Network anomaly detection plays a crucial role as it provides an effective mechanism to block or stop cyberattacks. With the recent advancement of Artificial Intelligence (AI), there has been a number of Autoencoder (AE) based deep learning approaches for network anomaly detection to improve our posture towards network security. The performance of existing state-of-the-art AE models used for network anomaly detection varies without offering a holistic approach to understand the critical impacts of the core set of important performance indicators of AE models and the detection accuracy. In this study, we propose a novel 5-layer autoencoder (AE)-based model better suited for network anomaly detection tasks. Our proposal is based on the results we obtained through an extensive and rigorous investigation of several performance indicators involved in an AE model. In our proposed model, we use a new data pre-processing methodology that transforms and removes the most affected outliers from the input samples to reduce model bias caused by data imbalance across different data types in the feature set. Our proposed model utilizes the most effective reconstruction error function which plays an essential role for the model to decide whether a network traffic sample is normal or anomalous. These sets of innovative approaches and the optimal model architecture allow our model to be better equipped for feature learning and dimension reduction thus producing better detection accuracy as well as f1-score. We evaluated our proposed model on the NSL-KDD dataset which outperformed other similar methods by achieving the highest accuracy and f1-score at 90.61% and 92.26% respectively in detection.

/pdf/improving-performance-of-autoencoder-based-network-anomaly-1t2nwcp0hd.pdf

Improving Performance of Autoencoder-Based Network Anomaly Detection on NSL-KDD Dataset

Distributed Denial-of-Service (DDoS) attacks are increasing as the demand for Internet connectivity massively grows in recent years. Conventional shallow machine learning-based techniques for DDoS attack classification tend to be ineffective when the volume and features of network traffic, potentially carry malicious DDoS payloads, increase exponentially as they cannot extract high importance features automatically. To address this concern, we propose a hybrid approach named AE-MLP that combines two deep learning-based models for effective DDoS attack detection and classification. The Autoencoder (AE) part of our proposed model provides an effective feature extraction that finds the most relevant feature sets automatically without human intervention (e.g., knowledge of cybersecurity professionals). The Multi-layer Perceptron Network (MLP) part of our proposed model uses the compressed and reduced feature sets produced by the AE as inputs and classifies the attacks into different DDoS attack types to overcome the performance overhead and bias associated with processing large feature sets with noise (i.e., unnecessary feature values). Our experimental results, obtained through comprehensive and extensive experiments on different aspects of performance on the CICDDoS2019 dataset, demonstrate both a very high and robust accuracy rate and F1-score that exceed 98% which also outperformed the performance of many similar methods. This shows that our proposed model can be used as an effective DDoS defense tool against the growing number of DDoS attacks.

/pdf/ae-mlp-a-hybrid-deep-learning-approach-for-ddos-detection-2vcyio7bbt.pdf

AE-MLP: A Hybrid Deep Learning Approach for DDoS Detection and Classification

Domain invariance and discrimination of learned features as two crucial factors affect the performance of unsupervised domain adaptation (UDA) person re-identification (Re-ID). Person attributes (such as “backpack”, “boots”, “handbag”, etc) remaining unchanged across multiple domains have been used as mid-level visual-semantic information in UDA person Re-ID. As two main challenges, both misalignment of attribute-related regions across multiple images and domain shift between source and target domains affect the learning of domain-invariant features (DIF). To address the above two challenges, this article proposes to take advantage of the stability of person attributes and the complementarity of person attributes and the corresponding low-level visual features to guide the learning of discriminative DIF. Specifically, the proposed solution contains the generation of latent attribute-correlated visual features (GLAVF), DIF learning under the guidance of person attributes, and the alignment of person attributes corresponding to the local regions of pedestrian images. Due to the gap between person attributes and visual features, person attributes are first converted into latent attribute-correlated visual features (LAVF) without any specific domain information in GLAVF, and then LAVF are used as the substitutions of person attributes to guide the learning of DIF. To enhance the discrimination of learned features, the proposed solution mainly explores the alignment between person attributes and corresponding local regions, and the alignment of the same person attributes across multiple pedestrian images. A fully connected layer is used to achieve the above two types of alignment in the proposed framework, which reduces the adverse impacts of inference information and ensures the semantic consistency between person attributes and corresponding local regions across multiple pedestrian images. The effectiveness of the proposed solution is confirmed on four existing datasets by comparative experiments.

Attribute-Aligned Domain-Invariant Feature Learning for Unsupervised Domain Adaptation Person Re-Identification

Due to the domain shift between source dataset and target dataset, most of the existing person re-identification (PRID) algorithms trained by a supervised learning framework often fail to be well generalized to another domain. To address this challenge, we propose a self-supervised learning algorithm based on attribute-identity embedding, which can incrementally optimize the model by selecting unlabeled samples from target domain. Thus the gap between source domain and target domain is bridged. Specifically, we first develop an attribute-identity joint prediction dictionary learning model for simultaneously learning a latent attribute space, a semantic attribute dictionary and an identifier. In our method, the predicted attribute from latent attribute space is used as a bridge to establish a preliminary link between different domains so as to predict the label of the target data sample. Second, to exploit the latent label contained in the predicted samples, we propose a prediction-training cycle self-supervised learning to tune the model variables to make them more adaptive in the target domain. Finally, the similarity measurement of pedestrians is achieved by combining the attribute space with latent identity space. The experiments show that the developed method outperforms some state-of-the-art supervised PRID methods and unsupervised PRID algorithms.

Attribute-Identity Embedding and Self-Supervised Learning for Scalable Person Re-Identification

Noise-robust image fusion with low-rank sparse decomposition guided by external patch prior

Malware detection is an essential task in cyber security. As the trend of malicious attacks grows, unknown malware detection with high accuracy becomes more and more challenging. The current deep learning-based approaches for malware detection are typically trained with large amounts of samples using labeled and existing malware families in the training set, thus, their capability to detect new unseen malware (such as a zero-day attack) is limited. To address this issue, we propose a new one-shot model called “Multi-Loss Siamese Neural Network with Batch Normalization Layer” that can work with fewer samples while providing high detection accuracy. Our model utilizes the Siamese Neural Network to detect new variants of malware that is trained with only a few samples. Our model is equipped with batch normalization and multiple loss functions to address the overfitting issue, due to the use of small samples, that can create the vanishing gradient problem as a result of binary cross-entropy loss, and feature embedding space to improve the detection accuracy. In addition, we illustrate a way to convert raw binary files into malware gray scale images, to work with the popular Siamese Neural Network by generating the positive and negative pairs for training. Our experimental results show that our model outperforms existing similar methods.

/pdf/multi-loss-siamese-neural-network-with-batch-normalization-10c3gwnfy7.pdf

Multi-Loss Siamese Neural Network With Batch Normalization Layer for Malware Detection

Top distance regularized projection and dictionary learning for person re-identification

Redundant features and outliers (noise) included in the data points for a machine learning clustering model heavily influences the discovery of more distinguished features for clustering. To solve this issue, we propose a spectral new clustering method to consider the feature selection with the $$L_{2,1}$$
 -norm regularization as well as simultaneously learns orthogonal representations for each sample to preserve the local structures of data points. Our model also solves the issue of out-of-sample, where the training process does not output an explicit model to predict unseen data points, along with providing an efficient optimization method for the proposed objective function. Experimental results showed that our method on twelve data sets achieves the best performance compared with other similar models.

https://link.springer.com/content/pdf/10.1007/s11063-020-10383-9.pdf

Joint Spectral Clustering based on Optimal Graph and Feature Selection

Ransomware defense solutions that can quickly detect and classify different ransomware classes to formulate rapid response plans have been in high demand in recent years. Though the applicability of adopting deep learning techniques to provide automation and self-learning provision has been proven in many application domains, the lack of data available for ransomware (and other malware)samples has been raised as a barrier to developing effective deep learning-based solutions. To address this concern, we propose a few-shot meta-learning based Siamese Neural Network that not only detects ransomware attacks but is able to classify them into different classes. Our proposed model utilizes the entropy feature directly extracted from ransomware binary files to retain more fine-grained features associated with different ransomware signatures. These entropy features are used further to train and optimize our model using a pre-trained network (e.g. VGG-16) in a meta-learning fashion. This approach generates more accurate weight factors, compared to feature images are used, to avoid the bias typically associated with a model trained with a limited number of training samples. Our experimental results show that our proposed model is highly effective in providing a weighted F1-score exceeding the rate>86% compared

A Few-Shot Meta-Learning based Siamese Neural Network using Entropy Features for Ransomware Classification.

Person re-identification aims to identify the same person across non-overlapping camera views It remains very challenging due to large differences in pose, illumination, and viewpoint between images To improve robustness to such variations, here we develop a joint asymmetric projection and dictionary-learning algorithm by adopting listwise similarity and identity consistency constraints Benefiting from the listwise similarities, dictionary learning considers the similarity list between each pedestrian image, thus exploiting the large amount of discriminative information contained in the samples This approach endows the dictionary with discriminative power In addition, we impose an identity consistency constraint on the coding coefficients to further improve the discriminative ability of the dictionary To overcome appearance variability across non-overlapping camera views, two asymmetric projection dictionaries are employed to map the pedestrian features into a unified subspace such that the correlation between data from the same people in different views is maximized Finally, by integrating the coding coefficient and classification results, we develop a fusion strategy with a modified cosine similarity measure to match the pedestrians Experiments on different challenging data sets demonstrate that our method is effective and outperforms some current state-of-the-art approaches

Jinting Zhu

Papers

Multi-Loss Siamese Neural Network With Batch Normalization Layer for Malware Detection

Top distance regularized projection and dictionary learning for person re-identification

Joint Spectral Clustering based on Optimal Graph and Feature Selection

A Few-Shot Meta-Learning based Siamese Neural Network using Entropy Features for Ransomware Classification.

Asymmetric Projection and Dictionary Learning With Listwise and Identity Consistency Constraints for Person Re-Identification