Anto Satriyo Nugroho

Analysis of Machine learning Techniques Used in Behavior-Based Malware Detection

The increase of malware that are exploiting the Internet daily has become a serious threat. The manual heuristic inspection of malware analysis is no longer considered effective and efficient compared against the high spreading rate of malware. Hence, automated behavior-based malware detection using machine learning techniques is considered a profound solution. The behavior of each malware on an emulated (sandbox) environment will be automatically analyzed and will generate behavior reports. These reports will be preprocessed into sparse vector models for further machine learning (classification). The classifiers used in this research are k-Nearest Neighbors (kNN), Naïve Bayes, J48 Decision Tree, Support Vector Machine (SVM), and Multilayer Perceptron Neural Network (MlP). Based on the analysis of the tests and experimental results of all the 5 classifiers, the overall best performance was achieved by J48 decision tree with a recall of 95.9%, a false positive rate of 2.4%, a precision of 97.3%, and an accuracy of 96.8%. In summary, it can be concluded that a proof-of-concept based on automatic behavior-based malware analysis and the use of machine learning techniques could detect malware quite effectively and efficiently.

Automated status identification of microscopic images obtained from malaria thin blood smears

Diagnosing malaria, as the first step to control the spread of the infectious disease, can be significantly optimized with a Computer Aided Diagnosis system. This study is proposed to develop a novel image processing algorithm to realiably detect the presence of malaria parasites from Plasmodium falciparum species in this smears of Giemsa stained peripheral blood sample. The proposed system was built using malaria samples that were specifically prepared by Eijkman Institute for Molecular Biology. Digital microphotographs were acquired using a digital camera connected to a light microscope. Global thresholding and connected component extraction were implemented to identify blood cell components. Two stage classification using separate set of features was built based on Bayes Decision Theory. Infected erythrocytes were identified with sensitivity of 92.59%, specificity of 99.65%, and PPV of 67.56%. The system provided an F1 measure of 0.78.

Text Classification Techniques Used to Faciliate Cyber Terrorism Investigation

rising of computer violence, such as Distributed Denial of Service (DDoS), web vandalism, and cyber bullying are becoming more serious issues when they are politically motivated and intentionally conducted to generate fear in society. These kinds of activity are categorized as cyber terrorism. As the number of such cases increase, the availability of information regarding these actions is required to facilitate experts in investigating cyber terrorism. This research aims to create text classification system which classifies the document using several algorithms including Naïve Bayes, Nearest Neighbor, Support Vector Machine (SVM), Decision Tree, and Multilayer Perceptron. The result shows that SVM outperforms by achieving 100% of accuracy. This result concludes the excellent performance of SVM in handling high dimensional of data.

Implementation of Intelligent Searching Using Self-Organizing Map for Webmining Used in Document Containing Information in Relation to Cyber Terrorism

The terrorism activities are not only in real world as development of technology, but also in cyber world. Terrorism activities in cyber world are called cyber terrorism. One of methodology for cyber terrorism detection is by applying data mining algorithm to textual content of terrorism related web pages. Web mining is technology applied to extract information from the web. By using web mining, cyber terrorism information will be collected from internet. This research aims to use text cluster technique, by which the web documents are clustered using Self-Organizing Map algorithm based on number of occurrences of the certain words in documents that have relevance to cyber terrorism. The result shows mapping of the clustered documents that have performance 6.1 and 22.75 in term of vector quantization error (VQE). According this result, we concluded that Self-Organizing Map (SOM) is able to visualizethe topology of the data, by converting statistical relationship among the data into simple geometrical relationship of their image points in 2-dimensional grid.

Two-stage feature extraction to identify Plasmodium ovale from thin blood smear microphotograph

Malaria is one of the tropical diseases, which is found with high prevalence in East side of Indonesia. To assist the diagnosis of this disease, we have developed a Computer Aided Diagnosis system that analyze the information obtained from thin blood smears microphotograph. Five species of the parasites are found in Indonesia, and each of them has different morphology. Therefore, the morphological characteristics of the parasites should be considered in the feature extraction development to obtain an accurate classifications system. The focus of this study is on the feature extraction development for Plasmodium ovale detection. A novel strategy is proposed by divide the feature extraction into two stages. The first stage focused on the most distinctive features, while the second focused on detail characteristics of the parasite. The proposed algorithm was evaluated using 177 microphotographs, obtained from Malaria observations carried out in various places of Indonesia by Eijkman Institute for Molecular Biology Indonesia, and showed a sensitivity of 0.75 and specificity 1.0.

Recursive text segmentation for Indonesian Automated Document Reader for people with visual impairment

This research is conducted to accommodate the needs of visually impaired people through an intelligent system, which reads textual information on papers and produces corresponding voice. Indonesian Automated Document Reader (I-ADR) is operated via a voice-based user interface to scan a document page. Textual information from the scanned page is then extracted using Optical Character Recognition (OCR) techniques. A user can then choose to have the system read the whole page, or they can opt to listen to a summary of the information in page. SIDoBI (Sistem Ikhtisar Dokumen untuk Bahasa Indonesia) is integrated into the system to provide summarization feature. The result of either the whole-page reading or summarization is converted to speech through a text-to-speech synthesizer. This whole system is developed under the Free Open Source Software policy and will be distributed openly to all users in need without any cost. This paper is focused on the text segmentation algorithm implemented in I-ADR to extract text from documents with complex layout. We implemented I-ADR text segmentation module using Enhanced CRLA and propose an improved algorithm for text extraction. Evaluation of the proposed system with various page layouts showed promising results.

Integrating Dynamic Analysis Using Clustering Techniques for local Malware in Indonesia

The understanding and predict threats to the security of information systems become really important in order to protect critical systems. Protection against the threat of computer threats have been adequately considered with anti-virus software which resulted in an increase in world surveys from CSI Survey 2008 for the use of security technologies against malware is that the use of antivirus stand in the first position with 97% usage rate. Malware has several characteristics and behavior that vary according to the programming techniques and objectives of the creator of the virus. Protection so that the system efficacy rely solely on antivirus software alone, not be considered sufficient. local malware have got a lot of attention to be seriously considered. This can be proofed with contribution and sharing information of Indonesia computer security communities and professional, Indonesia CERT, and also antivirus vendor consist of worldwide antivirus vendor and local antivirus vendor . local malware is not different from the other malware in the world that it is a potential threat. This research will focus on local malware analysis using data mining especially with clustering techniques and conducted to serve objective of analyzing local malwares characteristics/behaviors. This research propose Self-Organizing Map (SOM) and Simple K-means as the clustering analysis techniques.

Segmentation of malaria parasite candidates from thick blood smear microphotographs image using active contour without edge

Malaria is a serious health problem in Indonesia caused by malaria parasites. Early detection of Malaria is an important step to an effective treatment. Malaria parasite identification should be carried out based on observation on at least 100 fields view strong magnification of thick blood smears. Malaria parasite detection process is usually carried out with a microscope observation. But it consumes too much time and the number experts are limited. To overcome these obstacles, we developed a computer aided diagnosis system to automatically detecting malaria parasites. Parasite image segmentation is an important step in the detection process. But segmentation of malaria parasite that consists of a nucleus and cytoplasm in a thick blood smear is not easy because the boundary between object and background is not clear and has a low contrast. This study proposed a solution to the problem of segmentation of malaria candidate parasite candidates from thick blood smears. The proposed method focused on image enhancement and segmentation steps. Image enhancement consists of lowpass filtering to reduce noise and contrast stretching to increase contrast. Segmentation is used to detect object using active contour without edge, then erosion, dilation, masking, contrast stretching, and thresholding. The result showed that the proposed method is capable to segment malaria parasite candidates from thick blood smear with 97.57% accuracy, 12.04% (283 pixels) false negative rate (FNR), and 6.87% (202 pixels) false discovery rate (FDR), from 19600 pixels total in each image.

Enhancement of low quality thick blood smear microscopic images of malaria patients using contrast and edge corrections

Malaria becomes one of the diseases that cause many deaths in Indonesia, particularly in Eastern Indonesia. Parasite readings in many fields of thick blood smear microscopic images become the gold standard for the diagnosis of malaria. Therefore, it requires high-quality smear image that easily readable existence of parasites. Lack of health infrastructure, especially microscopy specifications, in endemic areas affect the availability of such smear images. Images that produced under these conditions have low quality that have characteristics: blurred, the diminished true color of object, unclear boundary, and the low contrast between the object and the background. Therefore, in this study, we propose image enhancement technique to improve the readability of parasite in the low quality of thick blood smear image. The proposed method consists of two parts, namely contrast and edge corrections. Contrast correction utilizing the integration of contrast correction globally and locally respectively using Dark Stretching and Contrast Limited Adaptive Histogram Equalization (CLAHE). Meanwhile, edge correction utilizing Unsharp Masking Filtering (UMF) to improve the edge of objects in an image. The results show that the proposed method is better in the image entropy than other methods. While the value of MSE and PSNR better if range of the histogram image is short. This value means that the proposed method can produce images that contain more information than the other methods and have a good effectiveness. So the proposed method successfully improve readability parasite in the low quality of thick blood smear image.

Iris localization using gradient magnitude and fourier descriptor

Best way to localize iris inside an image of an eye is still a huge challenge because a standard regarding iris image does not yet exist. The first step of iris segmentation is iris localization. It is very important step because it will ensure the other step is running well. In this paper, a novel method to localize iris in a robust and simple manner is explained. The method is able to localize iris occluded by eyelids. Experiments on publicly available iris database that made by Malaysia Multimedia University Iris Database (MMU1) [1] showed a satisfying result of the proposed method.