Evaluation of Machine Learning Techniques for Traffic Flow-Based Intrusion Detection.

Cybersecurity is one of the great challenges of today's world. Rapid technological development has allowed society to prosper and improve the quality of life and the world is more dependent on new technologies. Managing security risks quickly and effectively, preventing, identifying, or mitigating them is a great challenge. The appearance of new attacks, and with more frequency, requires a constant update of threat detection methods. Traditional signature-based techniques are effective for known attacks, but they are not able to detect a new attack. For this reason, intrusion detection systems (IDS) that apply machine learning (ML) techniques represent an alternative that is gaining importance today. In this work, we have analyzed different machine learning techniques to determine which ones permit to obtain the best traffic classification results based on classification performance measurements and execution times, which is decisive for further real-time deployments. The CICIDS2017 dataset was selected in this work since it contains bidirectional traffic flows (derived from traffic captures) that include benign traffic and different types of up-to-date attacks. Each traffic flow is characterized by a set of connection-related attributes that can be used to model the traffic and distinguish between attacks and normal flows. The CICIDS2017 also contains the raw network traffic captures collected during the dataset creation in a packet-based format, thus permitting to extract the traffic flows from them. Various classification techniques have been evaluated using the Weka software: naive Bayes, logistic, multilayer perceptron, sequential minimal optimization, k-nearest neighbors, adaptive boosting, OneR, J48, PART, and random forest. As a general result, methods based on decision trees (PART, J48, and random forest) have turned out to be the most efficient with F1 values above 0.999 (average obtained in the complete dataset). Moreover, multiclass classification (distinguishing between different types of attack) and binary classification (distinguishing only between normal traffic and attack) have been compared, and the effect of reducing the number of attributes using the correlation-based feature selection (CFS) technique has been evaluated. By reducing the complexity in binary classification, better results can be obtained, and by selecting a reduced set of the most relevant attributes, less time is required (above 30% of decrease in the time required to test the model) at the cost of a small performance loss. The tree-based techniques with CFS attribute selection (six attributes selected) reached F1 values above 0.990 in the complete dataset. Finally, a conventional tool like Zeek has been used to process the raw traffic captures to identify the traffic flows and to obtain a reduced set of attributes from these flows. The classification results obtained using tree-based techniques (with 14 Zeek-based attributes) were also very high, with F1 above 0.997 (average obtained in the complete dataset) and low execution times (allowing several hundred thousand flows/s to be processed). These classification results obtained on the CICIDS2017 dataset allow us to affirm that the tree-based machine learning techniques may be appropriate in the flow-based intrusion detection problem and that algorithms, such as PART or J48, may offer a faster alternative solution to the RF technique.

When Virtual Assistants Meet Teledermatology: Validation of a Virtual Assistant to Improve the Quality of Life of Psoriatic Patients.

Teledermatology has given dermatologists a tool to track patients' responses to therapy using images. Virtual assistants, the programs that interact with users through text or voice messages, could be used in teledermatology to enhance the interaction of the tool with the patients and healthcare professionals and the overall impact of the medication and quality of life of patients. As such, this work aimed to investigate the effectiveness of using a virtual assistant for teledermatology and its impact on the quality of life. We conducted surveys with the participants and measured the usability of the system with the System Usability Scale (SUS). A total of 34 participants (30 patients diagnosed with moderate-severe psoriasis and 4 healthcare professionals) were included in the study. The measurement of the improvement of quality of life was done by analyzing Psoriasis Quality of Life (PSOLIFE) and Dermatology Life Quality Index (DLQI) questionnaires. The results showed that, on average, the quality of life improved (from 63.8 to 64.8 for PSOLIFE (with a p-value of 0.66 and an effect size of 0.06) and 4.4 to 2.8 for DLQI (with a p-value of 0.04 and an effect size of 0.31)). Patients also used the virtual assistant to do 52 medical consultations. Moreover, the usability is above average, with a SUS score of 70.1. As supported by MMAS-8 results, adherence also improved slightly. Our work demonstrates the improvement of the quality of life with the use of a virtual assistant in teledermatology, which could be attributed to the sense of security or peace of mind the patients get as they can contact their dermatologists directly within the virtual assistant-integrated system.

A Study on the Impacts of Slot Types and Training Data on Joint Natural Language Understanding in a Spanish Medication Management Assistant Scenario.

This study evaluates the impacts of slot tagging and training data length on joint natural language understanding (NLU) models for medication management scenarios using chatbots in Spanish. In this study, we define the intents (purposes of the sentences) for medication management scenarios and two types of slot tags. For training the model, we generated four datasets, combining long/short sentences with long/short slots, while for testing, we collect the data from real interactions of users with a chatbot. For the comparative analysis, we chose six joint NLU models (SlotRefine, stack-propagation framework, SF-ID network, capsule-NLU, slot-gated modeling, and a joint SLU-LM model) from the literature. The results show that the best performance (with a sentence-level semantic accuracy of 68.6%, an F1-score of 76.4% for slot filling, and an accuracy of 79.3% for intent detection) is achieved using short sentences and short slots. Our results suggest that joint NLU models trained with short slots yield better results than those trained with long slots for the slot filling task. The results also indicate that short slots could be a better choice for the dialog system because of their simplicity. Importantly, the work demonstrates that the performance of the joint NLU models can be improved by selecting the correct slot configuration according to the usage scenario.

Validation of a Virtual Assistant for Improving Medication Adherence in Patients with Comorbid Type 2 Diabetes Mellitus and Depressive Disorder.

Virtual assistants are programs that interact with users through text or voice messages simulating a human-based conversation. The development of healthcare virtual assistants that use messaging platforms is rapidly increasing. Still, there is a lack of validation of these assistants. In particular, this work aimed to validate the effectiveness of a healthcare virtual assistant, integrated within messaging platforms, with the aim of improving medication adherence in patients with comorbid type 2 diabetes mellitus and depressive disorder. For this purpose, a nine-month pilot study was designed and subsequently conducted. The virtual assistant reminds patients about their medication and provides healthcare professionals with the ability to monitor their patients. We analyzed the medication possession ratio (MPR), measured the level of glycosylated hemoglobin (HbA1c), and obtained the patient health questionnaire (PHQ-9) score in the patients before and after the study. We also conducted interviews with all participants. A total of thirteen patients and five nurses used and evaluated the proposed virtual assistant using the messaging platform Signal. Results showed that on average, the medication adherence improved. In the final interview, 69% of the patients agreed with the idea of continuing to use the virtual assistant after the study.

Authorizing Third-Party Applications Served through Messaging Platforms.

The widespread adoption of smartphones and the new-generation wireless networks have changed the way that people interact among themselves and with their environment. The use of messaging platforms, such as WhatsApp, has become deeply ingrained in peoples' lives, and many digital services have started to be delivered using these communication channels. In this work, we propose a new OAuth grant type to be used when the interaction between the resource owner and the client takes place through a messaging platform. This new grant type firstly allows the authorization server to be sure that no Man-in-the-Middle risk exists between the resource owner and the client before issuing an access token. Secondly, it allows the authorization server to interact with the resource owner through the same user-agent already being used to interact with the client, i.e., the messaging platform, which is expected to improve the overall user experience of the authorization process. To verify this assumption, we conducted a usability study in which subjects were required to perform the full authorization process using both the standard authorization code grant type (through a web-browser) and the new grant type defined in this work. They have also been required to fill in a small questionnaire including some demographic information and their impressions about both authorization flows. The results suggest that the proposed grant type eases the authorization process in most cases.

Microservice chatbot architecture for chronic patient support.

Chatbots are able to provide support to patients suffering from very different conditions. Patients with chronic diseases or comorbidities could benefit the most from chatbots which can keep track of their condition, provide specific information, encourage adherence to medication, etc. To perform these functions, chatbots need a suitable underlying software architecture. In this paper, we introduce a chatbot architecture for chronic patient support grounded on three pillars: scalability by means of microservices, standard data sharing models through HL7 FHIR and standard conversation modeling using AIML. We also propose an innovative automation mechanism to convert FHIR resources into AIML files, thus facilitating the interaction and data gathering of medical and personal information that ends up in patient health records. To align the way people interact with each other using messaging platforms with the chatbot architecture, we propose these very same channels for the chatbot-patient interaction, paying special attention to security and privacy issues. Finally, we present a monitored-data study performed in different chronic diseases, and we present a prototype implementation tailored for one specific chronic disease, psoriasis, showing how this new architecture allows the change, the addition or the improvement of different parts of the chatbot in a dynamic and flexible way, providing a substantial improvement in the development of chatbots used as virtual assistants for chronic patients.

Validation of the Apple Watch for Heart Rate Variability Measurements during Relax and Mental Stress in Healthy Subjects.

Heart rate variability (HRV) analysis is a noninvasive tool widely used to assess autonomic nervous system state. The market for wearable devices that measure the heart rate has grown exponentially, as well as their potential use for healthcare and wellbeing applications. Still, there is a lack of validation of these devices. In particular, this work aims to validate the Apple Watch in terms of HRV derived from the RR interval series provided by the device, both in temporal (HRM (mean heart rate), SDNN, RMSSD and pNN50) and frequency (low and high frequency powers, LF and HF) domain. For this purpose, a database of 20 healthy volunteers subjected to relax and a mild cognitive stress was used. First, RR interval series provided by Apple Watch were validated using as reference the RR interval series provided by a Polar H7 using Bland-Altman plots and reliability and agreement coefficients. Then, HRV parameters derived from both RR interval series were compared and their ability to identify autonomic nervous system (ANS) response to mild cognitive stress was studied. Apple Watch measurements presented very good reliability and agreement (>0.9). RR interval series provided by Apple Watch contain gaps due to missing RR interval values (on average, 5 gaps per recording, lasting 6.5 s per gap). Temporal HRV indices were not significantly affected by the gaps. However, they produced a significant decrease in the LF and HF power. Despite these differences, HRV indices derived from the Apple Watch RR interval series were able to reflect changes induced by a mild mental stress, showing a significant decrease of HF power as well as RMSSD in stress with respect to relax, suggesting the potential use of HRV measurements derived from Apple Watch for stress monitoring.

Biometric Authentication Using the PPG: A Long-Term Feasibility Study.

The photoplethysmogram (PPG) is a biomedical signal that can be used to estimate volumetric blood flow changes in the peripheral circulation. During the past few years, several works have been published in order to assess the potential for PPGs to be used in biometric authentication systems, but results are inconclusive. In this paper we perform an analysis of the feasibility of using the PPG as a realistic biometric alternative in the long term. Several feature extractors (based on the time domain and the Karhunen⁻Loève transform) and matching metrics (Manhattan and Euclidean distances) have been tested using four different PPG databases (PRRB, MIMIC-II, Berry, and Nonin). We show that the false match rate (FMR) and false non-match rate (FNMR) values remain constant in different time instances for a selected threshold, which is essential for using the PPG for biometric authentication purposes. On the other hand, obtained equal error rate (EER) values for signals recorded during the same session range from 1.0% for high-quality signals recorded in controlled conditions to 8% for those recorded in conditions closer to real-world scenarios. Moreover, in certain scenarios, EER values rise up to 23.2% for signals recorded over different days, signaling that performance degradation could take place with time.

Analysis of ISO/IEEE 11073 built-in security and its potential IHE-based extensibility.

The ISO/IEEE 11073 standard for Personal Health Devices (X73PHD) aims to ensure interoperability between Personal Health Devices and aggregators-e.g. health appliances, routers-in ambulatory setups. The Integrating the Healthcare Enterprise (IHE) initiative promotes the coordinated use of different standards in healthcare systems (e.g. Personal/Electronic Health Records, alert managers, Clinical Decision Support Systems) by defining profiles intended for medical use cases. X73PHD provides a robust syntactic model and a comprehensive terminology, but it places limited emphasis on security and on interoperability with IHE-compliant systems and frameworks. However, the implementation of eHealth/mHealth applications in environments such as health and fitness monitoring, independent living and disease management (i.e. the X73PHD domains) increasingly requires features such as secure connections to mobile aggregators-e.g. smartphones, tablets-, the sharing of devices among different users with privacy, and interoperability with certain IHE-compliant healthcare systems. This work proposes a comprehensive IHE-based X73PHD extension consisting of additive layers adapted to different eHealth/mHealth applications, after having analyzed the features of X73PHD (especially its built-in security), IHE profiles related with these applications and other research works. Both the new features proposed for each layer and the procedures to support them have been carefully chosen to minimize the impact on X73PHD, on its architecture (in terms of delays and overhead) and on its framework. Such implications are thoroughly analyzed in this paper. As a result, an extended model of X73PHD is proposed, preserving its essential features while extending them with added value.

Introducing keytagging, a novel technique for the protection of medical image-based tests.

This paper introduces keytagging, a novel technique to protect medical image-based tests by implementing image authentication, integrity control and location of tampered areas, private captioning with role-based access control, traceability and copyright protection. It relies on the association of tags (binary data strings) to stable, semistable or volatile features of the image, whose access keys (called keytags) depend on both the image and the tag content. Unlike watermarking, this technique can associate information to the most stable features of the image without distortion. Thus, this method preserves the clinical content of the image without the need for assessment, prevents eavesdropping and collusion attacks, and obtains a substantial capacity-robustness tradeoff with simple operations. The evaluation of this technique, involving images of different sizes from various acquisition modalities and image modifications that are typical in the medical context, demonstrates that all the aforementioned security measures can be implemented simultaneously and that the algorithm presents good scalability. In addition to this, keytags can be protected with standard Cryptographic Message Syntax and the keytagging process can be easily combined with JPEG2000 compression since both share the same wavelet transform. This reduces the delays for associating keytags and retrieving the corresponding tags to implement the aforementioned measures to only ≃30 and ≃90ms respectively. As a result, keytags can be seamlessly integrated within DICOM, reducing delays and bandwidth when the image test is updated and shared in secure architectures where different users cooperate, e.g. physicians who interpret the test, clinicians caring for the patient and researchers.

Real-time echocardiogram transmission protocol based on regions and visualization modes.

This paper proposes an Echocardiogram Transmission Protocol (ETP) for real-time end-to-end transmission of echocardiograms over IP networks. The ETP has been designed taking into account the echocardiogram characteristics of each visualized region, encoding each region according to its data type, visualization characteristics and diagnostic importance in order to improve the coding and thus the transmission efficiency. Furthermore, each region is sent separately and different error protection techniques can be used for each region. This leads to an efficient use of resources and provides greater protection for those regions with more clinical information. Synchronization is implemented for regions that change over time. The echocardiogram composition is different for each device. The protocol is valid for all echocardiogram devices thanks to the incorporation of configuration information which includes the composition of the echocardiogram. The efficiency of the ETP has been proved in terms of the number of bits sent with the proposed protocol. The codec and transmission rates used for the regions of interest have been set according to previous recommendations. Although the saving in the codified bits depends on the video composition, a coding gain higher than 7% with respect to without using ETP has been achieved.

Designing an architecture for monitoring patients at home: ontologies and web services for clinical and technical management integration.

This paper presents the design and implementation of an architecture based on the combination of ontologies, rules, web services, and the autonomic computing paradigm to manage data in home-based telemonitoring scenarios. The architecture includes two layers: 1) a conceptual layer and 2) a data and communication layer. On the one hand, the conceptual layer based on ontologies is proposed to unify the management procedure and integrate incoming data from all the sources involved in the telemonitoring process. On the other hand, the data and communication layer based on REST web service (WS) technologies is proposed to provide practical backup to the use of the ontology, to provide a real implementation of the tasks it describes and thus to provide a means of exchanging data (support communication tasks). A case study regarding chronic obstructive pulmonary disease data management is presented in order to evaluate the efficiency of the architecture. This proposed ontology-based solution defines a flexible and scalable architecture in order to address main challenges presented in home-based telemonitoring scenarios and thus provide a means to integrate, unify, and transfer data supporting both clinical and technical management tasks.

On the seamless, harmonized use of ISO/IEEE11073 and openEHR.

Standardized exchange of clinical information is a key factor in the provision of high quality health care systems. In this context, the openEHR specification facilitates the management of health data in electronic health records (EHRs), while the ISO/IEEE11073 (also referred to as X73PHD) family of standards provides a reference framework for medical device interoperability. Hospitals and health care providers using openEHR require flawless integration of data coming from external sources, such as X73PHD. Hence, a harmonization process is crucial for achieving a seamless, coherent use of those specifications in real scenarios. Such harmonization is the aim of this paper. Thus, the classes and attributes of a representative number of X73PHD specializations for medical devices--weight, temperature, blood pressure, pulse and heart rate, oximetry, and electrocardiograph--along with the X73PHD core document--ISO/IEEE11073-20601--have been analyzed and mapped to openEHR archetypes. The proposed methodology reuses the existing archetypes when possible and suggests new ones--or appropriate modifications--otherwise. As a result, this paper analyzes the inconsistencies found and the implications thereof in the coordinated use of these two standards. The procedure has also shown how existing standards are able to influence the archetype development process, enhancing the existing archetype corpus.

Secure information embedding into 1D biomedical signals based on SPIHT.

This paper proposes an encoding system for 1D biomedical signals that allows embedding metadata and provides security and privacy. The design is based on the analysis of requirements for secure and efficient storage, transmission and access to medical tests in e-health environment. This approach uses the 1D SPIHT algorithm to compress 1D biomedical signals with clinical quality, metadata embedding in the compressed domain to avoid extra distortion, digital signature to implement security and attribute-level encryption to support Role-Based Access Control. The implementation has been extensively tested using standard electrocardiogram and electroencephalogram databases (MIT-BIH Arrhythmia, MIT-BIH Compression and SCCN-EEG), demonstrating high embedding capacity (e.g. 3 KB in resting ECGs, 200 KB in stress tests, 30 MB in ambulatory ECGs), short delays (2-3.3s in real-time transmission) and compression of the signal (by ≃3 in real-time transmission, by ≃5 in offline operation) despite of the embedding of security elements and metadata to enable e-health services.

A robust and simple security extension for the medical standard SCP-ECG.

This paper proposes a SCP-ECG security extension after having analyzed the features of this standard, its security requirements and the current measures implemented by other medical protocols. Our approach permits SCP-ECG files to be stored safely and proper access to be granted (or denied) to users for different purposes: interpretation of the test, consultation, clinical research or teaching. The access privileges are scaled by means of role-based profiles supported by cryptographic elements (ciphering, digital certificates and digital signatures). These elements are arranged as metadata into a new section which extends the protocol and protects the remaining sections. The application built to implement this approach has been extensively tested, showing its capacity to authenticate users and to protect the integrity of files and the privacy of sensitive data, with a low impact on file size and access time. In addition, this solution is compatible with any version of the SCP-ECG and can be easily integrated into e-health platforms.

Enhanced protocol for real-time transmission of echocardiograms over wireless channels.

This paper presents a methodology to transmit clinical video over wireless networks in real-time. A 3-D set partitioning in hierarchical trees compression prior to transmission is proposed. In order to guarantee the clinical quality of the compressed video, a clinical evaluation specific to each video modality has to be made. This evaluation indicates the minimal transmission rate necessary for an accurate diagnosis. However, the channel conditions produce errors and distort the video. A reliable application protocol is therefore proposed using a hybrid solution in which either retransmission or retransmission combined with forward error correction (FEC) techniques are used, depending on the channel conditions. In order to analyze the proposed methodology, the 2-D mode of an echocardiogram has been assessed. A bandwidth of 200 kbps is necessary to guarantee its clinical quality. The transmission using the proposed solution and retransmission and FEC techniques working separately have been simulated and compared in high-speed uplink packet access (HSUPA) and worldwide interoperability for microwave access (WiMAX) networks. The proposed protocol achieves guaranteed clinical quality for bit error rates higher than with the other protocols, being for a mobile speed of 60 km/h up to 3.3 times higher for HSUPA and 10 times for WiMAX.

An SNMP-based solution to enable remote ISO/IEEE 11073 technical management.

This paper presents the design and implementation of an architecture based on the integration of simple network management protocol version 3 (SNMPv3) and the standard ISO/IEEE 11073 (X73) to manage technical information in home-based telemonitoring scenarios. This architecture includes the development of an SNMPv3-proxyX73 agent which comprises a management information base (MIB) module adapted to X73. In the proposed scenario, medical devices (MDs) send information to a concentrator device [designated as compute engine (CE)] using the X73 standard. This information together with extra information collected in the CE is stored in the developed MIB. Finally, the information collected is available for remote access via SNMP connection. Moreover, alarms and events can be configured by an external manager in order to provide warnings of irregularities in the MDs' technical performance evaluation. This proposed SNMPv3 agent provides a solution to integrate and unify technical device management in home-based telemonitoring scenarios fully adapted to X73.

An integrated healthcare information system for end-to-end standardized exchange and homogeneous management of digital ECG formats.

This paper investigates the application of the enterprise information system (EIS) paradigm to standardized cardiovascular condition monitoring. There are many specifications in cardiology, particularly in the ECG standardization arena. The existence of ECG formats, however, does not guarantee the implementation of homogeneous, standardized solutions for ECG management. In fact, hospital management services need to cope with various ECG formats and, moreover, several different visualization applications. This heterogeneity hampers the normalization of integrated, standardized healthcare information systems, hence the need for finding an appropriate combination of ECG formats and a suitable EIS-based software architecture that enables standardized exchange and homogeneous management of ECG formats. Determining such a combination is one objective of this paper. The second aim is to design and develop the integrated healthcare information system that satisfies the requirements posed by the previous determination. The ECG formats selected include ISO/IEEE11073, Standard Communications Protocol for Computer-Assisted Electrocardiography, and an ECG ontology. The EIS-enabling techniques and technologies selected include web services, simple object access protocol, extensible markup language, or business process execution language. Such a selection ensures the standardized exchange of ECGs within, or across, healthcare information systems while providing modularity and accessibility.

A review on digital ECG formats and the relationships between them.

A plethora of digital ECG formats have been proposed and implemented. This heterogeneity hinders the design and development of interoperable systems and entails critical integration issues for the healthcare information systems. This paper aims at performing a comprehensive overview on the current state of affairs of the interoperable exchange of digital ECG signals. This includes 1) a review on existing digital ECG formats, 2) a collection of applications and cardiology settings using such formats, 3) a compilation of the relationships between such formats, and 4) a reflection on the current situation and foreseeable future of the interoperable exchange of digital ECG signals. The objectives have been approached by completing and updating previous reviews on the topic through appropriate database mining. 39 digital ECG formats, 56 applications, tools or implantation experiences, 47 mappings/converters, and 6 relationships between such formats have been found in the literature. The creation and generalization of a single standardized ECG format is a desirable goal. However, this unification requires political commitment and international cooperation among different standardization bodies. Ongoing ontology-based approaches covering ECG domain have recently emerged as a promising alternative for reaching fully fledged ECG interoperability in the near future.

Interoperability in digital electrocardiography: harmonization of ISO/IEEE x73-PHD and SCP-ECG.

The ISO/IEEE 11073 (x73) family of standards is a reference frame for medical device interoperability. A draft for an ECG device specialization (ISO/IEEE 11073-10406-d02) has already been presented to the Personal Health Device (PHD) Working Group, and the Standard Communications Protocol for Computer-Assisted ElectroCardioGraphy (SCP-ECG) Standard for short-term diagnostic ECGs (EN1064:2005+A1:2007) has recently been approved as part of the x73 family (ISO 11073-91064:2009). These factors suggest the coordinated use of these two standards in foreseeable telecardiology environments, and hence the need to harmonize them. Such harmonization is the subject of this paper. Thus, a mapping of the mandatory attributes defined in the second draft of the ISO/IEEE 11073-10406-d02 and the minimum SCP-ECG fields is presented, and various other capabilities of the SCP-ECG Standard (such as the messaging part) are also analyzed from an x73-PHD point of view. As a result, this paper addresses and analyzes the implications of some inconsistencies in the coordinated use of these two standards. Finally, a proof-of-concept implementation of the draft x73-PHD ECG device specialization is presented, along with the conversion from x73-PHD to SCP-ECG. This paper, therefore, provides recommendations for future implementations of telecardiology systems that are compliant with both x73-PHD and SCP-ECG.