On the Improvement of the Isolation Forest Algorithm for Outlier Detection with Streaming Data

Fourier transform infrared spectroscopy, high-performance liquid chromatography with diode array detection, and gas chromatography-mass spectrometry fingerprints combined with chemometrics for comprehensive evaluation and identification of raw and bran-fried Atractylodis Rhizoma

The quality and therapeutic properties of Atractylodis Rhizoma (AR) can be significantly influenced by processing methods such as bran frying. This study aims to comprehensively evaluate and identify raw and bran-fried AR using FT-IR, HPLC-DAD, and GC/MS fingerprints combined with chemometric analysis. FT-IR provided characteristic spectra for qualitative analysis, while HPLC-DAD and GC/MS revealed significant differences in chemical profiles, respectively. FT-IR spectra, coupled with chemometric methods such as genetic algorithm-based backpropagation neural network (GA-BPNN), effectively distinguished between raw and bran-fried samples. Preprocessing the original spectra with second-order derivative and VISSA resulted in 100 % accuracy, precision, recall, and F1 score in the test set. HPLC fingerprint, combined with hierarchical cluster analysis (HCA), principal component analysis (PCA), and orthogonal partial least squares-discriminant analysis (OPLS-DA), successfully differentiated raw AR from its processed products. The results indicated that bran frying significantly increased the levels of atractylenolide I and atractylenolide III, while decreasing the levels of atractylon. The GC/MS fingerprint, combined with a counter propagation-artificial neural network model, effectively distinguished between raw and bran-fried products, identifying characteristic volatile markers. This study highlights the potential of combining various advanced techniques for the quality evaluation and identification of AR and its processed products, providing valuable insights for quality control and therapeutic application.

An interpretable deep learning model for the accurate prediction of mean fragmentation size in blasting operations

Fragmentation size is an important indicator for evaluating blasting effectiveness. To address the limitations of conventional blasting fragmentation size prediction methods in terms of prediction accuracy and applicability, this study proposes an NRBO-CNN-LSSVM model for predicting mean fragmentation size, which integrates Convolutional Neural Networks (CNN), Least Squares Support Vector Machines (LSSVM), and the Newton-Raphson Optimizer (NRBO). The study is based on a database containing 105 samples derived from both previous research and field collection. Additionally, several machine learning prediction models, including CNN-LSSVM, CNN, LSSVM, Support Vector Machine (SVM), and Support Vector Regression (SVR), are developed for comparative analysis. The results showed that the NRBO-CNN-LSSVM model achieved remarkable prediction accuracy on the training dataset, with a coefficient of determination (R2) as high as 0.9717 and a root mean square error (RMSE) as low as 0.0285. On the test set, the model maintained high prediction accuracy, with an R2 value of 0.9105 and an RMSE of 0.0403. SHapley Additive exPlanations (SHAP) analysis revealed that the modulus of elasticity (E) was a key variable influencing the prediction of mean fragmentation size. Partial Dependence Plots (PDP) analysis further disclosed a significant positive correlation between the modulus of elasticity (E) and mean fragmentation size. In contrast, a distinct negative correlation was observed between the powder factor (Pf) and mean fragmentation size. To enhance the convenience of the model in practical applications, we developed an interactive Graphical User Interface (GUI), allowing users to input relevant variables and obtain instant prediction results.

Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security

Over the past couple of years, machine learning methods—especially the outlier detection ones—have anchored in the cybersecurity field to detect network-based anomalies rooted in novel attack patterns. However, the ubiquity of massive continuously generated data streams poses an enormous challenge to efficient detection schemes and demands fast, memory-constrained online algorithms that are capable to deal with concept drifts. Feature selection plays an important role when it comes to improve outlier detection in terms of identifying noisy data that contain irrelevant or redundant features. State-of-the-art work either focuses on unsupervised feature selection for data streams or (offline) outlier detection. Substantial requirements to combine both fields are derived and compared with existing approaches. The comprehensive review reveals a research gap in unsupervised feature selection for the improvement of outlier detection methods in data streams. Thus, a novel algorithm for Unsupervised Feature Selection for Streaming Outlier Detection, denoted as UFSSOD, will be proposed, which is able to perform unsupervised feature selection for the purpose of outlier detection on streaming data. Furthermore, it is able to determine the amount of top-performing features by clustering their score values. A generic concept that shows two application scenarios of UFSSOD in conjunction with off-the-shell online outlier detection algorithms has been derived. Extensive experiments have shown that a promising feature selection mechanism for streaming data is not applicable in the field of outlier detection. Moreover, UFSSOD, as an online capable algorithm, yields comparable results to a state-of-the-art offline method trimmed for outlier detection.

Exploiting the Outcome of Outlier Detection for Novel Attack Pattern Recognition on Streaming Data

Future-oriented networking infrastructures are characterized by highly dynamic Streaming Data (SD) whose volume, speed and number of dimensions increased significantly over the past couple of years, energized by trends such as Software-Defined Networking or Artificial Intelligence. As an essential core component of network security, Intrusion Detection Systems (IDS) help to uncover malicious activity. In particular, consecutively applied alert correlation methods can aid in mining attack patterns based on the alerts generated by IDS. However, most of the existing methods lack the functionality to deal with SD data affected by the phenomenon called concept drift and are mainly designed to operate on the output from signature-based IDS. Although unsupervised Outlier Detection (OD) methods have the ability to detect yet unknown attacks, most of the alert correlation methods cannot handle the outcome of such anomaly-based IDS. In this paper, we introduce a novel framework called Streaming Outlier Analysis and Attack Pattern Recognition, denoted as SOAAPR, which is able to process the output of various online unsupervised OD methods in a streaming fashion to extract information about novel attack patterns. Three different privacy-preserving, fingerprint-like signatures are computed from the clustered set of correlated alerts by SOAAPR, which characterizes and represents the potential attack scenarios with respect to their communication relations, their manifestation in the data’s features and their temporal behavior. Beyond the recognition of known attacks, comparing derived signatures, they can be leveraged to find similarities between yet unknown and novel attack patterns. The evaluation, which is split into two parts, takes advantage of attack scenarios from the widely-used and popular CICIDS2017 and CSE-CIC-IDS2018 datasets. Firstly, the streaming alert correlation capability is evaluated on CICIDS2017 and compared to a state-of-the-art offline algorithm, called Graph-based Alert Correlation (GAC), which has the potential to deal with the outcome of anomaly-based IDS. Secondly, the three types of signatures are computed from attack scenarios in the datasets and compared to each other. The discussion of results, on the one hand, shows that SOAAPR can compete with GAC in terms of alert correlation capability leveraging four different metrics and outperforms it significantly in terms of processing time by an average factor of 70 in 11 attack scenarios. On the other hand, in most cases, all three types of signatures seem to reliably characterize attack scenarios such that similar ones are grouped together, with up to 99.05% similarity between the FTP and SSH Patator attack.