Bot detection is a fundamental and crucial task for tracing and mitigating cyber threats in the Internet. This paper aims to address two major limitations of current bot detection systems. First, ...existing flow-based bot detection approaches ignore structural information of botnets, which lead to false detection. Second, they cannot identify the interactive behavioral patterns among heterogeneous botnet objects. In this paper, we propose a novel bot detection framework, namely Bot-AHGCN, which models fine-grained network flow objects (e.g., IP, response) as a multi-attributed heterogeneous graph and transforms bot detection problem into a semi-supervised node classification task on the graph. Particularly, we first build a multi-attributed heterogeneous information network (AHIN) to model the interdependent relationships among botnet objects. Second, we present a weight-learning based node embedding method, which learns the interactive behavioral patterns among bots and integrates them into weighted similarity graphs. Finally, we perform graph convolution on the learned similarity graphs to characterize more comprehensive and discriminative features of bots, and feed them into a forward neural network to identify bots. The overall experimental results on two real-world datasets confirm that Bot-AHGCN outperforms the existing state-of-the-art approaches, and presents better interpretability by introducing meaningful meta-paths and meta-graphs.
A tree-ensemble method, referred to as time series forest (TSF), is proposed for time series classification. TSF employs a combination of entropy gain and a distance measure, referred to as the ...Entrance (entropy and distance) gain, for evaluating the splits. Experimental studies show that the Entrance gain improves the accuracy of TSF. TSF randomly samples features at each tree node and has computational complexity linear in the length of time series, and can be built using parallel computing techniques. The temporal importance curve is proposed to capture the temporal characteristics useful for classification. Experimental studies show that TSF using simple features such as mean, standard deviation and slope is computationally efficient and outperforms strong competitors such as one-nearest-neighbor classifiers with dynamic time warping.
The performance of differential evolution (DE) mainly depends on its breeding offspring strategy (i.e., trial vector generation strategies and associated control parameters). To take full advantage ...of several effective breeding offspring strategies proposed in recent years, a fitness-based adaptive differential evolution algorithm (FADE) is proposed in this paper. In FADE, the entire population is split into multiple small-sized swarms, and three popular breeding strategies are saved in an archive which can be utilized by the multiple swarms. In each generation, different individuals in a same swarm adaptively select their own breeding strategy from the archive based on their fitness. With the adaptive breeding strategy, the individuals in a same swarm can exhibit distinct search behaviors. Moreover, the population size can be adaptively adjusted during the evolutionary process according to the performance of the best individual. Based on the adaptive population size, computational resources can be rationally assigned in different evolutionary stages, and then to satisfy diverse requirements of different fitness landscapes. The comprehensive performance of FADE is extensively evaluated by comparisons between it and other eight state-of-art DE variants based on CEC2013 and CEC2017 test suites as well as seven real applications. In addition, the effectiveness and efficiency of the newly introduced adaptive strategies are further confirmed by a set of experiments.
There exist several approaches to rough set approximations in a multigranulation space, namely, a family of equivalence relations. In this paper, we propose a unified framework to classify and ...compare existing studies. An underlying principle is to explain rough sets in a multigranulation space through rough sets derived by using individual equivalence relations. Two basic models are suggested. One model is based on a combination of a family of equivalence relations into an equivalence relation and the construction of approximations with respect to the combined relation. By combining equivalence relations through set intersection and union, respectively, we construct two sub-models. The other model is based on the construction of a family of approximations from a set of equivalence relations and a combination of the family of approximations. By using set intersection and union to combine a family of approximations, respectively, we again build two sub-models. As a result, we have a total of four models. We examine these models and give conditions under which some of them become the same.
Formal concepts and closed itemsets proved to be of big importance for knowledge discovery, both as a tool for concise representation of association rules and a tool for clustering and constructing ...domain taxonomies and ontologies. Exponential explosion makes it difficult to consider the whole concept lattice arising from data, one needs to select most useful and interesting concepts. In this paper interestingness measures of concepts are considered and compared with respect to various aspects, such as efficiency of computation and applicability to noisy data and performing ranking correlation.
Existing clustering algorithms are weak in extracting smooth subspaces for clustering time series data. In this paper, we propose a new k-means type smooth subspace clustering algorithm named Time ...Series k-means (TSkmeans) for clustering time series data. The proposed TSkmeans algorithm can effectively exploit inherent subspace information of a time series data set to enhance clustering performance. More specifically, the smooth subspaces are represented by weighted time stamps which indicate the relative discriminative power of these time stamps for clustering objects. The main contributions of our work include the design of a new objective function to guide the clustering of time series data and the development of novel updating rules for iterative cluster searching with respect to smooth subspaces. Based on a synthetic data set and five real-life data sets, our experimental results confirm that the proposed TSkmeans algorithm outperforms other state-of-the-art time series clustering algorithms in terms of common performance metrics such as Accuracy, Fscore, RandIndex, and Normal Mutual Information.
In differential evolution algorithm (DE), it is a widely accepted method that selecting individuals with higher fitness to generate a mutant vector. In this case, the population evolution is under a ...fitness-based driving force. Although the driving force is beneficial for the exploitation, it sacrifices performance on the exploration. In this paper, a novelty-hybrid-fitness driving force is introduced to trade off contradictions between the exploration and the exploitation of DE. In the new proposed DE, named as NFDDE, both fitness and novelty values of individuals are considered when choosing individuals to create mutant vectors. In addition, two adaptive scaling factors are proposed to adjust the weights of the fitness-based driving force and the novelty-based driving force, respectively, and then distinct properties of the two driving forces can be effectively utilized. At last, to save computational resources, some individuals with lower novelty are deleted when the population has converged to a certain extent. The comprehensive performance of NFDDE is extensively evaluated by comparisons between it and other 9 state-of-art DE variants based on CEC2017 test suite. In addition, distinct properties of the newly introduced strategies and involved parameters are further confirmed by a set of experiments.
Alzheimer’s disease (AD) is the most common cause of dementia in the elderly and affects approximately 30 million individuals worldwide. With the growth of the older population in developed nations, ...the prevalence of AD is expected to triple over the next 50 years while its early diagnosis remains being a difficult task. Functional imaging modalities including Single Photon Emission Computed Tomography (SPECT) and positron emission tomography (PET) are often used with the aim of achieving early diagnosis. However, conventional evaluation of SPECT images often relies on manual reorientation, visual reading of tomographic slices and semiquantitative analysis of certain regions of interest (ROIs). These steps are time consuming, subjective and prone to error. This paper shows a fully automatic computer-aided diagnosis (CAD) system for improving the early detection of the AD. The proposed approach is based on image parameter selection and support vector machine (SVM) classification. A study is carried out in order to finding the ROIs and the most discriminant image parameters with the aim of reducing the dimensionality of the input space and improving the accuracy of the system. Among all the features evaluated, coronal standard deviation and sagittal correlation parameters are found to be the most effective ones for reducing the dimensionality of the input space and improving the diagnosis accuracy when a radial basis function (RBF) SVM is used. The proposed system yields a 90.38% accuracy in the early diagnosis of the AD and outperforms existing techniques including the voxel-as-features (VAF) approach.
Time series classification and retrieval are two important tasks of time series analysis. Existing methods solve these two tasks separately, which ignores the sharable information among different ...tasks. In this paper, we propose a deep multi-task representation learning method (MTRL) for time series classification and retrieval, which exploits both related supervised and unsupervised information. Specifically, supervised representation learning for classification task tries to maximize the inter-class variations and minimize the intra-class variations. Unsupervised representation learning for retrieval task aims at preserving pairwise dynamic time warp (DTW) distances. These two tasks can benefit from each other via shared networks, which consist of deep wavelet decomposition networks and residual networks. These networks can extract the information hidden in different time and frequency domains, and can achieve easier information flow from the lowest level to the highest level than traditional convolutional neural networks. Furthermore, we propose a distance-weighted sampling strategy, which focuses on the more discriminative samples to achieve high convergence speed and accuracies. Extensive experiments on UCR datasets demonstrate that MTRL outperforms the state-of-the-art methods.
We are considering properties of interestingness measures of rules induced from data. These are: Bayesian confirmation property, two properties related to the case of entailment or refutation, called ...(Ex1) and logicality L, and a group of symmetry properties. We propose a modification of properties (Ex1) and L, called weak (Ex1), and weak L, that deploy the concept of confirmation in its larger sense. We demonstrate that properties (Ex1) and L do not fully reflect such understanding of the confirmation concept, and thus, we propose to substitute (Ex1) by weak (Ex1) and L by weak L. Moreover, we introduce four new approaches to normalization of confirmation measures in order to transform measures so that they would obtain desired properties. The analysis of the results of the normalizations of the confirmation measures takes into account all considered properties. We advocate for two normalized confirmation measures: measure Z considered in the literature, and newly proposed measure A. Finally, we provide some ideas for combining them in a single measure keeping all desirable properties.
PDF
