Gil Tahan

Distributed, intelligent, interactive visualization and exploration of time-oriented clinical data and their abstractions

OBJECTIVES We present KNAVE-II, an intelligent interface to a distributed architecture specific to the tasks of query, knowledge-based interpretation, summarization, visualization, interactive exploration of large numbers of distributed time-oriented clinical data, and dynamic sensitivity analysis of these data. KNAVE-II main contributions to the fields of temporal reasoning and intelligent user interfaces are: (1) the capability for interactive computation and visualization of domain specific temporal abstractions, supported by ALMA--a computational engine that applies the domain knowledge base to the clinical time-oriented database. (2) Semantic (ontology-based) navigation and exploration of the data, knowledge, and temporal abstractions, supported by the IDAN mediator, a distributed architecture that enables runtime access to domain-specific knowledge bases that are maintained by expert physicians. METHODS AND MATERIALS KNAVE-II was designed according to 12 requirements that were defined through iterative cycles of design and user-centered evaluation. The complete architecture has been implemented and evaluated in a cross-over study design that compared the KNAVE-II module versus two existing methods: paper charts and an Excel electronic spreadsheet. A small group of clinicians answered the same queries, using the domain of oncology and a set of 1000 patients followed after bone-marrow transplantation. RESULTS The results show that users are able to perform medium to hard difficulty level queries faster and more accurately by using KNAVE-II than paper charts and Excel. Moreover, KNAVE-II was ranked first in preference by all users, along all usability dimensions. CONCLUSIONS Initial evaluation of KNAVE-II and its supporting knowledge based temporal-mediation architecture, by applying it to a large data base of patients monitored several years after bone marrow transplantation (BMT), has produced highly encouraging results.

Applying Machine Learning Techniques for Detection of Malicious Code in Network Traffic

The Early Detection, Alert and Response (eDare) system is aimed at purifying Web traffic propagating via the premises of Network Service Providers (NSP) from malicious code. To achieve this goal, the system employs powerful network traffic scanners capable of cleaning traffic from known malicious code. The remaining traffic is monitored and Machine Learning (ML) algorithms are invoked in an attempt to pinpoint unknown malicious code exhibiting suspicious morphological patterns. Decision trees, Neural Networks and Bayesian Networks are used for static code analysis in order to determine whether a suspicious executable file actually inhabits malicious code. These algorithms are being evaluated and preliminary results are encouraging.

KNAVE II: the definition and implementation of an intelligent tool for visualization and exploration of time-oriented clinical data

KNAVE-II is an intelligent interface to a distributed web-based architecture that enables users (e.g., physicians) to query, visualize and explore clinical time-oriented databases. Based on prior studies, we have defined a set of requirements for provision of a service for interactive exploration of time oriented clinical data. The main requirements include the visualization, interactive exploration and explanation of both raw data and multiple levels of concepts abstracted from these data; the exploration of clinical data at different levels of temporal granularity along both absolute (calendar-based) and relative (clinically meaningful) time-lines; the exploration and dynamic visualization of the effects of simulated hypothetical modifications of raw data on the derived concepts; and the provision of generic services (such as statistics, documentation, fast search and retrieval of clinically significant concepts, amongst others). KNAVE-II has been implemented and is currently evaluated by expert clinicians in several medical domains, such as oncology, involving monitoring of chronic patients.

Auto-Sign: an automatic signature generator for high-speed malware filtering devices

This research proposes a novel automatic method (termed Auto-Sign) for extracting unique signatures of malware executables to be used by high-speed malware filtering devices based on deep-packet inspection and operating in real-time. Contrary to extant string and token-based signature generation methods, we implemented Auto-Sign an automatic signature generation method that can be used on large-size malware by disregarding signature candidates which appear in benign executables. Results from experimental evaluation of the proposed method suggest that picking a collection of executables which closely represents commonly used code, plays a key role in achieving highly specific signatures which yield low false positives.

Simulating Threats Propagation within the NSP Infrastructure

Threats such as computer worms, Spyware and Trojans account for more than 10% of the total traffic of a network service providers (NSP). The NSP traffic can be monitored and cleaned by distributed network intrusion detection system (DNIDS) that may be deployed on the NSP routers/links. In this study we choose which routers/links to protect based on group betweenness centrality index that is used as a measure of their collaborative influence on the communication in the NSP infrastructure. During the current study we developed a framework aimed at slowing down or even preventing the propagation of known threats. In the first part of the framework the influential group of routers/links has to be located. In the second part we analyze parallel propagation of multiple types of threats in the NSP infrastructure using the susceptible infective removed model of epidemic propagation.