in its minimal data requirements, while ReAct prompting enables the LLM to call external tools, such as search engines, ensuring real-time evidence collection. Since this is a novel problem without existing methods for comparison, we relied on human experts for ground truth and baseline comparison. In 50 experiments, our method successfully collected correct policy evidence 36 times using GPT-3.5. Furthermore, with more advanced models such as GPT-4o, the improved understanding of prompts and context enhances our method's efficiency. Finally, our method using GPT-4o successfully gathered correct evidence 45 times in 50 experiments. Our results demonstrate that, using our method, policy researchers can effectively gather evidence to support policy-making.

Adversarial attacks pose a critical threat to the reliability of machine learning models, potentially undermining trust in practical applications. As machine learning models find deployment in vital domains like autonomous vehicles, healthcare, and finance, they become susceptible to adversarial examples—crafted inputs that induce erroneous high-confidence predictions. These attacks fall into two main categories: white-box, with full knowledge of model architecture, and black-box, with limited or no access to internal details. This paper introduces a novel approach for targeted adversarial attacks in black-box scenarios. By combining genetic algorithms and gradient-based fine-tuning, our method efficiently explores input space for perturbations without requiring access to internal model details. Subsequently, gradient-based fine-tuning optimizes these perturbations, aligning them with the target model’s decision boundary. This dual strategy aims to evolve perturbations that effectively mislead target models while minimizing queries, ensuring stealthy attacks. Results demonstrate the efficacy of GenGradAttack, achieving a remarkable 95.06% Adversarial Success Rate (ASR) on MNIST with a median query count of 556. In contrast, conventional GenAttack achieved 100% ASR but required significantly more queries. When applied to InceptionV3 and Ens4AdvInceptionV3 on ImageNet, GenGradAttack outperformed GenAttack with 100% and 96% ASR, respectively, and fewer median queries. These results highlight the efficiency and effectiveness of our approach in generating adversarial examples with reduced query counts, advancing our understanding of adversarial vulnerabilities in practical contexts.

Internet of Things (IoT) devices bring an attack surface closer to personal life and industrial production. With containers as the primary method of IoT application deployment, detecting container escapes by analyzing audit logs can identify compromised edge devices. Since audit log data contains temporal property of events and relational information between system entities, existing analysis methods cannot comprehensively analyze these two properties. In this paper, a new Temporal Graph Neural Network (GNN) -based model was designed to detect anomalies of IoT applications in a container environment. The model employed Gated Recurrent Unit (GRU) and Graph Isomorphism Network (GIN) operators to capture temporal and spatial features. Using unsupervised learning to model the application’s normal behavior, the model can detect unknown anomalies that have not appeared in training. The model is trained on a dynamic graph generated from audit logs, which records security events in a system. Due to the lack of real-world datasets, we conducted experiments on a simulated dataset. Audit log records are divided into multiple graphs according to their temporal attribute to form a dynamic graph. Some nodes and edges are aggregated or removed to reduce the complexity of the graph. In the Experiments, The model has an F1 score of 0.976 on the validation set, which outperforms the best-performing baseline model, with an F1 score of 0.845.

The emergence of fan fiction websites, where fans write their own storied about a topic/genre, has resulted in serious content rating issues. The websites are accessible to general audiences but often includes explicit content. The authors can rate their own fan fiction stories but this is not required and many stories are un- rated. This motivates automatically predicting the content rating using recent natural languages processing techniques. The length of the fan fiction text, ambiguity in ratings schemes, self-annotated (weak) labels, and style of writing all make automatic content rating prediction very difficult. In this paper, we propose several embedding techniques and classification models to address these problem. Based on a dataset from a popular fan fiction website, we show that binary classification is better than multiclass classification and can achieve nearly 70% accuracy using a transformer-based model. When computation is considered, we show that a traditional word embedding technique and Logistic Regression produce the best results with 66% accuracy and 0.1 seconds computation (approximately 15,000 times faster than DistilBERT). We further show that many of the labels are not correct and require subsequent preprocessing techniques to correct the labels. We propose an Active Learning approach, that while the results are not conclusive, suggest further work to address.

Analysis of home mortgage applications is critical for financial decision-making for commercial and govern- ment lending organisations. The Home Mortgage Disclosure Act (HMDA) requires financial organisations to provide data on loan applications. Accordingly, the Consumer Financial Protection Bureau (CFPB) provides loan application data by year. This loan application data can be used to design regression and classification models. However, the amount of data is too large to train for modest computational resources. To address this, we used reservoir sampling to take suitable subsets for processing. A second issue is that the number of features are limited to the original 78 features in the HMDA records. There are a large number of other data source and associated features that may improve model accuracy. We augment the HMDA data with ten economic indicator features from an external data source. We found that the additional economic features do not improve the model’s accuracy. We designed and compared several classical and recent classification approaches to predict the loan approval decision. We show that the Decision Tree, XG Boost, Random Forest, and Support Vector Machine classifiers achieve between 82-85% accuracy while Naive Bayes results in the lowest accuracy of 79%. We found that a Deep Neural Network classifier had the best classification performance with almost 89% f1 accuracy on the HMDA data. We performed feature selection to determine what features are the most important loan classification. We found that the more obvious loan amount and applicant income were important. Interestingly we found that when we left race and gender in the feature set, unfortunately, they were selected as an important feature by the machine learning methods. This highlights the need for diligence in financial systems to make sure the machine is not biased.

Data integrity becomes paramount as the number of Internet of Things (ioT) sensor deployments increases. Sensor data can be altered by benign causes or malicious actions. Mechanisms that detect drifts and irregularities can prevent disruptions and data bias in the state of an IoT application. This paper presents LE3D, an ensemble framework of data drift estimators capable of detecting abnormal sensor behaviours. Working collaboratively with surrounding ioT devices, the type of drift (natural/abnormal) can also be identified and reported to the end-user. The proposed framework is a lightweight and unsupervised implementation able to run on resource-constrained IoT devices. Our framework is also generalisable, adapting to new sensor streams and environments with minimal online reconfiguration. We compare our method against state-of-the-art ensemble data drift detection frameworks, evaluating both the real-world detection accuracy as well as the resource utilisation of the implementation. Experimenting with real-world data and emulated drifts, we show the effectiveness of our method, which achieves up to 97% of detection accuracy while requiring minimal resources to run.

Parkinson's Disease (PD) is the second most common neurodegenerative disease and prevalence is increasing as populations age. However, because it remains difficult to sensitively evaluate symptom progression, testing of therapies which change the disease course has been hampered (and no such therapy is yet licensed). The more recent use of home monitoring systems provides the potential for providing granular assessment of symptom progression, specifically, tremor evaluation, by continuous monitoring using inertial measurement units. A significant barrier remains in obtaining the ground truth information to assess inference models in these non-laboratory environments. Given these limitations, in this paper we propose a machine learning tremor regression model and classifier heuristic that uses minimal annotations. We use a real-world dataset of 12 participants, where pairs of participants, one with PD and a healthy control, are monitored over a four-day period in a home environment with wrist-worn devices. Our approach leverages the accelerometer frequency-time representation. We evaluate the classifier heuristic on the control participants. The tremor score regression model is trained on the self-assessments of the participants. We show that the tremor classifier can achieve false positive rates (FPR) less than 0.001 (on average one false positive every five hours) on control participants. For a particular participant, we show that the machine learning regression model achieves a mean absolute error (MAE) of 0.46 as compared to a polynomial regression model (degree=3) with MAE of 0.99. This research is the first to provide a semi-supervised machine learning approach using self-report of symptoms to continually predict tremor scores for individuals with PD.

Physical Layer Key Generation (PLKG) is an attractive method for solving the key distribution problem in IoT networks. Although PLKG has a much lower complexity when compared to public key cryptography, it is not always practical in resource-constrained networks due to a high reconciliation cost. Channel Reciprocity for KEy Transmission (CRicKET) is an ultra-lightweight key agreement method that exploits channel reciprocity for securely transmitting a key generated at one end of a single-hop network. The key disagreement rate can be arbitrarily chosen without increasing the computational complexity. Analytical results allow design optimisation and derive the entropy requirement for perfect secrecy. The practicality of CRicKET is successfully tested on a series of IoT boards connected to a wireless network.

Fan fiction has provided opportunities for genre enthusiasts to produce their own story lines from existing print fiction. It has also introduced concerns including intellectual property issues for traditional print publishers. An interesting and difficult problem is determining whether a given segment of text is fan fiction or print fiction. Classifying unstructured text remains a critical step for many intelligent systems. In this paper we detail how a significant volume of print and fan fiction was obtained. The data is processed using a proposed pipeline and then analysed using various supervised machine learning classifiers. Given 5 to 10 sentences, our results show an accuracy of 80-90% can be achieved using traditional approaches. To our knowledge this is the first study that explores this type of fiction classification problem.

The advent of storing images on cloud platforms has introduced serious privacy concerns. The images are routinely scanned by machine learning algorithms to determine the contents. Usually the scanning is for marketing purposes but more malevolent purposes include criminal activity and government surveillance. The images are automatically analysed by machine learning algorithms. Notably, deep convolutional neural networks perform very well at identifying image classes. Obviously, the images could be encrypted before storing to cloud platforms and then decrypted after downloading. This would certainly obfuscate the images. However, many users prefer to be able to peruse the images on the cloud platform. This creates a difficult problem in which users prefer images stored in a way so that a human can understand them but machine learning algorithms cannot. This paper proposes a novel technique, termed seam doppelganger, for formatting images using seam carving to identify seams for replacement. The approach degrades typical image classification performance in order to provide privacy while leaving the image human-understandable. Furthermore, the technique can be largely reversed providing a reasonable facsimile of the original image. Using the ImageNet database for birds, we show how the approach degrades a state-of-the-art residual network (ResNet50) for various amounts of seam replacements.

Edge computing is rapidly changing the IoT-Cloud landscape. Various testbeds are now able to run multiple Docker-like containers developed and deployed by end-users on edge devices. However, this capability may allow an attacker to deploy a malicious container on the host and compromise it. This paper presents a dataset based on the Linux Auditing System, which contains malicious and benign container activity. We developed two malicious scenarios, a denial of service and a privilege escalation attack, where an adversary uses a container to compromise the edge device. Furthermore, we deployed benign user containers to run in parallel with the malicious containers. Container activity can be captured through the host system via system calls. Our time series auditd dataset contains partial labels for the benign and malicious related system calls. Generating the dataset is largely automated using a provided AutoCES framework. We also present a semi-supervised machine learning use case with the collected data to demonstrate its utility. The dataset and framework code are open-source and publicly available.

This paper presents Vesta, a digital health platform composed of a smart home in a box for data collection and a machine learning based analytic system for deriving health indicators using activity recognition, sleep analysis and indoor localization. This system has been deployed in the homes of 40 patients undergoing a heart valve intervention in the United Kingdom (UK) as part of the EurValve project, measuring patients health and well-being before and after their operation. In this work a cohort of 20 patients are analyzed, and 2 patients are analyzed in detail as example case studies. A quantitative evaluation of the platform is provided using patient collected data, as well as a comparison using standardized Patient Reported Outcome Measures (PROMs) which are commonly used in hospitals, and a custom survey. It is shown how the ubiquitous in-home Vesta platform can increase clinical confidence in self-reported patient feedback. Demonstrating its suitability for digital health studies, Vesta provides deeper insight into the health, well-being and recovery of patients within their home.

Over the past three decades large amounts of information have been converted to image formats from paper documents. Though in digital form, extracting the information, usually textual, from these documents requires complex image processing and optical character recognition techniques. The processing pipeline from the image to information typically includes an orientation correction task, document identification task, and text analysis task. When there are many document variants the tasks become difficult requiring complex sub-analysis for each variant and quickly exceeds human capability. In this work, we demonstrate a document analysis application with the orientation correction and document identification task carried out by supervised machine learning techniques for a large, international airline. The documents have been amassed over forty years with numerous variants and are mostly black and white, typically consist of text and lines, and some have extensive noise. Low level symbols are extracted from the raw images and separated into partitions. The partitions are used to generate statistical features which are then used to train the classifiers. We compare the classifiers for each task (e.g. decision tree, support vector machine, and random forest) to choose the most appropriate. We also perform feature selection to reduce the complexity of the document type classifiers. These parsimonious models result in comparable accuracy with 80% or fewer features.

We are interested in hot and cold water flow detection in domestic kitchen and bathroom taps for smart home environments. Water flow monitoring is particularly valuable for long-term behavioural monitoring systems for health-related applications, as it enables the collection of long-term data on the hydration levels of the house residents, and it is associated with several activities of daily life, such as cooking and cleaning. This paper presents a water flow sensing device that is based on sensing the vibrations on the pipe when water is flowing through them. The proposed solution is noninvasive and energy efficient, as it does not require cutting the water pipes or altering the plumbing system, and consumes less then 2 uA in continuous operation. The proposed water flow sensor has been integrated to SPHERE, a sensing platform of non-medical sensors for healthcare monitoring and behavioural analytics in a home environment, and deployed to more than 15 residential properties.

The upcoming Internet of Things (IoT) applications include real-time human activity monitoring with wearable sensors. Compared to the traditional environmental sensing with low-power wireless nodes, these new applications generate a constant stream of a much higher rate. Nevertheless, the wearable devices remain battery powered and therefore restricted to low-power wireless standards such as IEEE 802.15.4 or Bluetooth Low Energy (BLE). Our work tackles the problem of building a reliable autonomous schedule for forwarding this kind of dynamic data in IEEE 802.15.4 TSCH networks. Due to the a priori unpredictability of these data source locations, the quality of the wireless links, and the routing topology of the forwarding network, it is wasteful to reserve the number of slots required for the worst-case scenario, under conditions of high expected datarate, it is downright impossible. The solution we propose is a hybrid approach where dedicated TSCH cells and shared TSCH slots coexist in the same schedule. We show that under realistic assumptions of wireless link diversity, adding shared slots to a TSCH schedule increases the overall packet delivery rate and the fairness of the system.

Efficient one-to-many broadcasting is an essential function in dense or large-scale wireless systems managed by a sink or gateway. This paper describes HASTE, a novel heuristic designed for broadcast tree production. Minimizing maximum hop count reduces worst case broadcast latency, while maximizing the number of leaf nodes reduces the number of transmitted messages. The algorithm is designed to be used with current wireless routing protocols that have the capability to push tree configurations into the network. We evaluated HASTE against an approximation algorithm and found that it consistently produces trees with lower latencies and fewer transmissions. HASTE was also evaluated using a packet simulator and a novel approach using Bloom filters was proposed to include tree configuration information in packets. The results show that the HASTE generated spanning tree can be efficiently pushed into the network achieving high packet delivery rates with minimal overhead in packet transmissions.