This paper proposes a hybrid approach called XTS that uses a combination of techniques to analyze highly imbalanced data with minimum features. XTS combines cost-sensitive XGBoost, a game theory-based model explainer called TreeSHAP, and a newly developed algorithm known as Sequential Forward Evaluation algorithm (SFE). The general aim of XTS is to reduce the number of features required to learn a particular dataset. It assumes that low-dimensional representation of data can improve computational efficiency and model interpretability whilst retaining a strong prediction performance. The efficiency of XTS was tested on a public dataset, and the results showed that by reducing the number of features from 33 to less than five, the proposed model achieved over 99.9% prediction efficiency. XTS was also found to outperform other benchmarked models and existing proof-of-concept solutions in the literature. The dataset contained data related to DNS-over-HTTPS (DoH) tunnels. The top predictors for DoH classification and characterization were identified using interactive SHAP plots, which included destination IP, packet length mode, and source IP. XTS offered a promising approach to improve the efficiency of the detection and analysis of DoH tunnels while maintaining accuracy, which can have important implications for behavioral network intrusion detection systems.

A data-driven fault diagnosis method is proposed in this study to address the challenge of handling a large volume of pressure data in the air brake pipe of high-speed trains. The suggested method utilizes a BP (back propagation) neural network to transform the time series pressure data into model elements in the model space, ensuring simplicity and stability. Various fitting functions, including Fourier basis, Gaussian basis, polynomial basis, sine basis, and others, are employed to accurately fit the pressure curve of the air brake pipe. The fault diagnosis process involves two steps: classifying the fault based on an optimal approximation equation and diagnosing it by analyzing the topological relationship of the model elements in the model space. The proposed method achieves an average fault diagnosis accuracy of 89.8%, with high accuracy rates for different fault states: 98% for normal state, 88% for blockage state, 84% for leakage state, and 96% for compressor fault state. Compared to the hidden Markov model method, the proposed method improves the average diagnostic accuracy by 2% for known working conditions and 4.87% for all working conditions, demonstrating its effectiveness and reliability. The fault diagnosis of the air brake tube in high-speed trains is of great significance, which aims to realize accurate fault diagnosis and prediction through sensor data monitoring and signal processing technology, so as to ensure the safe operation of high-speed trains. These studies provide an important theoretical and practical basis for the improvement and application of fault diagnosis methods.

This paper proposes an innovative approach capitalized on the distinctive characteristics of command and control (C&C) beacons, namely, time intervals and frequency between consecutive unique connections, to compress the network flow dataset. While previous studies on the same matter used single technique, we propose a multi-technique approach for efficient detection of DoH tunnels. We use a baseline public dataset, CIRA-CIC-DoHBrw-2020, containing over a million network flow properties and statistical features of DoH, tunnels, benign DoH and normal browsing (HTTPS) traffic. Each sample is represented by 33 features with a timestamp. Our methodology combines star graph and bar plot visualizations with supervised and unsupervised learning techniques. The approach underscores the importance of C&C beacon characteristic features in compressing a dataset and reducing a flow dimension while enabling efficient detection of DoH tunnels. Through compression, the original dataset size and dimensions are reduced by approximately $95\%$ and $94\%$ respectively. For supervised learning, RF emerges as the top-performing algorithm, attaining precision and recall scores of 100% each, with speed increase of $\approx 6796$ times faster in training and $\approx 55$ in testing. For anomaly detection models, OCSVM emerges as the most suitable choice for this purpose, with precision (88.89) and recall (100). Star graph and bar graph models also show a clear difference between normal traffic and DoH tunnels. The reduction in flow sample size and dimension, while maintaining accuracy, holds promise for edge networks with constrained resources and aids security analysts in interpreting complex ML models to identify Indicators of Compromise (IoC).