TY - JOUR A1 - Prasse, Paul A1 - Knaebel, Rene A1 - Machlica, Lukas A1 - Pevny, Tomas A1 - Scheffer, Tobias T1 - Joint detection of malicious domains and infected clients JF - Machine learning N2 - Detection of malware-infected computers and detection of malicious web domains based on their encrypted HTTPS traffic are challenging problems, because only addresses, timestamps, and data volumes are observable. The detection problems are coupled, because infected clients tend to interact with malicious domains. Traffic data can be collected at a large scale, and antivirus tools can be used to identify infected clients in retrospect. Domains, by contrast, have to be labeled individually after forensic analysis. We explore transfer learning based on sluice networks; this allows the detection models to bootstrap each other. In a large-scale experimental study, we find that the model outperforms known reference models and detects previously unknown malware, previously unknown malware families, and previously unknown malicious domains. KW - Machine learning KW - Neural networks KW - Computer security KW - Traffic data KW - Https traffic Y1 - 2019 U6 - https://doi.org/10.1007/s10994-019-05789-z SN - 0885-6125 SN - 1573-0565 VL - 108 IS - 8-9 SP - 1353 EP - 1368 PB - Springer CY - Dordrecht ER - TY - JOUR A1 - Laskov, Pavel A1 - Gehl, Christian A1 - Krüger, Stefan A1 - Müller, Klaus-Robert T1 - Incremental support vector learning: analysis, implementation and applications JF - Journal of machine learning research N2 - Incremental Support Vector Machines (SVM) are instrumental in practical applications of online learning. This work focuses on the design and analysis of efficient incremental SVM learning, with the aim of providing a fast, numerically stable and robust implementation. A detailed analysis of convergence and of algorithmic complexity of incremental SVM learning is carried out. Based on this analysis, a new design of storage and numerical operations is proposed, which speeds up the training of an incremental SVM by a factor of 5 to 20. The performance of the new algorithm is demonstrated in two scenarios: learning with limited resources and active learning. Various applications of the algorithm, such as in drug discovery, online monitoring of industrial devices and and surveillance of network traffic, can be foreseen. KW - incremental SVM KW - online learning KW - drug discovery KW - intrusion detection Y1 - 2006 SN - 1532-4435 VL - 7 SP - 1909 EP - 1936 PB - MIT Press CY - Cambridge, Mass. ER - TY - JOUR A1 - Steuer, Ralf A1 - Humburg, Peter A1 - Selbig, Joachim T1 - Validation and functional annotation of expression-based clusters based on gene ontology JF - BMC bioinformatics N2 - Background: The biological interpretation of large-scale gene expression data is one of the paramount challenges in current bioinformatics. In particular, placing the results in the context of other available functional genomics data, such as existing bio-ontologies, has already provided substantial improvement for detecting and categorizing genes of interest. One common approach is to look for functional annotations that are significantly enriched within a group or cluster of genes, as compared to a reference group. Results: In this work, we suggest the information-theoretic concept of mutual information to investigate the relationship between groups of genes, as given by data-driven clustering, and their respective functional categories. Drawing upon related approaches (Gibbons and Roth, Genome Research 12: 1574-1581, 2002), we seek to quantify to what extent individual attributes are sufficient to characterize a given group or cluster of genes. Conclusion: We show that the mutual information provides a systematic framework to assess the relationship between groups or clusters of genes and their functional annotations in a quantitative way. Within this framework, the mutual information allows us to address and incorporate several important issues, such as the interdependence of functional annotations and combinatorial combinations of attributes. It thus supplements and extends the conventional search for overrepresented attributes within a group or cluster of genes. In particular taking combinations of attributes into account, the mutual information opens the way to uncover specific functional descriptions of a group of genes or clustering result. All datasets and functional annotations used in this study are publicly available. All scripts used in the analysis are provided as additional files. Y1 - 2006 U6 - https://doi.org/10.1186/1471-2105-7-380 SN - 1471-2105 VL - 7 IS - 380 PB - BioMed Central CY - London ER - TY - JOUR A1 - Linke, Thomas A1 - Tompits, Hans A1 - Woltran, Stefan T1 - On Acyclic and head-cycle free nested logic programs Y1 - 2004 SN - 3-540-22671-01 ER - TY - JOUR A1 - Linke, Thomas A1 - Tompits, Hans A1 - Woltran, Stefan T1 - On acyclic and head-cycle free nested logic programs Y1 - 2004 ER - TY - JOUR A1 - Hafer, Jörg A1 - Ludwig, Joachim A1 - Schumann, Marlen T1 - Fallstudien in medialen Räumen JF - Commentarii informaticae didacticae : (CID) N2 - Ziel dieses Beitrages ist es, das didaktische Konzept Fallstudien und seine lerntheoretisch-didaktische Begründung vorzustellen. Es wird die These begründet, dass mediale Räume für die Bearbeitung von Fallstudien lernunterstützend wirken und sich in besonderer Weise für Prozesse der Lernberatung und Lernbegleitung in der Hochschule eignen. Diese These wird entlang dem lerntheoretischen Konzept der Bedeutungsräume von Studierenden in Verbindung mit den Spezifika medialer Räume entfaltet. Für den daraus entstandenen E-Learning-Ansatz Online-Fallstudien kann hier lediglich ein Ausblick gegeben werden. Y1 - 2010 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:kobv:517-opus-64431 SN - 1868-0844 SN - 2191-1940 IS - 4 SP - 93 EP - 98 PB - Universitätsverlag Potsdam CY - Potsdam ER - TY - JOUR A1 - Bordihn, Henning A1 - Fernau, Henning A1 - Holzer, Markus A1 - Manca, Vincenzo A1 - Martin-Vide, Carlos T1 - Iterated sequential transducers as language generating devices JF - Theoretical computer science N2 - Iterated finite state sequential transducers are considered as language generating devices. The hierarchy induced by the size of the state alphabet is proved to collapse to the fourth level. The corresponding language families are related to the families of languages generated by Lindenmayer systems and Chomsky grammars. Finally, some results on deterministic and extended iterated finite state transducers are established. KW - finite state sequential transducers KW - state complexity KW - Lindenmayer systems Y1 - 2006 U6 - https://doi.org/10.1016/j.tcs.2006.07.059 SN - 0304-3975 VL - 369 IS - 1 SP - 67 EP - 81 PB - Elsevier CY - Amsterdam ER - TY - JOUR A1 - Stoffel, Dominik A1 - Kunz, Wolfgang A1 - Gerber, Stefan T1 - And/Or reasoning graphs for determining prime implicants in multi-level combinational networks Y1 - 1997 ER - TY - JOUR A1 - Baier, Thomas A1 - Di Ciccio, Claudio A1 - Mendling, Jan A1 - Weske, Mathias T1 - Matching events and activities by integrating behavioral aspects and label analysis JF - Software and systems modeling N2 - Nowadays, business processes are increasingly supported by IT services that produce massive amounts of event data during the execution of a process. These event data can be used to analyze the process using process mining techniques to discover the real process, measure conformance to a given process model, or to enhance existing models with performance information. Mapping the produced events to activities of a given process model is essential for conformance checking, annotation and understanding of process mining results. In order to accomplish this mapping with low manual effort, we developed a semi-automatic approach that maps events to activities using insights from behavioral analysis and label analysis. The approach extracts Declare constraints from both the log and the model to build matching constraints to efficiently reduce the number of possible mappings. These mappings are further reduced using techniques from natural language processing, which allow for a matching based on labels and external knowledge sources. The evaluation with synthetic and real-life data demonstrates the effectiveness of the approach and its robustness toward non-conforming execution logs. KW - Process mining KW - Event mapping KW - Business process intelligence KW - Constraint satisfaction KW - Declare KW - Natural language processing Y1 - 2018 U6 - https://doi.org/10.1007/s10270-017-0603-z SN - 1619-1366 SN - 1619-1374 VL - 17 IS - 2 SP - 573 EP - 598 PB - Springer CY - Heidelberg ER - TY - JOUR A1 - Przybylla, Mareen A1 - Romeike, Ralf T1 - Empowering learners with tools in CS education BT - physical computing in secondary schools JF - it - Information Technology N2 - In computer science, computer systems are both, objects of investigation and tools that enable creative learning and design. Tools for learning have a long tradition in computer science education. Already in the late 1960s, Papert developed a concept which had an immense impact on the development of informal education in the following years: his theory of constructionism understands learning as a creative process of knowledge construction that is most effective when learners create something purposeful that they can try out, show around, discuss, analyse and receive praise for. By now, there are numerous learning and programming environments that are based on the constructionist ideas. Modern tools offer opportunities for students to learn in motivating ways and gain impressive results in programming games, animations, implementing 3D models or developing interactive objects. This article gives an overview of computer science education research related to tools and media to be used in educational settings. We analyse different types of tools with a special focus on the categorization and development of tools for student adequate physical computing activities in the classroom. Research around the development and evaluation of tools and learning resources in the domain of physical computing is illustrated with the example of "My Interactive Garden", a constructionist learning and programming environment. It is explained how the results from empirical studies are integrated in the continuous development of the learning material. KW - tools KW - media KW - resources KW - computer science education KW - physical computing Y1 - 2018 U6 - https://doi.org/10.1515/itit-2017-0032 SN - 1611-2776 SN - 2196-7032 VL - 60 IS - 2 SP - 91 EP - 101 PB - De Gruyter CY - Berlin ER -