Adaptive Sampling and Statistical Inference for Anomaly Detection

Given the rising threat of malware and the increasing inadequacy of signature-based solutions, online performance monitoring has emerged as a critical component of the security infrastructure of data centers and networked systems. Most of the systems that require monitoring are usually large-scale, highly dynamic and time-evolving. These facts add to the complexity of both monitoring and the underlying techniques for anomaly detection. Furthermore, one cannot ignore the costs associated with monitoring and detection which can interfere with the normal operation of a system and deplete the supply of resources available for the system. Therefore, securing modern systems calls for efficient monitoring strategies and anomaly detection techniques that can deal with massive data with high efficiency and report unusual events effectively. This dissertation contributes new algorithms and implementation strategies toward a significant improvement in the effectiveness and efficiency of two components of security infrastructure: (1) system monitoring and (2) anomaly detection. For system monitoring purposes, we develop two techniques which reduce the cost associated with information collection: i) a non-sampling technique and ii) a sampling technique. The non-sampling technique is based on compression and employs the best basis algorithm to automatically select the basis for compressing the data according to the structure of the data. The sampling technique improves upon compressive sampling, a recent signal processing technique for acquiring data at low cost. This enhances the technique of compressive sampling by employing it in an adaptive-rate model wherein the sampling rate for compressive sampling is adaptively tuned to the data being sampled. Our simulation results on measurements collected from a data center show that these two data collection techniques achieve small information loss with reduced monitoring cost. The best basis algorithm can select the basis in which the data is most concisely represented, allowing a reduced sample size for monitoring. The adaptive-rate model for compressive sampling allows us to save 70% in sample size, compared with the constant-rate model. For anomaly detection, this dissertation develops three techniques to allow efficient detection of anomalies. In the first technique, we exploit the properties maintained in the samples of compressive sampling and apply state-of-the-art anomaly detection techniques directly to compressed measurements. Simulation results show that the detection rate of abrupt changes using the compressed measurements is greater than 95% when the size of the measurements is only 18%. In our second approach, we characterize performance-related measurements as a stream of covariance matrices, one for each designated window of time, and then propose a new metric to quantify changes in the covariance matrices. The observed changes are then employed to infer anomalies in the system. In our third approach, anomalies in a system are detected using a low-complexity distributed algorithm when only steams of raw measurement vectors, one for each time window, are available and distributed among multiple locations. We apply our techniques on real network traffic data and show that these two techniques furnish existing methods with more details about the anomalous changes.Ph.D., Electrical Engineering -- Drexel University, 201

Development and internal validation of a nine-lncRNA prognostic signature for prediction of overall survival in colorectal cancer patients

Background Colorectal cancer remains a serious public health problem due to the poor prognosis. In the present study, we attempted to develop and validate a prognostic signature to predict the individual mortality risk in colorectal cancer patients. Materials and Methods The original study datasets were downloaded from The Cancer Genome Atlas database. The present study finally included 424 colorectal cancer patients with wholly gene expression information and overall survival information. Results A nine-lncRNA prognostic signature was built through univariate and multivariate Cox proportional regression model. Time-dependent receiver operating characteristic curves in model cohort demonstrated that the Harrell’s concordance indexes of nine-lncRNA prognostic signature were 0.768 (95% CI [0.717–0.819]), 0.778 (95% CI [0.727–0.829]) and 0.870 (95% CI [0.819–0.921]) for 1-year, 3-year and 5-year overall survival respectively. In validation cohort, the Harrell’s concordance indexes of nine-lncRNA prognostic signature were 0.761 (95% CI [0.710–0.812]), 0.801 (95% CI [0.750–0.852]) and 0.883 (95% CI [0.832–0.934]) for 1-year, 3-year and 5-year overall survival respectively. According to the median of nine-lncRNA prognostic signature score in model cohort, 424 CRC patients could be stratified into high risk group (n = 212) and low risk group (n = 212). Kaplan–Meier survival curves showed that the overall survival rate of high risk group was significantly lower than that of low risk group (P < 0.001). Discussion The present study developed and validated a nine-lncRNA prognostic signature for individual mortality risk assessment in colorectal cancer patients. This nine-lncRNA prognostic signature is helpful to evaluate the individual mortality risk and to improve the decision making of individualized treatments in colorectal cancer patients

Evaluating Compressive Sampling Strategies for Performance Monitoring of Data Centers

Abstract-Performance monitoring of data centers provides vital information for dynamic resource provisioning, fault diagnosis, and capacity planning decisions. However, the very act of monitoring a system interferes with its performance, and if the information is transmitted to a monitoring station for analysis and logging, this consumes network bandwidth and disk space. This paper proposes a low-cost monitoring solution using compressive sampling-a technique that allows certain classes of signals to be recovered from the original measurements using far fewer samples than traditional approaches-and evaluates its ability to measure typical signals generated in a data-center setting using a testbed comprising the Trade6 enterprise application. The results open up the possibility of using low-cost compressive sampling techniques to detect performance bottlenecks and anomalies that manifest themselves as abrupt changes exceeding operatordefined threshold values in the underlying signals

A Motor-Driven and Computer Vision-Based Intelligent E-Trap for Monitoring Citrus Flies

Citrus flies are important quarantine pests in citrus plantations. Electronic traps (e-traps) based on computer vision are the most popular types of equipment for monitoring them. However, most current e-traps are inefficient and unreliable due to requiring manual operations and lack of reliable detection and identification algorithms of citrus fly images. To address these problems, this paper presents a monitoring scheme based on automatic e-traps and novel recognition algorithms. In this scheme, the prototype of an automatic motor-driven e-trap is firstly designed based on a yellow sticky trap. A motor autocontrol algorithm based on Local Binary Pattern (LBP) image analysis is proposed to automatically replace attractants in the e-trap for long-acting work. Furthermore, for efficient and reliable statistics of captured citrus flies, based on the differences between two successive sampling images of the e-trap, a simple and effective detection algorithm is presented to continuously detect the newly captured citrus flies from the collected images of the e-trap. Moreover, a Multi-Attention and Multi-Part convolutional neural Network (MAMPNet) is proposed to exploit discriminative local features of citrus fly images to recognize the citrus flies in the images. Finally, extensive simulation experiments validate the feasibility and efficiency of the designed e-trap prototype and its autocontrol algorithm, as well as the reliability and effectiveness of the proposed detection and recognition algorithms for citrus flies

Lung Ultrasound Is Accurate for the Diagnosis of High-Altitude Pulmonary Edema: A Prospective Study

Objective. The aim of this study was to assess the diagnostic accuracy of lung ultrasonography (LUS) for high-altitude pulmonary edema (HAPE). Background. LUS has proven to be a reliable tool for the diagnosis of pulmonary diseases, including pneumonia, acute respiratory distress syndrome (ARDS), and pneumothorax. LUS also has potential for the diagnosis of HAPE. However, the actual diagnostic value of LUS for HAPE is still unknown. Our objective was to determine the feasibility of using LUS for the diagnosis of HAPE. Materials and Methods. A prospective clinical research study of adult HAPE patients was conducted. LUS and chest X-ray (CXR) were performed in patients with suspected HAPE before and after treatment, and pulmonary moist rales were recorded concurrently. The diagnostic value of LUS, CXR, and moist rales for HAPE (i.e., their sensitivity, specificity, and positive and negative predictive values) were assessed, and the results were compared. The gold standard was the final diagnosis. Results. In total, 148 patients were enrolled in the study, 126 of which were diagnosed with HAPE (85.14%). Before treatment, the diagnostic accuracy of LUS for HAPE was as follows: sensitivity, 98.41% (95% confidence interval (CI) 100.60–96.23%); specificity, 90.91% (95% CI 102.92–78.90%). LUS had higher sensitivity (0.98 vs. 0.81, P<0.01 using the McNemar test) than moist rales for the diagnosis of HAPE. LUS also had higher sensitivity than CXR (0.98 vs. 0.93, P<0.05 using the McNemar test). After treatment, LUS was consistent with CXR in 96.55% of HAPE patients, and the concordance between LUS and CXR was high (k statistic = 0.483 P≤0.001; 95% CI −0.021 to −0.853). Conclusion. The results indicate that LUS is a reliable method for the diagnosis and surveillance of HAPE. This trial is registered with Chinese Clinical Trial Registry (No. ChiCTR-DDD-16009841)