Question: Advancing AI-driven personalization in MOOC educational experiences.

This paper presents a methodology for enhancing predictive inference under conditions of covariate shift by strategically adjusting the weight of observed samples in the maximization of the log-likelihood function. This technique is particularly useful in scenarios such as sample surveys or experimental designs, where the distribution of the observed covariate diverges from that of the overall population. In the context of a misspecified parametric model, the paper demonstrates that the optimal weight function, asymptotically, corresponds to the ratio of the population's covariate density function to that of the observed samples. This is akin to the pseudo-maximum likelihood estimation used in sample surveys. The optimality criterion is defined by minimizing the expected Kullback-Leibler loss, with the optimal weight determined through the importance sampling principle. However, under a correctly specified model, the conventional maximum likelihood estimate (MLE), which assumes a uniform weight, is shown to be the optimal choice asymptotically. For smaller sample sizes, the optimal weight function lies between these two extremes and is selected by minimizing a modified version of the information criterion, which serves as an estimate of the expected loss. The paper also explores the application of this method to a weighted Bayesian predictive density. The efficacy of the approach is illustrated through numerical examples and Monte-Carlo simulations in the context of polynomial regression. A discussion on the connection between this method and robust parametric estimation is also provided.

Modeling and predicting player behavior is of the utmost importance in developing games. Experience has proven that, while theory-driven approaches are able to comprehend and justify a model's choices, such models frequently fail to encompass necessary features because of a lack of insight of the model builders. In contrast, data-driven approaches rely much less on expertise, and thus offer certain potential advantages. Hence, this study conducts a systematic review of the extant research on data-driven approaches to game player modeling. To this end, we have assessed experimental studies of such approaches over a nine-year period, from 2008 to 2016; this survey yielded 46 research studies of significance. We found that these studies pertained to three main areas of focus concerning the uses of data-driven approaches in game player modeling. One research area involved the objectives of data-driven approaches in game player modeling: behavior modeling and goal recognition. Another concerned methods: classification, clustering, regression, and evolutionary algorithm. The third was comprised of the current challenges and promising research directions for data-driven approaches in game player modeling.

This study aimed to create an online community of practice by creating a virtual classroom in the Edmodo application and ascertain the opinions of pre-service primary teachers about the effects of Edmodo on their learning to teach science and availability of Edmodo. The research used a case study, which is one method of descriptive research. During the implementation process, pre-service primary teachers used Edmodo to share activities they had designed that centred on the scientific concepts taught in primary science education programmes. They also shared their diary entries that outlined their experiences and views after they had practised their activities in a real classroom. 58 pre-service primary teachers participated in the study. The author developed a questionnaire and it included one closed-ended and six open-ended questions; the questionnaire was used as the data collection tool. The pre-service primary teachers used Edmodo for 12 weeks. Descriptive and content analysis methods were used to analyse the data obtained from the study. The results obtained from the data analysis showed that pre-service primary teachers generally had positive views about the use of Edmodo in teacher education programmes. Most pre-service primary teachers stated that Edmodo provides the possibility of sharing knowledge, experiences and views. However, some pre-service teachers stated that Edmodo has some limitations; for example, the fact that it requires the user to have internet access. As a result, it can be said that Edmodo can be used to create an online community of practice in teacher education programmes.

Big data, which is maturing over time, has a high impact in analyzing scenarios and coming up with decision making strategies pertaining to any sector. Consequently the number of applications are also increasing where in the past, they were limited to the confines of company sales departments. In lieu, this paper is primarily focused on applying Data Sciences within the education sector. We will be discussing the overall application to address higher-education issues. We will also present a framework for capturing, analyzing it and concluding on data in order to benefit decision-makers, thus ultimately manifesting in informing design and finalizing policy.

This chapter addresses the challenge of building or authoring an Intelligent Tutoring System (ITS), along with the problems that have arisen and been dealt with, and the solutions that have been tested. We begin by clarifying what building an ITS entails, and then position today's systems in the overall historical context of ITS research. The chapter concludes with a series of open questions and an introduction to the other chapters in this part of the book.

The rise of digital technology creates disruptive innovation, new opportunities in communication, it transforms industrial production and it changes the way we work, learn and live. That leads to the fourth Industrial Revolution, which changes the working world enormously. New skills, future-ready curricula, new learning and training concepts as well as the flexibility in education are necessary. To deliver that, it needs a fourth revolution in the educational system with a strong active presence and most important Artificial Intelligence (AI) driven features for better performance. Education 4.0 needs also a strong partnership between industry and academicals environment in the formation of human resources for Industry 4.0. We present in this paper our answers of education regarding the challenges of fourth revolution in Industry and the seven AI driven didactic methods identified for the University of Future.

been developed during the last 20 years have proven to be quite successful, particularly in the domains of mathematics, science, and technology. They produce significant learning gains beyond classroom environments. They are capable of engaging most students’ attention and interest for hours. We have been working on a new generation of intelligent tutoring systems that hold mixedinitiative conversational dialogues with the learner. The tutoring systems present challenging problems and questions to the learner, the learner types in answers in English, and there is a lengthy multiturn dialogue as complete solutions or answers evolve. This article presents the tutoring systems that we have been developing. AUTOTUTOR is a conversational agent, with a talking head, that helps college students learn about computer literacy. ANDES, ATLAS, AND WHY2 help adults learn about physics. Instead of being mere information-delivery systems, our systems help students actively construct knowledge through conversations.

Education helps people develop as individuals. It not only helps build social skills but also enhances the problem solving and decision making skills of individuals. With the growing number of schools, colleges and universities around the globe, education now has taken new dimension. The main focus of higher Educational Institutes is to improve the overall quality and effectiveness of education. Predicting the performance of student and Predicting the Future in this world of Big Data is the need of Today in Education. The crude data from educational organizations act as a gold mine which facilitate the analysts and designers to make a system that will improve the overall teaching and learning process. This new field coined as Educational Data mining helps in Predicting the Future and Changing the Future. In this paper we have studied what is Educational Data Mining and what are the Application areas of EDM, various techniques of EDM and the factors affecting the students' Academic Performance and the Teaching-Learning process.

There is a trend in Irish universities to utilise the benefits of the e-learning as a mechanism to improve learning performance of campus-based students. Whilst traditional methods, such as face-to-face lectures, tutorials, and mentoring, remain dominant in the educational sector, universities are investing heavily in learning technologies, to facilitate improvements with respect to the quality of learning. The technology to support reuse and sharing of educational resources, or learning objects, is becoming more stable, with interoperability standards maturing. However, debate has raged about what constitutes effective use of learning technology. This research expands upon a study carried out in 2003 examining students’ perceptions of e-learning in a large undergraduate accounting class environment. As a result, improvements were made to the instructional design of the course, to enable students to engage interactively with content. The subsequent study, reported in this paper, adopted a broad range of techniques to understand students’ learning experience in depth. The findings of this research provide an insight into how these students really work and learn using technologies, if at all. It is hoped that our findings will improve the experience for both students and lecturers who engage in teaching and learning through this medium. 502 British Journal of Educational Technology Vol 36 No 3 2005 © British Educational Communications and Technology Agency, 2005. Introduction A recent trend in higher education is to create and provide online access to course materials. Over the past two decades academics and institutes of higher education have been diversifying their delivery of instruction through new Internet media such as learning management systems, asynchronous distance learning, and online classrooms amongst a myriad of other burgeoning educational technologies. This combination of traditional face-to-face lectures or tutorials, and web-based course content is better known as “blended learning,” purporting to blend the best aspects of real and virtual environments. Many Irish universities have invested in architectures and platforms to support their teaching staff in delivering material to students in a blended manner. Other institutions have adopted a lecturer-driven approach, whereby teaching staff are left to their own devices to supplement their lectures and tutorials with online material, hosted via their own web servers and typically open source, freeware software, or basic web pages. The reasons behind the drive to incorporate technology into the educational process are threefold. First, pressure to utilise information and communications technology (ICT) at university level comes from changes in the student demography. The rise of “full time part time students” is a phenomenon of recent years, where school leavers take part-time jobs whilst attending university, leaving less time for evening tutorials or weekend study. In addition, there is a drive for what is known as lifelong learning, whereby adults are increasingly returning to institutions of higher education to take supplementary courses whilst in full-time employment, or during short career breaks. In this regard, the Irish government has made a commitment to have 15% of adults in continuing higher education by 2006. The figure currently stands at less than 5% (Department of Education and Science, 2000). This movement to adult continuing education was also reflected in a statement made by Information Commission Society (Ireland): “The issue of integration IT to the teaching process is an important part of future improvements, which it will be crucial to pursue” (Boylan, 2000, p. 31). Second, changes in the market for delivery of education is also shifting. Private for-profit higher education institutions are offering a wide range of certificate and degree courses. The Irish Open University Initiative “Oscail” and its UK equivalent offer distance learning diploma and degree courses. Many of these courses are delivered through ICT, along with weekend face-to-face tutorials. This distance learning market has also seen the arrival of new entrants, such as the Atlantic University Alliance, a collaboration between National University of Ireland, Galway, University College Cork, and the University of Limerick. Similar undertakings are underway in other institutes of higher education, whereby expertise in delivering blended learning within the institution is being extended towards distance learning courses by using a significant amount of ICT to overcome geographic and time barriers. Third, another pressure on traditional institutions of higher education comes from innovations in new technologies. John Seely Brown and Paul Duiguid claim that these technologies “offer new ways to think of producing, distributing and consuming acaWhat students think about e-learning 503 © British Educational Communications and Technology Agency, 2005. demic material. As with so many other institutions, new technologies have caused universities to rethink not simply isolated features but their entire mission and how they go about it” (Seely Brown & Duiguid, 2000). This sentiment is also being echoed by government policy towards higher education where the Irish State is attempting to set certain parameters of performance covering such areas as equity of access, commitment to e-learning and to ICT, commitment to life-long learning, and outreach to other communities. In the subject domain of accountancy, the integration of technology into the classroom is also becoming a central issue for accounting educators for an additional reason. Accountancy professionals in industry require competency in accountancy-related information technology (IT) skills. Higher education institutions, in response, have tried to simulate authentic learning scenarios in the accountancy class and incorporate IT topics into their programmes. However, the efficacy of introducing technology in accounting education remains unclear. Positive learning effects associated with IT in accounting education have been noted (Abdolmohammadi et al , 1998; Fetters, McKenzie & Callaghan, 1986; Friedman, 1981). Equally, evidence has shown that technology has negatively impacted on learning (Dickens & Harper, 1986; Togo & McNamee, 1997). Indeed, some critics harshly criticise its introduction to educational contexts. Selwyn (2002, p. 172) claims in generic terms that “...in the final analysis educational technology remains a diverting pastime and ‘add-on’ to the curriculum for some teaching and learners, whilst for most in education its impact has been slight.” This paper hopes to look at some of the issues raised by individual students with regard to the use of technology in the teaching and learning process. Rather than focusing on macro issues, such as the political decisions behind the integration of technology, this research aims to examine individuals’ acceptance or rejection of using ICT. Exploring the perspective of the individual student when discussing the use of technology is paramount to beginning to understand the nature of ICT in higher educational settings. This is of importance both to policy makers and education technologists in the debate on the role of ICT in education at an organisational level. The module and the medium This research focused on one module of The Principles of Accounting being taught to approximately 600 first-year undergraduate students at the University of Limerick. The module under investigation was part of a wider course, leading to a degree in Business Studies or Law and Accounting. The majority of students were between 17 and 19 years of age, coming from distributed second-level schools in Ireland. A minority were Erasmus students from various European countries, or mature students over the age of 23. For all, except overseas students, this was their first experience in using an e-learning platform, although most had previously informal used the web to gather information, or prepare coursework in second-level education, prior to entering university. This module was delivered by using a blended learning approach, supplementing weekly lectures, tutorials, and laboratory sessions with online course content, interac504 British Journal of Educational Technology Vol 36 No 3 2005 © British Educational Communications and Technology Agency, 2005. tive quizzes, and Excel tasks. A range of different e-learning assessments complemented the traditional weekly meetings. Students were asked to submit a compulsory paperbased accounting case study, and additionally were offered two optional ICT assignments, a stream of online multiple-choice quizzes, and an Excel project. A module web site provided course details, additional readings, and supplementary links. Employing multiple teaching methods simultaneously is a form of blended learning (Saunders & Werner, 2003). Alternative instructional resources can stimulate positive effects on accounting students’ learning experiences, according to (Rebele et al , 1998). Furthermore, instructional innovations are desirable to develop accounting students’ IT competencies (Albrecht & Sack, 2000). Figure 1 illustrates the staged delivery of both the traditional and online elements of the module. The university does not provide institutional support for e-learning on a campus-wide scale, but two other modules in their first year also used a blended learning delivery approach, providing lecture notes online, or sample answers, in the subject area of economics and mathematics. Both of these other modules differ in marking scheme and in the extent to which online supports are provided such as discussion boards, or positive marking schemes for continuous online assessments. As such, blended learning is not yet a norm across modules for first-year students at this current time. Methods The research developed on experience gained in a previous study on a prior

One distinctive feature of any adaptive system is the user model that represents essential information about each user. This chapter complements other chapters of this book in reviewing user models and user modeling approaches applied in adaptive Web systems. The presentation is structured along three dimensions: what is being modeled, how it is modeled, and how the models are maintained. After a broad overview of the nature of the information presented in these various user models, the chapter focuses on two groups of approaches to user model representation and maintenance: the overlay approach to user model representation and the uncertainty-based approach to user

We have witnessed a great interest in ontologies as an emerging technology within the Semantic Web. Its foundation that was laid in the last decade paved the way for the development of ontologies and systems that use ontologies in various domains, including the E-Learning domain. In this article, we survey key contributions related to the development and use of ontologies in the domain of E-Learning systems. We provide a framework for classification of the literature that is useful for the community of practice in categorizing work in this field and for determining possible research lines. We also discuss future trends in this area.


Question: Advancing AI-driven personalization in MOOC-based learning experiences.

This paper explores the application of discriminative learning in scenarios where the training and test data distributions significantly diverge, a phenomenon often encountered in real-world classification tasks, particularly under the condition known as covariate shift. Our proposed solution breaks away from traditional approaches that require modeling both the training and test distributions explicitly. Instead, we present an integrated optimization problem that directly addresses learning under covariate shift, without the need for explicit distribution modeling. To tackle this challenge, we devise a kernel logistic regression classifier specifically tailored to accommodate differing training and test distributions. This classifier is designed to be purely discriminative, focusing solely on the differences in distributions rather than attempting to model them. By doing so, we aim to enhance the classifier's robustness and adaptability when faced with distributional discrepancies, making it a valuable tool for classification tasks in environments where covariate shift is prevalent.

Recent online services rely heavily on automatic personalization to recommend relevant content to a large number of users. This requires systems to scale promptly to accommodate the stream of new users visiting the online services for the first time. In this work, we propose a content-based recommendation system to address both the recommendation quality and the system scalability. We propose to use a rich feature set to represent users, according to their web browsing history and search queries. We use a Deep Learning approach to map users and items to a latent space where the similarity between users and their preferred items is maximized. We extend the model to jointly learn from features of items from different domains and user features by introducing a multi-view Deep Learning model. We show how to make this rich-feature based user representation scalable by reducing the dimension of the inputs and the amount of training data. The rich user feature representation allows the model to learn relevant user behavior patterns and give useful recommendations for users who do not have any interaction with the service, given that they have adequate search and browsing history. The combination of different domains into a single model for learning helps improve the recommendation quality across all the domains, as well as having a more compact and a semantically richer user latent feature vector. We experiment with our approach on three real-world recommendation systems acquired from different sources of Microsoft products: Windows Apps recommendation, News recommendation, and Movie/TV recommendation. Results indicate that our approach is significantly better than the state-of-the-art algorithms (up to 49% enhancement on existing users and 115% enhancement on new users). In addition, experiments on a publicly open data set also indicate the superiority of our method in comparison with transitional generative topic models, for modeling cross-domain recommender systems. Scalability analysis show that our multi-view DNN model can easily scale to encompass millions of users and billions of item entries. Experimental results also confirm that combining features from all domains produces much better performance than building separate models for each domain.

Active learning requires that students receive a continuous feedback about their understanding. Multiple-Choice Questions (MCQ) tests have been frequently used to provide students the required feedback and to measure the effectiveness of this learning model. To construct a test is a challenging task, which is time consuming and requires experience. For these reasons, research efforts have been focused on the automatic generation of well-constructed tests. The semantic technologies have played a relevant role in the implementation of these testgeneration systems. Nevertheless, the existing proposals present a set of drawbacks that restrict their applicability to different learning domains and the type of test to be composed. In this paper, we propose a service-oriented and semantic-based system that solves these drawbacks. The system consists of a dynamic strategy of generating candidate distractors (alternatives to the correct answer), a set of heuristics for scoring the distractors' suitability, and a selection of distractors that considers the difficulty level of tests. Besides, the final version of tests is created using the Google Form service, a de-facto standard for elaborating online questionnaires.

This chapter is about personalization and adaptation in electronic commerce (e-commerce) applications. In the first part, we briefly introduce the challenges posed by e-commerce and we discuss how personalization strategies can help companies to face such challenges. Then, we describe the aspects of personalization, taken as a general technique for the customization of services to the user, which have been successfully employed in e-commerce Web sites. To conclude, we present some emerging trends and and we discuss future perspectives.

In interactive storytelling systems and other story-based computer games, a drama manager is a background agent that aims to bring about an enjoyable and coherent experience for the players. In this paper, we present a personalized drama manager that increases a player’s expected enjoyment without removing player agency. Our personalized drama manager models a player’s preference using data-driven techniques, predicts the probability the player transitioning to different story experiences, selects an objective experience that can maximize the player’s expected enjoyment, and guides the player to the selected story experience. Human study results show that our drama manager can significantly increase players’ enjoyment ratings in an interactive storytelling testbed, compared to drama managers in pre-

The fields of learning theory and instructional design are in the midst of a scientific revolution in which their objectivist philosophical foundations are being replaced by a constructivist epistemology. This article describes the assumptions of a constructivist epistemology, contrasts them with objectivist assumptions, and then describes instructional systems that can support constructive learning at a distance Limitations of Distance Learning Technologies In an effort to supplement or replace live face-to-face instruction, technologicany mediated distance learning has more often than not merely replicated the ineffective methods that limit learning in face-to-face classrooms (Turoff 1995). Too often, potentially interactive technologies are used to present one-way lectures to students in remote locations. However, we believe that the most valuable activity in a classroom of any kind is the opportunity for students to work and interact together and to build and become part of a community of scholars and practitioners (Selfe and Eilola 1989; Bates 1990; Seaton 1993; Nalley 1995). A good learning experience is one in which a student can "master new knowledge and skills, criticany examine assumptions and beliefs, and engage in an invigorating, collaborative quest for wisdom and personal, holistic development" (Eastmond and Ziegahn 1995, 59). Technology used in distance education should facilitate these "good learning experiences" in an "extended classroom model" rather than broadcast teacher-centered lectures and demonstrations (Burge and Roberts 1993). A significant impediment to this goal is the fact that many teachers and instructional designers come to distance education from traditional backgrounds, bringing with them assumptions about teaching and learning that are not theory-based and do not translate well to technologicany mediated instruction (Schieman, Taere, and McLaren 1992).

In this volume, the authors introduce seven general principles of learning, distilled from the research literature as well as from twenty-seven years of experience working one-on-one with college faculty. They have drawn on research from a breadth of perspectives (cognitive, developmental, and social psychology; educational research; anthropology; demographics; and organizational behavior) to identify a set of key principles underlying learningfrom how effective organization enhances retrieval and use of information to what impacts motivation. These principles provide instructors with an understanding of student learning that can help them see why certain teaching approaches are or are not supporting student learning, generate or refine teaching approaches and strategies that more effectively foster student learning in specific contexts, and transfer and apply these principles to new courses.

This paper presents GISMO, a graphical interactive student monitoring and tracking system tool that extracts tracking data from an on-line course maintained with a Course Management System, and generates graphical representations that can be explored by course instructors to examine various aspects of distance students. GISMO uses techniques from Information Visualisation to render into an appropriate graphical manner the complex multidimensional student tracking data provided by the Course Management System. GISMO aims to help instructors to become aware of what is happening in their classes and provide a better support to their learners.

Robots have the potential to facilitate future therapies for children on the autism spectrum. However, existing robots are limited in their ability to automatically perceive and respond to human affect, which is necessary for establishing and maintaining engaging interactions. Their inference challenge is made even harder by the fact that many individuals with autism have atypical and unusually diverse styles of expressing their affective-cognitive states. To tackle the heterogeneity in children with autism, we used the latest advances in deep learning to formulate a personalized machine learning (ML) framework for automatic perception of the children’s affective states and engagement during robot-assisted autism therapy. Instead of using the traditional one-size-fits-all ML approach, we personalized our framework to each child using their contextual information (demographics and behavioral assessment scores) and individual characteristics. We evaluated this framework on a multimodal (audio, video, and autonomic physiology) data set of 35 children (ages 3 to 13) with autism, from two cultures (Asia and Europe), and achieved an average agreement (intraclass correlation) of ~60% with human experts in the estimation of affect and engagement, also outperforming nonpersonalized ML solutions. These results demonstrate the feasibility of robot perception of affect and engagement in children with autism and have implications for the design of future autism therapies.

Big data, which is maturing over time, has a high impact in analyzing scenarios and coming up with decision making strategies pertaining to any sector. Consequently the number of applications are also increasing where in the past, they were limited to the confines of company sales departments. In lieu, this paper is primarily focused on applying Data Sciences within the education sector. We will be discussing the overall application to address higher-education issues. We will also present a framework for capturing, analyzing it and concluding on data in order to benefit decision-makers, thus ultimately manifesting in informing design and finalizing policy.

Many current e-commerce systems provide personalization when their content is shown to users. In this sense, recommender systems make personalized suggestions and provide information of items available in the system. Nowadays, there is a vast amount of methods, including data mining techniques that can be employed for personalization in recommender systems. However, these methods are still quite vulnerable to some limitations and shortcomings related to recommender environment. In order to deal with some of them, in this work we implement a recommendation methodology in a recommender system for tourism, where classification based on association is applied. Classification based on association methods, also named associative classification methods, consist of an alternative data mining technique, which combines concepts from classification and association in order to allow association rules to be employed in a prediction context. The proposed methodology was evaluated in some case studies, where we could verify that it is able to shorten limitations presented in recommender systems and to enhance recommendation quality.


Question: Advancing AI-driven personalization in MOOC-based learning experiences.

This paper explores an innovative strategy to mitigate the sparsity issue in collaborative filtering (CF) algorithms, a significant obstacle for the majority of CF techniques. We introduce a method to leverage the dense user-item rating patterns from an auxiliary domain, such as a well-established movie rating platform, to enrich the sparse rating matrix in a target domain, such as an emerging book rating site. Our approach does not necessitate identical or overlapping user and item sets across the domains. Instead, it focuses on creating a cluster-level bridge between the two domains based on the limited ratings in the target matrix. This bridge allows for the transfer of valuable knowledge from the auxiliary to the target domain. Initially, we condense the auxiliary domain's ratings into a succinct, cluster-level representation, termed the codebook. Subsequently, we devise an efficient algorithm to expand this codebook and reconstruct the target rating matrix. Our empirical evaluations demonstrate the efficacy of our method in tackling the sparsity problem by effectively transferring knowledge from auxiliary tasks, outperforming several leading CF methods.

**Question**: A Comparative Analysis of Deep Learning Techniques in Natural Language Processing

**Documents**: A Deep Learning Framework for Personalized Recommender Systems
In recent years, deep learning has emerged as a powerful technique for personalizing recommender systems. This paper presents a deep learning framework designed to enhance the accuracy and personalization of recommendations. The proposed framework integrates various deep learning architectures, including convolutional neural networks (CNNs) and recurrent neural networks (RNNs), to process and analyze complex user-item interaction data. The CNN component captures the spatial features of the data, such as user preferences over different items, while the RNN component models the temporal dynamics of user behavior. The framework also includes a personalized attention mechanism that allows the model to focus on the most relevant features for each user. We evaluate the proposed framework on several benchmark datasets and compare its performance against state-of-the-art recommendation models. The results demonstrate that our framework outperforms traditional collaborative filtering methods and achieves higher accuracy in personalized recommendations.

**Similar Documents**: This paper introduces a comprehensive deep learning framework aimed at enhancing the personalization and accuracy of recommender systems. Capitalizing on the recent advancements in deep learning, the framework is designed to improve the quality of recommendations by integrating advanced architectures such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs). The CNN component of the framework is adept at capturing the spatial aspects of user-item interactions, such as identifying patterns in user preferences across various items. Meanwhile, the RNN component excels

72 AI MAGAZINE The Tactical Language and Culture Training System (TLCTS) helps people quickly acquire functional skills in foreign languages and cultures. It includes interactive lessons that focus on particular communicative skills and interactive games that apply those skills. Heavy emphasis is placed on spoken communication: learners must learn to speak the foreign language to complete the lessons and play the games. It focuses on the language and cultural skills needed to accomplish particular types of tasks and gives learners rich, realistic opportunities to practice achieving those tasks. Several TLCTS courses have been developed so far. Tactical Iraqi, Tactical Pashto, and Tactical French are in widespread use by U.S. marines and soldiers, and increasingly by military service members in other countries. Additional courses are being developed for use by business executives, workers for nongovernmental organizations, and high school and college students. While precise numbers are impossible to obtain (we do not control copies made by the U.S. government), over 40,000 and as many as 60,000 people have trained so far with TLCTS courses. More than 1000 people download copies of TLCTS courses each month, either for their own use or to set up computer language labs and redistribute copies to students. Just one training site, the military advisor training center at Fort Riley, Kansas, trains approximately 10,000 people annually. Artificial intelligence technologies play multiple essential functions in TLCTS. Speech is the primary input modality, so automated speech recognition tailored to foreign language learners is essential. TLCTS courses are populated with “virtual humans” that engage in dialogue with learners. AI techniques are used to model the decision processes of the virtual humans and to support the generation of their behavior. This makes it possible to give learners extensive conversational practice. Learner modeling software continually monitors each learner’s application of communication skills to estimate the learner’s

Intelligent tutoring systems research aims to produce systems that meet or exceed the effectiveness of one on one expert human tutoring. Theory and empirical study suggest that affective states of the learner must be addressed to achieve this goal. While many affective measures can be utilized, posture offers the advantages of non intrusiveness and ease of interpretation. This paper presents an accurate posture estimation algorithm applied to a computer mediated tutoring corpus of depth recordings. Analyses of posture and session level student reports of engagement and cognitive load identified significant patterns. The results indicate that disengagement and frustration may coincide with closer postural positions and more movement, while focused attention and less frustration occur with more distant, stable postural positions. It is hoped that this work will lead to intelligent tutoring systems that recognize a greater breadth of affective expression through channels of posture and gesture.

Augmented reality (AR) technologies could enhance learning in several ways. The quality of an AR-based educational platform is a combination of key features that manifests in usability, usefulness, and enjoyment for the learner. In this paper, we present a multidimensional model to measure the quality of an AR-based application as perceived by students. The model is specified by a second-order factor (perceived quality) and three dimensions: ergonomic quality, learning quality, and hedonic quality. The purpose of this model is to embody previous research into a coherent framework for the evaluation of AR-based educational platforms and to provide guidance for researchers and practitioners. The model was empirically validated on a Chemistry learning scenario and the results confirm the importance of both the learning and hedonic quality. ARTICLE HISTORY Received 23 July 2014 Revised 2 December 2015 Accepted 9 December 2015

As more and more college classrooms utilize online platforms to facilitate teaching and learning activities, analyzing student online behaviors becomes increasingly important for instructors to effectively monitor and manage student progress and performance. In this paper, we present CCVis, a visual analytics tool for analyzing the course clickstream data and exploring student online learning behaviors. Targeting a large college introductory course with over two thousand student enrollments, our goal is to investigate student behavior patterns and discover the possible relationships between student clickstream behaviors and their course performance. We employ higher-order network and structural identity classification to enable visual analytics of behavior patterns from the massive clickstream data. CCVis includes four coordinated views (the behavior pattern, behavior breakdown, clickstream comparative, and grade distribution views) for user interaction and exploration. We demonstrate the effectiveness of CCVis through case studies along with an ad-hoc expert evaluation. Finally, we discuss the limitation and extension of this work.

The education domain offers a fertile ground for many interesting and challenging data mining applications. These applications can help both educators and students, and improve the quality of education. In this paper, we present a real-life application for the Gifted Education Programme (GEP) of the Ministry of Education (MOE) in Singapore. The application involves many data mining tasks. This paper focuses only on one task, namely, selecting students for remedial classes. Traditionally, a cut-off mark for each subject is used to select the weak students. That is, those students whose scores in a subject fall below the cut-off mark for the subject are advised to take further classes in the subject. In this paper, we show that this traditional method requires too many students to take part in the remedial classes. This not only increases the teaching load of the teachers, but also gives unnecessary burdens to students, which is particularly undesirable in our case because the GEP students are generally taking more subjects than non-GEP students, and the GEP students are encouraged to have more time to explore advanced topics. With the help of data mining, we are able to select the targeted students much more precisely.

Modeling and predicting player behavior is of the utmost importance in developing games. Experience has proven that, while theory-driven approaches are able to comprehend and justify a model's choices, such models frequently fail to encompass necessary features because of a lack of insight of the model builders. In contrast, data-driven approaches rely much less on expertise, and thus offer certain potential advantages. Hence, this study conducts a systematic review of the extant research on data-driven approaches to game player modeling. To this end, we have assessed experimental studies of such approaches over a nine-year period, from 2008 to 2016; this survey yielded 46 research studies of significance. We found that these studies pertained to three main areas of focus concerning the uses of data-driven approaches in game player modeling. One research area involved the objectives of data-driven approaches in game player modeling: behavior modeling and goal recognition. Another concerned methods: classification, clustering, regression, and evolutionary algorithm. The third was comprised of the current challenges and promising research directions for data-driven approaches in game player modeling.

Gamifying learning activities can be beneficial as it can better engage students and result in improved learning. However, incorporating game elements into learning activities can be difficult because it requires an appropriate mix of science, art, and experience. Design science research can help to address this issue. In particular, its search process for determining an appropriate solution for a given problem is useful as it allows for a number of iterative cycles over which the solution is incrementally refined, and ultimately resulting in a successful implementation. Our objective in this study is to develop a non-discipline-specific instantiation that can be embedded into a learning activity to motivate students and improve the quality of their learning. We provide a detailed explanation of how we designed and developed a gamified multiple choice quiz software tool over multiple iterations. The tool was trialled in three undergraduate IT-related courses and evaluated using a questionnaire survey. Results showed that the tool was well received as 76 per cent of students believed it was effective for learning and would for it to be used in their other courses.

As the number of Internet users and the number of accessible Web pages grows, it is becoming increasingly difficult for users to find documents that are relevant to their particular needs. Users must either browse through a large hierarchy of concepts to find the information for which they are looking or submit a query to a publicly available search engine and wade through hundreds of results, most of them irrelevant. The core of the problem is that whether the user is browsing or searching, whether they are an eighth grade student or a Nobel prize winner, the identical information is selected and it is presented the same way. In this paper, we report on research that adapts information navigation based on a user profile structured as a weighted concept hierarchy. A user may create his or her own concept hierarchy and use them for browsing Web sites. Or, the user profile may be created from a reference ontology by ‘watching over the user’s shoulder’ while they browse. We show that these automatically created profiles reflect the user’s interests quite well and they are able to produce moderate improvements when applied to search results.

One of the most crucial problem on training personalized response generation models for conversational robots is the lack of large scale personal conversation data. To address the problem, we propose a two-phase approach, namely initialization then adaptation, to first pre-train an optimized RNN encoder-decoder model (LTS model) in a large scale conversational data for general response generation and then fine-tune the model in a small scale personal conversation data to generate personalized responses. For evaluation, we propose a novel human aided method, which can be seen as a quasi-Turing test, to evaluate the performance of the personalized response generation models. Experimental results show that the proposed personalized response generation model outperforms the state-of-the-art approaches to language model personalization and persona-based neural conversation generation on the automatic evaluation, offline human judgment and the quasi-Turing test.

The aim is to assess the impact of YouTube videos about academic writing and its skills on the writing performance of students. Theoretical perspectives from constructivism and associated learning models are used to inform the purpose of the research. The contextual setting is matriculation students awaiting admission to higher institutions. The population is 40 students belonging to a class aimed at assisting disadvantaged students in their academic writing in Scottsville, Province of KwaZulu-Natal, South Africa. The students are broken into two groups – control/traditional teaching and the treatment/YouTube facilitated groups. Consequently, a dominant qualitative approach is adopted using focus group discussion, interviews and tests to identify underlying patterns, methods and approaches to best fit academic writing guides and videos to improve user experiences of the media for academic writing. The fundamental results show that positive characterisations of user experiences include innovation, surprise, playfulness and stimulation whereas the narratives that are not satisfying are categorised as dissatisfaction, frustration, dissolution, disappointment, anger, confusion and irritation. Ultimately, the major findings of the research have the potential to improve user experiences on the platform by highlighting how and when the positive and negative experiences of users occur and a mapping of the differences in the academic writing performance between the two groups and best practices. Finally, the results have implications for pedagogy the fitting of YouTube videos to academic writing instruction.


Question: NGUARD: A framework for detecting game bots in NetEase MMORPGs.

This paper introduces two innovative methods that leverage unlabeled data to enhance sequence learning through recurrent neural networks. The first method involves predicting the subsequent element in a sequence, akin to a standard language model widely used in natural language processing tasks. The second method employs a sequence autoencoder, which encodes the input sequence into a vector and then reconstructs the sequence. Both techniques can serve as a "pre-training" phase for subsequent supervised sequence learning algorithms. Essentially, the parameters derived from the unsupervised learning phase can be utilized as an initial point for supervised training models. Through experimentation, we have observed that long short-term memory (LSTM) recurrent networks, after undergoing pre-training with these methods, exhibit greater stability and improved generalization capabilities. Pre-training enables us to train LSTM networks for several hundred timesteps, leading to superior performance in various text classification tasks, including IMDB movie reviews, DBpedia ontology, and 20 Newsgroups dataset analysis.

**Question**: Anomaly Detection in Multivariate Time Series with Missing Values Using Long Short-Term Memory Networks

**Documents**: A Hybrid Method for Anomaly Detection in Time Series Data
We propose a hybrid method for anomaly detection in time series data that combines the strengths of statistical and machine learning techniques. Our method uses a combination of moving average and moving standard deviation filters to preprocess the data, followed by a deep learning model, specifically a long short-term memory (LSTM) network, to detect anomalies. The LSTM network is trained to predict the next value in the time series, and the difference between the predicted value and the actual value is used to detect anomalies. We also incorporate a self-attention mechanism to enable the model to focus on important features in the time series. Our method is evaluated on a synthetic time series dataset and a real-world electricity consumption dataset. The results show that our method outperforms traditional statistical methods and other machine learning methods, such as autoencoders and support vector machines, in terms of anomaly detection accuracy.

**Similar Documents**: This paper outlines a novel hybrid approach for identifying anomalies in time series data, effectively merging the advantages of statistical analysis with machine learning. The proposed method first applies moving average and moving standard deviation filters to the data for preprocessing, before employing a deep learning model, particularly a long short-term memory (LSTM) network, to pinpoint anomalies. The LSTM network is trained to forecast the next value in the time series sequence, and anomalies are detected by analyzing the discrepancy between the forecasted value and the actual value. To enhance the model's ability to

In the last few years, many different attacks against computing platform targeting hardware or low level firmware have been published. Such attacks are generally quite hard to detect and to defend against as they target components that are out of the scope of the operating system and may not have been taken into account in the security policy enforced on the platform. In this paper, we study the case of remote attacks against network adapters. In our case study, we assume that the target adapter is running a flawed firmware that an attacker may subvert remotely by sending packets on the network to the adapter. We study possible detection techniques and their efficiency. We show that, depending on the architecture of the adapter and the interface provided by the NIC to the host operating system, building an efficient detection framework is possible. We explain the choices we made when designing such a framework that we called NAVIS and give details on our proof of concept implementation.

Modern communication networks are vulnerable to attackers who send unsolicited messages to innocent users, wasting network resources and user time. Some examples of such attacks are spam emails, annoying tele-marketing phone calls, viral marketing in social networks, etc. Existing techniques to identify these attacks are tailored to certain specific domains (like email spam filtering), but are not applicable to a majority of other networks. We provide a generic abstraction of such attacks, called the Random Link Attack (RLA), that can be used to describe a large class of attacks in communication networks. In an RLA, the malicious user creates a set of false identities and uses them to communicate with a large, random set of innocent users. We mine the social networking graph extracted from user interactions in the communication network to find RLAs. To the best of our knowledge, this is the first attempt to conceptualize the attack definition, applicable to a variety of communication networks. In this paper, we formally define RLA and show that the problem of finding an RLA is NP-complete. We also provide two efficient heuristics to mine subgraphs satisfying the RLA property; the first (GREEDY) is based on greedy set-expansion, and the second (TRWALK) on randomized graph traversal. Our experiments with a real-life data set demonstrate the effectiveness of these algorithms.

Ensuring the security of computers is a non-trivial task, with many techniques used by malicious users to compromise these systems. In recent years a new threat has emerged in the form of networks of hijacked zombie machines used to perform complex distributed attacks such as denial of service and to obtain sensitive data such as password information. These zombie machines are said to be infected with a dasiahotpsila - a malicious piece of software which is installed on a host machine and is controlled by a remote attacker, termed the dasiabotmaster of a botnetpsila. In this work, we use the biologically inspired dendritic cell algorithm (DCA) to detect the existence of a single hot on a compromised host machine. The DCA is an immune-inspired algorithm based on an abstract model of the behaviour of the dendritic cells of the human body. The basis of anomaly detection performed by the DCA is facilitated using the correlation of behavioural attributes such as keylogging and packet flooding behaviour. The results of the application of the DCA to the detection of a single hot show that the algorithm is a successful technique for the detection of such malicious software without responding to normally running programs.

Designing and implementing a quality matchmaking service for Multiplayer Online Games requires an extensive knowledge of the habits, behaviors and expectations of the players. Gathering and analyzing traces of real games offers insight on these matters, but game server providers are very protective of such data in order to deter possible reuse by the competition and to prevent cheating. We circumvented this issue by gathering public data from a League of Legends server (information over more than 28 million game sessions). In this paper, we present our database which is freely available online, and we detail the analysis and conclusions we draw from this data regarding the expected requirements for the matchmaking service.

Reputation reporting systems have emerged as an important risk management mechanism in online trading communities. However, the predictive value of these systems can be compromised in situations where conspiring buyers intentionally give unfair ratings to sellers or, where sellers discriminate on the quality of service they provide to different buyers. This paper proposes and evaluates a set of mechanisms, which eliminate, or significantly reduce the negative effects of such fraudulent behavior. The proposed mechanisms can be easily integrated into existing online reputation systems in order to safeguard their reliability in the presence of potentially deceitful buyers and sellers.

Recommender systems have emergedrecently in many aspects due to enormous amount of information or items existed in e-commerce or social network services. Users find it convenient if the service can recommend interesting items to them automatically. Past systems adopted users' preference or social connections for such recommendation. In this work, we will try to identify a game player's personality traits and use them to recommend games that may be interested by the player. The personality traits of a player is identified by applying a text mining process on textual contents related to the player. The same process is also applied on the comments of the games to identified the personality traits of games. Recommendation is then performed based on the similarity between the traits of the user and the game. We performed experiments on 63 players and 2050 games and obtained promising results which may demonstrate the plausibility of personality-based recommender systems.

Nowadays a lot of malware are analyzed with virtual machines. The Cuckoo sandbox (Cuckoo DevTeam: Cuckoo sandbox. http://www.cuckoosandbox.org , 2013) offers the possibility to log every actions performed by the malware on the virtual machine. To protect themselves and to evande detection, malware need to detect whether they are in an emulated environment or in a real one. With a few modifications and tricks on Cuckoo and the virtual machine we can try to prevent malware to detect that they are under analyze, or at least make it harder. It is not necessary to apply all the modifications, because it may produce a significant overhead and if malware checks his execution time, it may detect an anomaly and consider that it is running in a virtual machine. The present paper will show how a malware can detect the Cuckoo sandbox and how we can counter that.

Phishing website creators and anti-phishing defenders are in an arms race. Cloning a website is fairly easy and can be automated by any junior programmer. Attempting to recognize numerous phishing links posted in the wild e.g. on social media sites or in email is a constant game of escalation. Automated phishing website detection systems need both speed and accuracy to win. We present a new method of detecting phishing websites and a prototype system LEO (Logo Extraction and cOmparison) that implements it. LEO uses image feature recognition to extract “visual hotspots” of a webpage, and compare these parts with known logo images. LEO can recognize phishing websites that has different layout from the original websites, or logos embedded in images. Comparing to existing visual similaritybased methods, our method has a much wider application range and higher detection accuracy. Our method successfully recognized 24 of 25 random URLs from PhishTank that previously evaded detection of other visual similarity-based methods.

We propose a novel trap-based architecture for detecting passive, “silent”, attackers who are eavesdropping on enterprise networks. Motivated by the increasing number of incidents where attackers sniff the local network for interesting information, such as credit card numbers, account credentials, and passwords, we introduce a methodology for building a trap-based network that is designed to maximize the realism of bait-laced traffic. Our proposal relies on a “record, modify, replay” paradigm that can be easily adapted to different networked environments. The primary contributions of our architecture are the ease of automatically injecting large amounts of believable bait, and the integration of different detection mechanisms in the back-end. We demonstrate our methodology in a prototype platform that uses our decoy injection API to dynamically create and dispense network traps on a subset of our campus wireless network. Our network traps consist of several types of monitored passwords, authentication cookies, credit cards, and documents containing beacons to alarm when opened. The efficacy of our decoys against a model attack program is also discussed, along with results obtained from experiments in the field. In addition, we present a user study that demonstrates the believability of our decoy traffic, and finally, we provide experimental results to show that our solution causes only negligible interference to ordinary users.

Online product reviews play an important role in E-commerce websites because most customers read and rely on them when making purchases. For the sake of profit or reputation, review spammers deliberately write fake reviews to promote or demote target products, some even fraudulently work in groups to try and control the sentiment about a product. To detect such spammer groups, previous work exploits frequent itemset mining (FIM) to generate candidate spammer groups, which can only find tightly coupled groups, i.e. each reviewer in the group reviews every target product. In this paper, we present the loose spammer group detection problem, i.e. each group member is not required to review every target product. We solve this problem using bipartite graph projection. We propose a set of group spam indicators to measure the spamicity of a loose spammer group, and design a novel algorithm to identify highly suspicious loose spammer groups in a divide and conquer manner. Experimental results show that our method not only can find loose spammer groups with high precision and recall, but also can generate more meaningful candidate spammer groups than FIM, thus it can also be used as an alternative preprocessing tool for existing FIM-based approaches.


Question: NGUARD: A framework for detecting game bots in NetEase MMORPGs.

This paper delves into the intricate challenge of identifying and combating gold farming groups (GFGs) in the expansive virtual world of massively multiplayer online role-playing games (MMORPGs). These GFGs operate within the game's economy, often disrupting the balance and fairness by mass-producing in-game currency, or gold, for real-world profit. Despite existing efforts to detect gold farmers based on behavioral patterns, these methods fall short in uncovering the complex internal hierarchies and organizational structures of GFGs. Moreover, GFGs are constantly evolving, adopting new strategies to avoid detection, such as creating front organizations, masking the flow of cyber-money, and adapting their trading behaviors in response to crackdowns by game service providers.

To address these issues, we present a novel approach for comprehensive GFG detection within the ecosystem of a major MMORPG. Our methodology involves constructing a detailed graph that captures the dynamics of virtual economic transactions within the game. By analyzing this graph, we pinpoint unusual trading patterns and activities that are indicative of GFG presence. We extract a set of features from both the trading graph and the physical networks utilized by GFGs to accurately identify these groups in their entirety. Leveraging the structural insights gained from our analysis, we propose strategies for effectively defending against GFGs while preserving the integrity and functionality of the existing virtual ecosystem. Our framework is designed to be proactive and adaptive, capable of evolving alongside the tactics employed by GFGs to maintain a fair and enjoyable gaming environment for legitimate players.

Online reviews are often the primary factor in a customer’s decision to purchase a product or service, and are a valuable source of information that can be used to determine public opinion on these products or services. Because of their impact, manufacturers and retailers are highly concerned with customer feedback and reviews. Reliance on online reviews gives rise to the potential concern that wrongdoers may create false reviews to artificially promote or devalue products and services. This practice is known as Opinion (Review) Spam, where spammers manipulate and poison reviews (i.e., making fake, untruthful, or deceptive reviews) for profit or gain. Since not all online reviews are truthful and trustworthy, it is important to develop techniques for detecting review spam. By extracting meaningful features from the text using Natural Language Processing (NLP), it is possible to conduct review spam detection using various machine learning techniques. Additionally, reviewer information, apart from the text itself, can be used to aid in this process. In this paper, we survey the prominent machine learning techniques that have been proposed to solve the problem of review spam detection and the performance of different approaches for classification and detection of review spam. The majority of current research has focused on supervised learning methods, which require labeled data, a scarcity when it comes to online review spam. Research on methods for Big Data are of interest, since there are millions of online reviews, with many more being generated daily. To date, we have not found any papers that study the effects of Big Data analytics for review spam detection. The primary goal of this paper is to provide a strong and comprehensive comparative study of current research on detecting review spam using various machine learning techniques and to devise methodology for conducting further investigation.

In Thailand, investigator can track and find the suspects by using call logs from suspects' phone numbers and their contacts. In many cases, the suspects changed their phone numbers to avoid tracking. The problem is that the investigators have difficulty to track these suspects from their call logs. Our hypothesis is that each user has a unique calling behavior pattern. The calling pattern is importance for tracking suspect's telephone number. To compare the calling patterns, we consider common contact groups. Thus, the aim of this project is to develop a call logs tracking system which can predict a set of new possible suspect's phone numbers and present their contacts' connection with our network diagram visualization based on Graph database (Neo4j). This system will be very necessary for investigators because it can save investigators' time from analyzing excessive call logs data. The system can predict the possible suspect's phone numbers. Furthermore, our visualization can enhance human's sight ability to connect the relation among related phone numbers. Finally, the experimental results on real call logs demonstrate that our method can track telephone number approximately 69% of single possible suspect phone number's matching while 89% of multiple possible suspect phone numbers' matching.

Designing and implementing a quality matchmaking service for Multiplayer Online Games requires an extensive knowledge of the habits, behaviors and expectations of the players. Gathering and analyzing traces of real games offers insight on these matters, but game server providers are very protective of such data in order to deter possible reuse by the competition and to prevent cheating. We circumvented this issue by gathering public data from a League of Legends server (information over more than 28 million game sessions). In this paper, we present our database which is freely available online, and we detail the analysis and conclusions we draw from this data regarding the expected requirements for the matchmaking service.

Gamification is the use of video-game mechanics and elements in nongame contexts to enhance user engagement and performance. The purpose of this study is to conduct a systematic review to have an in-depth investigation into the existing gamification solutions targeted at solving user engagement problems in different categories of software. We carried out this systematic review by proposing a framework of gamifying process, which is the basis for comparison of existing gamification solutions. In order to report the review, the primary studies are categorized according to the following: a) gamified software and their platforms, b) elements of the gamifying process, c) gamification solutions in each software type, d) gamification solutions for software user engagement problems, e) gamification solutions in general, and f) effects of gamification on software user engagement and performance. Based on the search procedure and criteria, a total of 78 primary studies were extracted. Most of the studies focused on educational and social software, which were developed for web or mobile platforms. We concluded that the number of studies on motivating users to use software content, solving problems in learning software, and using real identity is very limited. Furthermore, few studies have been carried out on gamifying the following software categories: productivity software, cloud storage, utility software, entertainment software, search engine software, tool software, fitness software, software engineering, information worker software, and health-care software. In addition, a large number of gamification solutions are relatively simple and require improvement. Thus, for future studies, researchers can work on the items discovered in this review; they can improve the quality of the current gamified systems by using a wide variety of game mechanics and interface elements, utilizing a combination of contextual types of rewards and giving users the ability to use received rewards “in-game” and “out-game”.

A intrusion detection evaluation test bed was developed which generated normal traffic similar to that on a government site containing 100’s of users on 1000’s of hosts. More than 300 instances of 38 different automated attacks were launched against victim UNIX hosts in seven weeks of training data and two weeks of test data. Six research groups participated in a blind evaluation and results were analyzed for probe, denialof-service (DoS), remote-to-local (R2L), and user to root (U2R) attacks. The best systems detected old attacks included in the training data, at moderate detection rates ranging from 63% to 93% at a false alarm rate of 10 false alarms per day. Detection rates were much worse for new and novel R2L and DoS attacks included only in the test data. The best systems failed to detect roughly half these new attacks which included damaging access to root-level privileges by remote users. These results suggest that further research should focus on developing techniques to find new attacks instead of extending existing rule-based

Hunting ELFs: An Investigation Into Android Malware Detection by Thomas Sheridan Atkinson Master of Science in Information Security Royal Holloway, University of London 2015/2016 Android has risen to become the de facto operating system for mobile technologies. Its huge success and ubiquity has made it a target for malware writers. It has been found that recently sampled Android malware apps make use of repackaged malicious ELF binaries. The research carried out by this project has found a previously unknown technique used by malicious ELF binaries to hide calls to external packed binaries. An original and robust method for detecting ELF binaries that make calls to a packed binary has been developed and implemented into a state of the art framework with an aim to improving how the framework detects malicious APKs. When trained and tested on 84,979 benign samples and 16,132 malware samples, an accuracy of 96.50% was maintained using XGBoost as the classifier algorithm. The accuracy achieved using the Extra Trees algorithm was improved by 0.01% to 95.79% and the accuracy achieved when using the Random Forest algorithm was increased by 0.05% to 95.34%.

Web spoofing is a significant problem involving fraudulent email and web sites that trick unsuspecting users into revealing private information. We discuss some aspects of common attacks and propose a framework for client-side defense: a browser plug-in that examines web pages and warns the user when requests for data may be part of a spoof attack. While the plugin, SpoofGuard, has been tested using actual sites obtained through government agencies concerned about the problem, we expect that web spoofing and other forms of identity theft will be continuing problems in

Security equipment such as intrusion prevention system is an important supplementary for security management. They reduce the difficulty of network management by giving alarms corresponding to different attacks instead of raw traffic packet inspection. But there are many false alarms due to their running mechanism, which greatly reduces its usability. In this paper, we develop a hierarchical framework to mine high threating alarms from the massive alarm logs, and aim to provide fundamental and useful information for administrators to design efficient management policy. First, the alarms are divided into two parts based on their attributes, the first part mainly includes several kinds of famous attacks which are critical for security management, we proposed a similar alarm mining method based on Choquet integral to cluster and rank the frequently occurred attacks. The rest alarms constitute the second part, which are caused by the potential threats attacks, also include many false alarms. To reduce the effect of false alarms and rank the potential threats, we employ the frequent pattern mining algorithm to mine correlation rules and then filter false alarms. Following, we proposed a self-adapting threat degree calculation method to qualify the threat degree of these alarms after filtering. To verity the methods developed, an experimental platform is constructed in the campus network of Xi’an Jiaotong University. Experimental results based on the data collected verify the efficiency of the developed methods. For the first kind of alarms, the similar alarms mining accuracy is higher than 97% and the alarms are ranked with different processing urgencies. For the rest alarms, the proposed methods have filtering accuracy above 80% and can rank the potential threats. Based on the ranking results, administrators can deal with the high threats with their limited time and energy, in turn, keep the network under control.

Online social networking sites are experimenting with the following crowd-powered procedure to reduce the spread of fake news and misinformation: whenever a user is exposed to a story through her feed, she can flag the story as misinformation and, if the story receives enough flags, it is sent to a trusted third party for fact checking. If this party identifies the story as misinformation, it is marked as disputed. However, given the uncertain number of exposures, the high cost of fact checking, and the trade-off between flags and exposures, the above mentioned procedure requires careful reasoning and smart algorithms which, to the best of our knowledge, do not exist to date. In this paper, we first introduce a flexible representation of the above procedure using the framework of marked temporal point processes. Then, we develop a scalable online algorithm, CURB, to select which stories to send for fact checking and when to do so to efficiently reduce the spread of misinformation with provable guarantees. In doing so, we need to solve a novel stochastic optimal control problem for stochastic differential equations with jumps, which is of independent interest. Experiments on two real-world datasets gathered from Twitter and Weibo show that our algorithm may be able to effectively reduce the spread of fake news and misinformation.

Phishing is an especially challenging cyber security threat as it does not attack computer systems, but targets the user who works on that system by relying on the vulnerability of their decision-making ability. Phishing attacks can be used to gather sensitive information from victims and can have devastating impact if they are successful in deceiving the user. Several anti-phishing tools have been designed and implemented but they have been unable to solve the problem adequately. This failure is often due to security experts overlooking the human element and ignoring their fallibility in making trust decisions online. In this paper, we present Phish Phinder, a serious game designed to enhance the user’s confidence in mitigating phishing attacks by providing them with both conceptual and procedural knowledge about phishing. The user is trained through a series of gamified challenges, designed to educate them about important phishing related concepts, through an interactive user interface. Key elements of the game interface were identified through an empirical study with the aim of enhancing user interaction with the game. We also adopted several persuasive design principles while designing Phish Phinder to enhance phishing avoidance behaviour among users.


Question: NGUARD: A framework for detecting game bots in NetEase MMORPGs.

This paper evaluates the effectiveness of various learning algorithms for generic object recognition, ensuring invariance to pose, lighting, and background clutter. An extensive dataset was compiled, consisting of 194,400 stereo image pairs featuring 50 uniformly colored toys. These toys were photographed under diverse conditions, including 36 azimuth angles, 9 elevation angles, and 6 lighting scenarios. The toys were categorized into five generic types: four-legged animals, human figures, airplanes, trucks, and cars. For the training phase, five instances from each category were utilized, with the remaining five reserved for testing. The training and testing sets included low-resolution grayscale images of the objects, with varying levels of variability and background clutter. The study compared the performance of nearest neighbor methods, support vector machines (SVMs), and convolutional networks. These algorithms were applied to both raw pixel data and PCA-derived features. The convolutional networks outperformed SVMs, achieving test error rates of 7% for unseen object instances on uniform backgrounds, compared to 13% for SVMs. In a segmentation/recognition task with highly cluttered images, SVMs were deemed impractical, whereas convolutional networks demonstrated an error rate of 16/7%. An efficient, real-time version of the system was developed, capable of detecting and classifying objects in natural scenes at approximately 10 frames per second, highlighting the practicality of convolutional networks for object recognition in complex environments.

In this paper, we propose an approach for the detection of clickbait posts in online social media (OSM). Clickbait posts are short catchy phrases that attract a user’s attention to click to an article. The approach is based on a machine learning (ML) classifier capable of distinguishing between clickbait and legitimate posts published in OSM. The suggested classifier is based on a variety of features, including image related features, linguistic analysis, and methods for abuser detection. In order to evaluate our method, we used two datasets provided by Clickbait Challenge 2017. The best performance obtained by the ML classifier was an AUC of 0.8, accuracy of 0.812, precision of 0.819, and recall of 0.966. In addition, as opposed to previous studies, we found that clickbait post titles are statistically significant shorter than legitimate post titles. Finally, we found that counting the number of formal English words in the given contentis useful for clickbait detection.

Security equipment such as intrusion prevention system is an important supplementary for security management. They reduce the difficulty of network management by giving alarms corresponding to different attacks instead of raw traffic packet inspection. But there are many false alarms due to their running mechanism, which greatly reduces its usability. In this paper, we develop a hierarchical framework to mine high threating alarms from the massive alarm logs, and aim to provide fundamental and useful information for administrators to design efficient management policy. First, the alarms are divided into two parts based on their attributes, the first part mainly includes several kinds of famous attacks which are critical for security management, we proposed a similar alarm mining method based on Choquet integral to cluster and rank the frequently occurred attacks. The rest alarms constitute the second part, which are caused by the potential threats attacks, also include many false alarms. To reduce the effect of false alarms and rank the potential threats, we employ the frequent pattern mining algorithm to mine correlation rules and then filter false alarms. Following, we proposed a self-adapting threat degree calculation method to qualify the threat degree of these alarms after filtering. To verity the methods developed, an experimental platform is constructed in the campus network of Xi’an Jiaotong University. Experimental results based on the data collected verify the efficiency of the developed methods. For the first kind of alarms, the similar alarms mining accuracy is higher than 97% and the alarms are ranked with different processing urgencies. For the rest alarms, the proposed methods have filtering accuracy above 80% and can rank the potential threats. Based on the ranking results, administrators can deal with the high threats with their limited time and energy, in turn, keep the network under control.

1 The authors thank CAIDA for providing this set of traffic traces. Additional information for these traces can be found in the DatCat, Internet Measurement Data Catalog [8], indexed under the label ‘‘PAIX’’. 1910 M. Iliofotou et al. / Computer Networks 55 (2011) 1909–1920 behavior. Flow-level and payload-based classification methods require per application training and will thus not detect P2P traffic from emerging protocols. Behavioral-host-based approaches such as BLINC [25] can detect traffic from new protocols [25], but have weak performance when applied at the backbone [26]. In addition, most tools including BLINC [25] require fine-tuning and careful selection of parameters [26]. We discuss the limitations of previous methods in more detail in Section 4. In this paper, we use the network-wide behavior of an application to assist in classifying its traffic. To model this behavior, we use graphs where each node is an IP address, and each edge represents a type of interaction between two nodes. We use the term Traffic Dispersion Graph or TDG to refer to such a graph [19]. Intuitively, with TDGs we enable the detection of network-wide behavior (e.g., highly connected graphs) that is common among P2P applications and different from other traffic (e.g., Web). While we recognize that some previous efforts [6,9] have used graphs to detect worm activity, they have not explored the full capabilities of TDGs for application classification. This paper is an extension of a workshop paper [18] and the differences will be clarified in the related work section (Section 4). We propose a classification framework, dubbed Graption (Graph-based classification), as a systematic way to combine network-wide behavior and flow-level characteristics of network applications. Graption first groups flows using flow-level features, in an unsupervised and agnostic way, i.e., without using application-specific knowledge. It then uses TDGs to classify each group of flows. As a proof of concept, we instantiate our framework and develop a P2P detection method, which we call Graption-P2P. Compared to other methods (e.g., BLINC [25]), Graption-P2P is easier to configure and requires fewer parameters. The highlights of our work can be summarized in the following points: Distinguishing between P2P and client–server TDGs. We use real-world backbone traces and derive graph theoretic metrics that can distinguish between the TDGs formed by client–server (e.g., Web) and P2P (e.g., eDonkey) applications (Section 2.2). Practical considerations for TDGs. We show that even a single backbone link contains enough information to generate TDGs that can be used to classify traffic. In addition, TDGs of the same application seem fairly consistent across time (Section 2.3). High P2P classification accuracy. Our framework instantiation (Graption-P2P) classifies 90% of P2P traffic with 95% accuracy when applied at the backbone. Such traces are particularly challenging for other methods (Section 3.2.2). Comparison with a behavioral-host-based method. Graption-P2P performs better than BLINC [25] in P2P identification at the backbone. For example, Graption-P2P identifies 95% of BitTorrent traffic while BLINC identifies only 25% (Section 3.3). Identifying the unknown. Using Graption, we identified a P2P overlay of the Slapper worm. The TDG of Slapper was never used to train our classifier. This is a promising result showing that our approach can be used to detect both known and unknown P2P applications (Section 3.4). The rest of the paper is organized as follows. In Section 2 we define TDGs, and identify TDG-based metrics that differentiate between applications. In Section 3 we present the Graption framework and our instantiation, GraptionP2P. In Section 5 we discuss various practical issues. In Section 4 we discuss related work. Finally, in Section 6 we conclude the paper. 2. Studying the TDGs of P2P applications 2.1. Traffic dispersion graphs (TDGs) Definition. Throughout this paper, we assume that packets can be grouped into flows using the standard 5-tuple {srcIP, srcPort, dstIP, dstPort, protocol}. Given a group of flows S, collected over a fixed-length time interval, we define the corresponding TDG to be a directed graph G(V,E), where the set of nodes V corresponds to the set of IP addresses in S, and there is a link (u,v) 2 E from u to v if there is a flow f 2 S between them. In this paper, we consider bidirectional flows. We define a TCP flow to start on the first packet with the SYN-flag set and the ACK-flag not set, so that the initiator and the recipient of the flow are defined for the purposes of direction. For UDP flows, direction is decided upon the first packet of the flow. Visualization examples. In Fig. 1, we show TDG examples from two different applications. In order to motivate the discussion in the rest of the paper, we show the contrast between a P2P and a client–server TDG. From the figure we see that P2P traffic forms more connected and more dense graphs compared to client–server TDGs. In Section 2.2, we show how we can translate the visual intuition of Fig. 1 into quantitative measures that can be used to classify TDGs that correspond to different applications. Data set. To study TDGs, we use three backbone traces from a Tier-1 ISP and the Abilene (Internet2) network. These traces are summarized in Table 1. All data are IP anonymized and contain traffic from both directions of the link. The TR-PAY1 and TR-PAY2 traces were collected from an OC48 link of a commercial US Tier-1 ISP at the Palo Alto Internet eXchange (PAIX). To the best of our knowledge, these are the most recent backbone traces with payload that are available to researchers by CAIDA [5]. The TR-ABIL trace is a publicly available data set collected from the Abilene (Internet2) academic network connecting Indianapolis with Kansas City. The Abilene trace consists of five randomly selected five-minute samples taken every day for one month, and covers both day and night hours as well as weekdays and weekends. Extractingground truth. We used a Payload-based Classifier (PC) to establish the ground truth of flows for the 1 2 2 1 0 3 1 9 4 3 3 4 5 4 8 1 4 8 2 9 3 4 1 4 6 1 1 0 7 1 1 5 5 5 6 6 3 4 7 4 5 1 0 5 8 1 1 6 9 7 8 9 1 0 1 1 1 2 1 3 1 4 1 5 1 6 8 6 3 1 0 3 2 4 4 1 8 1 7 1 8 1 9 2 0 2 1 2 2 2 3 2 4 7 7 1 1 0 9 6 2 5 2 6 4 1 2 4 6 3 2 7 2 8 2 9 3 0 3 1 3 2 3 3 3 4 3 5 3 6 1 0 1 3 7 3 8 7 3 1 6 6 2 0 6 2 3 2 3 4 2 3 4 5 4 0 9 4 8 6 5 3 0 6 3 0 6 3 5 7 3 4 7 4 8 7 4 9 7 9 4 7 9 6 8 5 2 8 5 5 9 1 6 1 0 7 0 1 1 3 4 1 2 4 2 3 9 4 0 8 1 8 5 1 1 6 1 2 3 1 3 0 1 3 2 1 3 5 1 3 9 1 4 8 1 6 1 1 6 4 1 6 5 1 8 6 1 9 1 2 2 5 2 2 7 2 3 5 2 4 3 2 5 7 2 6 8 2 9 2 3 0 3 3 1 3 3 1 6 3 4 9 3 5 0 3 6 2 3 7 6 3 8 3 4 0 3 4 1 3 4 1 4 4 4 5 4 5 5 4 6 1 4 7 7 4 9 3 5 1 7 5 2 4 5 3 7 5 7 0 5 9 1 6 1 4 6 1 9 6 4 0 6 5 7 6 6 6 6 6 8 6 7 4 7 3 1 7 3 6 7 3 7 8 0 0 8 0 7 8 0 8 8 3 1 8 3 9 8 4 1 8 4 4 8 5 6 8 7 0 8 7 6 8 8 8 8 9 2 8 9 8 9 0 0 9 0 8 9 1 4 9 1 5 9 2 5 9 7 4 1 0 0 0 1 0 0 5 1 0 0 9 1 0 1 8 1 0 2 2 1 0 2 7 1 0 3 5 1 0 5 6 1 0 9 2 1 0 9 9 1 1 0 3 1 1 0 5 1 1 0 6 1 1 2 8 1 1 3 3 1 1 6 5 1 1 6 6 1 1 7 0 1 1 8 3 1 1 8 6 1 2 0 9 1 2 5 6 1 2 6 7 1 2 7 2 1 2 8 8 1 2 8 9 1 2 9 1 1 3 3 4 1 3 5 2 1 3 7 2 4 1 4 2 3 0 9 3 2 0 3 5 6 6 0 2 6 3 2 7 1 4 8 7 2 1 0 6 5 4 3 4 4 4 5 4 6 1 1 5 4 7 4 8 2 5 6 7 7 2 4 9 5 0 1 3 7 1 6 0 1 8 1 5 4 5 7 1 5 7 4 1 1 0 0 4 5 1 5 2 5 3 5 4 1 4 2 1 0 0 7 5 5 5 6 5 7 2 9 1 7 6 0 8 8 3 5 8 5 9 6 0 6 1 2 7 7 4 3 2 6 2 6 3 2 9 9 5 7 2 7 3 5 1 3 7 0 6 4 6 5 9 0 2 6 1 2 8 2 3 4 1 5 8 2 6 3 3 1 3 6 4 6 6 6 7 9 2 9 1 0 8 0 1 0 8 2 6 8 7 5 5 1 1 3 5 1 2 2 8 6 9 7 0 7 1 2 7 0 7 2 7 4 7 5 7 6 7 7 7 8 7 9 8 0 8 2 8 3 7 2 3 8 4 8 7 3 6 1 8 8 8 9 1 7 5 9 1 9 2

Ensuring the security of computers is a non-trivial task, with many techniques used by malicious users to compromise these systems. In recent years a new threat has emerged in the form of networks of hijacked zombie machines used to perform complex distributed attacks such as denial of service and to obtain sensitive data such as password information. These zombie machines are said to be infected with a dasiahotpsila - a malicious piece of software which is installed on a host machine and is controlled by a remote attacker, termed the dasiabotmaster of a botnetpsila. In this work, we use the biologically inspired dendritic cell algorithm (DCA) to detect the existence of a single hot on a compromised host machine. The DCA is an immune-inspired algorithm based on an abstract model of the behaviour of the dendritic cells of the human body. The basis of anomaly detection performed by the DCA is facilitated using the correlation of behavioural attributes such as keylogging and packet flooding behaviour. The results of the application of the DCA to the detection of a single hot show that the algorithm is a successful technique for the detection of such malicious software without responding to normally running programs.

In a large online advertising system, adversaries may attempt to profit from the creation of low quality or harmful advertisements. In this paper, we present a large scale data mining effort that detects and blocks such adversarial advertisements for the benefit and safety of our users. Because both false positives and false negatives have high cost, our deployed system uses a tiered strategy combining automated and semi-automated methods to ensure reliable classification. We also employ strategies to address the challenges of learning from highly skewed data at scale, allocating the effort of human experts, leveraging domain expert knowledge, and independently assessing the effectiveness of our system.

In the last few years, many different attacks against computing platform targeting hardware or low level firmware have been published. Such attacks are generally quite hard to detect and to defend against as they target components that are out of the scope of the operating system and may not have been taken into account in the security policy enforced on the platform. In this paper, we study the case of remote attacks against network adapters. In our case study, we assume that the target adapter is running a flawed firmware that an attacker may subvert remotely by sending packets on the network to the adapter. We study possible detection techniques and their efficiency. We show that, depending on the architecture of the adapter and the interface provided by the NIC to the host operating system, building an efficient detection framework is possible. We explain the choices we made when designing such a framework that we called NAVIS and give details on our proof of concept implementation.

In this paper, we present and analyze an extensive measurement study of Napster and Gnutella.

The sharp increase in the number of smartphones on the market, with the Android platform posed to becoming a market leader makes the need for malware analysis on this platform an urgent issue.
 In this paper we capitalize on earlier approaches for dynamic analysis of application behavior as a means for detecting malware in the Android platform. The detector is embedded in a overall framework for collection of traces from an unlimited number of real users based on crowdsourcing. Our framework has been demonstrated by analyzing the data collected in the central server using two types of data sets: those from artificial malware created for test purposes, and those from real malware found in the wild. The method is shown to be an effective means of isolating the malware and alerting the users of a downloaded malware. This shows the potential for avoiding the spreading of a detected malware to a larger community.

We propose a novel trap-based architecture for detecting passive, “silent”, attackers who are eavesdropping on enterprise networks. Motivated by the increasing number of incidents where attackers sniff the local network for interesting information, such as credit card numbers, account credentials, and passwords, we introduce a methodology for building a trap-based network that is designed to maximize the realism of bait-laced traffic. Our proposal relies on a “record, modify, replay” paradigm that can be easily adapted to different networked environments. The primary contributions of our architecture are the ease of automatically injecting large amounts of believable bait, and the integration of different detection mechanisms in the back-end. We demonstrate our methodology in a prototype platform that uses our decoy injection API to dynamically create and dispense network traps on a subset of our campus wireless network. Our network traps consist of several types of monitored passwords, authentication cookies, credit cards, and documents containing beacons to alarm when opened. The efficacy of our decoys against a model attack program is also discussed, along with results obtained from experiments in the field. In addition, we present a user study that demonstrates the believability of our decoy traffic, and finally, we provide experimental results to show that our solution causes only negligible interference to ordinary users.

Port scanning is the usual precursor to malicious attacks on today's Internet. Although many algorithms have been proposed for different aspects of the scan detection problem, their focused designed space is enterprise gateway level Intrusion Detection. Furthermore, we find few studies that track scanner behaviors over an extended period of time. Operating from a unique vantage point, the IP backbone, we put all the pieces together in designing and implementing a fast and accurate online port scan detection and tracking system. We introduce our flexible architecture, discuss trade-offs and design choices. Specifically, we go in depth to two design choices: the distinct counter data structure and the buffer size tuning. Our choice of a probabilistic counter is proved to have a low average error of 3.5%. The buffer size is derived using Lyapunov drift techniques on an equivalent queuing model. Our initial scanner tracking results show that the scanners' timing behavior follows a 90-10 curve. That is, 90% of scanners are active for a short time, with low scanning rates, while 10% are long term and fast scanners, with a few super-scanners lasting the entire duration of monitoring.