Detecting intrusions in large networks is a highly demanding task. In order to reduce the computation demand of analysing every single packet travelling along one of such networks, some years ago flows were proposed as a way of summarizing traffic information. Very few research works have addressed intrusion detection in flows from a visualizations perspective. In order to bridge this gap, the present paper proposes the application of a novel projection method (Beta Hebbian Learning) under this framework. With the aim (...) to validate this method, 8 traffic segments, containing many flows, have been analysed by means of this projection method. The promising results obtained for these segments, extracted from the University of Twente dataset, validate the proposed application. (shrink)

As it is well known, mobile phones have become a basic gadget for any individual that usually stores sensitive information. This mainly motivates the increase in the number of attacks aimed at jeopardizing smartphones, being an extreme concern above all on Android OS, which is the most popular platform in the market. Consequently, a strong effort has been devoted for mitigating mentioned incidents in recent years, even though few researchers have addressed the application of visualization techniques for the analysis of (...) malware. Within this field, the present work proposes the extension of a new technique called Hybrid Unsupervised Exploratory Plots to visualize Android malware datasets. More precisely, the novel Beta-Hebbian Learning (BHL) method is applied for the first time and validated under the frame of Hybrid Unsupervised Exploratory Plots, in conjunction with clustering methods. The informative visualization achieved provides a picture of the structure of the malware families, allowing subsequent analysis of their organization. To validate the Hybrid Unsupervised Exploratory Plot extension and its tuning, the popular Android Malware Genome dataset has been used in the experimental setting. Promising results have been obtained, suggesting that BHL applied in combination with clustering techniques in Hybrid Unsupervised Exploratory Plots are a viable resource for the visualization of malware families. (shrink)

There is much effort nowadays to protect communication networks against different cybersecurity attacks (which are more and more sophisticated) that look for systems’ vulnerabilities they could exploit for malicious purposes. Network Intrusion Detection Systems (NIDSs) are popular tools to detect and classify such attacks, most of them based on ML models. However, ML-based NIDSs cannot be trained by feeding them with network traffic data as it is. Thus, a Feature Engineering (FE) process plays a crucial role transforming network traffic raw (...) data onto derived one suitable for ML models. In this work, we study the effects of applying one such FE technique in different ways on the performance of two ML models (linear and non-linear) and their selected features. This the Feature as a Counter approach. The derived observations are computed from either with the same number of raw samples, (batch-based approaches) or by aggregating them by time intervals (timestamp-based approach). Results show that there is no significant differences between the proposed approaches neither in the performance of the models nor in the selected features that validate our proposal making it feasible to be widely used as a standard FE method. (shrink)

The Air Quality Index (AQI) shows the state of air pollution in a unique and more understandable way. This work aims to forecast the AQI in Algeciras (Spain) 8 hours in advance. The AQI is calculated indirectly through the predicted concentrations of five pollutants (O3, NO2, CO, SO2 and PM10) to achieve this goal. Artificial neural networks (ANNs), sequence-to-sequence long short-term memory networks (LSTMs) and a newly proposed method combing a rolling window with the latter (LSTMNA) are employed as the (...) forecasting techniques. Besides, two input approaches are evaluated: using only the data from the own time series of the pollutant in the first case or adding exogenous variables in the second one. Several window sizes are employed (24, 28 and 72 hours) with ANNs and LSTMNAs. Additionally, several feature ranking methods are applied in the exogenous approach to select the most relevant lagged variables to feed the models. Results show how the proposed exogenous approach increases the performance of the prediction models. Besides, the newly proposed method LSTMNA provides the best performances in most of the cases evaluated. Hence, it constitutes an exciting alternative to standard LSTMs and ANNs to predict pollutants concentrations and, consequently, the AQI. (shrink)