Deep Learning for Imbalanced Data

• 
  ConvMOS: climate model output statistics with deep learning. Steininger, Michael; Abel, Daniel; Ziegler, Katrin; Krause, Anna; Paeth, Heiko; Hotho, Andreas. In Data Mining and Knowledge Discovery, 37(1), pp. 136–166. 2023.
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  Climate models are the tool of choice for scientists researching climate change. Like all models they suffer from errors, particularly systematic and location-specific representation errors. One way to reduce these errors is model output statistics (MOS) where the model output is fitted to observational data with machine learning. In this work, we assess the use of convolutional Deep Learning climate MOS approaches and present the ConvMOS architecture which is specifically designed based on the observation that there are systematic and location-specific errors in the precipitation estimates of climate models. We apply ConvMOS models to the simulated precipitation of the regional climate model REMO, showing that a combination of per-location model parameters for reducing location-specific errors and global model parameters for reducing systematic errors is indeed beneficial for MOS performance. We find that ConvMOS models can reduce errors considerably and perform significantly better than three commonly used MOS approaches and plain ResNet and U-Net models in most cases. Our results show that non-linear MOS models underestimate the number of extreme precipitation events, which we alleviate by training models specialized towards extreme precipitation events with the imbalanced regression method DenseLoss. While we consider climate MOS, we argue that aspects of ConvMOS may also be beneficial in other domains with geospatial data, such as air pollution modeling or weather forecasts.

  @article{steininger2023convmos, abstract = {Climate models are the tool of choice for scientists researching climate change. Like all models they suffer from errors, particularly systematic and location-specific representation errors. One way to reduce these errors is model output statistics (MOS) where the model output is fitted to observational data with machine learning. In this work, we assess the use of convolutional Deep Learning climate MOS approaches and present the ConvMOS architecture which is specifically designed based on the observation that there are systematic and location-specific errors in the precipitation estimates of climate models. We apply ConvMOS models to the simulated precipitation of the regional climate model REMO, showing that a combination of per-location model parameters for reducing location-specific errors and global model parameters for reducing systematic errors is indeed beneficial for MOS performance. We find that ConvMOS models can reduce errors considerably and perform significantly better than three commonly used MOS approaches and plain ResNet and U-Net models in most cases. Our results show that non-linear MOS models underestimate the number of extreme precipitation events, which we alleviate by training models specialized towards extreme precipitation events with the imbalanced regression method DenseLoss. While we consider climate MOS, we argue that aspects of ConvMOS may also be beneficial in other domains with geospatial data, such as air pollution modeling or weather forecasts.}, author = {Steininger, Michael and Abel, Daniel and Ziegler, Katrin and Krause, Anna and Paeth, Heiko and Hotho, Andreas}, journal = {Data Mining and Knowledge Discovery}, keywords = {author:KRAUSE}, number = 1, pages = {136–166}, title = {ConvMOS: climate model output statistics with deep learning}, volume = 37, year = 2023 }
• 
  Automatic Speech Detection on a Smart Beehive’s Raspberry Pi. Janetzky, Pascal; Lissmann, Philipp; Hotho, Andreas; Krause, Anna. In LWDA 2023 - Learning, Knowledge, Data, and Analysis. 2023.
  • [ BibTeX ]
  • [ Download ]
  @inproceedings{janetzky2023automatic, author = {Janetzky, Pascal and Lissmann, Philipp and Hotho, Andreas and Krause, Anna}, booktitle = {LWDA 2023 - Learning, Knowledge, Data, and Analysis}, keywords = {author:LISSMANN}, title = {Automatic Speech Detection on a Smart Beehive's Raspberry Pi}, year = 2023 }
• 
  Swarming Detection in Smart Beehives Using Auto Encoders for Audio Data. Janetzky, Pascal; Schaller, Melanie; Krause, Anna; Hotho, Andreas. In 2023 30th International Conference on Systems, Signals and Image Processing (IWSSIP), pp. 1–5. 2023.
  • [ BibTeX ]
  • [ Download ]
  @inproceedings{10180253, author = {Janetzky, Pascal and Schaller, Melanie and Krause, Anna and Hotho, Andreas}, booktitle = {2023 30th International Conference on Systems, Signals and Image Processing (IWSSIP)}, keywords = {author:KRAUSE}, pages = {1-5}, title = {Swarming Detection in Smart Beehives Using Auto Encoders for Audio Data}, year = 2023 }

• 
  Open ERP System Data For Occupational Fraud Detection. Tritscher, Julian; Gwinner, Fabian; Schlör, Daniel; Krause, Anna; Hotho, Andreas. In arxiv. 2022.
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  @article{tritscher2022erpData, author = {Tritscher, Julian and Gwinner, Fabian and Schlör, Daniel and Krause, Anna and Hotho, Andreas}, journal = {arxiv}, keywords = {author:hotho}, title = {Open ERP System Data For Occupational Fraud Detection}, year = 2022 }
• 
  Detecting Anomalies in Transaction Data. Technical Report (PhD dissertation), . Schlör, Daniel. PhD dissertation. Universität Würzburg, 2022.
  • [ BibTeX ]
  • [ Download ]
  @phdthesis{Schloer2022, author = {Schlör, Daniel}, keywords = {from:daschloer}, school = {Universität Würzburg}, title = {Detecting Anomalies in Transaction Data}, type = {Doctoral Thesis}, year = 2022 }
• 
  A sensor-driven approach for analyzing a beehive’s state. Davidson, Padraig; Hotho, Andreas; Krause, Anna. 2022.
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  Assessing a colony’s state is one of the key components in apiculture. In recent years precision apiculture has emerged as a field of study to quantify the analysis of beehives with objective sensors (e.g. temperature within the beehive). One objective of analysis is the study of semantically consecutive time spans, sometimes covering several months. A common task for example could be detecting the different breeding periods in a year. A change in semantics is called a change point, which can be detected by rule-based knowledge (for example from the beekeeper), or an automated procedure called change point detection (CPD). Detecting the onset of succinct periods enables the beekeeper to provide specific care for each period. Within these longer time spans, short term events can occur, mostly specific to the semantic context. For example swarming can only occur in the summer breed rearing period. On the other hand, the death of a colony is more likely to happen during the winter seasons. These events are also known as anomalies, as they deviate from the expected normal behavior during that time span. Like for CPD, anomalies can be detected via certain rules, or automatically detected using an anomaly detection algorithm. In this study we investigate the use of machine learning algorithms to analyze a beehive’s state. With the data from multiple precision apiculture projects (BeeConnected, we4bee, HOBOS), we evaluate different algorithms to this end. This also enables us to not only study behavior at different locations but also with different sensor setups. We study the usage of single and multiple temperature sensors, but also integrate a scale for our purposes, and evaluate which combination of sensors yields the best results from an algorithmic standpoint. Besides quality of detection, we can also assess the applicability of specific sensors for beekeepers, keeping ease of use in mind. We hope our studies support beekeepers to gain new insight into their colonies for a better understanding. This also creates a feedback loop with the algorithms to improve prediction quality in the future.

  @presentation{davidson2022sensordriven, abstract = {Assessing a colony’s state is one of the key components in apiculture. In recent years precision apiculture has emerged as a field of study to quantify the analysis of beehives with objective sensors (e.g. temperature within the beehive). One objective of analysis is the study of semantically consecutive time spans, sometimes covering several months. A common task for example could be detecting the different breeding periods in a year. A change in semantics is called a change point, which can be detected by rule-based knowledge (for example from the beekeeper), or an automated procedure called change point detection (CPD). Detecting the onset of succinct periods enables the beekeeper to provide specific care for each period. Within these longer time spans, short term events can occur, mostly specific to the semantic context. For example swarming can only occur in the summer breed rearing period. On the other hand, the death of a colony is more likely to happen during the winter seasons. These events are also known as anomalies, as they deviate from the expected normal behavior during that time span. Like for CPD, anomalies can be detected via certain rules, or automatically detected using an anomaly detection algorithm. In this study we investigate the use of machine learning algorithms to analyze a beehive’s state. With the data from multiple precision apiculture projects (BeeConnected, we4bee, HOBOS), we evaluate different algorithms to this end. This also enables us to not only study behavior at different locations but also with different sensor setups. We study the usage of single and multiple temperature sensors, but also integrate a scale for our purposes, and evaluate which combination of sensors yields the best results from an algorithmic standpoint. Besides quality of detection, we can also assess the applicability of specific sensors for beekeepers, keeping ease of use in mind. We hope our studies support beekeepers to gain new insight into their colonies for a better understanding. This also creates a feedback loop with the algorithms to improve prediction quality in the future.}, author = {Davidson, Padraig and Hotho, Andreas and Krause, Anna}, keywords = {bee_connected}, title = {A sensor-driven approach for analyzing a beehive’s state}, year = 2022 }
• 
  Semi-unsupervised Learning for Time Series Classification. Davidson, Padraig; Steininger, Michael; Huhn, André; Krause, Anna; Hotho, Andreas. In Milets@KDD. arXiv, 2022.
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  Time series are ubiquitous and therefore inherently hard to analyze and ultimately to label or cluster. With the rise of the Internet of Things (IoT) and its smart devices, data is collected in large amounts any given second. The collected data is rich in information, as one can detect accidents (e.g. cars) in real time, or assess injury/sickness over a given time span (e.g. health devices). Due to its chaotic nature and massive amounts of datapoints, timeseries are hard to label manually. Furthermore new classes within the data could emerge over time (contrary to e.g. handwritten digits), which would require relabeling the data. In this paper we present SuSL4TS, a deep generative Gaussian mixture model for semi-unsupervised learning, to classify time series data. With our approach we can alleviate manual labeling steps, since we can detect sparsely labeled classes (semi-supervised) and identify emerging classes hidden in the data (unsupervised). We demonstrate the efficacy of our approach with established time series classification datasets from different domains.

  @article{davidson2022semiunsupervised, abstract = {Time series are ubiquitous and therefore inherently hard to analyze and ultimately to label or cluster. With the rise of the Internet of Things (IoT) and its smart devices, data is collected in large amounts any given second. The collected data is rich in information, as one can detect accidents (e.g. cars) in real time, or assess injury/sickness over a given time span (e.g. health devices). Due to its chaotic nature and massive amounts of datapoints, timeseries are hard to label manually. Furthermore new classes within the data could emerge over time (contrary to e.g. handwritten digits), which would require relabeling the data. In this paper we present SuSL4TS, a deep generative Gaussian mixture model for semi-unsupervised learning, to classify time series data. With our approach we can alleviate manual labeling steps, since we can detect sparsely labeled classes (semi-supervised) and identify emerging classes hidden in the data (unsupervised). We demonstrate the efficacy of our approach with established time series classification datasets from different domains.}, author = {Davidson, Padraig and Steininger, Michael and Huhn, André and Krause, Anna and Hotho, Andreas}, journal = {Milets@KDD}, keywords = {timeseries-classification}, publisher = {arXiv}, title = {Semi-unsupervised Learning for Time Series Classification}, year = 2022 }

• 
  Density-based weighting for imbalanced regression. Steininger, Michael; Kobs, Konstantin; Davidson, Padraig; Krause, Anna; Hotho, Andreas. In Machine Learning, A. Appice; S. Escalera; J. A. Gamez; H. Trautmann (eds.). 2021.
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  In many real world settings,imbalanced data impedes model performance of learning algorithms, like neural networks, mostly for rare cases. This is especially problematic for tasks focusing on these rare occurrences. For example, when estimating precipitation, extreme rainfall events are scarce but important considering their potential consequences. While there are numerous well studied solutions for classification settings, most of them cannot be applied to regression easily. Of the few solutions for regression tasks, barely any have explored cost-sensitive learning which is known to have advantages compared to sampling-based methods in classification tasks. In this work, we propose a sample weighting approach for imbalanced regression datasets called DenseWeight and a cost-sensitive learning approach for neural network regression with imbalanced data called DenseLoss based on our weighting scheme. DenseWeight weights data points according to their target value rarities through kernel density estimation (KDE). DenseLoss adjusts each data point’s influence on the loss according to DenseWeight, giving rare data points more influence on modeltraining compared to common data points. We show on multiple differently distributed datasets that DenseLoss significantly improves model performance for rare data points through its density-based weighting scheme. Additionally, we compare DenseLoss to the state-of-the-art method SMOGN, finding that our method mostly yields better performance. Our approach provides more control over model training as it enables us to actively decide on the trade-off between focusing on common or rare cases through a single hyperparameter, allowing the training of better models for rare data points.

  @article{steininger2021densitybased, abstract = {In many real world settings,imbalanced data impedes model performance of learning algorithms, like neural networks, mostly for rare cases. This is especially problematic for tasks focusing on these rare occurrences. For example, when estimating precipitation, extreme rainfall events are scarce but important considering their potential consequences. While there are numerous well studied solutions for classification settings, most of them cannot be applied to regression easily. Of the few solutions for regression tasks, barely any have explored cost-sensitive learning which is known to have advantages compared to sampling-based methods in classification tasks. In this work, we propose a sample weighting approach for imbalanced regression datasets called DenseWeight and a cost-sensitive learning approach for neural network regression with imbalanced data called DenseLoss based on our weighting scheme. DenseWeight weights data points according to their target value rarities through kernel density estimation (KDE). DenseLoss adjusts each data point’s influence on the loss according to DenseWeight, giving rare data points more influence on modeltraining compared to common data points. We show on multiple differently distributed datasets that DenseLoss significantly improves model performance for rare data points through its density-based weighting scheme. Additionally, we compare DenseLoss to the state-of-the-art method SMOGN, finding that our method mostly yields better performance. Our approach provides more control over model training as it enables us to actively decide on the trade-off between focusing on common or rare cases through a single hyperparameter, allowing the training of better models for rare data points.}, author = {Steininger, Michael and Kobs, Konstantin and Davidson, Padraig and Krause, Anna and Hotho, Andreas}, editor = {Appice, Annalisa and Escalera, Sergio and Gamez, Jose A. and Trautmann, Heike}, journal = {Machine Learning}, keywords = {selected}, title = {Density-based weighting for imbalanced regression}, year = 2021 }
• 
  A financial game with opportunities for fraud. Tritscher, Julian; Krause, Anna; Schlör, Daniel; Gwinner, Fabian; Von Mammen, Sebastian; Hotho, Andreas. In 2021 IEEE Conference on Games (CoG), pp. 1–5. 2021.
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  @inproceedings{Tritscher:2021aa, author = {Tritscher, Julian and Krause, Anna and Schlör, Daniel and Gwinner, Fabian and Von Mammen, Sebastian and Hotho, Andreas}, booktitle = {2021 IEEE Conference on Games (CoG)}, keywords = {from:daschloer}, pages = {1-5}, title = {A financial game with opportunities for fraud}, year = 2021 }
• 
  A financial game with opportunities for fraud. Tritscher, Julian; Krause, Anna; Schl"o}r, Daniel; Gwinner, Fabian; von Mammen, Sebastian; Hotho, Andreas. In IEE COG 2021, 2021. 2021.
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  Even though companies store large amounts of business data in enterprise resource planning (ERP) systems, obtaining data for financial fraud detection is prohibitively difficult due to privacy concerns and companies protecting trade secrets. One possible solution is game-based generation of synthetic ERP data, which poses the challenge of designing an environment that generates realistic ERP data and allows players to commit many different types of fraud. In this work, we design a multiplayer game that allows players to cooperatively run a fictional company, while simultaneously challenging them to maximize their personal gain. We introduce an approach for letting players explore fraud scenarios through emergent gameplay and present a prototype that may be primed with information from real world ERP systems to generate realistic data.

  @article{tritscherfinancial, abstract = {Even though companies store large amounts of business data in enterprise resource planning (ERP) systems, obtaining data for financial fraud detection is prohibitively difficult due to privacy concerns and companies protecting trade secrets. One possible solution is game-based generation of synthetic ERP data, which poses the challenge of designing an environment that generates realistic ERP data and allows players to commit many different types of fraud. In this work, we design a multiplayer game that allows players to cooperatively run a fictional company, while simultaneously challenging them to maximize their personal gain. We introduce an approach for letting players explore fraud scenarios through emergent gameplay and present a prototype that may be primed with information from real world ERP systems to generate realistic data.}, author = {Tritscher, Julian and Krause, Anna and Schl{\"o}r, Daniel and Gwinner, Fabian and von Mammen, Sebastian and Hotho, Andreas}, journal = {IEE COG 2021}, keywords = {research_imbalanced_data}, title = {A financial game with opportunities for fraud}, volume = 2021, year = 2021 }
• 
  Semi-unsupervised Learning: An In-depth Parameter Analysis. Davidson, Padraig; Buckermann, Florian; Steininger, Michael; Krause, Anna; Hotho, Andreas. In KI 2021: Advances in Artificial Intelligence, S. Edelkamp, R. M"o}ller, E. Rueckert (eds.), pp. 51–66. Springer International Publishing, Cham, 2021.
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  Creating datasets for supervised learning is a very challenging and expensive task, in which each input example has to be annotated with its expected output (e.g. object class). By combining unsupervised and semi-supervised learning, semi-unsupervised learning proposes a new paradigm for partially labeled datasets with additional unknown classes. In this paper we focus on a better understanding of this new learning paradigm and analyze the impact of the amount of labeled data, the number of augmented classes and the selection of hidden classes on the quality of prediction. Especially the number of augmented classes highly influences classification accuracy, which needs tuning for each dataset, since too few and too many augmented classes are detrimental to classifier performance. We also show that we can improve results on a large variety of datasets when using convolutional networks as feature extractors while applying output driven entropy regularization instead of a simple weight based L2 norm.

  @inproceedings{10.1007/978-3-030-87626-5_5, abstract = {Creating datasets for supervised learning is a very challenging and expensive task, in which each input example has to be annotated with its expected output (e.g. object class). By combining unsupervised and semi-supervised learning, semi-unsupervised learning proposes a new paradigm for partially labeled datasets with additional unknown classes. In this paper we focus on a better understanding of this new learning paradigm and analyze the impact of the amount of labeled data, the number of augmented classes and the selection of hidden classes on the quality of prediction. Especially the number of augmented classes highly influences classification accuracy, which needs tuning for each dataset, since too few and too many augmented classes are detrimental to classifier performance. We also show that we can improve results on a large variety of datasets when using convolutional networks as feature extractors while applying output driven entropy regularization instead of a simple weight based L2 norm.}, address = {Cham}, author = {Davidson, Padraig and Buckermann, Florian and Steininger, Michael and Krause, Anna and Hotho, Andreas}, booktitle = {KI 2021: Advances in Artificial Intelligence}, editor = {Edelkamp, Stefan and M{\"o}ller, Ralf and Rueckert, Elmar}, keywords = {author:hotho}, pages = {51–66}, publisher = {Springer International Publishing}, title = {Semi-unsupervised Learning: An In-depth Parameter Analysis}, year = 2021 }
• 
  Malware detection on windows audit logs using LSTMs. Ring, Markus; Schlör, Daniel; Wunderlich, Sarah; Landes, Dieter; Hotho, Andreas. In Computers & Security, 109, p. 102389. 2021.
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  Malware is a constant threat and is continuously evolving. Security systems try to keep up with the constant change. One challenge that arises is the large amount of logs generated on an operating system and the need to clarify which information contributes to the detection of possible malware. This work aims at the detection of malware using neural networks based on Windows audit log events. Neural networks can only process continuous data, but Windows audit logs are sequential and textual data. To address these challenges, we extract features out of the audit log events and use LSTMs to capture sequential effects. We create different subsets of features and analyze the effects of additional information. Features describe for example the action-type of windows audit log events, process names or target files that are accessed. Textual features are represented either as one-hot encoding or embedding representation, for which we compare three different approaches for representation learning. Effects of different feature subsets and representations are evaluated on a publicly available data set. Results indicate that using additional information improves the performance of the LSTM-model. While different representations lead to similar classification results, analysis of the latent space shows differences more precisely where FastText seems to be the most promising representation.

  @article{RING2021102389, abstract = {Malware is a constant threat and is continuously evolving. Security systems try to keep up with the constant change. One challenge that arises is the large amount of logs generated on an operating system and the need to clarify which information contributes to the detection of possible malware. This work aims at the detection of malware using neural networks based on Windows audit log events. Neural networks can only process continuous data, but Windows audit logs are sequential and textual data. To address these challenges, we extract features out of the audit log events and use LSTMs to capture sequential effects. We create different subsets of features and analyze the effects of additional information. Features describe for example the action-type of windows audit log events, process names or target files that are accessed. Textual features are represented either as one-hot encoding or embedding representation, for which we compare three different approaches for representation learning. Effects of different feature subsets and representations are evaluated on a publicly available data set. Results indicate that using additional information improves the performance of the LSTM-model. While different representations lead to similar classification results, analysis of the latent space shows differences more precisely where FastText seems to be the most promising representation.}, author = {Ring, Markus and Schlör, Daniel and Wunderlich, Sarah and Landes, Dieter and Hotho, Andreas}, journal = {Computers & Security}, keywords = {author:hotho}, pages = 102389, title = {Malware detection on windows audit logs using LSTMs}, volume = 109, year = 2021 }
• 
  Detecting Presence Of Speech In Acoustic Data Obtained From Beehives. Janetzky, Pascal; Davidson, Padraig; Steininger, Michael; Krause, Anna; Hotho, Andreas. In DCASE Workshop. 2021.
  • [ BibTeX ]
  • [ Download ]
  @article{janetzkydetecting, author = {Janetzky, Pascal and Davidson, Padraig and Steininger, Michael and Krause, Anna and Hotho, Andreas}, journal = {DCASE Workshop}, keywords = {from:msteininger}, title = {Detecting Presence Of Speech In Acoustic Data Obtained From Beehives}, year = 2021 }
• 
  Anomaly Detection in Beehives: An Algorithm Comparison. Davidson, Padraig; Steininger, Michael; Lautenschlager, Florian; Krause, Anna; Hotho, Andreas. In International Conference on Sensor Networks, Vol. 1674 of Communications in Computer and Information Science, A. Ahrens, R. Prasad, C. Benavente-Peces, N. Ansari (eds.), pp. 1–20. Springer, 2021.
  • [ BibTeX ]
  • [ Download ]
  @inproceedings{davidson2021anomaly, author = {Davidson, Padraig and Steininger, Michael and Lautenschlager, Florian and Krause, Anna and Hotho, Andreas}, booktitle = {International Conference on Sensor Networks}, editor = {Ahrens, A. and Prasad, R.V. and Benavente-Peces, C. and Ansari, N.}, keywords = {author:hotho}, pages = {1–20}, publisher = {Springer}, series = {Communications in Computer and Information Science}, title = {Anomaly Detection in Beehives: An Algorithm Comparison}, volume = 1674, year = 2021 }
• 
  Detecting Presence Of Speech In Acoustic Data Obtained From Beehives. Janetzky, Pascal; Davidson, Padraig; Steininger, Michael; Krause, Anna; Hotho, Andreas. In DCASE, pp. 26–30. 2021.
  • [ BibTeX ]
  • [ Download ]
  @inproceedings{janetzky2021detecting, author = {Janetzky, Pascal and Davidson, Padraig and Steininger, Michael and Krause, Anna and Hotho, Andreas}, booktitle = {DCASE}, keywords = {author:KRAUSE}, pages = {26–30}, title = {Detecting Presence Of Speech In Acoustic Data Obtained From Beehives.}, year = 2021 }

• 
  Smartwatch-Derived Data and Machine Learning Algorithms Estimate Classes of Ratings of Perceived Exertion in Runners: A Pilot Study. Davidson, Padraig; Düking, Peter; Zinner, Christoph; Sperlich, Billy; Hotho, Andreas. In Sensors, 20(9). 2020.
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  @article{davidson2020smartwatchderived, author = {Davidson, Padraig and Düking, Peter and Zinner, Christoph and Sperlich, Billy and Hotho, Andreas}, journal = {Sensors}, keywords = {timeseries-classification}, month = {05}, number = 9, title = {Smartwatch-Derived Data and Machine Learning Algorithms Estimate Classes of Ratings of Perceived Exertion in Runners: A Pilot Study}, volume = 20, year = 2020 }
• 
  Financial Fraud Detection with Improved Neural Arithmetic Logic Units. Schlör, Daniel; Ring, Markus; Krause, Anna; Hotho, Andreas. Vol. Fifth Workshop on MIning DAta for financial applicationS. 2020.
  • [ BibTeX ]
  • [ Download ]
  @proceedings{schlr2020financial, author = {Schlör, Daniel and Ring, Markus and Krause, Anna and Hotho, Andreas}, keywords = {inalu}, number = 5, title = {Financial Fraud Detection with Improved Neural Arithmetic Logic Units}, volume = {Fifth Workshop on MIning DAta for financial applicationS}, year = 2020 }

• 
  Flow-based network traffic generation using Generative Adversarial Networks. Ring, Markus; Schlör, Daniel; Landes, Dieter; Hotho, Andreas. In Computers & Security, 82, pp. 156–172. 2019.
  • [ Abstract ]
  • [ BibTeX ]
  • [ URL ]
  • [ Download ]
  Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.

  @article{RING2019156, abstract = {Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.}, author = {Ring, Markus and Schlör, Daniel and Landes, Dieter and Hotho, Andreas}, journal = {Computers & Security}, keywords = {selected}, pages = {156 - 172}, title = {Flow-based network traffic generation using Generative Adversarial Networks}, volume = 82, year = 2019 }