Journal articles, conference papers, preprints and patents, newest first. Filter by research line, type or year, or search titles, authors, venues and abstracts.
Each square is a paper. Click a year to show only that year, or a square to jump to the paper.
@article{zion2026ultrafast,
author = {Zion, Yehonatan and Dvir, Amit and Hajaj, Chen and Dubin, Ran and Filber, Neriya},
title = {Ultra fast encrypted network traffic classification based on classification by retrieval powered by out-of-distribution},
journal = {Computer Networks},
year = {2026},
doi = {10.1016/j.comnet.2026.112739},
url = {https://doi.org/10.1016/j.comnet.2026.112739}
}
Background: The prevalence of pediatric urinary tract infections (UTIs) caused by extended-spectrum β-lactamases (ESBL)-producing bacteria is increasing worldwide and is difficult to predict. As these infections require special antibiotic treatment, which is often not started empirically, they are associated with higher rates of intensive care unit admission, morbidity and prolonged hospitalization. We aimed to develop machine learning-based tools to aid pediatricians in predicting ESBL-positive UTIs and initiate appropriate empiric antibiotics. Methods: The electronic medical records of a large Health Maintenance Organization were searched for all children one month to 18 years of age with confirmed UTIs during January 1, 2010, to August 31, 2020. Data on demographics, clinical and laboratory information were retrieved, and following univariate analysis, machine learning-based tools were used to develop models to predict a UTI caused by an ESBL-producing bacterium. Results: A total of 35,830 pediatric UTI events comprised the study group. Age, sex, socioeconomic status, site of infection (community or hospital), prior antibiotic use, previous ESBL-positive UTI and the specific uropathogen were significantly associated with the rates of ESBL-positive infection. Using patients’ data available on presentation, the 5 models developed had a very high negative predictive value of 0.98, indicating strong rule-out performance for ESBL-positive UTIs. Conclusions: Our study indicates that machine learning models based on data available at UTI presentation may support clinicians in estimating the likelihood of ESBL-producing bacteria UTIs. Prospective studies are required to improve the models’ performance and determine their actual impact on clinical outcomes.
@article{shkalim2026esbl_uti_pidj,
author = {Hajaj, Chen and Alkoby, Shani and Ashkenazi, Shai and Herman Cohen, Avner and Reichenberg, Yael and Kushnir, Shiri and Shkalim Zemer, Vered},
title = {Machine Learning Tools for Predicting Pediatric Urinary Tract Infections Caused by ESBL-Producing Bacteria},
journal = {Pediatric Infectious Disease Journal},
year = {2026},
doi = {10.1097/INF.0000000000005179}
}
Learning through Concept Generation: The Case of Academic and Practitioner Teaching in the Design Engineering Studio
Hadas Sopher, Chen Hajaj, and John S Gero
ConferenceProceedings of the International Conference on Design, Computing and Cognition (DCC 2026)
Whether engineering design should be taught by academic or practitioner tutors remains a debatable topic. This paper examines this debate by comparing design learning behaviours through concept introduction in design engineering critiques given by academic and practitioner tutors. Taking a syntactic approach, the study applies natural language processing techniques to track the generation of design concepts, identified by the first occurrence of nouns and their reoccurrences by each speaker in each session. The tutor’s first occurrences reflect her demonstration. Once repeated by a student, they reflect learning through imitation. These learning behaviours are further examined by analysing the semantic distance between students’ and tutors’ concepts, reflecting convergence of conceptual alignment through semantic proximity. The method is demonstrated by analysing the protocols of a natural case study involving two groups (n = 30) across five consecutive sessions. Results revealed differences between the cohorts. Academic-taught students exhibit a higher rate of first occurrences, compared to practitioner-taught students. While tutors showed similarity in repeating students’ concepts, students’ imitation of academic tutors was at a higher rate compared to that of practitioner tutors. Practitioner tutors drifted further distant from student concepts, whereas students in both groups maintained a semantic proximity to their tutors, reflecting the role of the tutor in leading the educational process. Temporal analysis revealed a decrease in semantic distance throughout the course, indicating greater alignment. This study lays the foundation for articulating critique pedagogies empirically to improve learning behaviours in studio-based education.
@inproceedings{sopher2026learning_dcc,
author = {Sopher, Hadas and Hajaj, Chen and Gero, John S},
title = {Learning through Concept Generation: The Case of Academic and Practitioner Teaching in the Design Engineering Studio},
booktitle = {Proceedings of the International Conference on Design, Computing and Cognition (DCC 2026)},
year = {2026},
month = jun,
address = {Paris, France},
month_numeric = {6}
}
Uncovering Microservice Faults: A Temporal Graph Approach to Root Cause Analysis
Udi Aharon, Amit Dvir, Ran Dubin, Revital Marbel, and Chen Hajaj
ConferenceProceedings of the IEEE International Conference on Communications. ICC 2026
Real-time processing demands for massive IoT sensor data necessitate reliance on distributed microservice systems within edge clusters. However, pinpointing the root cause of anomalies within these edge microservice clusters poses a critical challenge for intelligent IoT operation and maintenance. To address the issue, a spatio-temporal graph propagation model ST-GraphRCA is proposed for root cause analysis in IoT edge environments. Our approach begins by resolving the fundamental issue of time-series asynchrony across distributed multi-source metrics. A PCA-DTW hybrid feature extraction method is introduced with a dynamic alignment strategy to mitigate the effects of random network delays and data deformation without requiring prior synchronization. Subsequently, ST-GraphRCA constructs a stream-based forward propagation graph based on the flow conservation principle. By integrating dynamic edge weights with node-level input–output anomaly scores, ST-GraphRCA precisely infers fault propagation pathways and identifies potential root cause candidates through causal reasoning. Finally, a topology-constrained high-utility mining algorithm filters these candidates. Using a constraint matrix, the algorithm filters out unreachable service combinations to locate low-frequency and high-risk root causes. Experimental results indicate that ST-GraphRCA achieves an F1-Score of 0.89, outperforming existing methods. In resource-constrained edge scenarios, its average localization time is merely 238.8 ms, representing a six-fold improvement over key benchmarks. Thus, ST-GraphRCA not only provides an efficient anomaly fault tracing solution for large-scale IoT systems but also offers technical support for the intelligent operation and maintenance of distributed microservice systems.
@inproceedings{aharon2026uncovering_microservice_faults,
author = {Aharon, Udi and Dvir, Amit and Dubin, Ran and Marbel, Revital and Hajaj, Chen},
title = {Uncovering Microservice Faults: A Temporal Graph Approach to Root Cause Analysis},
booktitle = {Proceedings of the IEEE International Conference on Communications. ICC 2026},
year = {2026},
month = may,
address = {Glasgow, Scotland, UK},
organization = {IEEE},
month_numeric = {5}
}
Latency is the most impactful on fairness and Quality of Experience (QoE) in First-Person Shooter (FPS) games. High latency degrades the QoE of players, who may leave the game if unsatisfied with their QoE. Modern FPS games make great efforts to maintain an excellent QoE even under a poor Internet connection with high latency. Those efforts include the wide distribution of game servers and many software optimizations to smooth the effect of lags in the games. This study aims to provide insights into QoE estimation for network-intensive applications by examining one of the most prominent FPS games of the past two decades: Call of Duty. We observed that the game dynamically adjusts its network traffic behavior, including packet size and transmission rate, in response to variations in network quality. However, the ISP does not have this capability since the network traffic is encrypted; observing the game’s network traffic does not expose its nature and most certainly does not expose the game player’s intensity, latency, or QoE. We propose a novel technique for estimating latency and QoE in FPS games from an ISP-level perspective. In our evaluation, the model detected problematic latency in near real-time with 81% accuracy and an 80% F1 on a 10-second window, highlighting a trade-off between responsiveness and predictive performance. The dataset generated for this study is publicly available to support further research.
@inproceedings{zion2026qoe_fps_ccnc,
author = {Zion, Yehonatan and Paz, Eyal and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
title = {Quality of Experience Prediction for First Person Shooter Online Gaming: The Case Study of Call of Duty},
doi = {10.1109/CCNC65079.2026.11366349},
booktitle = {Proceedings of the IEEE Consumer Communications \& Networking Conference (CCNC 2026)},
year = {2026},
month = jan,
address = {Las Vegas, NV, USA},
organization = {IEEE},
month_numeric = {1}
}
In today’s digital landscape, ensuring the security of cloud environments is critical for organizational resilience, growth, and operational efficiency. As cloud services become more prevalent, so do sophisticated attacks targeting cloud users, making early detection essential. This paper introduces a novel time-based embedding approach for Cloud Services Graph-based Anomaly Detection (CS-GAD) that leverages a Graph Neural Network (GNN) to detect anomalous user behavior. We propose a dynamic tripartite graph to model interactions among users, actions, and cloud services over time. Using behavioral patterns, our GNN generates user embeddings to enable early detection of anomalies. We evaluate this approach on a novel dataset simulating five real-world attacks: cryptojacking, billing abuse, lateral movement, monitor exploitation, and service targeting. The dataset comprises 107,116 Application Programming Interface (API) calls over 32 days, tracking 79 AWS services, with attacks embedded within legitimate cloud traffic. Our results demonstrate that the proposed method achieves a lower false positive rate and higher detection accuracy than a prevailing method, as evidenced by improved accuracy, precision, recall, and F1-score.
@inproceedings{marbel2026cloudy_ccnc,
author = {Marbel, Revital and Cohen, Yanir Victor and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
title = {Cloudy with a Chance of Anomalies: Dynamic Graph Neural Network for Early Detection of Cloud Services' User Anomalies},
booktitle = {Proceedings of the IEEE Consumer Communications \& Networking Conference (CCNC 2026)},
year = {2026},
month = jan,
address = {Las Vegas, NV, USA},
organization = {IEEE},
doi = {10.1109/ccnc65079.2026.11366510},
month_numeric = {1}
}
Music in the current digital era is consumed primarily on-demand, for example by streaming from Spotify or YouTube, rather than by broadcasting, for example, by listening to a radio station. A strong correlation has been found between music and emotions. Hence, with our ability to select our own music and the availability of artificial intelligence (AI) tools, the importance of music emotion recognition (MER) is significant. This research proposes a novel methodology for predicting emotions from a musical piece that is selected by the listener based on a two-layer AI. The dataset and the process are exceptional in two ways: first, by their qualitative character, which minimized the inherent subjectivity of self-reported emotions, and also the high reliability of the collected data in comparison to other methods such as a questionnaire; and second, by their quantitative character, given songs from about 4,447 people. The model succeeded in predicting the primary emotion with and one of the two leading emotions (the primary and the secondary) with, and without accommodating demographic factors in the model. We believe this knowledge may be a useful tool for therapists, coaches, teachers, etc. and may also raise public awareness of a potential privacy violation.
@article{hirshprung2026sound_of_emotions,
author = {Hirshprung, Ron and Lesman, Ori and Hajaj, Chen},
title = {The Sound of Emotions: An Artificial Intelligence Approach to Predicting Emotions from Musical Selections},
journal = {Multimedia Systems},
year = {2026},
doi = {10.1007/s00530-026-02220-1}
}
Selected: Cleaner Adversarial CAPTCHAs: Intelligent Targets and Precise Noise for Usable Security
Meir Litman and Chen Hajaj
ConferenceProceedings of the 25th International Conference on Autonomous Agents and Multiagent Systems (AAMAS 2026)
Traditional CAPTCHAs are increasingly vulnerable to deep learning-based solvers that decode text and images with high accuracy. In this work, we propose methods to strengthen adversarial CAPTCHAs without compromising human usability. First, we introduce a Precise Gradient Method (PGM) that preserves gradient magnitude (rather than discarding it via a sign operator), producing adversarial perturbations with significantly lower perceptual noise. Second, we develop intelligent target class selection, using either dataset-level confusion structure (Class Relations Network) or image-specific softmax probabilities (Distance-Based Target), to steer adversarial perturbations more efficiently. Across multiple modern architectures (MobileNets, EfficientNets, ResNet, and Vision Transformer), our framework achieves faster convergence (fewer iterations), reduced visual distortion, and notably greater robustness under iterative adversarial retraining. Experiments show that our methods consistently reduce iteration counts and perceptual distortion while significantly increasing the difficulty for automated attacks. Our results offer a practical, scalable path toward the next generation of CAPTCHA systems and contribute new insights to the adversarial machine learning landscape focused on security and usability.
@inproceedings{litman2026_cleaner_adversarial_captchas,
author = {Litman, Meir and Hajaj, Chen},
title = {Cleaner Adversarial CAPTCHAs: Intelligent Targets and Precise Noise for Usable Security},
booktitle = {Proceedings of the 25th International Conference on Autonomous Agents and Multiagent Systems (AAMAS 2026)},
year = {2026}
}
Product Pricing by Multidimensional Similarity: A Multimodal Attention Framework Using Image, Text, and Temporal Representations
Eylon Yehiel, Anat Goldstein, and Chen Hajaj
ConferenceProceedings of the 20th ILAIS Conference
@inproceedings{yehiel2026ilais,
author = {Yehiel, Eylon and Goldstein, Anat and Hajaj, Chen},
title = {Product Pricing by Multidimensional Similarity: A Multimodal Attention Framework Using Image, Text, and Temporal Representations},
booktitle = {Proceedings of the 20th ILAIS Conference},
year = {2026},
month = jul,
address = {Peres Academic Center, Israel},
note = {Best Paper Award (research-in-progress) -- Second Place},
month_numeric = {7}
}
FALCON: Few-shot ANN for Low-latency Classification in O-RAN Networks
Liav Cohen, Amit Dvir, and Chen Hajaj
ConferenceProceedings of the IEEE International Workshop on Computer-Aided Modeling and Design of Communication Links and Networks (CAMAD)
@inproceedings{cohen2026falcon,
author = {Cohen, Liav and Dvir, Amit and Hajaj, Chen},
title = {{FALCON}: Few-shot {ANN} for Low-latency Classification in {O-RAN} Networks},
booktitle = {Proceedings of the IEEE International Workshop on Computer-Aided Modeling and Design of Communication Links and Networks (CAMAD)},
year = {2026},
note = {Session: AI-Driven 6G Cloud, O-RAN and Network Orchestration}
}
@article{klein2026graphmux,
author = {Klein, M. and Marbel, Revital and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
title = {GraphMux: A graph-based framework for encrypted traffic classification},
journal = {Computer Networks},
year = {2026},
doi = {10.1016/j.comnet.2026.112370},
url = {https://doi.org/10.1016/j.comnet.2026.112370}
}
Objective: This study investigates the predictive role of nutritional factors and gastrointestinal dysfunction in determining mortality among critically ill patients admitted to the intensive care unit (ICU). Our goal is to enhance mortality prediction by incorporating detailed nutritional and clinical data collected during the first 48 hours following ICU admission. Methods: The study included data from 2,942 patients admitted to Beilinson Hospital ICU. Variables collected comprised nutritional measures, gastrointestinal dysfunction symptoms, patient demographics, vital signs, respiratory parameters, and laboratory results. For each clinical variable, per-patient 48-hour summary statistics were derived. Three feature selection strategies were compared: stepwise Cox proportional hazards modeling, Random Forest feature importance, and Principal Component Analysis (PCA). For each feature set, we developed Random Survival Forest (RSF) models and evaluated predictive performance using six-fold cross-validation. Performance evaluation included the Concordance Index (CI), time-dependent AUC at 10 days, and Integrated Brier Score (IBS ≤10 days) for Random Survival Forest models, while Akaike Information Criterion (AIC) and CI were used to monitor model fit and discrimination during stepwise Cox proportional hazards feature selection. Results: The stepwise-selected feature set produced the most accurate model (CI=0.76) and achieved the strongest overall performance across complementary metrics (AUC10d=0.874, IBS ≤10 d=0.049). The Random Forest–selected feature set performed closely behind (CI=0.747; AUC10d=0.872; IBS ≤10 d=0.050). PCA-based feature reduction resulted in substantially poorer discrimination (CI=0.73) and higher prediction error (AUC10d=0.715; IBS ≤10 d=0.068). Across approaches, nutritional and gastrointestinal (GI) dysfunction variables, including nasogastric output, feeding tolerance, and timing of enteral nutrition, emerged as important predictors of early mortality. Conclusion: Our findings underscore the critical importance of early nutritional intervention and GI dysfunction management for ICU patient survival. The study demonstrates that targeted feature selection, which incorporates clinical insight, yields superior discriminative performance compared with purely data-driven reduction methods. Future research should validate these models externally and integrate real-time monitoring data to further refine clinical decision-making and improve patient outcomes in ICU settings.
@article{goldstein2025_survival_forest_icu,
author = {Goldstein, Anat and Hajaj, Chen and Singer, Pierre and Raphaeli, Orit},
title = {Survival Forest Models for ICU Mortality Prediction based on Nutrition and Clinical Factors},
journal = {IEEE Access},
year = {2025},
doi = {10.1109/access.2025.3649629}
}
File type classification is critical in digital forensics, and file carving. However, the increasing diversity of file formats challenges accurate classification. Traditional methods rely on hand-crafted features or compact neural networks but face long training times, limited training data, and lower accuracy. This paper introduces three novel, content-based file-type classification approaches to address these challenges. These approaches improve accuracy and streamline the integration of new file types using pre-trained models, enhancing both speed and reliability. The first approach utilizes Natural Language Processing (NLP) with a transformer architecture, while the second combines statistical features with a pre-trained model via transfer learning. These methods achieved accuracy rates of 72.4 % and 69.2 %, respectively, surpassing state-of-the-art Convolutional Neural Network (CNN) models. The third approach employs one-shot learning, achieving 100 % accuracy in several scenarios, enabling efficient training with minimal data.
@inproceedings{lisker2025optimized,
title = {Optimized File Type Detection and One-Shot Retrieval},
pages = {1121--1126},
author = {Lisker, Simona and Butman, Ayelet and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
booktitle = {Proceedings of the IEEE International Conference on Communications (ICC 2025)},
series = {ICC},
year = {2025},
doi = {10.1109/icc52391.2025.11161523}
}
The increasing sophistication and frequency of cyberattacks have made Network Intrusion Detection Systems (NIDS) a critical component of modern cybersecurity. This work presents D-MAGIC, a novel real-time NIDS that leverages zero-shot learning and graph-based dynamic clustering to detect known and unknown threats. Unlike traditional systems that rely on labeled datasets and predefined attack signatures, D-MAGIC operates unsupervised, identifying anomalies by detecting deviations from normal network behavior. By embedding the relationships between network flows into a graph structure and dynamically clustering similar patterns, D-MAGIC can detect coordinated attacks and emerging threats with minimal delay. Experimental results on the CIC-IDS-2017 and CSE-CIC-IDS-2018 datasets demonstrate that D-MAGIC achieves an improvement of up to 12 % based on the standard F1 score compared to state-of-the-art methods, while significantly reducing false positives and ensuring rapid, real-time detection with minimal detection latency.
@inproceedings{simhon2025dmagic,
title = {A New D-MAGIC: Dynamic Model for Cybersecurity Attack Detection Using GNNs into Clustering},
author = {Simhon, Zohar and Weiss, Matan and Hajaj, Chen and Marbel, Revital and Dubin, Ran and Dvir, Amit},
booktitle = {Proceedings of the IEEE International Conference on Communications},
series = {ICC},
year = {2025},
doi = {10.1109/icc52391.2025.11160734}
}
The increasing popularity of online services has made Internet Traffic Classification a critical field of study. However, the rapid development of internet protocols and encryption limits usable data availability. This paper addresses the challenges of classifying encrypted Internet Traffic, focusing on the scarcity of open-source datasets and limitations of existing ones. We propose two Data Augmentation (DA) techniques to synthetically generate data based on real samples: Average augmentation and MTU augmentation. Both augmentations are aimed to improve the performance of the classifier, each from a different perspective: The Average augmentation aims to increase dataset size by generating new synthetic samples, while the M T U augmentation enhances classifier robustness to varying Maximum Transmission Units (MTUs). Our experiments, conducted on two well-known academic datasets and a commercial dataset, demonstrate the effectiveness of these approaches in improving model performance and mitigating constraints associated with limited and homogeneous datasets. Our findings underscore the potential of data augmentation in addressing the challenges of modern Internet Traffic classification. Specifically, we show that our augmentation techniques significantly enhance encrypted traffic classification models. This improvement can positively impact user Quality of Experience (QoE) by more accurately classifying traffic as video streaming (e.g., YouTube) or chat (e.g., Google Chat). Additionally, it can enhance Quality of Service (QoS) for file downloading activities (e.g., Google Docs).
@inproceedings{zion2025enhancing,
title = {Enhancing Encrypted Internet Traffic Classification Through Advanced Data Augmentation Techniques},
author = {Zion, Yehonatan and Aharon, Porat and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
booktitle = {Proceedings of the IEEE International Conference on Communications},
series = {ICC},
year = {2025},
doi = {10.1109/icc52391.2025.11160885}
}
Post-quantum cryptography (PQC) is expected to revolutionize secure communications in next-generation digital ecosystems. Previous and ongoing activities demonstrate that different PQC algorithms significantly impact traffic latency, but they do not yet provide a scheme to assess the existence of the PQC algorithm or its identification when encrypted traffic is analyzed for traffic engineering purposes. Hence, this work is the first to propose a novel PQClass pipeline for classifying encrypted Internet traffic of recently NIST-approved PQC algorithms. Hence, it establishes solid grounds for enabling engineers to optimize their networks and, in parallel, for cybersecurity practitioners to familiarise themselves with PQC algorithmic properties for enhancing or devising security architectures in diverse setups. Our pipeline demonstrates impressive performance on real-world data, achieving 86% accuracy in detecting the presence of a PQC algorithm and 91% and 98% accuracy in identifying the browser and OS, respectively, based on PQC-based traffic.
@inproceedings{marnerides2025pqclass,
title = {PQClass: Classification of Post-Quantum Encryption Applications in Internet Traffic},
author = {Marnerides, Angelos and Hajaj, Chen and Marbel, Revital and Dubin, Ran and Dvir, Amit},
booktitle = {Proceedings of the IEEE International Conference on Communications},
series = {ICC},
year = {2025},
doi = {10.1109/icc52391.2025.11160818}
}
Sentiment Analysis of Student-Tutor Interactions in VR Design Crits
Hadas Sopher, Chen Hajaj, and John S Gero
ConferenceThe Association for Computer-Aided Architectural Design Research in Asia (CAADRIA)
This research evaluates the effectiveness of using immersive VR media in tutor-student interactions in design studio crits as they progress by generating new concepts. Crit interactions, a core educational component in design education, encourage learner-centredness in concept generation. However, the interaction is often tutor-centric, resulting in sentiments that may hinder participation. Immersive VR media offer a new opportunity for design crits to interact at a tangible real-scale display of the design, potentially altering participants’ sentiments. Research lacks evidence on the cognitive effect of this high-end technology on design learning. This gap produces limitations: assessing the effectiveness of immersive media to improve concept generation and understanding the role of sentiments in this process. We conducted a natural experiment comparing crits given to ten students in immersive and non-immersive media. We then employed natural language processing techniques to measure the distribution and temporal distribution of new concepts generated within either positive or negative sentiment for each medium. Findings exhibit significant differences in concept generation per sentiment within the medium used, with a higher rate of concepts in immersive VR. These demonstrate its role in enhancing stimuli to support learner ideation and advance design studio education.
@inproceedings{sopher2025sentiment,
title = {Sentiment Analysis of Student-Tutor Interactions in VR Design Crits},
author = {Sopher, Hadas and Hajaj, Chen and Gero, John S},
year = {2025},
booktitle = {The Association for Computer-Aided Architectural Design Research in Asia (CAADRIA)}
}
Application Programming Interface (API) Injection attacks refer to the unauthorized or malicious use of APIs, which are often exploited to gain access to sensitive data or manipulate online systems for illicit purposes. Identifying actors that deceitfully utilize an API poses a demanding problem. Although there have been notable advancements and contributions in the field of API security, there remains a significant challenge when dealing with attackers who use novel approaches that don’t match the well-known payloads commonly seen in attacks. Also, attackers may exploit standard functionalities unconventionally and with objectives surpassing their intended boundaries. Thus, API security needs to be more sophisticated and dynamic than ever, with advanced computational intelligence methods, such as machine learning models that can quickly identify and respond to abnormal behavior. In response to these challenges, we propose a novel unsupervised few-shot anomaly detection framework composed of two main parts: First, we train a dedicated generic language model for API based on FastText embedding. Next, we use Approximate Nearest Neighbor search in a classification-by-retrieval approach. Our framework allows for training a fast, lightweight classification model using only a few examples of normal API requests. We evaluated the performance of our framework using the CSIC 2010 and ATRDF 2023 datasets. The results demonstrate that our framework improves API attack detection accuracy compared to the state-of-the-art (SOTA) unsupervised anomaly detection baselines.
@article{aharon2025classification,
title = {A Classification-by-Retrieval Framework for Few-Shot Anomaly Detection to Detect API Injection},
author = {Aharon, Udi and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
journal = {Computers \& Security},
volume = {150},
pages = {104249},
year = {2025},
publisher = {Elsevier Advanced Technology},
doi = {10.1016/j.cose.2024.104249}
}
Predicting Onset and Progression of Neurodegenerative Diseases Using Blood Test Data and Machine Learning Models
Amir Glik, Chen Hajaj, Orit Rephaeli, and Anat Goldstein
PatentUS Patent App. 18/910,178
@misc{glik2025predicting,
title = {Predicting Onset and Progression of Neurodegenerative Diseases Using Blood Test Data and Machine Learning Models},
author = {Glik, Amir and Hajaj, Chen and Rephaeli, Orit and Goldstein, Anat},
year = {2025},
month = jan,
note = {US Patent App. 18/910,178},
month_numeric = {1}
}
The growing complexity of the digital environment has increased the need for proactive and intelligence-based approaches to cybersecurity. This study examines the role of open-source intelligence (OSINT) as a strategic tool in proactive cybersecurity operations. Drawing on a wide range of peer-reviewed literature and professional sources, it reviews definitions, operational processes, areas of application, benefits, and challenges associated with OSINT. The analysis highlights OSINT’s contribution to situational awareness, early threat detection, and cyber threat intelligence (CTI) capabilities. By using publicly accessible data from the internet and social platforms, organizations can strengthen their defensive posture against diverse cyber threats. The study outlines workflows for collecting and analyzing OSINT, with attention to its integration into organizational intelligence frameworks and cybersecurity strategies. Examples from both the public and private sectors demonstrate how OSINT supports decision-making, incident response, and preparedness for emerging threats. The review also considers OSINT’s main advantages, including cost effectiveness, accessibility, and real-time relevance, alongside its main challenges such as data reliability, legal concerns, and information overload. The findings suggest that, despite these limitations, OSINT has significant potential to enhance proactive cybersecurity measures, support compliance with standards, assist law enforcement, prevent terrorism, and contribute to business decision-making. The paper concludes with a call for further research on integration with advanced technologies, real-time data analysis, and effective intelligence collaboration.
@article{11143131,
author = {Avrahami, Zafrir and Zwilling, Moti and Hajaj, Chen},
journal = {IEEE Access},
title = {Leveraging OSINT for Advanced Proactive Cybersecurity: Strategies and Solutions},
year = {2025},
volume = {13},
number = {},
pages = {154229-154250},
keywords = {Cyber threat intelligence;Computer security;Organizations;Social networking (online);Security;Law enforcement;Decision making;Blogs;Reliability;Real-time systems;Open-source intelligence;OSINT;cyber threat intelligence;CTI;intelligence cycle;proactive cybersecurity},
doi = {10.1109/ACCESS.2025.3603868}
}
Additive manufacturing (AM) has expanded significantly, particularly in aerospace; however, AM materials often have defects that impair fatigue performance. This study examines the geometry and morphology of critical defects in Ti‐6Al‐4V specimens produced using three printing quality settings, followed by hot isostatic pressing (HIP) or heat treatment (HT). We present an automated fatigue failure analysis framework using computer vision and AI to identify critical defects, measure surface proximity, and quantify 14 geometric and morphological features. The model achieved a mean IoU of 0.836 and approximately 10% error in feature measurement. Results show that surface proximity is the most influential factor on fatigue life, with near‐surface defects degrading performance for HT specimens with lack‐of‐fusion (LOF) defects. For HIP specimens, failure sources were typically within 0.16–0.6 mm from the surface. Additionally, for LOF defects, the ‐parameter model achieved with measured cycles to failure.
@article{lang2025ffe,
author = {Lang, Ro'i and Anidjar, Or Haim and Slonimsky, Sahar and Hajaj, Chen and Golan, Oz and Matias, Carmel and Diskin, Alex and Evgeny, Strokin and Mega, Mor},
title = {Measuring and Analyzing Defects of Additive Manufactured Ti-6Al-4V Specimens Through Image Segmentation},
journal = {Fatigue \& Fracture of Engineering Materials \& Structures},
volume = {48},
number = {12},
pages = {5112-5129},
year = {2025},
doi = {10.1111/ffe.70084}
}
@inproceedings{meiri2025outofdistribution,
author = {Meiri, Itay and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
title = {Out-Of-Distribution Is Not Magic: The Clash Between Rejection Rate and Model Success},
pages = {345--350},
series = {Annals of Computer Science and Information Systems, vol. 43},
booktitle = {Proceedings of the 20th Conference on Computer Science and Intelligence Systems (FedCSIS 2025)},
year = {2025},
doi = {10.15439/2025F5708},
url = {https://doi.org/10.15439/2025F5708}
}
@misc{glik2025routine,
author = {Glik, A. and Arbiv, Omry and Prado, Keshet and Raphaeli, Orit and Raclaw, Hayim and Kait, Roy and Kait, Ofri and Goldstein, Anat and Hajaj, Chen},
title = {Routine Blood Count and Chemistry can predict AD dementia risk up to Ten years Ahead},
howpublished = {Conference abstract (AAIC 2025), Alzheimer's \& Dementia 21(S2):e102512},
year = {2025},
doi = {10.1002/alz70856_102512},
url = {https://doi.org/10.1002/alz70856_102512}
}
Background The global mortality and morbidity rates of bronchiectasis patients due to nontuberculous mycobacteria (NTM) pulmonary infection are on a concerning upward trend. The aims of this study to identify the phenotype of NTM-positive individuals with bronchiectasis. Methods A retrospective single-center observational study was conducted in adult patients with bronchiectasis who underwent bronchoscopy in 2007-2020. Clinical, laboratory, pulmonary function, and radiological data were compared between patients with a positive or negative NTM culture. Results Compared to the NTM-negative group (n=677), the NTM-positive group (n=94) was characterized (P ≤0.05 for all) by older age, greater proportion of females, and higher rates of gastroesophageal reflux disease and muco-active medication use; lower body mass index, serum albumin level, and lymphocyte and eosinophil counts; lower values of forced expiratory volume in one second, forced vital capacity, and their ratio, and lower diffusing lung capacity for carbon monoxide; higher rates of bronchiectasis in both lungs and upper lobes and higher number of involved lobes; and more exacerbations in the year prior bronchoscopy. On multivariate analysis, older age (OR 1.05, 95% CI 1.02-1.07, P=0.001), lower body mass index (OR 1.16, 95% CI 1.16-1.07, P <0.001), and increased number of involved lobes (OR 1.26, 95% CI 1.01-1.44, P=0.04) were associated with NTM infection. Conclusions Patients with bronchiectasis and NTM pulmonary infection are more likely to be older and female with more severe clinical, laboratory, pulmonary function, and radiological parameters than those without NTM infection. This phenotype can be used for screening patients with suspected NTM disease.
@article{frajman2024phenotypical,
title = {Phenotypical Characteristics of Nontuberculous Mycobacterial Infection in Patients with Bronchiectasis},
author = {Frajman, Assaf and Izhakian, Shimon and Mekiten, Ori and Hadar, Ori and Lichtenstadt, Ariel and Hajaj, Chen and Shchori, Shon and Heching, Moshe and Rosengarten, Dror and Kramer, Mordechai R},
journal = {Respiratory Research},
volume = {25},
number = {1},
pages = {278},
year = {2024},
publisher = {Springer},
doi = {10.1186/s12931-024-02904-0}
}
Warm Recommendation: Enhancing Cold Start Recommendations Using Multimodal Product Representations
Anat Goldstein, Amit Alony, and Chen Hajaj
ConferenceInternational Conference on Information Systems (ICIS)
In the domain of online recommendation systems, the cold-start problem presents a persistent challenge, particularly acute within the fashion industry with rapid product turnover. Our study introduces a novel two-phase solution to generate recommendations when no prior user-item interactions exist. The first phase generates new item embeddings based on images, text descriptions, and attributes, then identifies the most similar existing item. The second phase utilizes a pre-established item-network to find items frequently purchased with the identified similar item. Our approach also enhances collaborative filtering when user history is available. Preliminary results, based on data from H&M’s store, indicate our method’s enhanced performance, with multimodal embeddings, outperforming individual modalities. Furthermore, incorporating our method into a collaborative-filtering algorithm yielded a relative improvement of 7% in hit-rate in an item cold-start scenario. This approach does not require retraining for new items or users, thus offering a promising solution to e-commerce’s prevalent cold-start issue.
@inproceedings{goldstein2024warm,
title = {Warm Recommendation: Enhancing Cold Start Recommendations Using Multimodal Product Representations},
author = {Goldstein, Anat and Alony, Amit and Hajaj, Chen},
year = {2024},
booktitle = {International Conference on Information Systems (ICIS)}
}
The accurate identification of internet traffic is crucial for network management. However, the use of encryption techniques and constant changes in network protocols make it difficult to extract useful features for traffic classification. Additionally, there may be limited data availability and a lack of diversity within the dataset, which poses further challenges. To address these issues, our research proposes a novel solution that uses an innovative data augmentation technique. This approach leverages the capabilities of LSTM networks to create synthetic data points that closely resemble real traffic data. By doing so, we can significantly enrich the dataset used for training and improve classification efficiency. We conducted thorough experiments to validate our approach and found that combining LSTM-generated data with actual traffic data leads to notable improvements in classification efficiency. We demonstrated the effectiveness of our methodology using academic and commercial datasets. Our classifier, trained on the generated data, showed a performance boost of 6%. Moreover, when classifying with only half of the time, thus utilizing half of the signal, our approach achieved a notable 4% improvement compared to the original classifier. The inclusion of augmented samples within the training set led to a noticeable improvement in both accuracy and F1-score. These findings compellingly demonstrate our data augmentation strategy’s practical utility and efficiency in earlier prediction with improved performance for encrypted traffic classification systems.
@article{hajaj2024art,
title = {The Art of Time-Bending: Data Augmentation and Early Prediction for Efficient Traffic Classification},
author = {Hajaj, Chen and Aharon, Porat and Dubin, Ran and Dvir, Amit},
journal = {Expert Systems with Applications},
volume = {252},
pages = {124166},
year = {2024},
publisher = {Pergamon},
doi = {10.1016/j.eswa.2024.124166}
}
Encrypted network traffic Classification tackles the problem from different approaches and with different goals. One of the common approaches is using Machine learning or Deep Learning-based solutions on a fixed number of classes, leading to misclassification when an unknown class is given as input. One of the solutions for handling unknown classes is to retrain the model, however, retraining models every time they become obsolete is both resource and time-consuming. Therefore, there is a growing need to allow classification models to detect and adapt to new classes dynamically, without retraining, but instead able to detect new classes using few shots learning [1]. In this paper, we introduce Adaptive Classification By Retrieval CBR, a novel approach for encrypted network traffic classification. Our new approach is based on an ANN-based method, which allows us to effectively identify new and existing classes without retraining the model. The novel approach is simple, yet effective and achieved similar results to RF with up to 5% difference (usually less than that) in the classification tasks while having a slight decrease in the case of new samples (from new classes) without retraining. To summarize, the new method is a real-time classification, which can classify new classes without retraining. Furthermore, our solution can be used as a complementary solution alongside RF or any other machine/deep learning classification method, as an aggregated solution.
@misc{lukach2024cbr,
title = {CBR--Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-Distribution},
doi = {10.48550/arXiv.2403.11206},
howpublished = {arXiv preprint arXiv:2403.11206},
author = {Lukach, Amir and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
year = {2024}
}
This work-in-progress research presents a novel approach to assessing tutor-student interactions in design studio critiques, thereby advancing studio assessment methodologies. Following constructivist theories, students learn by practicing professional design behaviors. They introduce new concepts and progress according to the tutor’s feedback and demonstration. Despite their principal role, critique interactions are often tutor-centric and ambiguous, resulting in negative sentiments that may hinder participation. Current methods measure solely learners’ performance of design practices while neglecting the cognitive actions involved, such as the learner’s sentiment. This gap limits assessing the effectiveness of the interaction. In this study, we measure the effect of sentiment on introducing new design concepts, identified as first occurrences (FOs). We demonstrate the approach in two natural case studies comprising six critiques of three CS students and three Architecture students. NLP algorithms are developed to quantify the distribution of FOs generated by students and tutors within positive and negative sentiment environments. Changes in the sentiment throughout critiques measure the temporal role of sentiment in generating FOs. Observations exhibit differences in sentiment between CS and Architecture students. In both courses, more learner-centric FOs occurred in a positive sentiment environment. Using explicit assessment methods opens new possibilities for establishing real-time feedback systems, leading studio-based education to its next step in reshaping constructivist pedagogy.
@inproceedings{sopher2024wip,
title = {Exploring the Role of Sentiment in Tutor-Student Interaction. The Case Study of CS and Architecture Formative Studio Critiques},
author = {Sopher, Hadas and Hajaj, Chen and Gero, John S},
booktitle = {2024 IEEE Frontiers in Education Conference (FIE)},
pages = {1--4},
year = {2024},
organization = {IEEE},
doi = {10.1109/fie61694.2024.10893114}
}
Few-Shot API Attack Detection: Overcoming Data Scarcity with GAN-Inspired Learning
Udi Aharon, Revital Marbel, Ran Dubin, Amit Dvir, and Chen Hajaj
PreprintarXiv preprint arXiv:2405.11258
Web applications and APIs face constant threats from malicious actors seeking to exploit vulnerabilities for illicit gains. To defend against these threats, it is essential to have anomaly detection systems that can identify a variety of malicious behaviors. However, a significant challenge in this area is the limited availability of training data. Existing datasets often do not provide sufficient coverage of the diverse API structures, parameter formats, and usage patterns encountered in real-world scenarios. As a result, models trained on these datasets often struggle to generalize and may fail to detect less common or emerging attack vectors. To enhance detection accuracy and robustness, it is crucial to access larger and more representative datasets that capture the true variability of API traffic. To address this, we introduce a GAN-inspired learning framework that extends limited API traffic datasets through targeted, domain-aware synthesis. Drawing on techniques from Natural Language Processing (NLP), our approach leverages Transformer-based architectures, particularly RoBERTa, to enhance the contextual representation of API requests and generate realistic synthetic samples aligned with security-specific semantics. We evaluate our framework on two benchmark datasets, CSIC 2010 and ATRDF 2023, and compare it with a previous data augmentation technique to assess the importance of domain-specific synthesis. In addition, we apply our augmented data to various anomaly detection models to evaluate its impact on classification performance. Our method achieves up to a 4.94% increase in F1 score on CSIC 2010 and up to 21.10% on ATRDF 2023. The source codes of this work are available at this https URL.
@misc{aharon2024few,
title = {Few-Shot API Attack Detection: Overcoming Data Scarcity with GAN-Inspired Learning},
howpublished = {arXiv preprint arXiv:2405.11258},
author = {Aharon, Udi and Marbel, Revital and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
year = {2024}
}
@article{anidjar2024extending,
title = {Extending Limited Datasets with GAN-Like Self-Supervision for SMS Spam Detection},
author = {Anidjar, Or Haim and Marbel, Revital and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
journal = {Computers \& Security},
volume = {145},
pages = {103998},
year = {2024},
publisher = {Elsevier Advanced Technology},
doi = {10.1016/j.cose.2024.103998}
}
Internet traffic classification plays a key role in network visibility, Quality of Services (QoS), intrusion detection, Quality of Experience (QoE) and traffic-trend analyses. In order to improve privacy, integrity, confidentiality, and protocol obfuscation, the current traffic is based on encryption protocols, e.g., SSL/TLS. With the increased use of Machine-Learning (ML) and Deep-Learning (DL) models in the literature, comparison between different models and methods has become cumbersome and difficult due to a lack of a standardized framework. In this paper, we propose an open-source framework, named OSF-EIMTC, which can provide the full pipeline of the learning process. From the well-known datasets to extracting new and well-known features, it provides implementations of well-known ML and DL models (from the traffic classification literature) as well as evaluations. Such a framework can facilitate research in traffic classification domains, so that it will be more repeatable, reproducible, easier to execute, and will allow a more accurate comparison of well-known and novel features and models.
@article{bader2024osf,
title = {OSF-EIMTC: An Open-Source Framework for Standardized Encrypted Internet Traffic Classification},
author = {Bader, Ofek and Lichy, Adi and Dvir, Amit and Dubin, Ran and Hajaj, Chen},
journal = {Computer Communications},
volume = {213},
pages = {271--284},
year = {2024},
publisher = {Elsevier},
doi = {10.1016/j.comcom.2023.10.011}
}
In recent years, privacy and security concerns have led to the wide adoption of encrypted protocols, making encrypted traffic a major portion of overall communications online. The transition into more secure protocols poses significant challenges for internet service providers to utilize traditional traffic classification techniques in order to guarantee the Quality of Service (QoS), Quality of Experience (QoE), and cyber-security of their customers. In this work, we introduce two methods, namely STFT-TC and DWT-TC, leveraging compact time-series representation coupled with well-known techniques from the field of Digital Signal Processing (DSP): the short-time Fourier transform (STFT) and the discrete wavelet transform (DWT). The STFT-TC method extracts a suite of statistical and spectral features from the magnitude spectrogram, offering a fresh perspective on interpreting and classifying encrypted traffic. The DWT-TC method extracts statistical features from the wavelet coefficients and incorporates unique characteristics that describe the signal’s shape and energy distribution. Evaluating our methods on two public QUIC datasets demonstrated improvements in accuracy of up to 5.7%. Similarly, the F1-scores also showed enhancements, with increments of up to 5.9% for the same datasets.
@inproceedings{dillbary2024hidden,
title = {Hidden in Time, Revealed in Frequency: Spectral Features and Multiresolution Analysis for Encrypted Internet Traffic Classification},
author = {Dillbary, Nathan and Yozevitch, Roi and Dvir, Amit and Dubin, Ran and Hajaj, Chen},
booktitle = {2024 IEEE 21st Consumer Communications \& Networking Conference (CCNC)},
pages = {266--271},
year = {2024},
organization = {IEEE},
doi = {10.1109/ccnc51664.2024.10454807}
}
E-tourism websites offer users a vast array of travel destinations and opportunities, necessitating tools that enable destination comparison and intelligent search capabilities. One key requirement for such tools is the ability to measure the similarity between destinations. Over the years, various similarity measurement techniques have been proposed, including user-based and content-based approaches. However, many of these techniques require data preparation or prior domain knowledge from experts. In contrast, this study proposes an innovative approach that requires no prior domain knowledge of flight destinations or their relationships, and utilizes only readily available data. Our approach draws upon concepts from image recognition and natural language processing (NLP) to extract hidden aspects of destinations. Using data from a flight-search website as a testbed, we analyze similarity metrics based on state-of-the-art methods for image recognition, NLP, and product-network analysis. We then compare these metrics to those obtained by human subjects. Our findings suggest that no single method dominates in all aspects, leading us to propose a hybrid method that leverages the strengths of each. The proposed method can be readily applied to measure product similarity in other domains.
@article{goldstein2024measuring,
title = {Measuring Flight-Destination Similarity: A Multidimensional Approach},
author = {Goldstein, Anat and Hajaj, Chen},
journal = {Expert Systems with Applications},
volume = {238},
pages = {121802},
year = {2024},
publisher = {Pergamon},
doi = {10.1016/j.eswa.2023.121802}
}
@misc{zion4654236revolutionizing,
title = {Revolutionizing Our Way to Better Classifiers: Leveraging Synthetic Data with Generative Models for Encrypted Network Traffic Classification},
howpublished = {SSRN preprint 4654236},
author = {Zion, Yehonatan and Hajaj, Chen and Dvir, Amit and Ben-Artzi, Gil and Mahpod, Shahar and Dubin, Ran},
year = {2024},
doi = {10.2139/ssrn.4654236}
}
Speaker Change Detection (SCD) is the problem of splitting an audio-recording by its speaker-turns. Many real-world problems, such as the Speaker Diarization (SD) or automatic speech transcription, are influenced by the quality of the speaker-turns estimation. Previous works have already shown that auxiliary textual information (for mono-lingual systems) can be of great use for detection of speaker-turns and the diarization systems’ performance. In this paper, we suggest a framework for speaker-turn estimation, as well as the determination of clustered speaker identities to the SD system, and examine our approach over a multi-lingual dataset that consists of three mono-lingual datasets—in English, French, and Hebrew. As such, we propose a generic and language-independent framework for the SCD problem that is learned through textual information using state-of-the-art transformer-based techniques and speech-embedding modules. Comprehensive experimental evaluation shows that (i) our multi-lingual SCD framework is competitive enough when compared to a framework over mono-lingual datasets, and that (ii) textual information improves the solution’s quality compared to the speech signal-based approach. In addition, we show that our multi-lingual SCD approach does not harm the performance of SD systems.
@article{anidjar2023speech,
title = {Speech and Multilingual Natural Language Framework for Speaker Change Detection and Diarization},
author = {Anidjar, Or Haim and Est{\`e}ve, Yannick and Hajaj, Chen and Dvir, Amit and Lapidot, Itshak},
journal = {Expert Systems with Applications},
volume = {213},
pages = {119238},
year = {2023},
publisher = {Pergamon},
doi = {10.1016/j.eswa.2022.119238}
}
Thesis. This article provides an analysis of online social interactions in two online Temporary Learning Groups (TLG) and their correlates with both pre-admissions scores and academic achievements. Concept. The function of Social Networking Systems (SNS) use on academic achievements is most often indirectly assessed through surveying attitudes of students and teachers. Contrary to this approach, we directly assessed the content on a TLG and paired it with objective admission scores and academic achievements. Results and conclusion. The results reveal that the content of the discussions on the TLGs is practical, immediate, and focuses on the allocation of information required for academic achievements. The users of the TLGs are usually students with lower admission scores and academic achievements. They use these platforms as a compensating mechanism to improve their achievements. In addition, some of the TLG users serve as maximising agents of other students’ achievements. TLGs’ implications for teaching, class-attendance and level of schooling must be recognised by teachers. Originality. While researchers focus on the presence of SNSs in class and its hampering of schooling by multitasking the effect of TLG activity must also be addressed.
@article{ben2023online,
title = {Online Temporary Learning Groups in Higher Education--Interactions, Compensation, and Maximisation of Achievements in an Israeli Case Study},
author = {Ben-Shalom, Uzi and Hajaj, Chen and Davidovitch, Nitza and Berger, Corinne},
journal = {Journal of Education Culture and Society},
volume = {14},
number = {1},
pages = {619--633},
year = {2023},
doi = {10.15503/jecs2023.1.619.633}
}
Android malware is a continuously expanding threat to billions of mobile users around the globe. Detection systems are updated constantly to address these threats. However, a backlash takes the form of evasion attacks, in which an adversary changes malicious samples in the wild such that they will be misclassified as benign. This paper comprehensively inspects a well-known Android malware detection system, MaMaDroid, which analyzes the control flow graph of the application. Changes in the portion of benign samples in the training set are considered to reveal their effect on the resulting classifier. These changes in the ratio between benign and malicious samples have a clear effect on each of the models, resulting in a decrease of more than 40% in their detection rate, model confidence, and reliability. Moreover, adopted Machine Learning models were implemented as well, including 5-NN, Decision Tree, and Adaboost. Exploration of the six models showed a typical behavior in different cases, of tree-based models and distance-based models. Moreover, three novel attacks that manipulate the Control Flow Graph (CFG) are described for each of the targeted models. The attacks decrease the detection rate of most models to less than 10%, with regards to different ratios of benign to malicious apps. As a result, a new version of MaMaDroid is engineered, which fuses the CFG of the app and static analysis of features of the app. This improved model is proven to be robust against evasion attacks targeting CFG-based models and static analysis models, achieving a detection rate of ∼80%.
@article{berger2023breaking,
title = {Breaking the Structure of MaMaDroid},
author = {Berger, Harel and Dvir, Amit and Mariconti, Enrico and Hajaj, Chen},
journal = {Expert Systems with Applications},
volume = {228},
pages = {120429},
year = {2023},
publisher = {Pergamon},
doi = {10.1016/j.eswa.2023.120429}
}
Covert communication channels are a concept in which a policy-breaking method is used in order to covertly transmit data from inside an organization to an external or accessible point. VoIP and Video systems are exposed to such attacks on different layers, such as the underlying real-time transport protocol (RTP) which uses Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) packet streams to punch a hole through Network address translation (NAT). This paper presents different innovative attack methods utilizing covert communication and RTP channels to spread malware or to create a data leak channel between different organizations. The demonstrated attacks are based on a UDP punch hole created using Skype peer-to-peer video conferencing communication. The different attack methods were successfully able to transmit a small text file in an undetectable manner by observing the communication channel, and without causing interruption to the audio/video channels or creating a noticeable disturbance to the quality. While these attacks are hard to detect by the eye, we show that applying classical Machine Learning algorithms to detect these covert channels on statistical features sampled from the communication channel is effective for one type of attack.
@article{joseph2023detecting,
title = {Detecting Parallel Covert Data Transmission Channels in Video Conferencing Using Machine Learning},
author = {Joseph, Ofir and Elmalech, Avshalom and Hajaj, Chen},
journal = {Electronics},
volume = {12},
number = {5},
pages = {1091},
year = {2023},
publisher = {MDPI},
doi = {10.3390/electronics12051091}
}
Internet traffic classification is widely used to facilitate network management. It plays a crucial role in Quality of Services (QoS), Quality of Experience (QoE), network visibility, intrusion detection, and traffic trend analyses. While there is no theoretical guarantee that deep learning (DL)-based solutions perform better than classic machine learning (ML)-based ones, DL-based models have become the common default. This paper compares well-known DL-based and ML-based models and shows that in the case of malicious traffic classification, state-of-the-art DL-based solutions do not necessarily outperform the classical ML-based ones. We exemplify this finding using two well-known datasets for a varied set of tasks, such as: malware detection, malware family classification, detection of zero-day attacks, and classification of an iteratively growing dataset. Note that, it is not feasible to evaluate all possible models to make a concrete statement, thus, the above finding is not a recommendation to avoid DL-based models, but rather empirical proof that in some cases, there are more simplistic solutions, that may perform even better.
@article{lichy2023rf,
title = {When a RF Beats a CNN and GRU, Together---A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification},
author = {Lichy, Adi and Bader, Ofek and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
journal = {Computers \& Security},
volume = {124},
pages = {103000},
year = {2023},
publisher = {Elsevier Advanced Technology},
doi = {10.1016/j.cose.2022.103000}
}
@misc{raphaeli2023protein,
title = {Protein Intake and Clinical Outcomes of Enterally Fed Critically Ill Patients},
howpublished = {Conference abstract, Clinical Nutrition ESPEN 54:534},
author = {Raphaeli, O and Statlander, L and Hajaj, C and Bendavid, I and Singer, Pierre},
volume = {54},
pages = {534},
year = {2023},
publisher = {Elsevier},
doi = {10.1016/j.clnesp.2022.09.224}
}
Background: The association between gastrointestinal intolerance during early enteral nutrition (EN) and adverse clinical outcomes in critically ill patients is controversial. We aimed to assess the prognostic value of enteral feeding intolerance (EFI) markers during early ICU stays and to predict early EN failure using a machine learning (ML) approach. Methods: We performed a retrospective analysis of data from adult patients admitted to Beilinson Hospital ICU between January 2011 and December 2018 for more than 48 h and received EN. Clinical data, including demographics, severity scores, EFI markers, and medications, along with 72 h after admission, were analyzed by ML algorithms. Prediction performance was assessed by the area under the receiver operating characteristics (AUCROC) of a ten-fold cross-validation set. Results: The datasets comprised 1584 patients. The means of the cross-validation AUCROCs for 90-day mortality and early EN failure were 0.73 (95% CI 0.71–0.75) and 0.71 (95% CI 0.67–0.74), respectively. Gastric residual volume above 250 mL on the second day was an important component of both prediction models. Conclusions: ML underlined the EFI markers that predict poor 90-day outcomes and early EN failure and supports early recognition of at-risk patients. Results have to be confirmed in further prospective and external validation studies.
@article{raphaeli2023using,
title = {Using Machine-Learning to Assess the Prognostic Value of Early Enteral Feeding Intolerance in Critically Ill Patients: A Retrospective Study},
author = {Raphaeli, Orit and Statlender, Liran and Hajaj, Chen and Bendavid, Itai and Goldstein, Anat and Robinson, Eyal and Singer, Pierre},
journal = {Nutrients},
volume = {15},
number = {12},
pages = {2705},
year = {2023},
publisher = {MDPI},
doi = {10.3390/nu15122705}
}
Traffic detection has attracted much attention in recent years, playing an essential role in intrusion detection systems (IDS). This paper proposes a new approach for traffic detection at the packet level, inspired by natural language processing (NLP), using simple contrastive learning of sentence embeddings (SimCSE) as an embedding model. The new approach can learn the features of traffic from raw packet data. Experiments were conducted on two well-known datasets to evaluate our approach. For detecting malicious activity, our model achieved an accuracy of 99.99% on the USTC-TFC2016 dataset, whereas for detecting virtual private network (VPN) activity, our model achieved an accuracy of 99.98% on the ISCXVPN2016 dataset. Furthermore, the resulting model was found to be robust based on zero-day attack detection, which shows the model’s ability to detect attacks that have not been seen before. Experiments show that our approach can effectively detect network traffic and outperforms many other state-of-the-art methods.
@article{bar2022simcse,
title = {SimCSE for Encrypted Traffic Detection and Zero-Day Attack Detection},
author = {Bar, Rotem and Hajaj, Chen},
journal = {IEEE Access},
volume = {10},
pages = {56952--56960},
year = {2022},
publisher = {IEEE},
doi = {10.1109/access.2022.3177272}
}
Android malware is a continuously expanding threat to billions of mobile users around the globe. Detection systems are updated constantly to address these threats. However, a backlash takes the form of evasion attacks, in which an adversary changes malicious samples such that those samples will be misclassified as benign. This paper fully inspects a well-known Android malware detection system, MaMaDroid, which analyzes the control flow graph of the application. Changes to the portion of benign samples in the train set and models are considered to see their effect on the classifier. The changes in the ratio between benign and malicious samples have a clear effect on each one of the models, resulting in a decrease of more than 40% in their detection rate. Moreover, adopted ML models are implemented as well, including 5-NN, Decision Tree, and Adaboost. Exploration of the six models reveals a typical behavior in different cases, of tree-based models and distance-based models. Moreover, three novel attacks that manipulate the CFG and their detection rates are described for each one of the targeted models. The attacks decrease the detection rate of most of the models to 0%, with regards to different ratios of benign to malicious apps. As a result, a new version of MaMaDroid is engineered. This model fuses the CFG of the app and static analysis of features of the app. This improved model is proved to be robust against evasion attacks targeting both CFG-based models and static analysis models, achieving a detection rate of more than 90% against each one of the attacks.
@misc{berger2022mamadroid2,
title = {MaMaDroid2.0--The Holes of Control Flow Graphs},
howpublished = {arXiv preprint arXiv:2202.13922},
author = {Berger, Harel and Hajaj, Chen and Mariconti, Enrico and Dvir, Amit},
year = {2022},
doi = {10.48550/arxiv.2202.13922}
}
Android is the most popular OS worldwide. Therefore, it is a target for various kinds of malware. As a countermeasure, the security community works day and night to develop appropriate Android malware detection systems, with ML-based or DL-based systems considered as some of the most common types. Against these detection systems, intelligent adversaries develop a wide set of evasion attacks, in which an attacker slightly modifies a malware sample to evade its target detection system. In this survey, we address problem-space evasion attacks in the Android OS, where attackers manipulate actual APKs, rather than their extracted feature vector. We aim to explore this kind of attacks, frequently overlooked by the research community due to a lack of knowledge of the Android domain, or due to focusing on general mathematical evasion attacks - i.e., feature-space evasion attacks. We discuss the different aspects of problem-space evasion attacks, using a new taxonomy, which focuses on key ingredients of each problem-space attack, such as the attacker model, the attacker’s mode of operation, and the functional assessment of post-attack applications.
@misc{berger2022problem,
title = {Problem-Space Evasion Attacks in the Android OS: A Survey},
howpublished = {arXiv preprint arXiv:2205.14576},
author = {Berger, Harel and Hajaj, Chen and Dvir, Amit},
year = {2022},
doi = {10.48550/arXiv.2205.14576}
}
Android malware is a spreading disease in the virtual world. Anti-virus and detection systems continuously undergo patches and updates to defend against these threats. Most of the latest approaches in malware detection use Machine Learning (ML). Against the robustifying effort of detection systems, raise the evasion attacks, where an adversary changes its targeted samples so that they are misclassified as benign. This paper considers two kinds of evasion attacks: feature-space and problem-space. Feature-space attacks consider an adversary who manipulates ML features to evade the correct classification while minimizing or constraining the total manipulations. Problem-space attacks refer to evasion attacks that change the actual sample. Specifically, this paper analyzes the gap between these two types in the Android malware domain. The gap between the two types of evasion attacks is examined via the retraining process of classifiers using each one of the evasion attack types. The experiments show that the gap between these two types of retrained classifiers is dramatic and may increase to 96%. Retrained classifiers of feature-space evasion attacks have been found to be either less effective or completely ineffective against problem-space evasion attacks. Additionally, exploration of different problem-space evasion attacks shows that retraining of one problem-space evasion attack may be effective against other problem-space evasion attacks.
@misc{berger2022you,
title = {Do You Think You Can Hold Me? The Real Challenge of Problem-Space Evasion Attacks},
howpublished = {arXiv preprint arXiv:2205.04293},
author = {Berger, Harel and Dvir, Amit and Hajaj, Chen and Ronen, Rony},
year = {2022},
doi = {10.48550/arxiv.2205.04293}
}
@article{goldstein2022hidden,
title = {The Hidden Conversion Funnel of Mobile vs. Desktop Consumers},
author = {Goldstein, Anat and Hajaj, Chen},
journal = {Electronic Commerce Research and Applications},
volume = {53},
pages = {101135},
year = {2022},
publisher = {Elsevier},
doi = {10.1016/j.elerap.2022.101135}
}
Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., CandC, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical weak spots in the structure of defense mechanisms. Since machine learning has become one of the most prominent malware detection methods, a robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits a high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is cut by half, the performance of the classifier is still improved (an increase in the model’s F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust with regard to the adversary’s manipulation. Based on an extensive evaluation of the different feature sets and commonly used classification models, this paper shows that models based on robust features are resistant to malicious perturbations and concurrently are helpful in classifying non-manipulated data.
@article{hajaj2022less,
title = {Less Is More: Robust and Novel Features for Malicious Domain Detection},
author = {Hajaj, Chen and Hason, Nitay and Dvir, Amit},
journal = {Electronics},
volume = {11},
number = {6},
pages = {969},
year = {2022},
publisher = {MDPI},
doi = {10.3390/electronics11060969}
}
The world of malware is shifting towards using encrypted traffic. While encryption improves the privacy of users, it brings challenges in the fields of QoS, QoE, and cybersecurity. Recent state-of-the-art Deep-Learning architectures for encrypted traffic classifications demonstrated superb results in tasks of traffic categorization over encrypted traffic. In this paper, we leverage the feasibility to use such architectures for the tasks of malware detection and classification to gain insights into how well these architectures perform in the domain of malware traffic. Specifically, we present a Deep-Learning model for malware traffic detection and classification (MalDIST), which outperforms both classical ML and DL malware traffic classification models both in terms of detection and classification.
@inproceedings{bader2022maldist,
title = {MalDIST: From Encrypted Traffic Classification to Malware Traffic Detection and Classification},
author = {Bader, Ofek and Lichy, Adi and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
booktitle = {2022 IEEE 19th annual consumer communications \& networking conference (CCNC)},
pages = {527--533},
year = {2022},
organization = {IEEE},
doi = {10.1109/ccnc49033.2022.9700625}
}
Using the Cardio-Vascular Index (CVRI) to Predict Mortality in Septic Shock
O Raphaeli, I Bendavid, C Hajaj, L Statlander, A Goldstein, E Chen, P Singer, and U Gabbay
AbstractConference abstract, ISICEM 2022
@misc{raphaeli2022using,
title = {Using the Cardio-Vascular Index (CVRI) to Predict Mortality in Septic Shock},
howpublished = {Conference abstract, ISICEM 2022},
author = {Raphaeli, O and Bendavid, I and Hajaj, C and Statlander, L and Goldstein, A and Chen, E and Singer, P and Gabbay, U},
year = {2022}
}
@article{berger2022patterns,
author = {Berger, C. and Ben‐Shalom, Uzi and Hajaj, Chen and Davidovich, N.},
title = {Patterns of Activity in Temporary Digital Learning Groups and Their Correlation with Academic Achievement Among University Students in an Israeli University},
journal = {Social Issues in Israel},
year = {2022},
doi = {10.26351/siii/31-2/7},
url = {https://doi.org/10.26351/siii/31-2/7}
}
@misc{low2022a,
author = {Lou, J. and Hajaj, Chen and Vorobeychik, Yevgeniy},
title = {A Rotating Proposer Mechanism for Team Formation},
howpublished = {arXiv preprint arXiv:2204.04251},
year = {2022},
doi = {10.48550/arXiv.2204.04251},
url = {https://doi.org/10.48550/arXiv.2204.04251}
}
Android OS is one of the most popular operating systems worldwide, making it a desirable target for malware attacks. Some of the latest and most important defensive systems are based on machine learning (ML) and cybercriminals continuously search for ways to overcome the barriers posed by these systems. Thus, the focus of this work is on evasion attacks in the attempt to show the weaknesses of state of the art research and how more resilient systems can be built. Evasion attacks consist of manipulating either the actual malicious application (problem-based) or its extracted feature vector (feature-based), to avoid being detected by ML systems. This study presents a set of innovative problem-based evasion attacks against well-known Android malware detection systems, which decrease their detection rate by up to 97%. Moreover, an analysis of the effectiveness of these attacks against VirusTotal (VT) scanners was conducted, empirically showing their efficiency against well-known scanners (e.g., McAfee and Comodo) as well. The VT system proved to be a great candidate for the attacks, as in 98% of the apps, less scanners detected the manipulated apps than the original malicious apps. As not all the attacks are effective in the same manner against the VT scanners, the attack efficiency classifiers are advised. Each classifier predicts the applicability of one of the attacks. The set of classifiers creates an ensemble, which shows high success rates, allowing the attacker to decide which attack is best to use for each malicious app and defense system.
@article{berger2021crystal,
title = {Crystal Ball: From Innovative Attacks to Attack Effectiveness Classifier},
author = {Berger, Harel and Hajaj, Chen and Mariconti, Enrico and Dvir, Amit},
journal = {IEEE Access},
volume = {10},
pages = {1317--1333},
year = {2021},
publisher = {IEEE},
doi = {10.1109/access.2021.3138628}
}
AbstractDecentralized coordination is one of the fundamental challenges for societies and organizations. While extensively explored from a variety of perspectives, one issue that has received limited attention is human coordination in the presence of adversarial agents. We study this problem by situating human subjects as nodes on a network, and endowing each with a role, either regular (with the goal of achieving consensus among all regular players), or adversarial (aiming to prevent consensus among regular players). We show that adversarial nodes are, indeed, quite successful in preventing consensus. However, we demonstrate that having the ability to communicate among network neighbors can considerably improve coordination success, as well as resilience to adversarial nodes. Our analysis of communication suggests that adversarial nodes attempt to exploit this capability for their ends, but do so in a somewhat limited way, perhaps to prevent regular nodes from recognizing their intent. In addition, we show that the presence of trusted nodes generally has limited value, but does help when many adversarial nodes are present, and players can communicate. Finally, we use experimental data to develop computational models of human behavior and explore additional parametric variations: features of network topologies and densities, and placement, all using the resulting data-driven agent-based (DDAB) model.
@article{hajaj2021robust,
title = {Robust Coordination in Adversarial Social Networks: From Human Behavior to Agent-Based Modeling},
author = {Hajaj, Chen and Joveski, Zlatko and Yu, Sixie and Vorobeychik, Yevgeniy},
journal = {Network Science},
volume = {9},
number = {3},
pages = {255--290},
year = {2021},
publisher = {Cambridge University Press},
doi = {10.1017/nws.2021.5}
}
COVID-19 has long become a worldwide pandemic. It is responsible for the death of over two million people and posed an economic recession. This paper studies the spread pattern of COVID-19, aiming to establish a prediction model for this event. We harness Data Mining and Machine Learning methodologies to train regression models to predict the number of confirmed cases in a spatial-temporal space. We introduce an innovative concept ‒ the Center of Infection Mass (CoIM) ‒ adapted from the field of physics. We empirically evaluated our model on western European countries, based on the CoIM index and other features, and showed that a relatively high accurate prediction of the spread can be obtained. Our contribution is twofold: first, we introduced a prediction methodology and proved empirically that a prediction can be made even to the range of over a month; second, we showed promise in adopting the CoIM index to prediction models, when models that adopt the CoIM yield significantly better results than those that discard it. By applying our model, and better controlling the inherent tradeoff between life-saving and economy, we believe that decision-makers can take close to optimal measures. Thus, this methodology may contribute to public welfare.
@article{hirschprung2021prediction,
title = {Prediction Model for the Spread of the COVID-19 Outbreak in the Global Environment},
author = {Hirschprung, Ron S and Hajaj, Chen},
journal = {Heliyon},
volume = {7},
number = {7},
year = {2021},
publisher = {Elsevier},
doi = {10.1016/j.heliyon.2021.e07416}
}
Speaker Change Detection (SCD) is the task of segmenting an input audio-recording according to speaker interchanges. This task is essential for many applications, such as automatic voice transcription or Speaker Diarization (SD). This paper focuses on the essential task of audio segmentation and suggests a word-embedding-based solution for the SCD problem. More-over, we show how to use our approach in order to outperform voice-based solutions for the SD problem. We empirically show that our method can accurately identify the speaker-turns in an audio-recording with 82.12% and 89.02% success in the Recall and F1-score measures.
@inproceedings{anidjar2021thousand,
title = {A Thousand Words Are Worth More Than One Recording: Word-Embedding Based Speaker Change Detection},
author = {Anidjar, Or Haim and Lapidot, Itshak and Hajaj, Chen and Dvir, Amit},
booktitle = {Interspeech},
pages = {3121--3125},
year = {2021},
doi = {10.21437/interspeech.2021-87}
}
Speaker Change Detection (SCD) is the task of segmenting an input audio-recording according to speaker interchanges. Nowadays, many applications, such as Speaker Diarization (SD) or automatic vocal transcription, depend on this segmentation task. In this paper, we focus on the essential task of the SD problem, the audio segmenting process, and suggest a solution for the SCD problem, as well as the assignment of clustered speaker labels for the extracted segments, and applying the solution over two datasets: a commercial dataset in Hebrew and the ICSI Meeting Corpus. As such, we propose a hybrid framework for the SCD problem that is learned by textual information and speech signals and the meta-data features that can be extracted from them. Moreover, we demonstrate the negative correlation between an increase in the number of speakers in the training dataset and the influence on the overall diarization system’s performance, which is improved using our efficient SCD component. Finally, we show how our proposed hybrid framework remains robust compared to the ICSI Meeting Corpus, as the experimental evaluation’s training and testing is based on two languages.
@article{anidjar2021hybrid,
title = {Hybrid Speech and Text Analysis Methods for Speaker Change Detection},
author = {Anidjar, Or Haim and Lapidot, Itshak and Hajaj, Chen and Dvir, Amit and Gilad, Issachar},
journal = {IEEE/ACM Transactions on Audio, Speech, and Language Processing},
volume = {29},
pages = {2324--2338},
year = {2021},
publisher = {IEEE},
doi = {10.1109/taslp.2021.3093817}
}
We introduce a novel representation of packet classifiers allowing to operate on partially available input data varying dynamically. For a given packet classifier, availability of fields or complexity of field computations, and free target specific resources, the proposed infrastructure computes a classifier representation satisfying performance and robustness requirements. We show the feasibility to reconstruct a classification result in this noisy environment, allowing for the improvement of performance and the achievement of additional robustness levels of network infrastructure. Our results are supported by extensive evaluations in various settings where only a partial input is available.
@inproceedings{demianiuk2021pcl,
title = {PCL: Packet Classification with Limited Knowledge},
author = {Demianiuk, Vitalii and Hajaj, Chen and Kogan, Kirill},
booktitle = {IEEE INFOCOM 2021-IEEE Conference on Computer Communications},
pages = {1--10},
year = {2021},
organization = {IEEE},
doi = {10.1109/infocom42981.2021.9488751}
}
@misc{raphaeli2021feeding,
title = {Feeding Intolerance as a Predictor of Clinical Outcomes in Critically Ill Patients: A Machine Learning Approach},
howpublished = {Conference abstract, Clinical Nutrition ESPEN 46:S546--S547},
author = {Raphaeli, O and Hajaj, C and Bendavid, I and Goldstein, A and Chen, E and Singer, P},
volume = {46},
pages = {S546--S547},
year = {2021},
publisher = {Elsevier},
doi = {10.1016/j.clnesp.2021.09.020}
}
Using machine learning to support early prediction of feeding intolerance in critically ill patients
O Raphaeli, C Hajaj, I Bendavid, A Goldstein, E Chen, and P Singer
AbstractConference abstract, ESICM LIVES 2021
BACKGROUND: The association between gastrointestinal intolerance during early enteral nutrition (EN) and adverse clinical outcomes in critically ill patients is controversial. We aimed to assess the prognostic value of enteral feeding intolerance (EFI) markers during early ICU stays and to predict early EN failure using a machine learning (ML) approach. METHODS: We performed a retrospective analysis of data from adult patients admitted to Beilinson Hospital ICU between January 2011 and December 2018 for more than 48 h and received EN. Clinical data, including demographics, severity scores, EFI markers, and medications, along with 72 h after admission, were analyzed by ML algorithms. Prediction performance was assessed by the area under the receiver operating characteristics (AUCROC) of a ten-fold cross-validation set. RESULTS: The datasets comprised 1584 patients. The means of the cross-validation AUCROCs for 90-day mortality and early EN failure were 0.73 (95% CI 0.71-0.75) and 0.71 (95% CI 0.67-0.74), respectively. Gastric residual volume above 250 mL on the second day was an important component of both prediction models. CONCLUSIONS: ML underlined the EFI markers that predict poor 90-day outcomes and early EN failure and supports early recognition of at-risk patients. Results have to be confirmed in further prospective and external validation studies.
@misc{raphaeli2021using,
title = {Using machine learning to support early prediction of feeding intolerance in critically ill patients},
howpublished = {Conference abstract, ESICM LIVES 2021},
author = {Raphaeli, O and Hajaj, C and Bendavid, I and Goldstein, A and Chen, E and Singer, P},
year = {2021}
}
Cyber threat intelligence officers and forensics investigators often require the behavioural profiling of groups based on their online video viewing activity. It has been demonstrated that encrypted video traffic can be classified under the assumption of using a known subset of video titles based on temporal video viewing trends of particular groups. Nonetheless, composing such a subset is extremely challenging in real situations. Therefore, this work exhibits a novel profiling scheme for encrypted video traffic with no a priori assumption of a known subset of titles. It introduces a seminal synergy of Natural Language Processing (NLP) and Deep Encoder-based feature embedding algorithms with refined clustering schemes from off-the-shelf solutions, in order to group viewing profiles with unknown video streams. This study is the first to highlight the most computationally effective, accurate combinations of feature embedding and clustering using real datasets, thereby, paving the way to future forensics tools for automated behavioural profiling of malicious actors.
@article{dvir2020encrypted,
title = {Encrypted Video Traffic Clustering Demystified},
author = {Dvir, Amit and Marnerides, Angelos K and Dubin, Ran and Golan, Nehor and Hajaj, Chen},
journal = {Computers \& Security},
volume = {96},
pages = {101917},
year = {2020},
publisher = {Elsevier Advanced Technology},
doi = {10.1016/j.cose.2020.101917}
}
Robust Machine Learning for Encrypted Traffic Classification
Jonathan Muehlstein, Yehonatan Zion, Ofir Pele, Chen Hajaj, Ran Dubin, and Amit Dvir
PreprintarXiv preprint (CoRR)
Desktops and laptops can be maliciously exploited to violate privacy. In this paper, we consider the daily battle between the passive attacker who is targeting a specific user against a user that may be adversarial opponent. In this scenario, while the attacker tries to choose the best vector attack by surreptitiously monitoring the victims encrypted network traffic in order to identify users parameters such as the Operating System (OS), browser and apps. The user may use tools such as a Virtual Private Network (VPN) or even change protocols parameters to protect his/her privacy. We provide a large dataset of more than 20,000 examples for this task. We run a comprehensive set of experiments, that achieves high (above 85) classification accuracy, robustness and resilience to changes of features as a function of different network conditions at test time. We also show the effect of a small training set on the accuracy.
@misc{muehlstein2020robust,
title = {Robust Machine Learning for Encrypted Traffic Classification},
howpublished = {arXiv preprint (CoRR)},
author = {Muehlstein, Jonathan and Zion, Yehonatan and Pele, Ofir and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
year = {2020}
}
@inproceedings{berger2020evasion,
title = {Evasion Is Not Enough: A Case Study of Android Malware},
doi = {10.1007/978-3-030-49785-9_11},
author = {Berger, Harel and Hajaj, Chen and Dvir, Amit},
booktitle = {Cyber Security Cryptography and Machine Learning (CSCML 2020), LNCS},
pages = {167--174},
year = {2020},
organization = {Springer International Publishing Cham}
}
Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting these attacks, many alarming problems remain open, such as the weak spots of the defense mechanisms. Because ML has become one of the most prominent methods of malware detection, we propose a robust feature selection mechanism that results in malicious domain detection models that are resistant to black-box evasion attacks. This paper makes two main contributions. Our mechanism exhibits high performance based on data collected from 5000 benign active URLs and 1350 malicious active (attacks) URLs. We also provide an analysis of robust feature selection based on widely used features in the literature. Note that even though we cut the feature set dimensional space in half (from nine to four features), we still improve the performance of the classifier (an increase in the model’s F1-score from 92.92% to 95.81%). The fact that our models are robust to malicious perturbations but are also useful for clean data demonstrates the effectiveness of constructing a model that is solely trained on robust features.
@inproceedings{hason2020robust,
title = {Robust Malicious Domain Detection},
author = {Hason, Nitay and Dvir, Amit and Hajaj, Chen},
booktitle = {Cyber Security Cryptography and Machine Learning: Fourth International Symposium, CSCML 2020, Be'er Sheva, Israel, July 2--3, 2020, Proceedings 4},
pages = {45--61},
year = {2020},
organization = {Springer International Publishing},
doi = {10.1007/978-3-030-49785-9_4}
}
Extensive literature exists studying decentralized coordination and consensus, with considerable attention devoted to ensuring robustness to faults and attacks. However, most of the latter literature assumes that non-malicious agents follow simple stylized rules. In reality, decentralized protocols often involve humans, and understanding how people coordinate in adversarial settings is an open problem. We initiate a study of this problem, starting with a human subjects investigation of human coordination on networks in the presence of adversarial agents, and subsequently using the resulting data to bootstrap the development of a credible agent-based model of adversarial decentralized coordination. In human subjects experiments, we observe that while adversarial nodes can successfully prevent consensus, the ability to communicate can significantly improve robustness, with the impact particularly significant in scale-free networks. On the other hand, and contrary to typical stylized models of behavior, we show that the existence of trusted nodes has limited utility. Next, we use the data collected in human subject experiments to develop a data-driven agent-based model of adversarial coordination. We show that this model successfully reproduces observed behavior in experiments, is robust to small errors in individual agent models, and illustrate its utility by using it to explore the impact of optimizing network location of trusted and adversarial nodes.
@inproceedings{hajaj2019adversarial,
title = {Adversarial Coordination on Social Networks},
author = {Hajaj, Chen and Yu, Sixie and Joveski, Zlatko and Vorobeychik, Yevgeniy},
booktitle = {Proceedings of the 18th International Conference on Autonomous Agents and Multiagent Systems},
pages = {1515--1523},
year = {2019},
doi = {10.65109/ckdj6887}
}
Selected: Improving Robustness of ML Classifiers Against Realizable Evasion Attacks Using Conserved Features
Liang Tong, Bo Li, Chen Hajaj, Chaowei Xiao, Ning Zhang, and Yevgeniy Vorobeychik
Machine learning (ML) techniques are increasingly common in security applications, such as malware and intrusion detection. However, ML models are often susceptible to evasion attacks, in which an adversary makes changes to the input (such as malware) in order to avoid being detected. A conventional approach to evaluate ML robustness to such attacks, as well as to design robust ML, is by considering simplified feature-space models of attacks, where the attacker changes ML features directly to effect evasion, while minimizing or constraining the magnitude of this change. We investigate the effectiveness of this approach to designing robust ML in the face of attacks that can be realized in actual malware (realizable attacks). We demonstrate that in the context of structure-based PDF malware detection, such techniques appear to have limited effectiveness, but they are effective with content-based detectors. In either case, we show that augmenting the feature space models with conserved features (those that cannot be unilaterally modified without compromising malicious functionality) significantly improves performance. Finally, we show that feature space models enable generalized robustness when faced with a variety of realizable attacks, as compared to classifiers which are tuned to be robust to a specific realizable attack.
@inproceedings{tong2019improving,
title = {Improving Robustness of ML Classifiers Against Realizable Evasion Attacks Using Conserved Features},
author = {Tong, Liang and Li, Bo and Hajaj, Chen and Xiao, Chaowei and Zhang, Ning and Vorobeychik, Yevgeniy},
booktitle = {28th USENIX Security Symposium (USENIX Security 19)},
pages = {285--302},
year = {2019}
}
The problem of assigning tasks to workers is of long-standing fundamental importance. Examples of this include the classical problem of assigning computing tasks to nodes in a distributed computing environment, assigning jobs to robots, and crowdsourcing. Extensive research into this problem generally addresses important issues such as uncertainty and incentives. However, the problem of adversarial tampering with the task assignment process has not received as much attention. We are concerned with a particular adversarial setting where an attacker may target a set of workers in order to prevent the tasks assigned to these workers from being completed. When all tasks are homogeneous, we provide an efficient algorithm for computing the optimal assignment. When tasks are heterogeneous, we show that the adversarial assignment problem is NP-Hard, and present an algorithm for solving it approximately. Our theoretical results are accompanied by extensive experiments showing the effectiveness of our algorithms.
@inproceedings{hajaj2018adversarial,
title = {Adversarial task assignment},
author = {Hajaj, Chen and Vorobeychik, Yevgeniy},
booktitle = {International Joint Conference on Artificial Intelligence},
pages = {3783--3789},
year = {2018},
doi = {10.24963/ijcai.2018/526}
}
A crowdsourcing framework for medical data sets
Cheng Ye, Joseph Coco, Anna Epishova, Chen Hajaj, Henry Bogardus, Laurie Novak, Joshua Denny, Yevgeniy Vorobeychik, Thomas Lasko, Bradley Malin, and others
ConferenceAMIA Joint Summits on Translational Science Proceedings
Crowdsourcing services like Amazon Mechanical Turk allow researchers to ask questions to crowds of workers and quickly receive high quality labeled responses. However, crowds drawn from the general public are not suitable for labeling sensitive and complex data sets, such as medical records, due to various concerns. Major challenges in building and deploying a crowdsourcing system for medical data include, but are not limited to: managing access rights to sensitive data and ensuring data privacy controls are enforced; identifying workers with the necessary expertise to analyze complex information; and efficiently retrieving relevant information in massive data sets. In this paper, we introduce a crowdsourcing framework to support the annotation of medical data sets. We further demonstrate a workflow for crowdsourcing clinical chart reviews including (1) the design and decomposition of research questions; (2) the architecture for storing and displaying sensitive data; and (3) the development of tools to support crowd workers in quickly analyzing information from complex data sets.
@inproceedings{ye2018crowdsourcing,
title = {A crowdsourcing framework for medical data sets},
booktitle = {AMIA Joint Summits on Translational Science Proceedings},
author = {Ye, Cheng and Coco, Joseph and Epishova, Anna and Hajaj, Chen and Bogardus, Henry and Novak, Laurie and Denny, Joshua and Vorobeychik, Yevgeniy and Lasko, Thomas and Malin, Bradley and others},
volume = {2018},
pages = {273},
year = {2018}
}
Selected: Crowdsourcing Clinical Chart Reviews
Joseph R. Coco, Cheng Ye, Chen Hajaj, Yevgeniy Vorobeychik, J. Denny, L. Novak, B. Malin, T. Lasko, and D. Fabbri
ConferenceAMIA Annual Symposium Proceedings
@inproceedings{coco2018crowdsourcing,
author = {Coco, Joseph R. and Ye, Cheng and Hajaj, Chen and Vorobeychik, Yevgeniy and Denny, J. and Novak, L. and Malin, B. and Lasko, T. and Fabbri, D.},
title = {Crowdsourcing Clinical Chart Reviews},
booktitle = {AMIA Annual Symposium Proceedings},
year = {2018}
}
We model decentralized team formation as a game in which players make offers to potential teams whose members then either accept or reject the offers. The games induce no-delay subgame perfect equilibria with unique outcomes that are individually rational and match soulmates. We provide sufficient conditions for equilibria to implement core coalition structures, and show that when each player can make a sufficiently large number of proposals, outcomes are Pareto optimal. We then design a mechanism to implement equilibrium of this game and provide sufficient conditions to ensure that truthful reporting of preferences is a strong ex post Nash equilibrium. Moreover, we show empirically that players rarely have an incentive to misreport preferences more generally. Furthermore, for the problem with cardinal preferences, we show empirically that the resulting mechanism results in significantly higher social welfare than serial dictatorship, and the outcomes are highly equitable.
@misc{chambers2017non,
title = {Non-Cooperative Team Formation and a Team Formation Mechanism},
howpublished = {SSRN working paper 3054771},
author = {Chambers, Matthew and Hajaj, Chen and Leo, Greg and Lou, Jian and Van der Linden, Martin and Vorobeychik, Yevgeniy and Wooders, Myrna H},
year = {2017},
doi = {10.2139/ssrn.3054771}
}
The plethora of comparison shopping agents (CSAs) in today’s markets enables buyers to query more than a single CSA when shopping, thus expanding the list of sellers whose prices they obtain. This potentially decreases the chance of a purchase within any single interaction between a buyer and a CSA, and consequently decreases each CSAs’ expected revenue per-query. Obviously, a CSA can improve its competence in such settings by acquiring more sellers’ prices, potentially resulting in a more attractive “best price”. In this paper we suggest a complementary approach that improves the attractiveness of the best result returned based on intelligently controlling the order according to which they are presented to the user, in a way that utilizes several known cognitive-biases of human buyers. The advantage of this approach is in its ability to affect the buyer’s tendency to terminate her search for a better price, hence avoid querying further CSAs, without spending valuable resources on finding additional prices to present. The effectiveness of our method is demonstrated using real data, collected from four CSAs for five products. Our experiments confirm that the suggested method effectively influence people in a way that is highly advantageous to the CSA compared to the common method for presenting the prices. Furthermore, we experimentally show that all of the components of our method are essential to its success.
@article{hajaj2017enhancing,
title = {Enhancing Comparison Shopping Agents Through Ordering and Gradual Information Disclosure},
author = {Hajaj, Chen and Hazon, Noam and Sarne, David},
journal = {Autonomous Agents and Multi-Agent Systems},
volume = {31},
number = {3},
pages = {696--714},
year = {2017},
publisher = {Springer US},
doi = {10.1007/s10458-016-9342-8}
}
This paper studies the strategic behavior of platforms that provide agents easier access to the type of opportunities in which they are interested (e.g., eCommerce platforms, used cars bulletins and dating web-sites). We show that under four common service schemes, a platform can benefit from not necessarily listing all the opportunities with which it is familiar, even if there is no marginal cost for listing any additional opportunity. The main implication of this result is that platforms should take the subset of opportunities to be included in their listings as a decision variable, alongside the fees set for the service in their expected-profit maximizing optimization problem. We show that none of the four schemes generally dominates any of the others or is dominated by any. For the case of homogeneous preferences, however, several dominance relationships can be proved. Furthermore, the analysis provides a game-theoretic search-based explanation for a possible preference of buyers to pay for the service rather than receive it for free (e.g., when the service is sponsored by ads). The paper shows that this preference can hold both for the users and the platform simultaneously in a given setting, even if both sides are fully strategic. Finally, the paper analyzes the potential improvement in the platform’s expected profit that can be achieved by considering hybrid service schemes that combine the basic ones. In particular, we focus in the Two-Part Tariff scheme that combines the two commonly used subscription and pay-per-click schemes.
@article{hajaj2017selective,
title = {Selective Opportunity Disclosure at the Service of Strategic Information Platforms},
author = {Hajaj, Chen and Sarne, David},
journal = {Autonomous Agents and Multi-Agent Systems},
volume = {31},
number = {5},
pages = {1133--1164},
year = {2017},
publisher = {Springer US},
doi = {10.1007/s10458-016-9357-1}
}
This paper presents methods for improving the attention span of workers in tasks that heavily rely on their attention to the occurrence of rare events. The underlying idea in our approach is to dynamically augment the task with some dummy (artificial) events at different times throughout the task, rewarding the worker upon identifying and reporting them. The proposed approach is an alternative to the traditional approach of exclusively relying on rewarding the worker for successfully identifying the event of interest itself. We propose three methods for timing the dummy events throughout the task. Two of these methods are static and determine the timing of the dummy events at random or uniformly throughout the task. The third method is dynamic and uses the identification (or misidentification) of dummy events as a signal for the worker’s attention to the task, adjusting the rate of dummy events generation accordingly.
@inproceedings{elmalech2017enhancing,
title = {Enhancing Crowdworkers' Vigilance},
author = {Elmalech, Avshalom and Sarne, David and David, Esther and Hajaj, Chen},
booktitle = {Twenty-Sixth International Joint Conference on Artificial Intelligence (IJCAI-17)},
pages = {4826--4830},
year = {2017},
doi = {10.24963/ijcai.2017/675}
}
@book{ceppi2017agent,
title = {Agent-Mediated Electronic Commerce. Designing Trading Strategies and Mechanisms for Electronic Markets},
doi = {10.1007/978-3-319-54229-4},
note = {Edited volume, AMEC/TADA 2015 and 2016 revised selected papers},
series = {Lecture Notes in Business Information Processing},
author = {Ceppi, Sofia and David, Esther and Hajaj, Chen and Robu, Valentin and Vetsikas, Ioannis A},
year = {2017},
publisher = {Springer}
}
2016
Extending Workers’ Attention Span Through Dummy Events
Avshalom Elmalech, David Sarne, Esther David, and Chen Hajaj
ConferenceProceedings of the AAAI Conference on Human Computation and Crowdsourcing
This paper studies a new paradigm for improving the attention span of workers in tasks that heavily rely on user’s attention to the occurrence of rare events. Such tasks are highly common, ranging from crime monitoring to controlling autonomous complex machines, and many of them are ideal for crowdsourcing. The underlying idea in our approach is to dynamically augment the task with some dummy (artificial) events at different times throughout the task, rewarding the worker upon identifying and reporting them. This, as an alternative to the traditional approach of exclusively relying on rewarding the worker for successfully identifying the event of interest itself. We propose three methods for timing the dummy events throughout the task. Two of these methods are static and determine the timing of the dummy events at random or uniformly throughout the task. The third method is dynamic and uses the identification (or misidentification) of dummy events as a signal for the worker’s attention to the task, adjusting the rate of dummy events generation accordingly. We use extensive experimentation to compare the methods with the traditional approach of inducing attention through rewarding the identification of the event of interest and within the three. The analysis of the results indicates that with the use of dummy events a substantially more favorable tradeoff between the detection (of the event of interest) probability and the expected expense can be achieved, and that among the three proposed method the one that decides on dummy events on the fly is (by far) the best.
@inproceedings{elmalech2016extending,
title = {Extending Workers' Attention Span Through Dummy Events},
author = {Elmalech, Avshalom and Sarne, David and David, Esther and Hajaj, Chen},
booktitle = {Proceedings of the AAAI Conference on Human Computation and Crowdsourcing},
volume = {4},
pages = {42--51},
year = {2016}
}
This thesis explores the use of autonomous agents serving as mediators between different entities in modern markets to maximize an expected revenue (e.g., the agents’ own profit or users’ social welfare). This mediation can take many forms and serve many purposes, such as buyers and sellers at online shopping environments, men and women at dating sites, and different traders at barter markets. These agents differ from one another in terms such as the cost of their mediation services (e.g, they can offer their services for a fee or complimentary). In the first case, when the services are costly, agents must ponder the terms they set for their services. Similarly, when offering their services for free they have to be as appealing as possible in order to overcome external competition. This thesis provides theoretically-justified and empirically-validated approaches for designing and operating intelligent mechanisms for mediation agents in both electronic and barter markets. While two of the mechanisms presented within this thesis guide the platform for how to use selective information disclosure for its benefit, a different one is designed specifically in order to avoid selective information disclosure to the platform. The research is based on both theoretical analysis and online validation of suggested heuristics. Theoretical analysis is carried out using concepts from search theory, and game theory and the online validation is based on Amazon Mechanical Turk, a well-known crowdsourcing platform imitating people’s behavior in real-life.The models used in this thesis consider settings of autonomous, fully-rational, and self-interested agents interacting with both fully-rational agents and bounded-rational people, and how the difference in their decision-making processes may imply differently, yet correlated, strategies for the system designer. The different model variants are applicable and can be mapped onto various different real-life applications (e.g., online shopping, car purchasing, and barter markets). The models differ primarily in the assumptions they make. In electronic markets, assumptions relating to the agents’ source of income and the users’ computational capabilities (fully-rational agents vs. bounded-rational people). For barter markets, this thesis focuses on fully-rational agents that differ in the number of goods they hold and can be traded on the market. Based on the common model for these markets, this thesis provides a proof of impossibility result on the ability to enforce the agents’ strategy-proof behavior regardless of the means used. Still, the thesis shows that by adding a set of real-life assumptions on the model, one can circumvent this impossibility result and validate that the truthful strategy is indeed the dominant one. The analysis is accompanied by extensive simulations and online experiments, making use of various testbeds. The simulations and online experiments are used to validate the applicability of the suggested mechanisms for modern markets and to the different entities populating them.
@phdthesis{hajaj2016intelligent,
title = {Intelligent Mechanisms for Platforms in Modern Markets},
author = {Hajaj, Chen},
year = {2016},
school = {Bar-Ilan University},
doi = {10.31237/osf.io/n5vbs}
}
A new approach for increasing the attractiveness of comparison shopping agents.The approach, selective price-disclosure, affects the buyer’s decision-making.Two methods for selective price-disclosure for fully-rational agents are given.The effectiveness and efficiency of the methods are demonstrated using real data.A third method is experimentally shown to be highly effective with people. The plethora of comparison shopping agents (CSAs) in today’s markets enables buyers to query more than a single CSA when shopping, and an inter-CSAs competition naturally arises. We suggest a new approach, termed "selective price disclosure", which improves the attractiveness of a CSA by removing some of the prices in the outputted list. The underlying idea behind this approach is to affect the buyer’s beliefs regarding the chance of obtaining more attractive prices. The paper presents two methods, which are suitable for fully-rational buyers, for deciding which prices among those known to the CSA should be disclosed. The effectiveness and efficiency of the methods are evaluated using real data collected from five CSAs. The methods are also evaluated with human subjects, showing that selective price disclosure can be highly effective in this case as well; however, the disclosed subset of prices should be extracted in a different (simplistic) manner.
@article{hajaj2015improving,
title = {Improving Comparison Shopping Agents' Competence Through Selective Price Disclosure},
author = {Hajaj, Chen and Hazon, Noam and Sarne, David},
journal = {Electronic Commerce Research and Applications},
volume = {14},
number = {6},
pages = {563--581},
year = {2015},
publisher = {Elsevier},
doi = {10.1016/j.elerap.2015.08.006}
}
In this work, we propose a fully automatic and computationally efficient group registration approach for sets of three-dimensional models represented as mesh objects. Our approach is based on agglomerating the set of pairwise model-to-model rigid registrations by a robust spectral synchronization scheme. The pairwise registration is computed using spectral graph matching applied to meshes via the LD-SIFT local mesh features. We applied the proposed scheme to sets of subcortical surfaces, and it was shown to provide accurate and robust registration results.
@inproceedings{darom2015automatic,
title = {Automatic Anatomical Shape Correspondence and Alignment Using Mesh Features},
author = {Darom, Tal and Gur, Yaniv and Hajaj, Chen and Keller, Yosi},
booktitle = {Biomedical Imaging (ISBI), 2015},
pages = {1530--1534},
year = {2015},
doi = {10.1109/isbi.2015.7164169}
}
Strategy-Proof and Efficient Kidney Exchange Using a Credit Mechanism
Chen Hajaj, John P Dickerson, Avinatan Hassidim, Tuomas Sandholm, and David Sarne
ConferenceIn proceedings of the Twenty-Ninth AAAI Conference on Artificial Intelligence
We present a credit-based matching mechanism for dynamic barter markets—and kidney exchange in particular—that is both strategy proof and efficient, that is, it guarantees truthful disclosure of donor-patient pairs from the transplant centers and results in the maximum global matching. Furthermore, the mechanism is individually rational in the sense that, in the long run, it guarantees each transplant center more matches than the center could have achieved alone. The mechanism does not require assumptions about the underlying distribution of compatibility graphs—a nuance that has previously produced conflicting results in other aspects of theoretical kidney exchange. Our results apply not only to matching via 2-cycles: the matchings can also include cycles of any length and altruist-initiated chains, which is important at least in kidney exchanges. The mechanism can also be adjusted to guarantee immediate individual rationality at the expense of economic efficiency, while preserving strategy proofness via the credits. This circumvents a well-known impossibility result in static kidney exchange concerning the existence of an individually rational, strategy-proof, and maximal mechanism. We show empirically that the mechanism results in significant gains on data from a national kidney exchange that includes 59% of all US transplant centers.
@inproceedings{hajaj2015strategy,
title = {Strategy-Proof and Efficient Kidney Exchange Using a Credit Mechanism},
author = {Hajaj, Chen and Dickerson, John P and Hassidim, Avinatan and Sandholm, Tuomas and Sarne, David},
booktitle = {In proceedings of the Twenty-Ninth AAAI Conference on Artificial Intelligence},
year = {2015}
}
2014
Advanced Service Schemes for a Self-Interested Information Platform
Chen Hajaj, David Sarne, and Lea Perets
ConferenceProceedings of the 2014 international conference on Autonomous agents and multi-agent systems
This paper deals with platforms that bring together agents and opportunities of the type in which they are interested (e.g., eCommerce platforms, used car bulletins and dating web sites). It shows that the platform can benefit from not necessarily listing all of the opportunities that it can potentially list, even if there is no marginal cost for listing any additional opportunity. Two important implications of this result are discussed and demonstrated. The first is that the platform should take into account the option to disclose different subsets of opportunities, whenever setting its expected-profit-maximizing service fee. The second is that from the platform’s users point of view, it might turn out to be more beneficial to pay for the platform’s service rather than get it for free (e.g., when the service is sponsored by ads), as the costly case is characterized by more favorable listings.
@inproceedings{hajaj2014advanced,
title = {Advanced Service Schemes for a Self-Interested Information Platform},
author = {Hajaj, Chen and Sarne, David and Perets, Lea},
booktitle = {Proceedings of the 2014 international conference on Autonomous agents and multi-agent systems},
pages = {1413--1414},
year = {2014}
}
Ordering Effects and Belief Adjustment in the Use of Comparison Shopping Agents
Chen Hajaj, Noam Hazon, and David Sarne
ConferenceProceedings of the Twenty-Eighth AAAI Conference on Artificial Intelligence (AAAI 2014)
The popularity of online shopping has contributed to the development of comparison shopping agents (CSAs) aiming to facilitate buyers’ ability to compare prices of online stores for any desired product. Furthermore, the plethora of CSAs in today’s markets enables buyers to query more than a single CSA when shopping, thus expanding even further the list of sellers whose prices they obtain. This potentially decreases the chance of a purchase based on the prices outputted as a result of any single query, and consequently decreases each CSAs’ expected revenue per-query. Obviously, a CSA can improve its competence in such settings by acquiring more sellers’ prices, potentially resulting in a more attractive “best price”. In this paper we suggest a complementary approach that improves the attractiveness of a CSA by presenting the prices to the user in a specific intelligent manner, which is based on known cognitive-biases. The advantage of this approach is its ability to affect the buyer’s tendency to terminate her search for a better price, hence avoid querying further CSAs, without having the CSA spend any of its resources on finding better prices to present. The effectiveness of our method is demonstrated using real data, collected from four CSAs for five products. Our experiments with people confirm that the suggested method effectively influence peoplein a way that is highly advantageous to the CSA.
@inproceedings{hajaj2014ordering,
title = {Ordering Effects and Belief Adjustment in the Use of Comparison Shopping Agents},
author = {Hajaj, Chen and Hazon, Noam and Sarne, David},
booktitle = {Proceedings of the Twenty-Eighth AAAI Conference on Artificial Intelligence (AAAI 2014)},
pages = {930--936},
year = {2014}
}
This paper deals with platforms that provide agents easier access to the type of opportunities in which they are interested (e.g., eCommerce platforms, used cars bulletins and dating web-sites). We show that under various common service schemes, a platform can benefit from not necessarily listing all the opportunities with which it is familiar, even if there is no marginal cost for listing any additional opportunity. The main implication of this result is that platforms should extract their expected-profit-maximizing service terms not based solely on the fees charged from users, but they should also use the subset that will be listed as the decision variable in the optimization problem. The analysis applies to four well-known service schemes that a platform may use to price its services. We show that neither of these schemes generally dominates the others or is dominated by any of the others. For the common case of homogeneous preferences, however, several dominance relationships can be proved, enabling the platform to identify the schemes that should be used as a default. Furthermore, the analysis provides a game-theoretic search-based explanation for a possible preference of buyers to pay for the service rather than receive it for free (e.g., when the service is sponsored by ads), a phenomena that has been justified in prior literature typically with the argument of willingness to pay a premium for an ad-free experience or more reliable platforms. The paper shows that this preference can hold both for the users and the platform in a given setting, even if both sides are fully strategic.
@inproceedings{hajaj2014strategic,
title = {Strategic Information Platforms: Selective Disclosure and the Price of Free},
author = {Hajaj, Chen and Sarne, David},
booktitle = {Proceedings of the Fifteenth ACM conference on Economics and Computation},
pages = {839--856},
year = {2014},
organization = {ACM},
doi = {10.1145/2600057.2602864}
}
2013
Search More, Disclose Less
Chen Hajaj, Noam Hazon, David Sarne, and Avshalom Elmalech
ConferenceIn proceedings of the Twenty-Seventh AAAI Conference on Artificial Intelligence
The blooming of comparison shopping agents (CSAs) in recent years enables buyers in today’s markets to query more than a single CSA while shopping, thus substantially expanding the list of sellers whose prices they obtain. From the individual CSA point of view, however, the multi-CSAs querying is definitely non-favorable as most of today’s CSAs benefit depends on payments they receive from sellers upon transferring buyers to their websites (and making a purchase). The most straightforward way for the CSA to improve its competence is through spending more resources on getting more sellers’ prices, potentially resulting in a more attractive "best price". In this paper we suggest a complementary approach that improves the attractiveness of the best price returned to the buyer without having to extend the CSAs’ price database. This approach, which we term "selective price disclosure" relies on removing some of the prices known to the CSA from the list of results returned to the buyer. The advantage of this approach is in the ability to affect the buyer’s beliefs regarding the probability of obtaining more attractive prices if querying additional CSAs. The paper presents two methods for choosing the subset of prices to be presented to a fully-rational buyer, attempting to overcome the computational complexity associated with evaluating all possible subsets. The effectiveness and efficiency of the methods are demonstrated using real data, collected from five CSAs for four products. Furthermore, since people are known to have an inherently bounded rationality, the two methods are also evaluated with human buyers, demonstrating that selective price-disclosing can be highly effective with people, however the subset of prices that needs to be used should be extracted in a different (and more simplistic) manner.
@inproceedings{hajaj2013search,
title = {Search More, Disclose Less},
author = {Hajaj, Chen and Hazon, Noam and Sarne, David and Elmalech, Avshalom},
booktitle = {In proceedings of the Twenty-Seventh AAAI Conference on Artificial Intelligence},
year = {2013}
}
2012
Three Dimensional Group Registration of Mesh Objects
Chen Hajaj
ThesisMSc thesis, Bar-Ilan University
@mastersthesis{hajaj2012three,
title = {Three Dimensional Group Registration of Mesh Objects},
school = {Bar-Ilan University},
author = {Hajaj, Chen},
year = {2012}
}
No publications match
Try a shorter search or another research line, or clear the filters to see the full list.