dataesr/scientific-paragraphs-categorization huggingface dataset:
Discussion Fundamental properties of IoT devices that affect blockchain adoption include their limited computation power and network reachability. It is an absolute requirement for a blockchain solution to be resilient to network discontinuations for an IoT deployment. Considering the cyberattacks IoT devices face from the public internet, the fundamental property of network resiliency becomes a required feature. In a mission-critical setup, such as cyber-physical deployment which usually has its intranet, can leverage a lot from an ideal offline blockchain. In this case, the IoT devices can carry their operations normally within an enclaved/isolated network and rapidly synchronize their data to the public blockchain or a larger trustful group of nodes. We show in this paper that the existing provisions in the IOTA blockchain provide quite limited aid to offline devices that want to synchronize their data to the public blockchain nodes.
Even with offline transactions broadcasted within the time bounds, a significant proportion of those transactions still might not get confirmed. To our understanding, provisions in IOTA make the blockchain resilient to a very small network outage, as defined in Equation (1), while retaining the trade-off of putting a portion of transactions through the reattachment process. As shown in Table  2 , the results pointed by our study fills a gap between theory and hypothesis made by past studies that IOTA accommodates the offline blockchain use case. Our study is the first of a kind that investigates different aspects of offline blockchain from IOTA's point of view. Issues investigated in our study will also lay a foundation for future blockchains that aims to support offline functionality. Our study also points out the impact of data availability on time bounds as noted in Equation (1) and convergence of transactions abiding the time bounds.
Both NSL-KDD and UNSW-NB15 datasets are used to validate the feasibility of our XAI framework. The experimental results show the efficiency of our framework to improve the interpretability of the IoT IDS against well-known IoT attacks, and help the cybersecurity experts get a better understanding of IDS decisions. Index Terms-Internet of Things; Intrusion Detection System; Deep Learning; Explainable Artificial Intelligence; Local and Global Explanations.
The local explanations target a single/particular DL output, while global explanations focus on deducing the most important features that have conducted to each made decision (e. g. , intrusion detection). Hence, our framework introduces more transparency and trust between the decisions made by our DL-based IDS model and cybersecurity experts. NSL-KDD and UNSW-NB15 datasets were used to validate the feasibility of our XAI framework  [32]. The experimental results show the efficiency of our framework to improve the interpretability of the IoT IDS against well-known IoT attacks, and help the cybersecurity experts get a better understanding of IDSs' decisions. The main contributions of this paper can be summarized as follows: This paper is organized as follows. Section II gives an overview on existing related solutions.
II. RELATED WORK In this section, we give the few existing solutions that addressed the explainability of DL-based IDS systems  [33] -  [37]. In  [33] , the authors addressed the challenge of how to explain IDS in computer networks. They first leveraged deep learning to build a DL-based IDS. Then, they designed an XAI framework to optimize the transparency of their DLbased IDS. The authors used N SL -KDD dataset not only for creating the DL-based IDS, but also to validate many XAI techniques, such as, LIME, SHAP, ProtoDash, and contrastive explanations method. Similarly, another XAI framework was designed using SHAP approach, to add more transparency and explainability to any IDS system, in  [34]. The authors aimed to combine local and global explanations to improve the interpretability. They also built two classifiers (one class and multi-class), and compare the interpretations of both classifiers.
The NSL-KDD dataset is used to demonstrate the feasibility of the designed framework. In  [35] , another XAI framework is designed to deal with adversarial attacks on top of machine learning-based IDS. The authors first built a random forest classifier to identify intrusions in the network. Then, global explanations are associated to each classifier prediction using SHAP approach. The performance of the framework are evaluated on hop skip jump attack and CICIDS dataset. Moreover, the developed machine learning-based IDS is validated against other learning algorithms, through several metrics, including precision, recall, F1-score, and accuracy. Besides, the authors aimed to improve user trust against deep learning-based IDS, by optimizing its transparency, in  [38]. To do so, the authors first trained a deep learning-based IDS using the KDD-NSL dataset.
Noting that the designed approach is validated using NSL-KDD dataset. The authors addressed the challenge of dynamic network access in Software Defined Networking (SDN) era, in  [40]. They built a Recurrent Neural Network (RNN) based IDS, to detect network anomalies and generate SDN flow rules to enable then dynamic network access control. In addition, they also train an interpretable model to explain the RNNbased model's outcome. Based on the explanation, the authors derived access control policies. In  [41] , the authors designed a new autoencoder-based detection framework that uses Convolutional Neural Network (CNN) and Recurrent Neural Networks (i. e. , LSTM), to discover attacks in Industrial IoT (IIoT) networks and explain the model. The main advantage of this framework is that it combines both LSTM and CNN to detect both traditional attacks and new (zero-day) attacks related to IIoT.
Moreover, this framework leverages LIME approach to provide local explanation that matches each prediction made by the CNN-LSTM model. Although these existing works  [33] -  [41]  considered XAI approaches, such as LIME and SHAPE, to interpret and explain DL-enabled IDS; however, they focused only on shallow machine learning algorithms, which are not complicated to interpret compared to DL algorithms. [35] , also they were designed for a general setup, without considering the DL algorithm implemented for IoT-based networks (i. e. , IoT-based attacks)  [34]  [38]  [39]. These existing works may not be realistic for some cases, since the XAI model should take into account the main features of the DL algorithm, to be able then to explain its decisions. Moreover, most of these works did not target the IoT networks and used the NSL-KDD dataset which does not cover the IoT attacks, especially the emerging ones.
To overcome these limits, in this work, we designed a novel framework that leverages RuleFit, LIME, and SHAPE as XAI approaches, to explain and interpret a deep neural networkbased IDS for IoT networks, that we also develop in this work by leveraging both NSL-KDD and UNSW-NB15 datasets. We note that our framework enables not only to deduce the most relevant features conducting to each DL-based prediction, but also providing both local and global explanations related to each IDS decision.
B. Explainable Deep Learning-based IDS for IoT Applications First, to evaluate the efficiency of our XAI-powered framework, we built two deep neural network (DNN) models with an input layer of 122 dimensions and 49 dimensions, that corresponds to the dimension of the input features for the NSL-KDD and UNSW-NB15 datasets, respectively. Each DNN architecture is composed of five hidden layers with Leaky Rectified Linear Unit, and an output layer of two dimensions, that corresponds to the dimension of the class label (i. e. , Attack or Normal). This work aims to effectively explain the decision made by this DL-based IDS, the objective is, through these explanations, to answer this question: "Why should I trust your IDS?". The emphasis is on exploring linear and non-linear techniques, including both local and global explanations; it consists of three techniques, namely, RuleFit, Local Interpretable Model-agnostic Explanations (LIME), and SHapley Additive exPlanations (SHAP).
Methods Accuracy Precision Recall F1 J48  [42]  0. 81 N/A N/A N/A NB  [42]  0. 76 N/A N/A N/A RF  [42]  0. 80 N/A N/A N/A MLP  [42]  0. 77 N/A N/A N/A SVM  [42]  0. 70 N/A N/A N/A CNN  [43]  0  At the first stage, We tested the performance of our DNN architecture in terms of accuracy and F1 score. we also compared the results obtained with the state-of-the-art schemes, using both datasets, NSL-KDD and UNSW-NB15. Tables  1  and 2  show the results of our proposed XAI-empowered framework and the most relevant works in the state-of-the-art; we observe that our proposed XAI-empowered framework achieves the highest accuracy and detection rate on both datasets. The experimental results confirm that our proposed XAI framework outperforms the state-of-the-art works in terms of accuracy and F1-score on both datasets.
The feature importance scores includes the importance of the original features and the decision rules where the features appears; it shows the most relevant features/rules that have important/significant impact on the model predictions. The proposed framework studies the use of linear and non-linear techniques, including both local and global explanations, to identify the most informative features and investigate their impact on the final model's predictions; it consists of three techniques, namely, RuleFit, Local Interpretable Model-agnostic Explanations (LIME), and SHapley Additive exPlanations (SHAP). Fig. 2  shows the important features that have the highest scores using RuleFit method on UNSW-NB15 and NSL-KDD datasets, respectively. For the UNSW-NB15 dataset, the highest scoring features corresponds to the following features: (1) sttl: which is the Source to destination time to live;  (2)  This article has been accepted for publication in IEEE Open Journal of the Communications Society.
This is the author's version which has not been fully edited and ct state ttl: which is the Number of each state according to a range of values for source/destination time to live (ttl); (3) service: which is the protocol used e. g. , http, dns, ssh; and (4) dsport: which is the destination port number. For the NSL-KDD dataset, the highest scoring features corresponds to the following features: (1) src bytes: which is the number of data bytes from source to destination; (2) service: which is the network service of the destination host/machine e. g. , http; (3) dst bytes: which is the number of data bytes from destination to source; and (4) hot feature: which is the number of "hot" indicators (e. g. , directory accesses). Fig. 3  shows the important features that have the highest scores using SHAP method on UNSW-NB15 and NSL-KDD datasets, respectively.
For the UNSW-NB15 dataset, the highest scoring features corresponds to the following features: (1) srcip: corresponds to the Source IP address of the source machine; (2) ct dst src ltm: corre-sponds to the number of connections that contain the same service and destination address in the last hundred connections; and (3) ct dst sport ltm: corresponds to the number of connections of the same destination address and the source port in the last hundred connections. For the NSL-KDD dataset, the highest scoring features corresponds to the following features: (1) dst host srv count: corresponds to the feature Srv-count for destination host; (2) count: corresponds to the number of connections to the same host as the current connection in the past two seconds; and (3) dst host count: corresponds to the feature fount for the destination host.
Fig. 4  shows the data samples distribution of features of UNSW-NB15 dataset in terms for: (a) the highest scoring features using RuleFit and SHAP; and (b) the other non-irrelevant features, while Fig. 5  shows the data samples distribution of features of NSL-KDD dataset in terms for: (a) the highest scoring features using RuleFit and SHAP; and (b) the other non-irrelevant features. In both figures, we observe that the most relevant features, computed based on RuleFit and SHAP methods, respectively, can effectively distinguish the two classes (i. e. , Normal and Attack), because the data distribution of the two classes is completely different, while the data distribution of the two classes is similar for the other non-relevant features, which makes classification difficult for the IDS. Figs.
6  and 7  show the interpretation of our DL-based IDS on UNSW-NB15 and NSL-KDD datasets using SHAP method, receptively. In our experiments we have examined two observations for each dataset. Instead of examining decisions of our DNN model locally, we examine the overall/global feature importance of U N SW -N B15 dataset using SHAP, we sum up shapley the input values and we average all the columns/features individually. In the following observations, the blue features push the prediction of an instance to be Normal, while the red features reduce the probability for a data sample to be Normal. Fig. 6 (a) shows the first observation using UNSW-NB15 dataset, where the data sample is an attack and our DL-based IDS correctly predicted/detected as an attack. In this observation, the values of the input features are as follows: ct dst sport ltm is equal to 1.
0, ct dst src ltm is equal 1. 0, and srcip is equal to 38. 0. In this observation, the most contributing features are: ct dst sport ltm and ct dst src ltm; these features drive the probability for a data sample to be an attack. dst host count is equal to 255. 0, count is equal 30. 0, and dst host srv count is equal to 255. 0. The red feature (i. e. , dst host count) reduces the probability for a data sample to be Therefore, knowledge makes cybersecurity experts more convinced of the decisions regarding ML/DLbased IDS. Fig. 8  shows the best features using SHAP on UNSW-NB15 and NSL-KDD datasets, receptively. For a particular instance/observation, each input feature has either a positive or a negative contribution to the final decision. Fig. 9  shows the local explanation of our DL-based IDS using LIME on UNSW-NB15 dataset for (a) positive scenario; and (b) negative scenario, while Fig.
V. CONCLUSION In this paper, we designed a new XAI-based Framework for intrusion detection in IoT networks. Our framework integrated first a deep neural network model to detect intrusions in real-time. Once this model makes decisions, our framework leverages three different approaches of XAI (i. e. , LIME, SHAPE, and RuleFit), to add more explainability, transparency, and trust to the model's decisions. Moreover, our framework with its explainability targets two different users: users of the deep learning model that aim to understand and trust model's outputs, in order to be able to optimize their decisions, and cybersecurity experts that also aim to understand the model's outputs, in order to make the suitable recommendations, especially when an intrusion is detected. We have used both NSL-KDD and UNSW-NB15 datasets to demonstrate the feasibility/performances of our framework; the experimental results show the efficiency of our proposed XAI-based Framework in not only detecting IoT-based attacks, but also integrating more details and interpretation about how and why such detection decisions are made by our deep neural network model.
This article has been accepted for publication in IEEE Open Journal of the Communications Society. This is the author's version which has not been fully edited and content may change prior to final publication. Citation information: DOI 10. 1109/OJCOMS. 2022. 3188750This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4. 0 License. For more information, see https://creativecommons. org/licenses/by-nc-nd/4. 0/ using UNSW-NB15 in which the data sample is Normal and our DL-based IDS correctly predicted this data sample as a Normal one. In this observation, the values of the input features are as follows: srcip is equal to 36. 0, sport is equal 55806. 0, and dstip is equal to 23. 0. Fig. 7(a) shows the first observation using NSL-KDD dataset in which the data sample is Normal and our DL-based IDS correctly predicted/detected as a Normal data sample.
Acknowledgments The research has been managed and supervised by the  Bioastronautics and Space Mechatronics Research Group--BIO&SM  (https://sites. google. com/view/bio-sm). The publication of the article was funded through the  Universidad San Ignacio de Loyola. Also, special thanks to the  Graduate Program in Biomedical Engineering of the Superior School of Engineering, Science and Technology at Universitat Internacional Valenciana, Spain.
Corpus and data preparation This study is based on data drawn from 23 monologues from the NaijaSynCor corpus, corresponding roughly to two hours of recorded speech, 2000 utterances, and 700 prenuclei at the left periphery. Each monologue in our sample was represented by an audio file (. wav), a time-stamped pitch contour (. PitchTier) manually verified and corrected using the prosodic annotation software ANALOR  [11] , a raw text file representing each utterance in the form of a syntactic tree (. conllu) created under the Surface-Syntactic Universal Dependencies (SUD) annotation scheme  [12] , and a. TextGrid alignment containing a word and syllable-level segmentation of each utterance. In a second step, we developed a Python script to construct a second set of. TextGrid alignments specifying the estimated positions of each prenucleus in the 23 monologues.
SLAM+ and contour stylization For each prenucleus, a stylized melodic contour was generated using the software SLAM+ 1 , described more fully in  [13]. This 1 https://github. com/vieenrose/SLAMplus software intends to reduce the F0 variations in each segment of speech into a streamlined modelization which represents only those which are truly perceptible. Using a cleaned. PitchTier as well as the corresponding. TextGrid alignment as input, SLAM+ models the melodic characteristics of each segment of a specified tier using an annotation scheme which takes into account the following variables: The relative F0 value of the first voiced section of the segment. x The relative F0 value of the final voiced section of the segment. x If applicable, the F0 value and relative position of the most salient F0 peak within the segment.
Our approach suffered shortcomings often encountered with spontaneous speech. This study is based on a dataset of about 700 simple and complex prenuclei, yielding a limited number of tokens of the four subtypes of aboutness topics. Furthermore, the number of tokens of each of these subtypes is uneven, with resumed topics being relatively rare in our dataset. A larger dataset would have provided more tokens, allowing us to better consolidate the observations made in this paper, and make more meaningful generalizations about the role of intonation in left-detached topics. Secondly, though the stylized contours generated by SLAM+ encode the positions of internal saliencies, we were unable to detect any link between these positions and the four topic categories. It would be reasonable to conclude that the position of internal saliencies has no relation to information 1 http://naijasyncor.
Biometric authentication is used to secure digital or physical access. Such an authentication system uses a biometric database, where data are sometimes protected by cancelable transformations. This paper introduces the notion of biometric masterkeys. A masterkey is a feature vector such that the corresponding template matches with a significant number of templates stored in a cancelable biometric database. Such a masterkey is directly researched from a cancelable biometric database, but we also investigate another scenario in which the masterkey is fixed before the creation of the cancelable biometric database, providing additional access rights in the system for the masterkey's owner. Experimental results on the fingerprint database FVC and the face image database LFW show the effectiveness and the efficiency of such masterkeys in both scenarios.
Introduction Nowadays, biometrics is more and more used in many applications, from access control on smartphones to payment on the Internet. Biometrics is generally based on physical characteristics such as fingerprints, face, iris or voice. Several ways are used for biometric data protection, as cryptography or cancelable biometric transformations. These transformations should respect several security properties as revocability, unlinkability and non-invertibility while maintaining good performance. They use a secret parameter, called token or seed, but the most used security model considers that this secret can be known by an attacker (stolen token model). During the enrollment step, one or several biometric data is transformed into a biometric template and stored in a database with biometric templates of other people.
During the authentication step, a person sends a biometric data and the seed to the matcher, the corresponding template is computed and compared with templates of the database. If the matching is correct, the person is authenticated. The performance of the cancelable scheme is expected close to the original scheme without transformations, which means similar biometric data are mapped to similar templates with high probability. In this paper, we are interested in the creation of feature vectors for which the corresponding templates match with the greatest number of templates of the cancelable database. Such feature vectors, called masterkeys, can be used to attack the system, in the stolen token model, or provide some additional access rights for the system administrator. In this case, the cancelable transformation is used not for the security of biometric data, but for the creation of efficient masterkeys, by considering the secret seed as a public salt.
More precisely, masterkeys are computed in the two following scenarios: • The cancelable database and the corresponding seeds are known. The goal is to create a synthetic feature vector for which the corresponding templates, computed with the seeds, matches with the maximal number of templates of the database. • The biometric database is known, and a feature vector is fixed. The goal is to find the seeds for which the corresponding templates, computed with the seeds, match with the maximal number of templates, computed with the same seeds. Experiments use a random projection, with or without a binarization step, for transformation, applied on two biometric databases: the FVC database (fingerprints) and the LFW database (face images). In the second scenario, a brute force strategy is used for the computation of seeds, providing successful masterkeys for all the biometric database, with no significative performance degradation in these cancelable biometric databases.
This second scenario proposes a new paradigm in biometric authentication, with the creation of biometric databases with specific access rights. It can also be seen as a backdoor placed in the system. Seeds are also computed for a set of masterkeys's candidate, providing partial masterkeys for other feature vectors. Section 2 proposes generic definitions on biometric systems and presents the works close to this paper. Section 3 formalizes the concept of masterkey with several definitions on the effectiveness of such masterkeys. Experiments and results are given in Section 4, whereas conclusion and future works are in Section 5.