Publications

XML transactions are used in many information systems to store data and interact with other systems. Abnormal transactions, the result of either an on-going cyber attack or the actions of a benign user, can potentially harm the interacting systems and therefore they are regarded as a threat. In this paper we address the problem of anomaly detection and localization in XML transactions using machine learning techniques. We present a new XML anomaly detection framework, XML-AD. Within this framework, an automatic method for extracting features from XML transactions was developed as well as a practical method for transforming XML features into vectors of fixed dimensionality. With these two methods in place, the XML-AD framework makes it possible to utilize general learning algorithms for anomaly detection. Central to the functioning of the framework is a novel multi-univariate anomaly detection algorithm, ADIFA. The framework was evaluated on four XML transactions datasets, captured from real information systems, in which it achieved over 89% true positive detection rate with less than a 0.2% false positive rate.

It is our great pleasure to welcome you to the 2013 ACM International Workshop on Computational Scientometrics: Theory and Applications -- CSTA'13. This is the first time when the CSTA workshop has been organized in the ACM International Conference on Information and Knowledge Management. The primary goals and objectives of the workshop are to promote both theoretical results and practical applications within digital libraries to better answer questions such as how do research ideas emerge, evolve, or disappear as a topic, what is a good measure of quality of published works, what are the most promising areas of research, how authors connect and influence each other, who are the experts in a field, what works are similar, and who funds a particular research topic. The workshop aims at bringing together researchers with diverse interdisciplinary backgrounds interested in mining the web, large digital libraries and other relevant databases for research related publications and data. The combination of classical bibliometrics and novel text mining provides a synergy unavailable within each approach taken independently. In this proposed workshop, we also focus on bibliometrics analysis by using sophisticated text mining, or natural language processing methods, which will enable researchers to generate innovative research topics, e.g. full-text citation analysis. We expect people interested in the practical applications within digital libraries such as citation analysis and recommendation, scientific and research trends, expert finding, and collaborator recommendation, to attend the CSTA'13 workshop. The call for papers attracted submissions from Europe, Australia, and the United States. The program committee accepted 6 papers that cover topics, including program committees recommendation for academic conferences, collaborators recommendation, and citations classification and labeling. In addition, the program includes a keynote speech by Xiaozhong Liu on Full-text Citation Analysis and its Application.

In this paper we describe and share with the research community, a significant smartphone dataset obtained from an ongoing long-term data collection experiment. The dataset currently contains 10 billion data records from 30 users collected over a period of 1.6 years and an additional 20 users for 6 months (totaling 50 active users currently participating in the experiment).

In recent years, Online Social Networks (OSNs) have essentially become an integral part of our daily lives. There are hundreds of OSNs, each with its own focus and offers for particular services and functionalities. To take advantage of the full range of services and functionalities that OSNs offer, users often create several accounts on various OSNs using the same or different personal information. Retrieving all available data about an individual from several OSNs and merging it into one profile can be useful for many purposes. In this paper, we present a method for solving the Entity Resolution (ER), problem for matching user profiles across multiple OSNs. Our algorithm is able to match two user profiles from two different OSNs based on machine learning techniques, which uses features extracted from each one of the user profiles. Using supervised learning techniques and extracted features, we constructed different classifiers, which were then trained and used to rank the probability that two user profiles from two different OSNs belong to the same individual. These classifiers utilized 27 features of mainly three types: name based features (i.e., the Soundex value of two names), general user info based features (i.e., the cosine similarity between two user profiles), and social network topological based features (i.e., the number of mutual friends between two users' friends list). This experimental study uses real-life data collected from two popular OSNs, Facebook and Xing. The proposed algorithm was evaluated and its classification performance measured by AUC was 0.982 in identifying user profiles across two OSNs.

Decision trees are considered to be one of the most popular approaches for representing classifiers. Researchers from various disciplines such as statistics, machine learning, pattern recognition, and data mining considered the issue of growing a decision tree from available data. This paper presents an updated survey of current methods for constructing decision tree classifiers in a top-down manner. The paper suggests a unified algorithmic framework for presenting these algorithms and describes the various splitting criteria and pruning methodologies.

Intrusion detection is the process of monitoring and analyzing the events occurring in a computer system in order to detect signs of security problems. The problem of intrusion detection can be solved using anomaly detection techniques. For instance, one is given a set of connection data belonging to different classes (normal activity, different attacks) and the aim is to construct a classifier that accurately classifies new unlabeled connections data. Clustering methods can be used to detect anomaly in data which might implies intrusion of a new type. This chapter gives a critical summary of anomaly detection research for intrusion detection. This chapter surveys a list of research projects that apply anomaly detection techniques to intrusion detection. Finally some directions for research are given.

We present a novel approach for the construction of ensemble classifiers based on dimensionality reduction. The ensemble members are trained based on dimension-reduced versions of the training set. In order to classify a test sample, it is first embedded into the dimension reduced space of each ind ividual classifier by using an out-of-sample extension algorithm. Each classifier is then applied to the embedded sample and the classification is obtained via a voting scheme. We demonstrate the proposed approach using the Random Projections, the Diffusion Maps and the Random Subspaces dimensionality reduction algorithms. We also present a multi-strategy ensemble which combines AdaBoost and Diffusion Maps. A comparison is made with the Bagging, AdaBoost, Rotation Forest ensemble classifiers and also with the base classifier. Our experiments used seventeen benchmark datasets from the UCI repository. The results obtained by the proposed algorithms were superior in many cases to other algorithms.

Modern business activities rely on extensive email exchange. Email mistakes have become widespread, and the severe damage caused by such mistakes constitutes a disturbing problem both for organizations and for individuals. Various solutions attempt to analyze email exchange for preventing emails to be sent to wrong recipients. However there is still no satisfying solution: many email addressing mistakes are not detected and in many cases correct recipients are wrongly marked as potential addressing mistake. In this paper we present a new approach for preventing emails slip-ups in organizations. The approach is based on analysis of emails exchange among members of the organization and identification of groups of members that exchange emails with common topics. Each member's topics are then used during the enforcement phase for detecting potential leakage. When a new email is composed and about to be sent, each email recipient is analyzed. A recipient is approved if the email's content belongs to at least one of the topics common to the sender and the recipient. We evaluated the new approach by comparing its detection performance to a baseline approach using the Enron Email dataset. Our evaluation results suggests that group communication analysis improves the performance of a baseline email classifier, which classifies a new email based only on emails exchanged in the past between the sender of the email and each of the recipients.

Value Investing stands as one of the most time-honored strategies for long-term equity investment in financial markets, specifically in the domain of stocks. The essence of this approach lies in the estimation of a company's "intrinsic value," which serves as an investor's most refined gage of the company's true worth. Once the investor arrives at an estimation of the intrinsic value for a given company, she proceeds to contemplate purchasing the company's stocks solely if the prevailing market price of the stocks significantly deviates below the estimated intrinsic value, thus presenting an enticing buying opportunity. This deviation, referred to as the "margin of safety," represents the disparity between the intrinsic value and the current market capitalization of the company. Within the scope of this endeavor, our objective is to automate the stock selection process for value investing across a vast spectrum of US companies. To accomplish this, we harness a combination of value-investing principles and quality features derived from historical financial reports and market capitalization data, thereby enabling the identification of favorable value-driven opportunities. Our methodology entails the utilization of an ensemble of classifiers, where the class is determined as a function of the margin of safety. Consequently, the model is trained to discern stocks that exhibit value characteristics warranting investment. Remarkably, our model attains a success rate surpassing 80%, effectively identifying stocks capable of yielding an annualized return of 15% within a three-year timeframe from the recommended stock purchase date provided by the model.

In this paper a novel system for detecting meaningful deviations in a mobile application's network behavior is proposed. The main goal of the proposed system is to protect mobile device users and cellular infrastructure companies from malicious applications. The new system is capable of: (1) identifying malicious attacks or masquerading applications installed on a mobile device, and (2) identifying republishing of popular applications injected with a malicious code. The detection is performed based on the application's network traffic patterns only. For each application two types of models are learned. The first model, local, represents the personal traffic pattern for each user using an application and is learned on the device. The second model, collaborative, represents traffic patterns of numerous users using an application and is learned on the system server. Machine-learning methods are used for learning and detection purposes. This paper focuses on methods utilized for local (i.e., on mobile device) learning and detection of deviations from the normal application's behavior. These methods were implemented and evaluated on Android devices. The evaluation experiments demonstrate that: (1) various applications have specific network traffic patterns and certain application categories can be distinguishable by their network patterns, (2) different levels of deviations from normal behavior can be detected accurately, and (3) local learning is feasible and has a low performance overhead on mobile devices.

No abstract is provided for this article.

An ability to predict the mileage at failure of components in a complicated system, particularly in automobiles, is a challenging task. In the current work, a methodology for estimating the distribution of failure and survival rate of automobile components affected by multiple factors is presented. A novel adaptation of an ensemble recursive partitioning and tree-based learning method, mutually exclusive forest, is introduced. The proposed method is capable of handling a high dimensional dataset and maximizing the extracted information to estimate the distribution of mileage at failure of automobile components. Each tree in the proposed mutually exclusive forest uses a mutually exclusive set of factors in each of its constituent decision trees to classify the failure data. Information across the trees is combined to obtain the failure rate distribution of an automobile component with respect to mileage. A case study, based on real-world field failure data and censored data of automobile components, is presented to evaluate the proposed algorithm. Results show similar results to the C-Forest approach in terms of prediction quality, while generating models with significantly lower space that are easier to interpret.

No abstract is provided for this article.

In many modern manufacturing plants, data that characterize the manufacturing process are electronically collected and stored in the organization’s databases. Thus, data mining tools can be used for automatically discovering interesting and useful patterns in the manufacturing processes. These patterns can be subsequently exploited to enhance the whole manufacturing process in such areas as defect prevention and detection, reducing flow-time, increasing safety, etc. When data mining is directed towards improving manufacturing process, there are certain distinctions that should be noted compared to the classical methods employed in quality engineering, such as the experimental design. In data mining the primary purpose of the targeted database is not data analysis; the volume of the collected data makes it impractical to explore it using standard statistical procedures (Braha and Shmilovici, 2003).

The idea of decomposition methodology is to break down a complex data mining task into several smaller, less complex and more manageable, sub-tasks that are solvable by using existing tools, then joining their solutions together in order to solve the original problem. In this paper we provide an overview of decomposition methods in classification tasks with emphasis on elementary decomposition methods. We present the main properties that characterize various decomposition frameworks and the advantages of using these framework. Finally we discuss the uniqueness of decomposition methodology as opposed to other closely related fields, such as ensemble methods and distributed data mining.