Question:
DEVELOPING A STRUCTURED APPROACH TO ENHANCE TANGIBILITY IN MULTIMEDIA LEARNING FOR PRE-SCHOOL CHILDREN

**Question**: THE ROLE OF S OCIAL M EDIA IN IMPROVING CUSTOMER SATISFACTION IN THE H OSPITALITY INDUSTRY

**Similar Question**: EVALUATING THE IMPACT OF SOCIAL MEDIA ON CUSTOMER SATISFACTION IN THE HOSPITALITY SECTOR

Innovating Tangible Interfaces: A Seamless Bridge Between Digital and Physical Realities for Enhanced Multimedia Learning

This paper outlines our forward-thinking approach to Human-Computer Interaction (HCI), coined "Innovating Tangible Interfaces." This concept enables users to intuitively control and interact with digital information ('bits') by seamlessly merging them with tangible physical objects ('atoms') and interactive surfaces within their environment. By physically engaging with digital content, users can better grasp and manipulate information, which is central to their focus. Moreover, this framework utilizes ambient media such as light, sound, air movement, and water flow in an augmented space to subtly convey peripheral digital information, enhancing users' overall awareness and engagement. The primary aim is to harmonize the digital realm with the physical world and balance the foreground and background of human activities, thereby enriching the multimedia learning experience for young learners.

The paper elaborates on three pivotal concepts central to "Innovating Tangible Interfaces": interactive surfaces that facilitate direct manipulation of digital content; the integration of digital information with physical objects for a more tangible learning experience; and ambient media for background awareness, which subtly informs users of secondary information. These concepts are demonstrated through three prototype systems – the interactiveLearningDesk, the tactileDisplayBoard, and the immersiveLearningSpace – to explore the underlying research challenges and opportunities. By focusing on these elements, we aim to create a more immersive and engaging multimedia learning environment for preschoolers, bridging the gap between digital and physical learning experiences.

The issue of web-site quality is tackled from the perspective of the ‘voice of the customer’. Quality function deployment (QFD) is adopted as a framework for identifying web-site qualities demanded by users, which are gathered through a quality workshop. From the workshop an instrument for assessing web-site quality is developed (WebQual) and tested in the domain of UK business schools. The results of the WebQual survey are presented and analyzed, leading to the generation of a WebQual Index of web-site quality. Work under way to extend and refine the WebQual instrument includes electronic commerce evaluation, where web-site service quality is proposed as a key issue.

CONTEXT
The exchange of health information on the Internet has been heralded as an opportunity to improve public health surveillance. In a field that has traditionally relied on an established system of mandatory and voluntary reporting of known infectious diseases by doctors and laboratories to governmental agencies, innovations in social media and so-called user-generated information could lead to faster recognition of cases of infectious disease. More direct access to such data could enable surveillance epidemiologists to detect potential public health threats such as rare, new diseases or early-level warnings for epidemics. But how useful are data from social media and the Internet, and what is the potential to enhance surveillance? The challenges of using these emerging surveillance systems for infectious disease epidemiology, including the specific resources needed, technical requirements, and acceptability to public health practitioners and policymakers, have wide-reaching implications for public health surveillance in the 21st century.

METHODS
This article divides public health surveillance into indicator-based surveillance and event-based surveillance and provides an overview of each. We did an exhaustive review of published articles indexed in the databases PubMed, Scopus, and Scirus between 1990 and 2011 covering contemporary event-based systems for infectious disease surveillance.

FINDINGS
Our literature review uncovered no event-based surveillance systems currently used in national surveillance programs. While much has been done to develop event-based surveillance, the existing systems have limitations. Accordingly, there is a need for further development of automated technologies that monitor health-related information on the Internet, especially to handle large amounts of data and to prevent information overload. The dissemination to health authorities of new information about health events is not always efficient and could be improved. No comprehensive evaluations show whether event-based surveillance systems have been integrated into actual epidemiological work during real-time health events.

CONCLUSIONS
The acceptability of data from the Internet and social media as a regular part of public health surveillance programs varies and is related to a circular challenge: the willingness to integrate is rooted in a lack of effectiveness studies, yet such effectiveness can be proved only through a structured evaluation of integrated systems. Issues related to changing technical and social paradigms in both individual perceptions of and interactions with personal health data, as well as social media and other data from the Internet, must be further addressed before such information can be integrated into official surveillance systems.

FACULTY OF ENGINEERING, SCIENCES AND MATHEMATICS SCHOOL OF ELECTRONICS AND COMPUTER SCIENCE Doctor of Philosophy A CONCEPTUAL FRAMEWORK FOR SERIOUS GAMES AND ITS VALIDATION

As mobile gaming has become increasingly popular in recent years, new forms of mobile game social media such as GameDuck that share mobile gameplay videos have emerged. In this work, we set out to understand the user motives of GameDuck by leveraging the Uses and Gratification Theory. We first explore the major motive themes from users' responses (n=138) and generate motivation survey items. We then identify the key motivators by conducting exploratory factor analysis of the survey results (n=354). Finally, we discuss how this new social media relates to existing systems such as Twitch.

We performed a study to determine the influence that site quality has on repurchase intention of Internet shopping through customer satisfaction, customer trust, and customer commitment. Appropriate measures were developed and tested on 230 university students of Gyeongnam province in South Korea with a cross-sectional questionnaire survey. The results of the empirical analysis confirmed that site quality can be conceptualized as a composite of six dimensions of shopping convenience, site design, information usefulness, transaction security, payment system, and customer communication. Second, site quality positively affected customer satisfaction and customer trust, but did not affect customer commitment and repurchase intention. Third, site quality can affect repurchase intention by enhancing or attenuating customer satisfaction, customer trust, and customer commitment in online transaction situation. The mediating effect of customer satisfaction, customer trust, and customer commitment between site quality and repurchase intention is identified. Fourth, site quality indirectly affected customer commitment through customer satisfaction. Customer satisfaction indirectly affected repurchase intention through customer trust and customer commitment. Thus, it is found that site quality can be a very important factor to enhance repurchase intention in the customer perspective. © 2013 Elsevier Ltd. All rights reserved.

Service quality is the highest requirement by users, especially for the service in electronic government. During the past decades, it has become a major area of academic investigation. Considering this issue, there are a lot of researches that evaluated the dimensions and e-service contexts. This study also identified the dimensions of service quality, but focuses on a new concept and provides a new methodology in developing measurement scales of e-service quality such as information quality, service quality and organization quality. Finally, this study will suggest a key factor to evaluate e-government service quality better. Keywords—E-government, e-service, e-service quality, dimensionality.

The tourism sector has found virtual reality technology to be a good way to market travel destinations for consumers. In this paper, we describe two user studies with three web-based 3D virtual travel destination marketing portals. These three portals were developed to support and attract wintertime tourism into the region by offering a possibility to experience in advance, a virtual snowy scenery with different activities, for example downhill skiing. In both user studies with 21 subjects the focus was on user experience with the 3D virtual travel destination marketing portals. In the second study also the visual design aspects within these portals were studied. Our studies indicate that 3D virtual travel destination marketing portals can enhance 2D web pages, if they offer the possibility to explore the location freely and through different kinds of virtual activities. Also our studies support prior findings of the efficiency of glow effect for indicating interactive 3D elements within a 3D virtual environment.

Purpose – The purpose of this paper is to evaluate and assess the awareness and extent of the use of social networking sites (SNSs) by the students and research scholars of universities of North India. Design/methodology/approach – The study is a questionnaire-based survey on the usage of SNSs among the students and research scholars of the universities of North India. The data of the study were collected through questionnaires, which were personally distributed to the identified population, i.e. undergraduate students, postgraduate students and research scholars, by the authors. The survey was based on a sample of 610 questionnaires; of which, 486 questionnaires were received, having a response rate of 79.67 per cent. Findings – The study showed that all the respondents were found to be aware of and making use of such applications in their academic affairs. It was revealed from the study that Facebook is the most popular SNS by all categories of respondents. To determine the purpose of SNSs, it emerged that SNSs are mostly used for entertainment and communication. The study also found that the majority of respondents were aware about the security aspects of SNSs. It signifies that excessive time consumption and fear of misusing personal information were the major hurdles in the way of accessing SNSs. Research limitations/implications – The study covers the students and research scholars of select universities of North India. It also signifies the use of SNSs in their research and academic environment. Originality/value – The paper provides reliable and authentic data. The study is worth, justifiable and enlightens the salient findings on the topic, which will be very useful for researchers in this area.

This paper presents the first step in creating design and evaluation heuristics for social games which emerge from the domain of social media. Initial high level heuristics for social games are offered by reviewing four existing video game heuristic models and analyzing two social games design frameworks.

Companies have increasingly advocated social media technologies and platforms to improve and ultimately transform business performance. This study examines whether social media has a predictive relationship with firm equity value, which metric of social media has the strongest relationship, and the dynamics of the relationship. The results derived from the vector autoregressive models suggest that social media-based metrics (blogs and reviews) are significant leading indicators of firm stock market performance. We also find a faster predictive value of social media, i.e., a shorter “wear-in” effect compared with conventional online behavior metrics, such as web traffic and search. Interestingly, conventional digital user metrics (Google search and web traffic), which have been widely adopted to measure online consumer behavior, are found to have significant yet substantially weaker predictive relationships with firm equity value than social media. The results provide new insights for social media managers and firm equity valuations.


Question: Intrusion Detection: A comparison of support vector machines and neural networks.

Intrusion Detection Utilizing Neural Networks: A Novel Approach

Amidst the exponential growth of computer networks in recent years, ensuring robust security measures has become paramount for safeguarding modern computing systems. An efficacious method for identifying unauthorized access involves monitoring deviations in user behavior. Traditional approaches, such as crafting intricate rule sets or employing real-time command prediction, are often time-consuming or prone to inaccuracies. This paper introduces an innovative application of neural networks for intrusion detection. We posit that each user generates a unique behavioral 'signature' while interacting with the system; this signature can be learned by a neural network, enabling it to recognize individual users akin to forensic experts matching fingerprints to individuals at crime scenes. When a user's actions diverge significantly from their established signature, an alert for potential security breaches is triggered. To validate this concept, we developed a backpropagation neural network, designated as NNID (Neural Network Intrusion Detector), which was trained to recognize user profiles and tested in a practical setting with a pool of ten users. The experimental results revealed a detection accuracy of 96% for anomalous activities, complemented by a false alarm rate of just 7%. These findings substantiate the efficacy of employing neural networks for learning and identifying user behaviors, thereby serving as a potent tool for intrusion detection.

In this age of computer science each and every thing becomes intelligent and perform task as human. For that purpose there are various tools, techniques and methods are proposed. Support vector machine is a model for statistics and computer science, to perform supervised learning, methods that are used to make analysis of data and recognize patterns. SVM is mostly used for classification and regression analysis. And in the same way k-nearest neighbor algorithm is a classification algorithm used to classify data using training examples. In this paper we use SVM and KNN algorithm to classify data and get prediction (find hidden patterns) for target. Here we use medical patients nominal data to classify and discover the data pattern to predict future disease, Uses data mining which is use to classify text analysis in future.

Computer networks became one of the most important dimensions in any organization. This importance is due to the connectivity benefits that can be given by networks, such as computing power, data sharing and enhanced performance. However using networks comes with a cost, there are some threats and issues that need to be addressed, such as providing sufficient level of security. One of the most challenging issues in network security is network scanning. Network scanning is considered to be the initial step in any attacking process. Therefore, detecting networks scanning helps to protect networks resources, services, and data before the real attack happens. This paper proposes an approach that consists of three layers to detect Sequential and Random network scanning for both TCP and UDP protocols. The proposed Three Layers Approach aims to increase network scanning detection accuracy. The Three Layers Approach defines some packets to be used as signs of network scanning existence. Before applying the approach in a network, there is a Thresholds Generation Stage to that aims to determine descriptive set of thresholds. After that, the first layer of the approach aggregates sign packets in separated tables. Then the second layer of the approach analyzes these tables in new tables by counting packets generated by each IP. Finally, the last layer makes a decision of whether or not a network is being scanned.

The massive amount of alarm data generated from intrusion detection systems is cumbersome for network system administrators to analyze. Often, important details are overlooked and it is difficult to get an overall picture of what is occurring in the network by manually traversing textual alarm logs. We have designed a novel visualization to address this problem by showing alarm activity within a network. Alarm data is presented in an overview where system administrators can get a general sense of network activity and easily detect anomalies. They then have the option of zooming and drilling down for details. The information is presented with local network IP (Internet Protocol) addresses plotted over multiple yaxes to represent the location of alarms. Time on the x-axis is used to show the pattern of the alarms and variations in color encode the severity and amount of alarms. Based on our system administrator requirements study, this graphical layout addresses what system administrators need to see, is faster and easier than analyzing text logs, and uses visualization techniques to effectively scale and display the data. With this design, we have built a tool that effectively uses operational alarm log data generated on the Georgia Tech campus network. The motivation and background of our design is presented along with examples that illustrate its usefulness. CR Categories: C.2.0 [Computer-Communication Networks]: General—Security and Protection C.2.3 [ComputerCommunication Networks]: Network Operations—Network Monitoring H.5.2 [Information Systems]: Information Interfaces and Presentation—User Interfaces

With more and more online services developed into web applications, security problems based on web applications become more serious now. Most intrusion detection systems are based on every single request to find the cyber-attack instead of users' behaviors, and these systems can only protect web application from known vulnerability rather than some zero-day attacks. In order to detect newly developed attacks, we analyze web logs from web servers and define users' behaviors to divide them into normal and malicious ones. The result shows that by using the feature of web resources to define users' behaviors, a higher accuracy rate and lower false alarm rate of intrusion detection can be obtained.

Internet of things (IoT) is nowadays one of the fastest growing technologies for both private and business purposes. Due to a big number of IoT devices and their rapid introduction to the market, security of things and their services is often not at the expected level. Recently, machine learning algorithms, techniques, and methods are used in research papers to enhance IoT security. In this paper, we systematically review the state-of-the art to classify the research on machine learning for the IoT security. We analysed the primary studies, identify types of studies and publication fora. Next, we have extracted all machine learning algorithms and techniques described in primary studies, and identified the most used ones to tackle IoT security issues. We classify the research into three main categories (intrusion detection, authentication and other) and describe the primary studies in detail to analyse existing relevant works and propose topics for future research.

A handwritten digit recognition system was used in a demonstration project to visualize artificial neural networks, in particular Kohonen’s self-organizing feature map. The purpose of this project was to introduce neural networks through a relatively easy-to-understand application to the general public. This paper describes several techniques used for preprocessing the handwritten digits, as well as a number of ways in which neural networks were used for the recognition task. Whereas the main goal was a purely educational one, a moderate recognition rate of 98% was reached on a test set.

The support vector (SV) machine is a novel type of learning machine, based on statistical learning theory, which contains polynomial classifiers, neural networks, and radial basis function (RBF) networks as special cases. In the RBF case, the SV algorithm automatically determines centers, weights, and threshold that minimize an upper bound on the expected test error. The present study is devoted to an experimental comparison of these machines with a classical approach, where the centers are determined byk-means clustering, and the weights are computed using error backpropagation. We consider three machines, namely, a classical RBF machine, an SV machine with Gaussian kernel, and a hybrid system with the centers determined by the SV method and the weights trained by error backpropagation. Our results show that on the United States postal service database of handwritten digits, the SV machine achieves the highest recognition accuracy, followed by the hybrid system. The SV approach is thus not only theoretically wellfounded but also superior in a practical application.

Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.

The support-vector network is a new learning machine for two-group classification problems. The machine conceptually implements the following idea: input vectors are non-linearly mapped to a very high-dimension feature space. In this feature space a linear decision surface is constructed. Special properties of the decision surface ensures high generalization ability of the learning machine. The idea behind the support-vector network was previously implemented for the restricted case where the training data can be separated without errors. We here extend this result to non-separable training data. High generalization ability of support-vector networks utilizing polynomial input transformations is demonstrated. We also compare the performance of the support-vector network to various classical learning algorithms that all took part in a benchmark study of Optical Character Recognition.

We recently conducted a research project for a large North American automobile insurer. This study was the most exhaustive ever undertaken by this particular insurer and lasted over an entire year. We analyzed the discriminating power of each variable used for ratemaking. We analyzed the performance of several models within five broad categories: linear regressions, generalized linear models, decision trees, neural networks and support vector machines. In this paper, we present the main results of this study. We qualitatively compare models and show how neural networks can represent high-order nonlinear dependencies with a small number of parameters, each of which is estimated on a large proportion of the data, thus yielding low variance. We thoroughly explain the purpose of the nonlinear sigmoidal transforms which are at the very heart of neural networks’ performances. The main numerical result is a statistically significant reduction in the out-of-sample meansquared error using the neural network model and our ability to substantially reduce the median premium by charging more to the highest risks. This in turn can translate into substantial savings and financial benefits for an insurer. We hope this paper goes a long way in convincing actuaries to include neural networks within their set of modeling tools for ratemaking.


Question: Intrusion Detection: Comparing Support Vector Machines and Neural Networks

Intrusion Detection Using Artificial Neural Networks: A Novel Approach
The detection of network intrusions, particularly through misuse detection, involves scrutinizing current network activities for signs that deviate from the norm, indicative of potential attacks. Traditionally, misuse detection systems have relied on rule-based expert systems to pinpoint signatures of known attacks. Yet, these systems often struggle with identifying novel or slightly altered attack methods that do not strictly adhere to established patterns. Artificial neural networks (ANNs) offer a promising alternative due to their ability to analyze and classify network data that is fragmented, incomplete, or exhibits nonlinear characteristics. This paper proposes a fresh approach to misuse detection that harnesses the unique analytical capabilities of ANNs. We detail our methodology and present the outcomes of our initial investigations into this innovative technique, showcasing its potential to enhance the effectiveness of intrusion detection systems.

The article gives an overview of some of the most popular machine learning methods (Bayesian classification, k-NN, ANNs, SVMs) and of their applicability to the problem of spam-filtering. Brief descriptions of the algorithms are presented, which are meant to be understandable by a reader not familiar with them before. A most trivial sample implementation of the named techniques was made by the author, and the comparison of their performance on the PU1 spam corpus is presented. Finally, some ideas are given of how to construct a practically useful spam filter using the discussed techniques. The article is related to the author’s first attempt of applying the machine-learning techniques in practice, and may therefore be of interest primarily to those getting aquainted with machine-learning.

Machine Learning is the technology, in which algorithms which are capable of learning from previous cases and past experiences are designed. It is implemented using various algorithms which reiterate over the same data repeatedly to analyze the pattern of data. The techniques of data mining are no far behind and are widely used to extract data from large databases to discover some patterns making decisions. This paper presents the Naïve Bayes improved K-Nearest Neighbor method (NBKNN) for Fraud Detection of Credit Card. Experimental results illustrate that both classifiers work differently for the same dataset. The purpose is to enhance the accuracy and enhance the flexibility of the algorithm.

Cyber frauds are a major security threat to the banking industry worldwide. Malware is one of the manifestations of cyber frauds. Malware authors use Application Programming Interface (API) calls to perpetrate these crimes. In this paper, we propose a static analysis method to detect Malware based on API call sequences using text and data mining in tandem. We analyzed the dataset available at CSMINING group. First, we employed text mining to extract features from the dataset consisting a series of API calls. Further, mutual information is invoked for feature selection. Then, we resorted to over-sampling to balance the data set. Finally, we employed various data mining techniques such as Decision Tree (DT), Multi Layer Perceptron (MLP), Support Vector Machine (SVM), Probabilistic Neural Network (PNN) and Group Method for Data Handling (GMDH). We also applied One Class SVM (OCSVM). Throughout the paper, we used 10-fold cross validation technique for testing the techniques. We observed that SVM and OCSVM achieved 100% sensitivity after balancing the dataset.

One of the most critical problems for machine learning methods is overfitting. The overfitting problem is a phenomenon in which the accuracy of the model on unseen data is poor whereas the training accuracy is nearly perfect. This problem is particularly severe in complex models that have a large set of parameters. In this paper, we propose a deep learning neural network model that adopts the support vector data description (SVDD). The SVDD is a variant of the support vector machine, which has high generalization performance by acquiring a maximal margin in one-class classification problems. The proposed model strives to obtain the representational power of deep learning. Generalization performance is maintained using the SVDD. The experimental results showed that the proposed model can learn multiclass data without severe overfitting problems.

Modern malware represents an emerging threat not only to individual privacy, but also to organizational security. Over the last few decades, a number of malware families have been codified, differentiated by their behaviour and functionality. The majority of machine learning methods work well with the general benign-malicious classification yet fail to distinguish among many classes. Deep learning is known to be successful for such applications, Deep Neural Networks in particular. There is no way however to extract an understandable model in order to characterize each malware family separately. Thus, the goal of this paper is many-fold: we investigated multinomial malware categorization using static and dynamic behavioural features extracted from Windows Portable Executables (PE32) malware collection as of the end of 2015. Furthermore, we proposed a novel Deep Neuro-Fuzzy architecture, a Hybrid Intelligence approach capable of boosting the performance of conventional Neuro-Fuzzy method targeting rules extraction. It proved capable of achieving a 49.335% better result than classical Neuro-Fuzzy and 7.347% improvement over the same complexity Deep Neural Network (DNN). Moreover, we studied the Deep Neural Network behaviour when handling such non-trivial problems as multinomial malware categorization. We believe that this model contributes to Windows PE32 malware categorization by improving the similarity-based detection of zero-days malware. It can serve as a stepping stone for malware analysts to speed up the detection and dissemination.

Deep neural networks, like many other machine learning models, have recently been shown to lack robustness against adversarially crafted inputs. These inputs are derived from regular inputs by minor yet carefully selected perturbations that deceive machine learning models into desired misclassifications. Existing work in this emerging field was largely specific to the domain of image classification, since the highentropy of images can be conveniently manipulated without changing the images’ overall visual appearance. Yet, it remains unclear how such attacks translate to more securitysensitive applications such as malware detection–which may pose significant challenges in sample generation and arguably grave consequences for failure. In this paper, we show how to construct highly-effective adversarial sample crafting attacks for neural networks used as malware classifiers. The application domain of malware classification introduces additional constraints in the adversarial sample crafting problem when compared to the computer vision domain: (i) continuous, differentiable input domains are replaced by discrete, often binary inputs; and (ii) the loose condition of leaving visual appearance unchanged is replaced by requiring equivalent functional behavior. We demonstrate the feasibility of these attacks on many different instances of malware classifiers that we trained using the DREBIN Android malware data set. We furthermore evaluate to which extent potential defensive mechanisms against adversarial crafting can be leveraged to the setting of malware classification. While feature reduction did not prove to have a positive impact, distillation and re-training on adversarially crafted samples show promising results.

The ability to predict the students’ academic performance is very important in institution educational system. Recently some researchers have been proposed data mining techniques for higher education. In this paper, we compare two data mining techniques which are: Artificial Neural Network (ANN) and the combination of clustering and decision tree classification techniques for predicting and classifying students’ academic performance. The data set used in this research is the student data of Computer Science Department, Faculty of Science and Defence Technology, National Defence University of Malaysia (NDUM).

This paper presents a novel unsupervised approach to detect cyber attacks in Cyber-Physical Systems (CPS). We describe an unsupervised learning approach using a Recurrent Neural network which is a time series predictor as our model. We then use the Cumulative Sum method to identify anomalies in a replicate of a water treatment plant. The proposed method not only detects anomalies in the CPS but also identifies the sensor that was attacked. The experiments were performed on a complex dataset which is collected through a Secure Water Treatment Testbed (SWaT). Through the experiments, we show that the proposed technique is able to detect majority of the attacks designed by our research team with low false positive rates.

Breast cancer is one of the diseases that represent a large number of incidence and mortality in the world. Data mining classifications techniques will be effective tools for classifying data of cancer to facilitate decision-making.
 The objective of this paper is to compare the performance of different machine learning algorithms in the diagnosis of breast cancer, to define exactly if this type of cancer is a benign or malignant tumor.
 Six machine learning algorithms were evaluated in this research Bayes Network (BN), Support Vector Machine (SVM), k-nearest neighbors algorithm (Knn), Artificial Neural Network (ANN), Decision Tree (C4.5) and Logistic Regression. The simulation of the algorithms is done using the WEKA tool (The Waikato Environment for Knowledge Analysis) on the Wisconsin breast cancer dataset available in UCI machine learning repository.

Communication network is facilitated with different protocol .Each protocol supported to increase the network performance in a secured manner. In communication process, user’s connectivity, violations of policy on access of information are handles through intrusion. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. It focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. However, organizations use Intrusion detection and prevention system (IDPS) for other purposes, such as identifying problems with security policies, documenting existing threats, and determining individuals from violating security policies. Communication architecture is built up on IP.Internet Control Message Protocol (ICMP ) protocol is tightly integrated with IP. ICMP messages, delivered in IP packets, are used for out-of-band messages related to network operation or mis-operation.In this paper describes about HDLC , ICMP protocol sequences which is used to detect the intrusion on hybrid network and its attributes are recommend the standardized protocol for the intrusion detection process. This standardization protocol compare the previous part of the research of HDLC and ICMP protocols.


Question: Intrusion Detection: Comparing Support Vector Machines and Neural Networks

This paper outlines a sophisticated real-time intrusion-detection system, designed to identify break-ins, intrusions, and other forms of unauthorized computer activity. The system's foundation rests on the premise that monitoring a system's audit records for deviations from typical usage patterns can reveal security breaches. Central to this model are profiles that capture the behavior of users (subjects) towards various system components (objects) through quantitative metrics and statistical analyses. These profiles are continuously updated through rules that extract knowledge about user behavior from audit records and flag any anomalous activities. The model's architecture is deliberately generic, allowing it to be adaptable to any system, application environment, or type of intrusion, thereby serving as a versatile framework for a comprehensive intrusion-detection system.

**Question**: How to improve the performance of a deep learning model?

**Documents**: Techniques for Improving the Performance of Deep Learning Models
Deep learning models can be enhanced through various techniques such as increasing the size of the training dataset, using data augmentation, applying regularization methods, tuning hyperparameters, and optimizing the architecture of the model. A larger training dataset can help the model learn more robust features and generalize better to unseen data. Data augmentation techniques, such as rotation, flipping, and cropping, can artificially increase the size of the training set and introduce diversity, which can improve the model's ability to generalize. Regularization methods, such as dropout and L1/L2 regularization, can prevent overfitting by adding a penalty for complexity in the model. Careful tuning of hyperparameters, such as the learning rate and batch size, can significantly impact the model's performance. Lastly, optimizing the architecture of the model, such as increasing the number of layers or changing the activation functions, can also lead to performance improvements.

**Similar Documents**: Enhancing Deep Learning Models: Strategies for Boosting Performance
The performance of deep learning models can be significantly improved by employing several strategies, including expanding the training dataset, employing data augmentation, implementing regularization techniques, fine-tuning hyperparameters, and refining the model architecture. Expanding the training dataset enables the model to learn a broader range of features, enhancing its ability to generalize to new data. Data augmentation, through methods like rotation, flipping, and cropping, artificially expands the dataset and introduces variability, which can strengthen the model's generalization capabilities. Regularization techniques, such as dropout and L1/L2 regularization, can safeguard against overfitting by penalizing model complexity. Precise adjustment of hyperparameters, including the learning rate and batch size, can markedly influence model performance. Lastly,

This This study aims to investigate the robustness of prediction model by comparing artificial neural networks (ANNs), and support vector machine (SVMs) model. The study employs ten years monthly data of six types of macroeconomic variables as independent variables and the average rate of return of one-month time deposit of Indonesian Islamic banks (RR) as dependent variable. Finally, the performance is evaluated through graph analysis, statistical parameters and accuracy rate measurement. This research found that ANNs outperforms SVMs empirically resulted from the training process and overall data prediction. This is indicating that ANNs model is better in the context of capturing all data pattern and explaining the volatility of RR.

Support vector machine (SVM) is a very speci1c type of learning algorithms characterized by the capacity control of the decision function, the use of the kernel functions and the sparsity of the solution. In this paper, we investigate the predictability of 1nancial movement direction with SVM by forecasting the weekly movement direction of NIKKEI 225 index. To evaluate the forecasting ability of SVM, we compare its performance with those of Linear Discriminant Analysis, Quadratic Discriminant Analysis and Elman Backpropagation Neural Networks. The experiment results show that SVM outperforms the other classi1cation methods. Further, we propose a combining model by integrating SVM with the other classi1cation methods. The combining model performs best among all the forecasting methods. ? 2004 Elsevier Ltd. All rights reserved.

One of the most difficult problems in the design of an anomaly b sed intrusion detection system (IDS) that uses clustering is th at of labelling the obtained clusters, i.e. determining which of them correspond t ”good” behaviour on the network/host and which to ”bad” behaviour. In this pap er, a new clusters’ labelling strategy, which makes use of a clustering quality index is proposed for application in such an IDS. The aim of the new labelling algor ithm is to detect compact clusters containing very similar vectors and these are highly likely to be attack vectors. Two clustering quality indexes have been te sted and compared: the Silhouette index and the Davies-Bouldin index. Experiment al results comparing the effectiveness of a multiple classifier IDS with the two in dexes implemented show that the system using the Silhouette index produces sli ghtly more accurate results than the system that uses the Davies-Bouldin index. However, the computation of the Davies-Bouldin index is much less complex th an the computation of the Silhouette index, which is a very important advantage regarding eventual real-time operation of an IDS that employs clustering.

Tactical Mobile Ad-hoc Networks (MANETs) are widely deployed in military organizations that have critical needs of communication even with the absence of fixed infrastructure. The lack of communication infrastructure and dynamic topology makes MANETs vulnerable to a wide range attacks. Tactical military operations are among the prime users of ad-hoc networks. The military holds higher standards of security requirements and thus require special intrusion detection applications. Conventional Intrusion Detection System (IDS) require central control and monitoring entities and thus cannot be applied to MANETs. Solutions to secure these networks are based on distributed and cooperative security. This paper presents a survey of IDS specifically for MANETs and also highlights the strengths and weakness of each model. We present a unique evaluation matrix for measuring the effectiveness of IDS for MANETs in an emergency response scenario.

Hardware-based malware detectors (HMDs) are a promising new approach to defend against malware. HMDs collect low-level architectural features and use them to classify malware from normal programs. With simple hardware support, HMDs can be always on, operating as a first line of defense that prioritizes the application of more expensive and more accurate software-detector. In this paper, our goal is to increase the accuracy of HMDs, to improve detection, and reduce overhead. We use specialized detectors targeted towards a specific type of malware to improve the detection of each type. Next, we use ensemble learning techniques to improve the overall accuracy by combining detectors. We explore detectors based on logistic regression (LR) and neural networks (NN). The proposed detectors reduce the false-positive rate by more than half compared to using a single detector, while increasing their sensitivity. We develop metrics to estimate detection overhead; the proposed detectors achieve more than 16.6x overhead reduction during online detection compared to an idealized software-only detector, with an 8x improvement in relative detection time. NN detectors outperform LR detectors in accuracy, overhead (by 40%), and time-to-detection of the hardware component (by 5x). Finally, we characterize the hardware complexity by extending an open-core and synthesizing it on an FPGA platform, showing that the overhead

Security has been one of the major concerns for the computer network community due to resource abuse and malicious flows intrusion. Before a network or a system is attacked, a port scan is typically performed to discover vulnerabilities, like open ports, which may be used to access and control them. Several studies have addressed Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) methods for detecting malicious activities, based on received flows or packet data analysis. However, those methods lead to an increase in switching latency, due to the need to analyze flows or packets before routing them. This may also increase network overhead when flows or packets are duplicated to be parsed by an external IDS. On the one hand, an IDS/IPS may be a bottleneck on the network and may not be useful. On the other hand, the new paradigm called Software Defined Networking (SDN) and the OpenFlow protocol provide some statistical information about the network that may be used for detecting malicious activities. Hence, this work presents a new port scan IPS for SDN based on the OpenFlow switch counters data. A non-intrusive and lightweight method was developed and implemented, with low network overhead, and low memory and processing power consumption. The results showed that our method is effective on detecting and preventing port scan attacks.

To defend against multi-step intrusions in high-speed networks, efficient algorithms are needed to correlate isolated alerts into attack scenarios. Existing correlation methods usually employ an in-memory index for fast searches among received alerts. With finite memory, the index can only be built on a limited number of alerts inside a sliding window. Knowing this fact, an attacker can prevent two attack steps from both falling into the sliding window by either passively delaying the second step or actively injecting bogus alerts between the two steps. In either case, the correlation effort is defeated. In this paper, we first address the above issue with a novel queue graph (QG) approach. Instead of searching all the received alerts for those that prepare for a new alert, we only search for the latest alert of each type. The correlation between the new alert and other alerts is implicitly represented using the temporal order between alerts. Consequently, our approach can correlate alerts that are arbitrarily far away, and it has a linear (in the number of alert types) time complexity and quadratic memory requirement. Then, we extend the basic QG approach to a unified method to hypothesize missing alerts and to predict future alerts. Finally, we propose a compact representation for the result of alert correlation. Empirical results show that our method can fulfill correlation tasks faster than an IDS can report alerts. Hence, the method is a promising solution for administrators to monitor and predict the progress of intrusions and thus to take appropriate countermeasures in a timely manner. 2006 Elsevier B.V. All rights reserved.

Intrusion detection System forms a vital component of internet security. To keep pace with the growing trends, there is a critical need to replace single layer detection technology with multi layer detection. Different types of Denial of Service (DoS) attacks thwart authorized users from gaining access to the networks and we tried to detect as well as alleviate some of those attacks. In this paper, we have proposed a novel cross layer intrusion detection architecture to discover the malicious nodes and different types of DoS attacks by exploiting the information available across different layers of protocol stack in order to improve the accuracy of detection. We have used cooperative anomaly intrusion detection with data mining technique to enhance the proposed architecture. We have implemented fixed width clustering algorithm for efficient detection of the anomalies in the MANET traffic and also generated different types of attacks in the network. The simulation of the proposed architecture is performed in OPNET simulator and we got the result as we expected.

Support Vector Machine is a machine learning technique used in recent studies to forecast stock prices. This study uses daily closing prices for 34 technology stocks to calculate price volatility and momentum for individual stocks and for the overall sector. These are used as parameters to the SVM model. The model attempts to predict whether a stock price sometime in the future will be higher or lower than it is on a given day. We find little predictive ability in the short-run but definite predictive ability in the long-run.

The massive amount of alarm data generated from intrusion detection systems is cumbersome for network system administrators to analyze. Often, important details are overlooked and it is difficult to get an overall picture of what is occurring in the network by manually traversing textual alarm logs. We have designed a novel visualization to address this problem by showing alarm activity within a network. Alarm data is presented in an overview where system administrators can get a general sense of network activity and easily detect anomalies. They then have the option of zooming and drilling down for details. The information is presented with local network IP (Internet Protocol) addresses plotted over multiple yaxes to represent the location of alarms. Time on the x-axis is used to show the pattern of the alarms and variations in color encode the severity and amount of alarms. Based on our system administrator requirements study, this graphical layout addresses what system administrators need to see, is faster and easier than analyzing text logs, and uses visualization techniques to effectively scale and display the data. With this design, we have built a tool that effectively uses operational alarm log data generated on the Georgia Tech campus network. The motivation and background of our design is presented along with examples that illustrate its usefulness. CR Categories: C.2.0 [Computer-Communication Networks]: General—Security and Protection C.2.3 [ComputerCommunication Networks]: Network Operations—Network Monitoring H.5.2 [Information Systems]: Information Interfaces and Presentation—User Interfaces


Question: Intrusion Detection: Comparing Support Vector Machines and Neural Networks

This paper extends the work of Lee, Stolfo, and Mok on the utilization of association rules and frequency episodes in mining audit data for intrusion detection by incorporating fuzzy logic. The integration of fuzzy logic with association rules and frequency episodes is particularly beneficial in intrusion detection due to the involvement of numerous quantitative features and the inherently fuzzy nature of security. We propose an enhanced algorithm for extracting fuzzy association rules and introduce the concept of fuzzy frequency episodes, along with a novel algorithm for their mining. To ensure equitable contribution from each data instance, we incorporate a normalization step into the fuzzy association rule mining process. Additionally, we adapt the frequency episode mining procedure to learn fuzzy frequency episodes. Our experimental findings validate the efficacy of fuzzy association rules and fuzzy frequency episodes in enhancing intrusion detection capabilities. The final, updated version of this research is published in the International Journal of Intelligent Systems, Volume 15, No. 1, August 2000.

**Question**: A Direct Search Method to solve Economic Dispatch Problem with Valve-Point Effect

**Documents**: A hybrid of genetic algorithm and particle swarm optimization for recurrent network design
An evolutionary recurrent network which automates the design of recurrent neural/fuzzy networks using a new evolutionary learning algorithm is proposed in this paper. This new evolutionary learning algorithm is based on a hybrid of genetic algorithm (GA) and particle swarm optimization (PSO), and is thus called HGAPSO. In HGAPSO, individuals in a new generation are created, not only by crossover and mutation operation as in GA, but also by PSO. The concept of elite strategy is adopted in HGAPSO, where the upper-half of the best-performing individuals in a population are regarded as elites. However, instead of being reproduced directly to the next generation, these elites are first enhanced. The group constituted by the elites is regarded as a swarm, and each elite corresponds to a particle within it. In this regard, the elites are enhanced by PSO, an operation which mimics the maturing phenomenon in nature. These enhanced elites constitute half of the population in the new generation, whereas the other half is generated by performing crossover and mutation operation on these enhanced elites. HGAPSO is applied to recurrent neural/fuzzy network design as follows. For recurrent neural network, a fully connected recurrent neural network is designed and applied to a temporal sequence production problem. For recurrent fuzzy network design, a Takagi-Sugeno-Kang-type recurrent fuzzy network is designed and applied to dynamic plant control. The performance of HGAPSO is compared to both GA

Information security in the sense of personal and institutional has become a top priority in digitalized modern world in parallel to the new technological developments. Many methods, tools and technologies are used to provide the information security of IT systems. These are considered, encryption, authentication, firewall, and intrusion detection and prevention systems. Moreover, honeypot systems are proposed as complementary structures. This paper presents the overall view of the publications in IDS, IPS and honeypot systems. Recently, honeypot systems are anymore used in connection with intrusion detection systems. So this paper describes possible implementation of honeypot technologies combined with IDS/IPS in a network. Studies in the literature have shown intrusion detection systems cannot find the 0-day vulnerabilities. The system provided by the honeypots and intrusion detection systems in the network, might detect new exploit and hacker attempt. Index Terms – Information security, Intrusion detection system (IDS), Intrusion prevention system (IPS), Honeypot, Network Security.

In recent years, we have seen notable changes in the way attackers infiltrate computer systems compromising their functionality. Research in intrusion detection systems aims to reduce the impact of these attacks. In this paper, we present a taxonomy of intrusion response systems (IRS) and Intrusion Risk Assessment (IRA), two important components of an intrusion detection solution. We achieve this by classifying a number of studies published during the last two decades . We discuss the key features of existing IRS and IRA. We show how characterizing security risks and choosing the right countermeasures are an important and challenging part of designing an IRS and an IRA. Poorly designed IRS and IRA may reduce network performance and wrongly disconnect users from a network. We propose techniques on how to address these challenges and highlight the need for a comprehensive defense mechanism approach. We believe that this taxonomy will open up interesting areas for future research in the growing field of intrusion risk assessment and response systems.

Nowadays it is very important to maintain a high level security to ensure safe and trusted communication of information between various organizations. But secured data communication over internet and any other network is always under threat of intrusions and misuses. So Intrusion Detection Systems have become a needful component in terms of computer and network security. There are various approaches being utilized in intrusion detections, but unfortunately any of the systems so far is not completely flawless. So, the quest of betterment continues. In this progression, here we present an Intrusion Detection System (IDS), by applying genetic algorithm (GA) to efficiently detect various types of network intrusions. Parameters and evolution processes for GA are discussed in details and implemented. This approach uses evolution theory to information evolution in order to filter the traffic data and thus reduce the complexity. To implement and measure the performance of our system we used the KDD99 benchmark dataset and obtained reasonable detection rate.

Effective prediction of defect-prone software modules can enable software developers to focus quality assurance activities and allocate effort and resources more efficiently. Support vector machines (SVM) have been successfully applied for solving both classification and regression problems in many applications. This paper evaluates the capability of SVM in predicting defect-prone software modules and compares its prediction performance against eight statistical and machine learning models in the context of four NASA datasets. The results indicate that the prediction performance of SVM is generally better than, or at least, is competitive against the compared models. 2007 Elsevier Inc. All rights reserved.

To defend against multi-step intrusions in high-speed networks, efficient algorithms are needed to correlate isolated alerts into attack scenarios. Existing correlation methods usually employ an in-memory index for fast searches among received alerts. With finite memory, the index can only be built on a limited number of alerts inside a sliding window. Knowing this fact, an attacker can prevent two attack steps from both falling into the sliding window by either passively delaying the second step or actively injecting bogus alerts between the two steps. In either case, the correlation effort is defeated. In this paper, we first address the above issue with a novel queue graph (QG) approach. Instead of searching all the received alerts for those that prepare for a new alert, we only search for the latest alert of each type. The correlation between the new alert and other alerts is implicitly represented using the temporal order between alerts. Consequently, our approach can correlate alerts that are arbitrarily far away, and it has a linear (in the number of alert types) time complexity and quadratic memory requirement. Then, we extend the basic QG approach to a unified method to hypothesize missing alerts and to predict future alerts. Finally, we propose a compact representation for the result of alert correlation. Empirical results show that our method can fulfill correlation tasks faster than an IDS can report alerts. Hence, the method is a promising solution for administrators to monitor and predict the progress of intrusions and thus to take appropriate countermeasures in a timely manner. 2006 Elsevier B.V. All rights reserved.

Intelligent systems rely on pattern recognition and signaturebased approaches for a wide range of sensors enhancing situational awareness. For example, autonomous systems depend on environmental sensors to perform their tasks and secure systems depend on anomaly detection methods. The availability of large amount of data requires the processing of data in a “streaming” fashion with online algorithms. Yet, just as online learning can enhance adaptability to a non-stationary environment, it introduces vulnerabilities that can be manipulated by adversaries to achieve their goals while evading detection. Although human intelligence might have evolved from social interactions, machine intelligence has evolved as a human intelligence artifact and been kept isolated to avoid ethical dilemmas. As our adversaries become sophisticated, it might be time to revisit this question and examine how we can combine online learning and reasoning leading to the science of deceptive and counter-deceptive machines.

This This study aims to investigate the robustness of prediction model by comparing artificial neural networks (ANNs), and support vector machine (SVMs) model. The study employs ten years monthly data of six types of macroeconomic variables as independent variables and the average rate of return of one-month time deposit of Indonesian Islamic banks (RR) as dependent variable. Finally, the performance is evaluated through graph analysis, statistical parameters and accuracy rate measurement. This research found that ANNs outperforms SVMs empirically resulted from the training process and overall data prediction. This is indicating that ANNs model is better in the context of capturing all data pattern and explaining the volatility of RR.

Many learning tasks such as spam filtering and credit card fraud detection face an active adversary that tries to avoid detection. For learning problems that deal with an active adversary, it is important to model the adversary's attack strategy and develop robust learning models to mitigate the attack. These are the two objectives of this paper. We consider two attack models: a free-range attack model that permits arbitrary data corruption and a restrained attack model that anticipates more realistic attacks that a reasonable adversary would devise under penalties. We then develop optimal SVM learning strategies against the two attack models. The learning algorithms minimize the hinge loss while assuming the adversary is modifying data to maximize the loss. Experiments are performed on both artificial and real data sets. We demonstrate that optimal solutions may be overly pessimistic when the actual attacks are much weaker than expected. More important, we demonstrate that it is possible to develop a much more resilient SVM learning model while making loose assumptions on the data corruption models. When derived under the restrained attack model, our optimal SVM learning strategy provides more robust overall performance under a wide range of attack parameters.

Network Function Virtualization (NFV) promises the benefits of reduced infrastructure, personnel, and management costs by outsourcing network middleboxes to the public or private cloud. Unfortunately, running network functions in the cloud entails security challenges, especially for complex stateful services. In this paper, we describe our experiences with hardening the king of middleboxes - Intrusion Detection Systems (IDS) - using Intel Software Guard Extensions (Intel SGX) technology. Our IDS secured using Intel SGX, called SEC-IDS, is an unmodified Snort 3 with a DPDK network layer that achieves 10Gbps line rate. SEC-IDS guarantees computational integrity by running all Snort code inside an Intel SGX enclave. At the same time, SEC-IDS achieves near-native performance, with throughput close to 100 percent of vanilla Snort 3, by retaining network I/O outside of the enclave. Our experiments indicate that performance is only constrained by the modest Enclave Page Cache size available on current Intel SGX Skylake based E3 Xeon platforms. Finally, we kept the porting effort minimal by using the Graphene-SGX library OS. Only 27 Lines of Code (LoC) were modified in Snort and 178 LoC in Graphene-SGX itself.

Most of the time of a cryptanalyst is spent on finding the cipher technique used for encryption rather than the finding the key/ plaintext of the received cipher text. The Strength of the classical substitution cipher‟s success lie on the variety of characters employed to represent a single character. More, the characters employed more the complexity. Thus, in order to reduce the work of the cryptanalyst, neural network based identification is done based on the features of the cipher methods. In this paper, classical substitution ciphers, namely, Playfair, Vigenère and Hill ciphers are considered. The features of the cipher methods under consideration were extracted and a backpropagation neural network was trained. The network was tested for random texts with random keys of various lengths. The cipher text size was fixed as 1Kb. The results so obtained were encouraging.


Question: Intrusion detection utilizing support vector machines and neural networks.

This paper explores advanced methodologies for efficiently extracting association rules from large datasets, a critical task in data mining and knowledge discovery. The focus is on the development and application of fast algorithms tailored specifically for this purpose. Association rules are patterns that highlight significant correlations between different items in a dataset. Discovering these rules swiftly is essential for practical applications in various fields, such as market basket analysis, where understanding customer purchasing behavior is crucial. The proposed algorithms optimize the process by minimizing the computational resources required while maintaining accuracy. This is achieved through innovative strategies that reduce the search space and eliminate unnecessary computations. The efficiency of these algorithms is demonstrated through extensive experimental evaluations on real-world datasets. The results highlight the superiority of the proposed methods over existing approaches in terms of speed and scalability, making them suitable for large-scale data mining operations.

The paper also discusses the integration of these algorithms with other data mining techniques to create a comprehensive framework for knowledge discovery. This includes the application of machine learning models such as support vector machines (SVMs) and neural networks, which can further enhance the predictive capabilities of association rule mining. SVMs are particularly effective for classification tasks, while neural networks excel in handling complex patterns and non-linear relationships. By combining the strengths of these models with fast association rule mining algorithms, the framework offers a powerful tool for uncovering hidden insights in large datasets. This integration not only accelerates the data mining process but also improves the overall accuracy and reliability of the extracted knowledge, making it a valuable resource for decision-making in various industries.

The purpose of this study is to compare the performance of Artificial Neural Network (ANN) and Support Vector Machine (SVM) for liver cancer classification. The performance of both models is compared and validated on BUPA Liver Disorder Dataset in terms of accuracy, sensitivity, specificity and Area under Curve (AUC). The comparative results show that the SVM classifier outperforms ANN classifier where SVM gives an accuracy of 63.11%, specificity of 100% and AUC of 68.34% where as ANN gives classification accuracy of 57.28%, specificity of 32.56 and AUC of 53.78. This result indicates that the classification capability of SVM is better than ANN and may potentially fill in a critical gap in the use of current or future classification algorithms for liver cancer.

Breast cancer is one of the diseases that represent a large number of incidence and mortality in the world. Data mining classifications techniques will be effective tools for classifying data of cancer to facilitate decision-making.
 The objective of this paper is to compare the performance of different machine learning algorithms in the diagnosis of breast cancer, to define exactly if this type of cancer is a benign or malignant tumor.
 Six machine learning algorithms were evaluated in this research Bayes Network (BN), Support Vector Machine (SVM), k-nearest neighbors algorithm (Knn), Artificial Neural Network (ANN), Decision Tree (C4.5) and Logistic Regression. The simulation of the algorithms is done using the WEKA tool (The Waikato Environment for Knowledge Analysis) on the Wisconsin breast cancer dataset available in UCI machine learning repository.

One of the most difficult problems in the design of an anomaly b sed intrusion detection system (IDS) that uses clustering is th at of labelling the obtained clusters, i.e. determining which of them correspond t ”good” behaviour on the network/host and which to ”bad” behaviour. In this pap er, a new clusters’ labelling strategy, which makes use of a clustering quality index is proposed for application in such an IDS. The aim of the new labelling algor ithm is to detect compact clusters containing very similar vectors and these are highly likely to be attack vectors. Two clustering quality indexes have been te sted and compared: the Silhouette index and the Davies-Bouldin index. Experiment al results comparing the effectiveness of a multiple classifier IDS with the two in dexes implemented show that the system using the Silhouette index produces sli ghtly more accurate results than the system that uses the Davies-Bouldin index. However, the computation of the Davies-Bouldin index is much less complex th an the computation of the Silhouette index, which is a very important advantage regarding eventual real-time operation of an IDS that employs clustering.

Generally, theintrudermustperformseveralactions,organizedin anintrusionscenario, to achieve hisor hermaliciousobjective.Wearguethatintrusionscenarioscan bemodelledasa planningprocessandwesuggestmodellinga maliciousobjectiveas anattemptto violatea givensecurityrequirement. Our proposalis thento extendthe definitionof attackcorrelationpresentedin [CM02] to correlateattackswith intrusion objectivesThis notionis usefulto decideif a sequenceof correlatedactionscanlead to a securityrequirementviolation.This approachprovidesthesecurityadministrator with aglobalview of whathappensin thesystem.In particular, it controlsunobserved actionsthroughhypothesisgeneration,clustersrepeatedactionsin a singlescenario, recognizesintrudersthatarechangingtheir intrusionobjectivesandis efficient to detectvariationsof anintrusionscenario.Thisapproachcanalsobeusedto eliminatea category of falsepositivesthatcorrespondto falseattacks,that is actionsthatarenot furthercorrelatedto anintrusionobjective.

Phishing is a potential web threat that includes mimicking official websites to trick users by stealing their important information such as username and password related to financial systems. The attackers use social engineering techniques like email, SMS and malware to fraud the users. Due to the potential financial losses caused by phishing, it is essential to find effective approaches for phishing websites detection. This paper proposes a hybrid approach for classifying the websites as Phishing, Legitimate or Suspicious websites, the proposed approach intelligently combines the K-nearest neighbors (KNN) algorithm with the Support Vector Machine (SVM) algorithm in two stages. Firstly, the KNN was utilized as a robust to noisy data and effective classifier. Secondly, the SVM is employed as a powerful classifier. The proposed approach integrates the simplicity of KNN with the effectiveness of SVM. The experimental results show that the proposed hybrid approach achieved the highest accuracy of 90.04% when compared with other approaches. Keywords—Information security; phishing websites; support vector machine; K-nearest neighbors

Artificial neural networks’ (ANNs’) generalization powers have in recent years received admiration of finance researchers and practitioners. Their usage in such areas as bankruptcy prediction, debt-risk assessment, and security-market applications has yielded promising results. With such intensive research and proven ability of the ANN in the area of security-market application and the growing importance of the role of equity securities in Singapore, it has motivated the conceptual development of this work in using the ANN in stock selection. With their proven generalization ability, neural networks are able to infer the characteristics of performing stocks from the historical patterns. The performance of stocks is reflective of the profitability and quality of management of the underlying company. Such information is reflected in financial and technical variables. As such, the ANN is used as a tool to uncover the intricate relationships between the performance of stocks and the related financial and technical variables. Historical data, such as financial variables (inputs) and performance of the stock (output) is used in this ANN application. Experimental results obtained thus far have been very encouraging. IDEA GROUP PUBLISHING This paper appears in the publication, Artificial Neural Networks in Finance and Manufacturing edited by Joarder Kamruzzaman, Rezaul Begg, and Ruhul Sarker© 2006, Idea Group Inc. 701 E. Chocolate Avenue, Suite 200, Hershey PA 17033-1240, USA Tel: 717/533-8845; Fax 717/533-8661; URL-http://www.idea-group.com ITB13014 Improving Returns on Stock Investment through Neural Network Selection 153 Copyright © 2006, Idea Group Inc. Copying or distributing in print or electronic forms without written permission of Idea Group Inc. is prohibited. Introduction With the growing importance in the role of equities to both international and local investors, the selection of attractive stocks is of utmost importance to ensure a good return. Therefore, a reliable tool in the selection process can be of great assistance to these investors. An effective and efficient tool/system gives the investor the competitive edge over others as he/she can identify the performing stocks with minimum effort. In assisting the investors in their decision-making process, both the academics and practitioners have devised trading strategies, rules, and concepts based on fundamental and technical analysis. Innovative investors opt to employ information technology to improve the efficiency in the process. This is done through transforming trading strategies into computer-known language so as to exploit the logical processing power of the computer. This greatly reduces the time and effort in short-listing the list of attractive stocks. In the age where information technology is dominant, such computerized rule-based expert systems have severe limitations that will affect their effectiveness and efficiency. In particular, their inability in handling nonlinear relationships between financial variables and stock prices has been a major shortcoming. However, with the significant advancement in the field of ANNs, these limitations have found a solution. In this work, the generalization ability of the ANN is being harnessed in creating an effective and efficient tool for stock selection. Results of the research in this field have so far been very encouraging. Application of Neural Network in Stock Investment One of the earliest studies was by Halquist and Schmoll (1989), who used a neural network model to predict trends in the S&P 500 index. They found that the model was able to predict the trends 61% of the time. This was followed by Trippi and DeSieno (1992) and Grudnitski and Osburn (1993). Trippi and DeSieno (1992) devised an S&P 500 trading system that consisted of several trained neural networks and a set of rules for combining the network results to generate a composite recommended trading strategy. The trading system was used to predict S&P 500 index futures and the results showed that this system significantly outperformed the passive buy-and-hold strategy. Grudnitski and Osburn (1993) used a neural network to predict the monthly price changes and trading return in the S&P 500 index futures. The results showed that the neural network was able to predict correctly 75% of the time and gave a positive return above risk. Another work on predicting S&P 500 index futures was by Tsaih, Hsu, and Lai (1998). Similar to Trippi and DeSieno (1992), Tsaih et al. (1998) also integrated a rule-based system technique with a neural network to produce a trading system. However, in the Tsaih et al. (1998) study, they used reasoning neural networks instead of the backpropagation method used by Trippi and Desieno (1992). Empirical results in the daily prediction of price changes in the S&P 500 index futures showed that this hybrid artificialintelligence (AI) approach outperformed the passive buy-and-hold investment strategy. 11 more pages are available in the full version of this document, which may be purchased using the "Add to Cart" button on the publisher's webpage: www.igi-global.com/chapter/improving-returns-stockinvestment-through/5354

One of the most critical problems for machine learning methods is overfitting. The overfitting problem is a phenomenon in which the accuracy of the model on unseen data is poor whereas the training accuracy is nearly perfect. This problem is particularly severe in complex models that have a large set of parameters. In this paper, we propose a deep learning neural network model that adopts the support vector data description (SVDD). The SVDD is a variant of the support vector machine, which has high generalization performance by acquiring a maximal margin in one-class classification problems. The proposed model strives to obtain the representational power of deep learning. Generalization performance is maintained using the SVDD. The experimental results showed that the proposed model can learn multiclass data without severe overfitting problems.

Applications such as those for systems management and intrusion detection employ an automated real-time operation system in which sensor data are collected and processed in real time. Although such a system effectively reduces the need for operation staff, it requires constructing and maintaining correlation rules. Currently, rule construction requires experts to identify problem patterns, a process that is timeconsuming and error-prone. In this paper, we propose reducing this burden by mining historical data that are readily available. Specifically, we first present efficient algorithms to mine three types of important patterns from historical event data: event bursts, periodic patterns, and mutually dependent patterns. We then discuss a framework for efficiently mining events that have multiple attributes. Last, we present Event Correlation Constructor—a tool that validates and extends correlation knowledge.

Redundant and irrelevant features in data have caused a long-term problem in network traffic classification. These features not only slow down the process of classification but also prevent a classifier from making accurate decisions, especially when coping with big data. In this paper, we propose a mutual information based algorithm that analytically selects the optimal feature for classification. This mutual information based feature selection algorithm can handle linearly and nonlinearly dependent data features. Its effectiveness is evaluated in the cases of network intrusion detection. An Intrusion Detection System (IDS), named Least Square Support Vector Machine based IDS (LSSVM-IDS), is built using the features selected by our proposed feature selection algorithm. The performance of LSSVM-IDS is evaluated using three intrusion detection evaluation datasets, namely KDD Cup 99, NSL-KDD and Kyoto 2006+ dataset. The evaluation results show that our feature selection algorithm contributes more critical features for LSSVM-IDS to achieve better accuracy and lower computational cost compared with the state-of-the-art methods.

Traditional intrusion detection systems (IDSs) focus on low-level attacks or anomalies, and raise alerts independently, though there may be logical connections between them. In situations where there are intensive intrusions, not only will actual alerts be mixed with false alerts, but the amount of alerts will also become unmanageable. As a result, it is difficult for human users or intrusion response systems to understand the alerts and take appropriate actions. This paper presents a practical technique to address this issue. The proposed approach constructs attack scenarios by correlating alerts on the basis of  prerequisites and consequences of intrusions. Intuitively, the prerequisite of an intrusion is the necessary condition for the intrusion to be successful, while the consequence of an intrusion is the possible outcome of the intrusion. Based on the prerequisites and consequences of different types of attacks, the proposed approach correlates alerts by (partially) matching the consequence of some previous alerts and the prerequisite of some later ones. The contribution of this paper includes a formal framework for alert correlation, the implementation of an off-line alert correlator based on the framework, and the evaluation of our method with the 2000 DARPA intrusion detection scenario specific datasets. Our experience and experimental results have demonstrated the potential of the proposed method and its advantage over alternative methods.


Question: Neural correlates associated with heart rate variability while experiencing emotions.

This study aimed to explore the interplay between physical fitness, heart rate variability (HRV), and cognitive performance in a cohort of 37 male sailors serving in the Royal Norwegian Navy. All participants underwent an 8-week structured training regimen, following which they underwent initial cognitive assessments (pre-test). Subsequently, they were divided into two groups: a detrained group (DG) and a trained group (TG), based on their individual decisions regarding continued service. The DG ceased their training regimen for a period of 4 weeks, after which all subjects repeated the cognitive tests (post-test). Various metrics were recorded, including physical fitness as gauged by maximum oxygen consumption (V̇O2max), resting HRV, and cognitive function through a continuous performance task (CPT) and a working memory test (WMT), with results presented as mean and standard deviation values. The findings revealed no significant differences in V̇O2max or HRV between the groups at the pre-test stage. However, the DG exhibited a notable decline in V̇O2max from pre- to post-test, and their resting HRV was lower than that of the TG post-test. Although no between-group disparities were observed in CPT or WMT outcomes at the pre-test, the TG demonstrated quicker reaction times and a higher number of true positive responses in executive function tests post-test compared to pre-test. Conversely, the DG showed faster reaction times on non-executive tasks post-test relative to pre-test. These results are interpreted within the context of a neurovisceral integration model, which posits a connection between parasympathetic nervous system activity directed at the heart and prefrontal brain functions.

This paper investigates the potential of physiological signals as reliable channels for multi-subject emotion recognition. A three-stage decision framework is proposed for recognizing four emotions of multiple subjects. The decision framework consists of three stages: (1) in the initial stage, identifying a subject group that a test subject can be mapped to; (2) in the second stage, identifying an emotion pool that an instance of the test subject can be assigned to; and (3) in the final stage, generating the predicted emotion from the given emotion pool for the test instance. In comparison with a series of alternative methods, the high accuracy of 70.04% achieved by our proposed method clearly demonstrates the potential of the three-stage decision method in multi-subject emotion recognition.

Anxiety is the cognitive state related to the inability to control emotional responses to perceived threats. Anxiety is inversely related to brain activity associated with the cognitive regulation of emotions. Mindfulness meditation has been found to regulate anxiety. However, the brain mechanisms involved in meditation-related anxiety relief are largely unknown. We employed pulsed arterial spin labeling MRI to compare the effects of distraction in the form of attending to the breath (ATB; before meditation training) to mindfulness meditation (after meditation training) on state anxiety across the same subjects. Fifteen healthy subjects, with no prior meditation experience, participated in 4 d of mindfulness meditation training. ATB did not reduce state anxiety, but state anxiety was significantly reduced in every session that subjects meditated. Meditation-related anxiety relief was associated with activation of the anterior cingulate cortex, ventromedial prefrontal cortex and anterior insula. Meditation-related activation in these regions exhibited a strong relationship to anxiety relief when compared to ATB. During meditation, those who exhibited greater default-related activity (i.e. posterior cingulate cortex) reported greater anxiety, possibly reflecting an inability to control self-referential thoughts. These findings provide evidence that mindfulness meditation attenuates anxiety through mechanisms involved in the regulation of self-referential thought processes.

Whether observation of distress in others leads to empathic concern and altruistic motivation, or to personal distress and egoistic motivation, seems to depend upon the capacity for self-other differentiation and cognitive appraisal. In this experiment, behavioral measures and event-related functional magnetic resonance imaging were used to investigate the effects of perspective-taking and cognitive appraisal while participants observed the facial expression of pain resulting from medical treatment. Video clips showing the faces of patients were presented either with the instruction to imagine the feelings of the patient (imagine other) or to imagine oneself to be in the patient's situation (imagine self). Cognitive appraisal was manipulated by providing information that the medical treatment had or had not been successful. Behavioral measures demonstrated that perspective-taking and treatment effectiveness instructions affected participants' affective responses to the observed pain. Hemodynamic changes were detected in the insular cortices, anterior medial cingulate cortex (aMCC), amygdala, and in visual areas including the fusiform gyrus. Graded responses related to the perspective-taking instructions were observed in middle insula, aMCC, medial and lateral premotor areas, and selectively in left and right parietal cortices. Treatment effectiveness resulted in signal changes in the perigenual anterior cingulate cortex, in the ventromedial orbito-frontal cortex, in the right lateral middle frontal gyrus, and in the cerebellum. These findings support the view that humans' responses to the pain of others can be modulated by cognitive and motivational processes, which influence whether observing a conspecific in need of help will result in empathic concern, an important instigator for helping behavior.

This article evaluates the suitability of low frequency (LF) heart rate variability (HRV) as an index of sympathetic cardiac control and the LF/high frequency (HF) ratio as an index of autonomic balance. It includes a comprehensive literature review and a reanalysis of some previous studies on autonomic cardiovascular regulation. The following sources of evidence are addressed: effects of manipulations affecting sympathetic and vagal activity on HRV, predictions of group differences in cardiac autonomic regulation from HRV, relationships between HRV and other cardiac parameters, and the theoretical and mathematical bases of the concept of autonomic balance. Available data challenge the interpretation of the LF and LF/HF ratio as indices of sympathetic cardiac control and autonomic balance, respectively, and suggest that the HRV power spectrum, including its LF component, is mainly determined by the parasympathetic system.

The mirror neuron system (MNS) has been proposed to play an important role in social cognition by providing a neural mechanism by which others' actions, intentions, and emotions can be understood. Here functional magnetic resonance imaging was used to directly examine the relationship between MNS activity and two distinct indicators of social functioning in typically-developing children (aged 10.1 years+/-7 months): empathy and interpersonal competence. Reliable activity in pars opercularis, the frontal component of the MNS, was elicited by observation and imitation of emotional expressions. Importantly, activity in this region (as well as in the anterior insula and amygdala) was significantly and positively correlated with established behavioral measures indexing children's empathic behavior (during both imitation and observation) and interpersonal skills (during imitation only). These findings suggest that simulation mechanisms and the MNS may indeed be relevant to social functioning in everyday life during typical human development.

We present a simple and computationally feasible method to perform automatic emotional classification of facial expressions. We propose the use of 10 characteristic points (that are part of the MPEG4 feature points) to extract relevant emotional information (basically five distances, presence of wrinkles and mouth shape). The method defines and detects the six basic emotions (plus the neutral one) in terms of this information and has been fine-tuned with a data-base of 399 images. For the moment, the method is applied to static images. Application to sequences is being now developed. The extraction of such information about the user is of great interest for the development of new multimodal user interfaces.

This study develops a framework for the detection and analysis of stress/anxiety emotional states through video-recorded facial cues. A thorough experimental protocol was established to induce systematic variability in affective states (neutral, relaxed and stressed/anxious) through a variety of external and internal stressors. The analysis was focused mainly on non-voluntary and semi-voluntary facial cues in order to estimate the emotion representation more objectively. Features under investigation included eye-related events, mouth activity, head motion parameters and heart rate estimated through camerabased photoplethysmography. A feature selection procedure was employed to select the most robust features followed by classification schemes discriminating between stress/anxiety and neutral states nxiety tress link rate ead motion with reference to a relaxed state in each experimental phase. In addition, a ranking transformation was proposed utilizing self reports in order to investigate the correlation of facial parameters with a participant perceived amount of stress/anxiety. The results indicated that, specific facial cues, derived from eye activity, mouth activity, head movements and camera based heart activity achieve good accuracy and are suitable as discriminative indicators of stress and anxiety.

OBJECTIVE
The present paper reviews the evidence that depression is a risk factor for the development and progression of coronary artery disease (CAD).

METHODS
MEDLINE searches and reviews of bibliographies were used to identify relevant articles. Articles were clustered by theme: depression as a risk factor, biobehavioral mechanisms, and treatment outcome studies.

RESULTS
Depression confers a relative risk between 1.5 and 2.0 for the onset of CAD in healthy individuals, whereas depression in patients with existing CAD confers a relative risk between 1.5 and 2.5 for cardiac morbidity and mortality. A number of plausible biobehavioral mechanisms linking depression and CAD have been identified, including treatment adherence, lifestyle factors, traditional risk factors, alterations in autonomic nervous system (ANS) and hypothalamic pituitary adrenal (HPA) axis functioning, platelet activation, and inflammation.

CONCLUSION
There is substantial evidence for a relationship between depression and adverse clinical outcomes. However, despite the availability of effective therapies for depression, there is a paucity of data to support the efficacy of these interventions to improve clinical outcomes for depressed CAD patients. Randomized clinical trials are needed to further evaluate the value of treating depression in CAD patients to improve survival and reduce morbidity.

The Learning Pulse study aims to explore whether physiological data such as heart rate and step count correlate with learning activity data and whether they are good predictors for learning success during self-regulated learning. To verify this hypothesis an experiment was set up involving eight doctoral students at the Open University of the Netherlands. Through wearable sensors, heart rate and step count were constantly monitored and learning activity data were collected. All data were stored in a Learning Record Store in xAPI format. Additionally, with an Activity Rating Tool, the participants rated their learning and working experience by indicating the perceived levels of productivity, stress, challenge and abilities along with the type of activity. These human annotated labels can be used for supervising machine learning algorithms to discriminate the successful learning moments from the unsuccessful ones and eventually discover the attributes that most influence the learning process.

The paper describes a novel technique for the recognition of emotions from multimodal data. We focus on the recognition of the six prototypic emotions. The results from the facial expression recognition and from the emotion recognition from speech are combined using a bi-modal multimodal semantic data fusion model that determines the most probable emotion of the subject. Two types of models based on geometric face features for facial expression recognition are being used, depending on the presence or absence of speech. In our approach we define an algorithm that is robust to changes of face shape that occur during regular speech. The influence of phoneme generation on the face shape during speech is removed by using features that are only related to the eyes and the eyebrows. The paper includes results from testing the presented models.