Real-Time Malware Process Detection and Automated Process Killing

Perimeter-based detection is no longer sufficient for mitigating the threat posed by malicious software. This is evident as antivirus (AV) products are replaced by endpoint detection and response (EDR) products, the latter allowing visibility into live machine activity rather than relying on the AV to filter out malicious artefacts. This paper argues that detecting malware in real-time on an endpoint necessitates an automated response due to the rapid and destructive nature of some malware. The proposed model uses statistical filtering on top of a machine learning dynamic behavioural malware detection model in order to detect individual malicious processes on the fly and kill those which are deemed malicious. In an experiment to measure the tangible impact of this system, we find that fast-acting ransomware is prevented from corrupting 92% of files with a false positive rate of 14%. Whilst the false-positive rate currently remains too high to adopt this approach as-is, these initial results demonstrate the need for a detection model that is able to act within seconds of the malware execution beginning; a timescale that has not been addressed by previous work.

A proposal to measure the impact of automated response systems on meeting student learning outcomes

With the advancement of Artificial Intelligence (AI), much has been made of the use of AI in education. Central to that is the idea of an Automated Response System (ARS). Current adoption of ARS’s in education has been mainly in the realm of administrative tasks but is likely to move into the support of teaching. ARS can be used as a supplement for teaching as it provides instant feedback, and 24/7 support. Having a highly accessible, 24/7 ARS can help relieve some of the burdens placed on teachers, especially in a post COVID-19 environment, where teachers expect work to intensify, rather than simplify. In this paper we present a work-in-progress that proposes what features an ARS for education should have, how these would be useful and how these features help teachers assist students meet their learning outcomes in a holistic manner.

Conceptual Planning of Micro-Assembly for a Better Utilization of Reconfigurable Manufacturing Systems

Reconfigurable manufacturing systems (RMS) can be used to produce micro-assembled products that are too complex for assembly on flat substrates like printed circuit boards. The greatest advantage of RMS is their capability to reuse machine parts for different products, which enhances the economical efficiency of quickly changing or highly individualized products. However, often, process engineers struggle to achieve the full potential of RMS due to product designs not being suited for their given system. Guaranteeing a better fit cannot be done by static guidelines because the higher degree of freedom would make them too complex. Therefore, a new method for generating dynamic guidelines is proposed. The method consists of a model, with which designers can create a simplified assembly sequence of their product idea, and another model, with which process engineers can describe the RMS and the procedures and operations that it can offer. By combining both, a list of possible machine configurations for an RMS can be generated as an automated response for a modeled assembly sequence. With the planning tool for micro-assembly, an implementation of this method as a modern web application is shown, which uses a real existent RMS for micro-assembly.

Development of an Automated Tool for Assessing Response in Patients with Polycythemia Vera

Myeloproliferative neoplasms (MPNs) are a group of hematologic malignancies characterized by the clonal proliferation of one or more hematopoietic cell lineages demonstrated by terminal myeloid cell expansion into the peripheral blood. The most commonly diagnosed Philadelphia chromosome negative (Ph-) MPNs include essential thrombocythemia (ET), polycythemia vera (PV), and myelofibrosis (MF). Assessing various categories of response to a treatment is determined according to multiple factors, including laboratory values; transfusion dependence; degree of splenomegaly; mutational status and variant allelic frequency (VAF); cytogenetic abnormalities; and bone marrow morphological features, such as myeloblasts, fibrosis, and the volume ratio of hematopoietic stem cells in bone marrow [1]. While many of these components exist in electronic health records (EHRs), they are documented with varying degrees of structure. Some terms are recorded as tabular values, whereas others are captured purely in free text (Table 1). However, nearly all clinical trials and reviews studying patients with MPNs rely on expert adjudication of response as determined by these data points. The current process for determining response involves manual review of the patient's EHR data, an arduous task requiring extensive human effort. To alleviate these efforts, the Richard T. Silver Myeloproliferative Neoplasm Center at Weill Cornell Medicine (WCM) worked in tandem with the Architecture for Research Computing in Health (ARCH) program to develop a method for assessing response in patients with MPNs. A research data repository (RDR) containing data from both outpatient and inpatient EHRs was designed to allow for computational assessment of response. Structured data elements, including laboratory values, mutational data, and VAF, were extracted from the EHR. A natural language processing (NLP) pipeline using the Leo framework was developed [2] to extract data on cellularity, reticulin fibrosis, and myeloblast count from bone marrow biopsy pathology reports (Figure 1). Other data points, including splenomegaly and symptom burden, continue to require interpretation and manual collection by trained research personnel, who enter these data points into REDCap (Research Electronic Data Capture), a WCM-provisioned secure web application for managing clinical databases. These manual data are then pivoted and loaded into a Microsoft SQL Server environment [3]. Data generated by the MPN RDR were frequently reviewed for quality control, which drove subsequent iterations designed to minimize any identified errors. After acceptable confidence levels had been achieved, the MPN RDR was queried to provide data that were used to contribute to response assessments [1] for a retrospective review studying PV patients. Fully automated response parameters included hematocrit, platelet, and white blood cell count values; cellularity; reticulin fibrosis; and JAK2V617F VAF. Partially automated response assessments included rates of phlebotomy. Manually collected response criteria included symptom burden, degree of palpable splenomegaly, and indications of hemorrhagic/thrombotic events. Extracted data were merged with manually collected data within clinically justified temporal windows and applied to PV response criteria. The process provided valuable insight on potential modifications to the extraction process. Future steps include extending these processes to criteria still dependent on manual collection. Efforts are currently under way to apply NLP to hepatosplenomegaly and cytogenetics reports. This process will also be used to assist in response assessments for the spectrum of other MPN subtypes. While the feasibility of a fully comprehensive computable approach to assessing response in MPNs may not be entirely feasible nor even advisable, it is rather the objective that clinical data collection, which has been historically onerous, become automated to the furthest extent possible so as to allow research personnel to focus on the extraction of data elements that do require manual adjudication. Adaption of a similar workflow may help other institutions expand their ability to assess response in patients with MPNs and, potentially, additional hematologic malignancies. Disclosures No relevant conflicts of interest to declare.

Naturalistic Study of Truck Following Behavior

A baseline case was created for the following behavior of heavy-truck drivers with the use of naturalistic driving data to support the development of automated platooning. A truck platoon is a string of trucks following each other in the same lane at short distances. Grouping vehicles in platoons can increase capacity on roads, save significant fuel, reduce emissions, and potentially result in improved safety. However, these benefits can be realized only if the platoons operate in an automated, coordinated manner. Because little literature of truck following behavior exists to support the development of such truck platoons, this research focused on how closely trucks follow other vehicles on highways under various environmental conditions, how closely a truck follows a leading vehicle when other vehicles cut in between, and the safety impact of following at different headways. Findings indicate that trucks follow other vehicles at an average headway of about 2 s overall, and those headways are shorter when following a passenger car rather than a heavy truck, on state highways rather than on Interstates, in clear weather rather than in rain or snow, and during the day rather than during at night. Vehicles usually do not cut in when a truck is following another vehicle at less than 25-m (82-ft) or 1.0-s headway. For manual response times, the rear-end crash risk increases considerably at headways of less than 1.0 s; for automated response times, crash risk is almost negligible at headways as low as 0.5 s.