Search

Co-modality is a concept based on a unified network system which will ensure the effective and sustainable utilization of all transportation modes. However, the application of co-modality as a measure of evaluating public transit system performance is recent and has been predominantly used in freight transport systems. This study proposes a novel approach by using co-modality as a key performance indicator to characterize public transit systems for passengers. This paper examines a new data set to evaluate transit systems from a user perspective. The data is gathered from an Application Programming Interface (API) which pulls from the real-time General Transit Feed Specification (GTFS). Data was collected over 24 h to explore 4320 transit trips and 69,120 attributes for a single origin–destination pair. Co-modality is used to understand how dozens of transit routes and schedules will best serve transit users. A detailed analysis of trips involving multiple transit segments is conducted to understand how varying headways influence the overall trip travel time. The main conclusion for this paper is that a user perspective is necessary to understand co-modality across public transit systems. Some of the metrics identified in this paper, such as percent of trip spent walking, will be useful in assessing last-mile portions of travel across multiple trips. A better understanding of transit service to travelers by the transit system as a whole will help to improve transportation in dense urban areas.

Classifying wine according to their grade, price, and region of origin is a multi-label and multi-target problem in wine-informatics. Using wine reviews as the attributes, we compare several different multi-label/multitarget methods to the single-label method where each label is treated independently. We explore both single-label and multi-label approaches for a two-class problem for each of the labels and we explore both single-label and multi-target approaches for a four-class problem on two of the three labels, with the third label remaining a two-class problem. In terms of per-label accuracy, the single-label method has the best performance, although some multi-label methods approach the performance of single-label. However, multi-label/multi-target metrics approaches do exceed the performance of the single-label method.

The emerging connected vehicle (CV) technology has introduced the opportunity to improve traditional traffic signal operation. Real-time vehicle trajectory information (location, speed, and...

Although wine has been produced for several thousands of years, the ancient beverage has remained popular and even more affordable in modern times. Among all wine making regions, Bordeaux, France is probably one of the most prestigious wine areas in history. Since hundreds of wines are produced from Bordeaux each year, humans are not likely to be able to examine all wines across multiple vintages to define the characteristics of outstanding 21st century Bordeaux wines. Wineinformatics is a newly proposed data science research with an application domain in wine to process a large amount of wine data through the computer. The goal of this paper is to build a high-quality computational model on wine reviews processed by the full power of the Computational Wine Wheel to understand 21st century Bordeaux wines. On top of 985 binary-attributes generated from the Computational Wine Wheel in our previous research, we try to add additional attributes by utilizing a CATEGORY and SUBCATEGORY for an additional 14 and 34 continuous-attributes to be included in the All Bordeaux (14,349 wine) and the 1855 Bordeaux datasets (1359 wines). We believe successfully merging the original binary-attributes and the new continuous-attributes can provide more insights for Na&iuml, ve Bayes and Supported Vector Machine (SVM) to build the model for a wine grade category prediction. The experimental results suggest that, for the All Bordeaux dataset, with the additional 14 attributes retrieved from CATEGORY, the Na&iuml, ve Bayes classification algorithm was able to outperform the existing research results by increasing accuracy by 2.15%, precision by 8.72%, and the F-score by 1.48%. For the 1855 Bordeaux dataset, with the additional attributes retrieved from the CATEGORY and SUBCATEGORY, the SVM classification algorithm was able to outperform the existing research results by increasing accuracy by 5%, precision by 2.85%, recall by 5.56%, and the F-score by 4.07%. The improvements demonstrated in the research show that attributes retrieved from the CATEGORY and SUBCATEGORY has the power to provide more information to classifiers for superior model generation. The model build in this research can better distinguish outstanding and class 21st century Bordeaux wines. This paper provides new directions in Wineinformatics for technical research in data science, such as regression, multi-target, classification and domain specific research, including wine region terroir analysis, wine quality prediction, and weather impact examination.

In the effort of making a more realistic simulation environment for VANET systems, we employ real traffic data to create a mobility scenario for ns-3. We then test how our simulated system performs when running different variations for network protocols. One version is optimized for general use, while the other is optimized for a VANET environment. We then evaluate how effective the optimizations for VANET are as well as the accuracy of our test system. We found that 802.11p performed better than 802.11ac in our simulated system in terms of both packet delivery and computational efficiency, and that our system seemed to be a reasonable model of the real world.

Vehicular Ad-hoc Networks (VANETs) are an emerging technology that has much potential development ahead of it. VANETs seek to connect devices contained within vehicles together to create services that are particularly relevant to a vehicular environment. They attempt to do so without relying on infrastructure devices to assist in the process of network topology management. This particular nature of VANETs leads them to provide both unique challenges and opportunities to investigate. This paper will seek to address the key features that define a VANET environment, while discussing what can be done with a VANET system. This paper will then investigate many different perspectives on VANETs, including historical perspectives and ideas for uses as well as more modern perspectives, and discuss how they have changed over time. Finally, this paper will investigate the current state of VANET technologies and discuss the current progress towards the successful deployment of these technologies in the real world.

Through social media, users may consciously reveal information about their personality; however, they could also unintentionally disclose private information related to the locations of where they live/work, car license plates, signatures or even their identification documents. Any disclosed information can endanger an individual’s privacy, possibly resulting in burglaries or identity theft. To the best of our knowledge, this paper is the first to claim and demonstrate that people may reveal information when they are vulnerable and actively seek help; evidently, in the event of a natural disaster, people change their behavior and become more inclined to share their personal information. To examine this phenomenon, we investigate two hurricane events (Harvey and Maria) and one earthquake (Mexico City) using datasets obtained from Twitter. Our findings show a significant change in people’s behavioral pattern in the disaster areas, regarding tweeting images that contain Personally Identifiable Information (PII), before and after a disaster event.

Until recently, industrial control systems (ICSs) used “air-gap” security measures, where every node of the ICS network was isolated from other networks, including the Internet, by a physical disconnect. Attaching ICS networks to the Internet benefits companies and engineers who use them. However, as these systems were designed for use in the air-gapped security environment, protocols used by ICSs contain little to no security features and are vulnerable to various attacks. This paper proposes an approach to detect the intrusions into network attached ICSs by measuring and verifying data that is transmitted through the network but is not inherently the data used by the transmission protocol—network telemetry. Using simulated PLC units, the developed IDS was able to achieve 94.3 percent accuracy when differentiating between machines of an attacker and engineer on the same network, and 99.5 percent accuracy when differentiating between attacker and engineer on the Internet.

With the increasing popularity of microblogging and social media platforms like Twitter, researchers are trying to make use of the massive amount of user-created data to explore new applications/tools. Success of research in data science is highly dependent on the amount and type of data collected. For this effort, a thesaurus-based query expansion technique from information retrieval will be used to extract additional Twitter data. Though there has been research in this general area, our effort concentrates on applying a thesaurus-based query expansion for Twitter retrieval. Experiments are performed to collect Twitter data using the proposed approach for query terms related to disaster situations like hurricanes and shootings. We observed an increase of 32% in tweets received for the Hurricane Harvey event, and a 131% increase in the volume of tweets for a query related to the Vegas shooting incidence using the thesaurus-based query expansion approach.

Bluetooth Low Energy (BTLE) is pervasive in technology throughout all areas of our lives. In this research effort, experiments are performed to discover vulnerabilities in the Bluetooth protocol and given the right technology determine exploitation. Using a Bluetooth keyboard, practical examples of the Bluetooth Low Energy protocol were able to be provided. Because of the results garnered, it is recommended that Bluetooth Low Energy not be used for any connections that may transmit sensitive data, or with devices that may have access to sensitive networks.

Code smells are anomalies often generated in design, implementation or maintenance phase of software development life cycle. Researchers established several catalogues characterizing the smells. Fowler and Beck developed the most popular catalogue of 22 smells covering varieties of development issues. This literature presents an overview of the existing research conducted on these 22 smells. Our motivation is to represent these smells with an easier interpretation for the software developers, determine the causes that generate these issues in applications and their impact from different aspects of software maintenance. This paper also highlights previous and recent research on smell detection with an effort to categorize the approaches based on the underlying concept.

Wineinformatics is a novel data science application domain to understand more about wine via wine related datasets, including physicochemical laboratory data and wine reviews. Many interesting works has been done in this novel domain, including predict the wines' score based on the wine expert reviews (in human language format) and wine region estimation. In this paper, Granule computing was applied to Wineinformatics. The information granules are evaluated and found out that the results produced within the information granules surpass the predictive models build on the whole dataset. It suggests that the information granule do have the power to pick up the correlation between wine attributes and wine scores to produce higher quality results. Important attributes are also reported in this paper. It is the first time that the granule computing concept being applied in any wine related experiment or dataset. This paper also enables many possible future works in Wineinformatics.

With the increase in mobile device use, there is a greater need for increasingly sophisticated malware detection algorithms. The research presented in this paper examines two types of features of Android applications, permission requests and system calls, as a way to detect malware. We are able to differentiate between benign and malicious apps by applying a machine learning algorithm. The model that is presented here achieved a classification accuracy of around 80% using permissions and 60% using system calls for a relatively small dataset. In the future, different machine learning algorithms will be examined to see if there is a more suitable algorithm. More features will also be taken into account and the training set will be expanded.

According to the 2016 Internet Security Threat Report by Symantec, there are around 431 million variants of malware known. This effort focuses on malware used for spying on user's activities, remotely controlling devices, and identity and credential theft within a Windows based operating system. As Windows operating systems create and maintain a log of all events that are encountered, various malware are tested on virtual machines to determine what events they trigger in the Windows logs. The observations are compiled into Operating System specific lookup tables that can then be used to find the tested malware on other computers with the same Operating System.

Fuzzy hashes are gaining recognition in the realm of digital forensics as an alternative method of recognizing similar or nearly identical files. However, despite a high diversity of algorithms in existence, only SSDEEP and sdhash are widely used. This paper describes several viable fuzzy hashes not in wide use and compares them in detail, examining both security and non-security flaws. Finally, we develop guidelines to put these hashes to practical use, as well as suggesting improvements to several of the hashes.

Web browsers store web surfing data and history to facilitate the users ease of operation such as instant website recommendations or quicker access to previously visited sites. Since cyber-criminals or suspects, in general, may use the browser to search for any number of crime methods or visit different websites to collect information, this is a good source of electronic evidence used in lawsuits and other crime related investigations. For this reason, web browser forensics is an important field of Digital Forensics. It is crucial to know about the different web browsing analysis tools that are available and have a clear understanding of which tool would be more productive and suitable for which cases and situations. Therefore, this paper presents a survey of web browser forensics analysis tools for Firefox, as well as evaluates the performance of the tools and the system while the tool is being run. These tools are tested against different criteria such as time constraints, memory consumption, and availability. The evaluation result is varied with respect to different sets of criteria. Each of the tools in this survey had their own strengths and weaknesses. However, if one is to be chosen which could be suitable enough for all the jobs, then FoxAnalysis would be the choice.

The use and deployment of Industrial Control Systems (ICS) have become standard across many industries, though the security of these important systems have not kept pace with their current Internet focused deployment technologies. This technology gap has exposed an exploitable vector for would be attackers as ICS protocols do not have security mechanisms in place to handle Internet connectivity. This paper focuses on a critical component of a Network Telemetry based Intrusion Detection system (IDS) that can help eliminate this exploitable vector. This component is a method for extracting features using session duration based instantiation. After integrating this feature extraction method into the telemetry based IDS, it is able to achieve 99.98% accuracy when distinguishing between an engineer and an attacker on the same network.

This paper presents an overview of the privacy issues that are expected to emerge as a result of the Internet of Things (IoT). IoT expands digital world to include different things in our physical world. This ambitious aspiration is becoming true with the utilization of already existing technologies that enable things to be identified and to communicate with each other. Unfortunately, the ubiquitous collection and dissemination of data that characterize IoT come at the expense of data privacy. We have witnessed many privacy breaches during the last decade, more vicious breaches will find its way to the huge amounts of qualitative data that are collected in IoT with more expected catastrophic consequences to individuals and organizations. Evaluating some papers, the lessons to be learnt and some possible directions for future research were highlighted.

As the use of mobile devices continues to increase, so does the need for sophisticated malware detection algorithms. The preliminary research presented in this paper focuses on examining permission requests made by Android apps as a means for detecting malware. By using a machine learning algorithm, we are able to differentiate between benign and malicious apps. The model presented achieved a classification accuracy between 75% and 80% for our dataset and the best combination of parameters. Future work will seek to improve the model by expanding the training dataset, taking more features into account, and exploring other machine learning algorithms.

This paper describes recent work on securing a Web-browser-based remote visualization capability for large datasets. The results from a security performance study are presented.

Research efforts to develop malicious application detection algorithms have been a priority ever since the discovery of the first "viruses". Various methods are used to search and identify these malicious applications. One such method, n-gram analysis, can be implemented to extract features from binary files. These features are then be used by machine learning algorithms to classify them as malicious or benign. However, the resulting high dimensionality of the features makes accurate detection in some cases impossible. This is known as "the curse of dimensionality". To counteract this effect, a feature reduction technique known as randomized projection was implemented. Through this reduction, not only are classification times decreased but also an increase in true positive and decreases false positive rates are observed. By varying the n-gram size and target feature size it is possible to fine-tune the accuracy of machine learning algorithms to reach an average accuracy of 99%.

Computer virtualization is not a new technology, it has become increasingly important because of the many advantages it offers to businesses and individuals to reduce costs, while introducing new challenges to the field of digital forensics. As virtualization continues to be adopted by more and more companies every year, malware and hacker attacks are going to have an increasing effect on virtualized systems. Therefore, the increasing growth of virtualization has created the need for a new generation of computer forensic tools and techniques to analyze these compromised systems. Because of the rapid growth of virtualization, new techniques to interact with virtual systems have been developed. Some of these techniques reduce the limitations of traditional forensics tools abilities to analyze the virtual system. Virtual Machine Introspection (VMI) is one of these techniques that have formed the basis for a number of novel approaches in the fields of cyber security and digital forensics. This paper explores how VMI improves traditional digital forensics to overcome its downfalls when used to investigate virtual machines, especially during a live analysis of the machine.

Signature based anti-virus systems inherently restrict the detection of new and previously unknown types of malicious attacks. To that end researchers are searching for methodologies to combat this problem. One potential method is the use of static application analysis. Using this methodology the applications are not executed to determine whether or not they contain malicious functionality. This paper presents a static application analysis methodology using the information retrieval technique of n-gram analysis and the dimensionality reduction techniques of randomized projection and mutual information to create a malicious application detection model. For this effort, a data set was extracted from Microsoft Windows applications that were either benign or possessed malicious functionality. Dimensionality and prediction methodology was then applied. Initial results show promise when comparing the prediction to expected outcomes. In one performance evaluation, the Boosted J48 algorithm achieved an accuracy of 99.08%.

Industrial Control Systems (ICS) are present across many industries ranging from automotive to utilities. These systems have been found to be connected to corporate enterprise servers and can communicate over unencrypted communication channels. Interconnections of this type provide an attack vector for people with malicious intent and therefore are a critical cyber security risk. To better understand these risks and possible security measures, this research presents as proof of concept several attacks against a programmable logic controller along with observations made during the attacks. Our results indicate a time sequence difference between legitimate and spoofed command and control packets. Attacks are launched using the Metasploit Framework against a simulated control scenario. Using the observations made in this paper it is then suggested that several features can be extracted and then utilized in next generation mitigation and detection techniques for the industrial control environment.

The emergence of cyber systems to the realm of physical control is currently being seen in the control environment of the critical infrastructure power grid. This research describes a possible way of detecting cyber-events including malicious intrusions. Specifically, the intrusion this work examines is data manipulation or data injection. The detection mechanism used is based on information retrieval and feature identification methods. Principal component analysis, a type of feature identification method, is used to transform each observed power system instance into a new dimensional space. In this new space, detection metric is created based on the Hotelling T2 value along with a probabilistic metric to classify instances that may contain malicious activity. An experimental trusted model is derived based on a pseudo-random Monte Carlo simulation of the Newton-Raphson method for a 5-bus power system.

This research is part of a continuing effort to show the viability of using random projection as a feature extraction and reduction technique in the classification of malware to produce more accurate classifiers. In this paper, we use a vector space model with n-gram analysis to produce weighted feature vectors from binary executables, which we then reduce to a smaller feature set using the random projection method proposed by Achlioptas, and the feature selection method of mutual information to produce two separate data sets. We then apply several popular machine learning algorithms including J48 decision tree, naive Bayes, support vector machines, and an instance-based learner to the data sets to produce classifiers for the detection of malicious executables. We evaluate the performance of the different classifiers and discover that using a data set reduced by random projection can improve the performance of support vector machine and instance-based learner classifiers.

Computer virtualization is not new; however, it has become increasingly important because of the many advantages it offers businesses and individuals to reduce costs. A company can reduce maintenance, hardware, and energy costs by running virtualized servers on a single physical machine. Although virtualization offers these advantages, it introduces new challenges to current computer forensic techniques as well as computer system defense tools. As this technology continues to be adopted by more and more companies every year, malware and hacker attacks are potentially going to affect virtualized systems as they have been affecting physical systems in the past. Therefore, the increasing growth of virtualization has created the need for a new generation of computer system defenses as well as computer forensic techniques to effectively defend these systems before or after they have been attacked. Because of the nature of how virtualization operates, new techniques to interact with these systems have become available. These techniques allow us to increase the effectiveness of current forensic and system defense tools to create new tools to defend or analyze virtualized systems. Virtual Machine Introspection (VMI) is one of these techniques that have formed the basis of a number of novel approaches in the field of Digital Forensics and Cybersecurity. In this paper, we present what VMI has offered to Digital Forensics and the new challenges it brings. Likewise, we discuss why traditional Digital Forensic techniques are not reliable to analyze virtual machines once they have been attacked.

This work is part of an on-going effort in using randomized projection as a feature extraction and reduction method to improve a cosine similarity, information retrieval technique to enhance the detection of known malicious applications and their variations. We follow a standard information retrieval methodology that allows software to be regarded as documents in the corpus. This provides the ability to search the corpus with a query, malicious software, and retrieve/identify potentially malicious software and other instances of the same type of vulnerability. In our experiments, we compare Gaussian-distributed random matrix randomized projection to two alternative methods of randomized projection, sparse matrix randomized projection and Linial-London-Rabinovich random set randomized projection, and assess their performance when applied to features of malicious applications extracted via the information retrieval technique of n-gram analysis. In our results, the Gaussian distributed random matrix approach outperformed the other methods with generally higher values for each observed performance metric, however, each algorithm showed promise in selected scenarios. These results support the hypothesis that applying the technique of random matrix projection as a dimensionality reduction method for the cosine similarity metric has merit in determining if an application may contain a malicious application.

This poster presents a four-phase investigation methodology to acquire, authenticate and analyze a virtual machine. During a simulated investigation, sensitive information about a suspect's activities was obtained from a virtual machine by applying the four-phase investigation methodology. This methodology can be used to investigate a suspect's virtual machine to identify and obtain evidence about a suspect's activities in a virtual machine.

This research paper describes an on-going effort to design, develop and improve upon malicious application detection algorithms. This work looks specifically at improving a cosine similarity, information retrieval technique to enhance detection of known and variances of known malicious applications by applying the feature extraction technique known as randomized projection. Document similarity techniques, such as cosine similarity, have been used with great success in several document retrieval applications. By following a standard information retrieval methodology, software, in machine readable format, can be regarded as documents in the corpus. These "documents" may or may not have a known malicious functionality. The query is software, again in machine readable format, which contains a certain type of malicious software. This methodology provides an ability to search the corpus with a query and retrieve/identify potentially malicious software as well as other instances of the same type of vulnerability. Retrieval is based on the similarity of the query to a given document in the corpus. There have been several efforts to overcome what is known as 'the curse of dimensionality' that can occur with the use of this type of information retrieval technique including mutual information and randomized projections. Randomized projections are used to create a low-order embedding of the high dimensional data. Results from experimentation have shown promise over previously published efforts.

Visualization is a promising approach in improving the teaching of algorithms because it can give a pictorial representation of the effect of every step of an algorithm. However, traditional implementations of visualizations require much additional coding to support the infrastructure necessary to step through an algorithm. In this work, we embark on a different path for implementing visualizations, PCIL (PseudoCode Interpreted Language). We believe that PCIL distinguishes itself from other approaches to algorithm visualization by incorporating visualization into its specification. Each language primitive, such as a variable, natively supports a graphical representation. The PCIL interpreter automatically derives visualizations from algorithm implementations. In addition, PCIL includes constructs to facilitate pedagogically effective visualizations, such as the ability to specify custom inputs to algorithms and the ability to ask the student to predict algorithmic behavior. Experimental results indicate that not only do students enjoy using PCIL, they also perform much better on tests after using it compared to students who simply use traditional study aides. Furthermore, the students who use the application for longer amounts of time derive more benefit from the tool than those who only use it for a short time.

This paper describes a research effort to improve the use of the cosine similarity information retrieval technique to detect unknown, known or variances of known rogue software by applying the feature extraction technique of randomized projection. Document similarity techniques, such as cosine similarity, have been used with great success in several document retrieval applications. By following a standard information retrieval methodology, software, in machine readable format, can be regarded as documents in the corpus. These "documents" may or may not have a known rogue functionality. The query is software, again in machine readable format, which contains a certain type of rogue software. This methodology provides an ability to search the corpus with a query and retrieve/identify potentially rogue software as well as other instances of the same type of vulnerability. This retrieval is based on the similarity of the query to a given document in the corpus. To overcome what is known as the 'the curse of dimensionality' that can occur with the use of this type of information retrieval technique, randomized projections are used to create a low-order embedding of the high-dimensional data. For our experiment, we obtain Microsoft Windows applications, infect a subset of them with several common Trojans and apply our dimensionality and prediction methodology. Preliminary results show promise when applying randomized projections to cosine similarity in both speed of prediction and efficiency of required space when compared with using only cosine similarity.

This work describes a web browser-based remote visualization capability for large datasets. We discuss recent enhancements including access to databases and remote resources, as well as the addition of two image compression algorithms and their effect on performance. Results indicate that the existing sequential unified- channel image run transmission (SQUIRT) image compression algorithm performs best for large bandwidth situations while the new binary set splitting with k-d trees (BISK) algorithm works better than the previous JPEG compression scheme. The results from a study on encryption effects on the data stream show that encryption does not add a significant amount of overhead.

In bug localisation a developer uses information about a bug present in a software system to locate the source code elements that must be modified to correct the bug. Researchers have developed static bug localisation techniques using Information Retrieval techniques such as Latent Semantic Indexing (LSI) to model lexical information from source code. In this paper we present a new technique, LSICG, that combines LSI to model lexical information and call graphs to model structural information. A case study of 21 bugs in Rhino demonstrates that our technique provides improved performance compared to LSI alone.