El-Sayed M. El-Alfy

Using GMDH-based networks for improved spam detection and email feature analysis

Unsolicited or spam email has recently become a major threat that can negatively impact the usability of electronic mail. Spam substantially wastes time and money for business users and network administrators, consumes network bandwidth and storage space, and slows down email servers. In addition, it provides a medium for distributing harmful code and/or offensive content. In this paper, we explore the application of the GMDH (Group Method of Data Handling) based inductive learning approach in detecting spam messages by automatically identifying content features that effectively distinguish spam from legitimate emails. We study the performance for various network model complexities using spambase, a publicly available benchmark dataset. Results reveal that classification accuracies of 91.7% can be achieved using only 10 out of the available 57 attributes, selected through abductive learning as the most effective feature subset (i.e. 82.5% data reduction). We also show how to improve classification performance using abductive network ensembles (committees) trained on different subsets of the training data. Comparison with other techniques such as neural networks and naive Bayesian classifiers shows that the GMDH-based learning approach can provide better spam detection accuracy with false-positive rates as low as 4.3% and yet requires shorter training time.

Construction and analysis of educational tests using abductive machine learning

Recent advances in educational technologies and the wide-spread use of computers in schools have fueled innovations in test construction and analysis. As the measurement accuracy of a test depends on the quality of the items it includes, item selection procedures play a central role in this process. Mathematical programming and the item response theory (IRT) are often used in automating this task. However, when the item bank is very large, the number of item combinations increases exponentially and item selection becomes more tedious. To alleviate the computational complexity, researchers have previously applied heuristic search and machine learning approaches, including neural networks, to solve similar problems. This paper proposes a novel approach that uses abductive network modeling to automatically identify the most-informative subset of test items that can be used to effectively assess the examinees without seriously degrading accuracy. Abductive machine learning automatically selects only effective model inputs and builds an optimal network model of polynomial functional nodes that minimizes a predicted squared error criterion. Using a training dataset of 1500 cases (examinees) and 45 test items, the proposed approach automatically selected only 12 items which classified an evaluation population of 500 cases with 91% accuracy. Performance is examined for various levels of model complexity and compared with that of statistical IRT-based techniques. Results indicate that the proposed approach significantly reduces the number of test items required while maintaining acceptable test quality.

Combining spatial and DCT based Markov features for enhanced blind detection of image splicing

Nowadays, it is extremely simple to manipulate the content of digital images without leaving perceptual clues due to the availability of powerful image editing tools. Image tampering can easily devastate the credibility of images as a medium for personal authentication and a record of events. With the daily upload of millions of pictures to the Internet and the move towards paperless workplaces and e-government services, it becomes essential to develop automatic tampering detection techniques with reliable results. This paper proposes an enhanced technique for blind detection of image splicing. It extracts and combines Markov features in spatial and Discrete Cosine Transform domains to detect the artifacts introduced by the tampering operation. To reduce the computational complexity due to high dimensionality, Principal Component Analysis is used to select the most relevant features. Then, an optimized support vector machine with radial-basis function kernel is built to classify the image as being tampered or authentic. The proposed technique is evaluated on a publicly available image splicing dataset using cross validation. The results showed that the proposed technique outperforms the state-of-the-art splicing detection methods.

A Pareto-based hybrid multiobjective evolutionary approach for constrained multipath traffic engineering optimization in MPLS/GMPLS networks

Abstract This paper proposes a hybrid evolutionary algorithm for solving the constrained multipath traffic engineering problem in MPLS (Multi-Protocol Label Switching) network and its extended architecture GMPLS (Generalized MPLS). Multipath traffic engineering is gaining more importance in contemporary networks. It aims to satisfy the requirements of emerging network applications while optimizing the network performance and the utilization of the available resources within the network. A formulation of this problem as a multiobjective constrained mixed-integer program, which is known to be NP-hard, is first extended. Then, we develop a hybrid heuristic algorithm based on combining linear programming with a devised Pareto-based genetic algorithm for approximating the optimal Pareto curve. A numerical example is adopted from the literature to evaluate and compare the performance of six variations of the proposed heuristic. We study the statistical significance of the results using Kruskal–Wallis nonparametric test. We also compare the results of the heuristic approach with the lexicographic weighted Chebyshev method using a variety of performance metrics.

Towards scalable rough set based attribute subset selection for intrusion detection using parallel genetic algorithm in MapReduce

Abstract Attribute subset selection based on rough sets is a crucial preprocessing step in data mining and pattern recognition to reduce the modeling complexity. To cope with the new era of big data, new approaches need to be explored to address this problem effectively. In this paper, we review recent work related to attribute subset selection in decision-theoretic rough set models. We also introduce a scalable implementation of a parallel genetic algorithm in Hadoop MapReduce to approximate the minimum reduct which has the same discernibility power as the original attribute set in the decision table. Then, we focus on intrusion detection in computer networks and apply the proposed approach on four datasets with varying characteristics. The results show that the proposed model can be a powerful tool to boost the performance of identifying attributes in the minimum reduct in large-scale decision systems.

AdaBoost-based artificial neural network learning

A boosting-based method of learning a feed-forward artificial neural network (ANN) with a single layer of hidden neurons and a single output neuron is presented. Initially, an algorithm called Boostron is described that learns a single-layer perceptron using AdaBoost and decision stumps. It is then extended to learn weights of a neural network with a single hidden layer of linear neurons. Finally, a novel method is introduced to incorporate non-linear activation functions in artificial neural network learning. The proposed method uses series representation to approximate non-linearity of activation functions, learns the coefficients of nonlinear terms by AdaBoost. It adapts the network parameters by a layer-wise iterative traversal of neurons and an appropriate reduction of the problem. A detailed performances comparison of various neural network models learned the proposed methods and those learned using the least mean squared learning (LMS) and the resilient back-propagation (RPROP) is provided in this paper. Several favorable results are reported for 17 synthetic and real-world datasets with different degrees of difficulties for both binary and multi-class problems.

Spam filtering framework for multimodal mobile communication based on dendritic cell algorithm

With the continual growth of mobile devices, they become a universal portable platform for effective business and personal communication. They enable a plethora of textual communication modes including electronic mails, instant messaging, and short messaging services. A downside of such great technology is the alarming rate of spam messages that are not only annoying to end-users but raises security concerns as well. This paper presents an intelligent framework for filtering multimodal textual communication including emails and short messages. We explore a novel methodology for information fusion inspired by the human immune system and hybrid approaches of machines learning. We study a number of methods to extract and select more relevant features to reduce the complexity of the proposed model to suite mobile applications while preserving good performance. The proposed framework is intensively evaluated on a number of benchmark datasets with remarkable results achieved. Proposed an intelligent framework for multimodal textual spam filtering for mobile devices.A novel hybrid machine learning approach and fusion with dendritic cell algorithm.Analyzed the discrimination of a rich set of content and style related features that can be easily extracted from received messages.Rigorously evaluated and benchmarked models on five email and SMS datasets using a variety of performance measures.Reduce complexity for feature extraction while preserving good performance.

Boosting paraphrase detection through textual similarity metrics with abductive networks

Graphical abstractDisplay Omitted HighlightsAnalyze a set of weak text reuse similarity metrics for paraphrase detection.Boost the performance of individual metrics using the abductive learning paradigm.Use decision-level fusion to build a committee of models of individual metrics.Use feature-level fusion to get a paraphrase detector using optimal set of metrics.Validate merits of the approach over individual metrics and other learning methods. A number of metrics have been proposed in the literature to measure text re-use between pairs of sentences or short passages. These individual metrics fail to reliably detect paraphrasing or semantic equivalence between sentences, due to the subjectivity and complexity of the task, even for human beings. This paper analyzes a set of five simple but weak lexical metrics for measuring textual similarity and presents a novel paraphrase detector with improved accuracy based on abductive machine learning. The objective here is 2-fold. First, the performance of each individual metric is boosted through the abductive learning paradigm. Second, we investigate the use of decision-level and feature-level information fusion via abductive networks to obtain a more reliable composite metric for additional performance enhancement. Several experiments were conducted using two benchmark corpora and the optimal abductive models were compared with other approaches. Results demonstrate that applying abductive learning has significantly improved the results of individual metrics and further improvement was achieved through fusion. Moreover, building simple models of polynomial functional elements that identify and integrate the smallest subset of relevant metrics yielded better results than those obtained from the support vector machine classifiers utilizing the same datasets and considered metrics. The results were also comparable to the best result reported in the literature even with larger number of more powerful features and/or using more computationally intensive techniques.

A Heuristic Approach for Firewall Policy Optimization

A primary goal of this paper is to develop a heuristic approach based on genetic algorithms to enhance the firewall performance. Typical firewall policies may have thousands of rules and determining an optimal rule order that minimizes the average number of rule comparisons while maintaining the policy integrity is proven to be NP-hard. This problem is formulated as a binary integer program for which an optimal solution is obtained using the branch-and-bound technique. Then an alternative solution approach is devised based on genetic algorithms. Several experiments are conducted to evaluate the effectiveness of the proposed approach as compared to other rule-ordering techniques. Empirical results show the potential and flexibility of the proposed approach.

Adaptive resource allocation with prioritized handoff in cellular mobile networks under QoS provisioning

In the next generation cellular mobile multimedia networks, a resource allocation policy, which prioritizes handoff requests over new calls while making efficient use of the network resources, will be an essential component for successful operation. In this paper we develop a new handoff prioritized scheme which adapts the allocation policy according to the current traffic conditions. The goal is to minimize the new call blocking while keeping the handoff failures close to a targeted objective. This problem is formulated as a constrained semi-Markov decision process (SMDP) with average cost criterion. A simulation-based learning algorithm is developed to determine a control policy from direct interaction with the network without a priori knowledge of the network dynamics or traffic. Extensive simulations test the effectiveness of the algorithm under a variety of traffic conditions. Comparisons with other resource allocation policies, such as complete sharing and channel reservation, are presented.