From the Publisher: 
The accessible presentation of this book gives both a general view of the entire computer vision enterprise and also offers sufficient detail to be able to build useful applications. Users learn techniques that have proven to be useful by first-hand experience and a wide range of mathematical methods. A CD-ROM with every copy of the text contains source code for programming practice, color images, and illustrative movies. Comprehensive and up-to-date, this book includes essential topics that either reflect practical significance or are of theoretical importance. Topics are discussed in substantial and increasing depth. Application surveys describe numerous important application areas such as image based rendering and digital libraries. Many important algorithms broken down and illustrated in pseudo code. Appropriate for use by engineers as a comprehensive reference to the computer vision enterprise.

Computer vision : a modern approach = 计算机视觉 : 一种现代的方法

International Journal of Computer and Applications

MUCKE aims to mine a large volume of images, to structure them conceptually and to use this conceptual structuring in order to improve large-scale image retrieval. The last decade witnessed important progress concerning low-level image representations. However, there are a number problems which need to be solved in order to unleash the full potential of image mining in applications. The central problem with low-level representations is the mismatch between them and the human interpretation of image content. This problem can be instantiated, for instance, by the incapability of existing descriptors to capture spatial relationships between the concepts represented or by their incapability to convey an explanation of why two images are similar in a content-based image retrieval framework. We start by assessing existing local descriptors for image classification and by proposing to use co-occurrence matrices to better capture spatial relationships in images. The main focus in MUCKE is on cleaning large scale Web image corpora and on proposing image representations which are closer to the human interpretation of images. Consequently, we introduce methods which tackle these two problems and compare results to state of the art methods. Note: some aspects of this deliverable are withheld at this time as they are pending review. Please contact the authors for a preview.

http://ieeexplore.ieee.org/iel2/4524/12820/00592460.pdf

Image Processing

IEEE Transactions on Pattern Analysis and Machine Intelligence

Deep Convolutional Neural Network (CNN) is a special type of Neural Networks, which has shown exemplary performance on several competitions related to Computer Vision and Image Processing. Some of the exciting application areas of CNN include Image Classification and Segmentation, Object Detection, Video Processing, Natural Language Processing, and Speech Recognition. The powerful learning ability of deep CNN is primarily due to the use of multiple feature extraction stages that can automatically learn representations from the data. The availability of a large amount of data and improvement in the hardware technology has accelerated the research in CNNs, and recently interesting deep CNN architectures have been reported. Several inspiring ideas to bring advancements in CNNs have been explored, such as the use of different activation and loss functions, parameter optimization, regularization, and architectural innovations. However, the significant improvement in the representational capacity of the deep CNN is achieved through architectural innovations. Notably, the ideas of exploiting spatial and channel information, depth and width of architecture, and multi-path information processing have gained substantial attention. Similarly, the idea of using a block of layers as a structural unit is also gaining popularity. This survey thus focuses on the intrinsic taxonomy present in the recently reported deep CNN architectures and, consequently, classifies the recent innovations in CNN architectures into seven different categories. These seven categories are based on spatial exploitation, depth, multi-path, width, feature-map exploitation, channel boosting, and attention. Additionally, the elementary understanding of CNN components, current challenges, and applications of CNN are also provided.

https://link.springer.com/content/pdf/10.1007/s10462-020-09825-6.pdf

A survey of the recent architectures of deep convolutional neural networks

Evaluating deep learning approaches to characterize and classify malicious URL’s

Long short-term memory recurrent neural network (LSTM-RNN) have witnessed as a powerful approach for capturing long-range temporal dependencies in sequences of arbitrary length. This paper seeks to model a large set of Android permissions particularly the permissions from Normal, Dangerous, Signature and Signature Or System categories within a large number of Android application package (APK) files of Cyber Security Data Mining Competition (CDMC 2016), Android malware classification challenge. The sequences of Android permissions are transformed into features by using recurrent LSTM layer with bag-of-words embedding and the extracted features are fed into dense and activation layer with non-linear activation function such as sigmoid for classification. Furthermore, to selectively find out the optimal paramaters and network structure, we have done various experimens with different network parameters and network structures. All experiments are run up to 1000 epochs with a learning rate in the range [0.01-0.5]. All LSTM network configurations have substantially performed well in classification settings of 5-fold cross validation in comparison to the recurrent neural network (RNN). Most importantly, LSTM has achieved the highest accuracy as 0.897 on the real-world Android malware test data set, provided by CDMC2016. This is primarily due to fact that the LSTM houses a complex memory processing unit that facilitates to learn the temporal behaviors quickly with sparse representations of Android permissions sequences. Thus, we claim that applying LSTM network to permission based Android malware classification is more appropriate.

Deep android malware detection and classification

This﻿article﻿describes﻿how﻿sequential﻿data﻿modeling﻿is﻿a﻿relevant﻿task﻿in﻿Cybersecurity.﻿Sequences﻿are﻿ attributed﻿temporal﻿characteristics﻿either﻿explicitly﻿or﻿implicitly.﻿Recurrent﻿neural﻿networks﻿(RNNs)﻿are﻿ a﻿subset﻿of﻿artificial﻿neural﻿networks﻿(ANNs)﻿which﻿have﻿appeared﻿as﻿a﻿powerful,﻿principle﻿approach﻿ to﻿learn﻿dynamic﻿temporal﻿behaviors﻿in﻿an﻿arbitrary﻿length﻿of﻿large-scale﻿sequence﻿data.﻿Furthermore,﻿ stacked﻿recurrent﻿neural﻿networks﻿(S-RNNs)﻿have﻿the﻿potential﻿to﻿learn﻿complex﻿temporal﻿behaviors﻿ quickly,﻿including﻿sparse﻿representations.﻿To﻿leverage﻿this,﻿the﻿authors﻿model﻿network﻿traffic﻿as﻿a﻿time﻿ series,﻿particularly﻿transmission﻿control﻿protocol﻿/﻿internet﻿protocol﻿(TCP/IP)﻿packets﻿in﻿a﻿predefined﻿ time﻿ range﻿ with﻿ a﻿ supervised﻿ learning﻿ method,﻿ using﻿ millions﻿ of﻿ known﻿ good﻿ and﻿ bad﻿ network﻿ connections.﻿To﻿find﻿out﻿the﻿best﻿architecture,﻿the﻿authors﻿complete﻿a﻿comprehensive﻿review﻿of﻿various﻿ RNN﻿architectures﻿with﻿its﻿network﻿parameters﻿and﻿network﻿structures.﻿Ideally,﻿as﻿a﻿test﻿bed,﻿they﻿ use﻿the﻿existing﻿benchmark﻿Defense﻿Advanced﻿Research﻿Projects﻿Agency﻿/﻿Knowledge﻿Discovery﻿ and﻿Data﻿Mining﻿(DARPA)﻿/﻿(KDD)﻿Cup﻿‘99’﻿intrusion﻿detection﻿(ID)﻿contest﻿data﻿set﻿to﻿show﻿the﻿ efficacy﻿of﻿these﻿various﻿RNN﻿architectures.﻿All﻿the﻿experiments﻿of﻿deep﻿learning﻿architectures﻿are﻿ run﻿up﻿to﻿1000﻿epochs﻿with﻿a﻿learning﻿rate﻿in﻿the﻿range﻿[0.01-0.5]﻿on﻿a﻿GPU-enabled﻿TensorFlow﻿and﻿ experiments﻿of﻿traditional﻿machine﻿learning﻿algorithms﻿are﻿done﻿using﻿Scikit-learn.﻿Experiments﻿of﻿ families﻿of﻿RNN﻿architecture﻿achieved﻿a﻿low﻿false﻿positive﻿rate﻿in﻿comparison﻿to﻿the﻿traditional﻿machine﻿ learning﻿classifiers.﻿The﻿primary﻿reason﻿is﻿that﻿RNN﻿architectures﻿are﻿able﻿to﻿store﻿information﻿for﻿ long-term﻿dependencies﻿over﻿time-lags﻿and﻿to﻿adjust﻿with﻿successive﻿connection﻿sequence﻿information.﻿ In﻿addition,﻿the﻿effectiveness﻿of﻿RNN﻿architectures﻿are﻿shown﻿for﻿the﻿UNSW-NB15﻿data﻿set. KEywoRDS Deep Learning (DL) Approaches, Gated Recurrent Unit (GRU), Intrusion Detection (ID) Data Sets, KDDCup ’99’, Long Short-Term Memory (LSTM), Machine Learning (ML), Recurrent Neural Network (RNN), UNSW-NB15

Evaluation of Recurrent Neural Network and its Variants for Intrusion Detection System (IDS)

Long short-term memory (LSTM) architecture is an important approach for capturing long-range temporal dependencies in sequences of arbitrary length. Moreover, stacked-LSTM (S-LSTM: formed by adding recurrent LSTM layer to the existing LSTM network in hidden layer) has capability to learn temporal behaviors quickly with sparse representations. To apply this to anomaly detection, we model the operation log samples of normal and anomalous events occurred in 1 minute time interval as time-series with the aim to detect and classify the events as either normal or anomalous. To select an appropriate LSTM network, experiments are conducted for various network parameters and network structures with the dataset provided by Cyber Security Data Mining Competition (CDMC2016). The experiments are run up to 1000 epochs with learning rate in the range [0.01-05]. S-LSTM network architecture has showed its strength by achieving the highest accuracy 0.996 with false positive rate 0.02 on the provided real-world test data by CDMC2016.

Long short-term memory based operation log anomaly detection

There are myriad of security solutions that have been developed to tackle the Cyber Security attacks and malicious activities in digital world. They are firewalls, intrusion detection and prevention systems, anti-virus systems, honeypots etc. Despite employing these detection measures and protection mechanisms, the number of successful attacks and the level of sophistication of these attacks keep increasing day-by-day. Also, with the advent of Internet-of-Things, the number of devices connected to Internet has risen dramatically. The inability to detect attacks on these devices are due to (1) the lack of computational power for detecting attacks, (2) the lack of interfaces that could potentially indicate a compromise on this devices and (3) the lack of the ability to interact with the system to execute diagnostic tools. This warrants newer approaches such as Tier-1 Internet Service Provider level view of attack patterns to provide situational awareness of Cyber Security threats. We investigate and explore the event data generated by the Internet protocol Domain Name Systems (DNS) for the purpose of Cyber threat situational awareness. Traditional methods such as Static and Binary analysis of Malware are sometimes inadequate to address the proliferation of Malware due to the time taken to obtain and process the individual binaries in order to generate signatures. By the time the Anti-Malware signature is available, there is a chance that a significant amount of damage might have happened. The traditional Anti-Malware systems may not identify malicious activities. However, it may be detected faster through DNS protocol by analyzing the generated event data in a timely manner. As DNS was not designed with security in mind (or suffers from vulnerabilities), we explore how the vast amount of event data generated by these systems can be leveraged to create Cyber threat situational awareness. The main contributions of the book chapter are two-fold: (1). A scalable framework that can perform web scale analysis in near real-time that provide situational awareness. (2). Detect early warning signals before large scale attacks or malware propagation occurs. We employ deep learning approach to classify and correlate malicious events that are perceived from the protocol usage. To our knowledge this is the first time, a framework that can analyze and correlate the DNS usage information at continent scale or multiple Tier-1 Internet Service Provider scale has been studied and analyzed in real-time to provide situational awareness. Merely using a commodity hardware server, the developed framework is capable of analyzing more than 2 Million events per second and it could detect the malicious activities within them in near real-time. The developed framework can be scaled out to analyze even larger volumes of network event data by adding additional computing resources. The scalability and real-time detection of malicious activities from early warning signals makes the developed framework stand out from any system of similar kind.

K. P. Soman

Papers

Evaluating deep learning approaches to characterize and classify malicious URL’s

Deep android malware detection and classification

Evaluation of Recurrent Neural Network and its Variants for Intrusion Detection System (IDS)

Long short-term memory based operation log anomaly detection

Scalable Framework for Cyber Threat Situational Awareness Based on Domain Name Systems Data Analysis