Search

AbstractClustering is a widely used unsupervised learning technique that groups data into homogeneous clusters. However, when dealing with real-world data that contain categorical values, existing algorithms can be computationally costly in high dimensions and can struggle with noisy data that has missing values. Furthermore, except for one algorithm, no others provide theoretical guarantees of clustering accuracy. In this article, we propose a general categorical data encoding method and a computationally efficient spectral-based algorithm to cluster high-dimensional noisy categorical data (nominal or ordinal). Under a statistical model for data on m attributes from n subjects in r clusters with missing probability ϵ, we show that our algorithm exactly recovers the true clusters with high probability when mn(1−ϵ)≥CMr2 log 3M, with M=max(n,m) and a fixed constant C. In addition, we show that mn(1−ϵ)2≥rδ/2 with 0<δ<1 is necessary for any algorithm to succeed with probability at least (1+δ)/2. In cases where m = n and r are fixed, the sufficient condition matches with the necessary condition up to a polylog(n) factor. In numerical studies our algorithm outperforms several existing algorithms in both clustering accuracy and computational efficiency. Supplementary materials for this article are available online. [ABSTRACT FROM AUTHOR]

Machine learning based network intrusion system (NIDS) is known to be vulnerable to evasions. Attackers conceal intrusion activities to make them undetected. Researching evasion techniques contributes to evaluating and increasing the robustness of NIDS. Previous evasion approaches modify feature values or packets of an offline network trace as a whole. However, in real scenarios, attackers are constrained to manipulate only outbound packets on the fly. To bridge this assumption gap, we present the first evasion solution for live network traffic against learning based NIDSs. The solution consists of three components: a devised Kalman filter based algorithm to predicate the feature values of live flows, a set of formally constructed atomic packet mutation operators, and a proposed Strength Enhanced Deep Q-learning (SE-DQN) to determine effective mutation operators on outbound packets according to the predicted features. A defense scheme based on adaptive decision threshold adjustment is also provided. Experimental evaluation is presented on various NIDS classifiers and cyber attacks. Results show that SE-DQN achieves an evasion rate of at least 64.2% on most classifiers and even more than 90% on certain ones, and it is three times faster than DQN on learning mutation policy. The defense scheme shows an improvement of at least 76.4% on recall measurement. [ABSTRACT FROM AUTHOR]

Abstract Background Patients who no-show to primary care appointments interrupt clinicians’ efforts to provide continuity of care. Prior literature reveals no-shows among diabetic patients are common. The purpose of this study is to assess whether no-shows to primary care appointments are associated with increased risk of future emergency department (ED) visits or hospital admissions among diabetics. Methods A prospective cohort study was conducted using data from 8,787 adult diabetic patients attending outpatient clinics associated with a medical center in Indiana. The outcomes examined were hospital admissions or ED visits in the 6 months (182 days) following the patient’s last scheduled primary care appointment. The Andersen-Gill extension of the Cox proportional hazard model was used to assess risk separately for hospital admissions and ED visits. Adjustment was made for variables associated with no-show status and acute care utilization such as gender, age, race, insurance and co-morbid status. The interaction between utilization of the acute care service in the six months prior to the appointment and no-show was computed for each model. Results The six-month rate of hospital admissions following the last scheduled primary care appointment was 0.22 (s.d. = 0.83) for no-shows and 0.14 (s.d. = 0.63) for those who attended (p p Conclusions No-show to a primary care appointment is associated with increased risk for hospital admission among diabetics recently hospitalized.

The transport layer security (TLS) protocol is widely adopted by apps as well as malware. With the geometric growth of TLS traffic, accurate and efficient detection of malicious TLS flows is becoming an imperative. However, current studies focus on either detection accuracy or detection efficiency, and few studies take into account both indicators. In this paper, we propose a two-layer detection framework composed of a filtering model (FM) and a malware family classification model (MFCM). In the first layer, a new set of TLS handshake features is presented to train the FM, which is devised to filter out a majority of benign TLS flows. For identifying malware families, both TLS handshake features and statistical features are applied to construct the MFCM in the second layer. Comprehensive experiments are conducted to substantiate the high accuracy and efficiency of the proposed two-layer framework. A total of 96.32% of benign TLS flows can be filtered out by the FM with few malicious TLS flows being discarded provided the threshold of the FM is set to 0.01. Moreover, a multiclassifier is selected to construct the MFCM to provide better performance than a set of binary classifiers under the same feature set. In addition, when the ratio of benign and malicious TLS flows is set to 10:1, the detection efficiency of the two-layer framework is 188% faster than that of the single-layer framework, while the average detection accuracy reaches 99.45%. [ABSTRACT FROM AUTHOR]