Anomaly detection plays a vital role as a crucial security measure for edge devices in Artificial Intelligence and Internet of Things (AIoT). With the rapid development of IoT ( Internet of Things), changes in system configurations and the introduction of new devices can lead to significant alterations in device relationships and data flows within the IoT, thereby triggering concept drift. Previously trained anomaly detection models fail to adapt to the changed distribution of streaming data, resulting in a high number of false positive events. This paper aims to address the issue of concept drift in IoT anomaly detection by proposing a comprehensive Concept Drift Detection, Interpretation, and Adaptation framework (CDDIA). We focus on accurately capturing the concept drift of normal data in unsupervised scenarios. To interpret drift samples, we integrate a search optimization algorithm and the SHAP method, providing a comprehensive interpretation of drift samples at both the sample and feature levels. Simultaneously, by utilizing the sample-level interpretation results for filtering new and old samples, we retrain the anomaly detection model to mitigate the impact of concept drift and reduce the false positive rate. This integrated strategy demonstrates significant advantages in maintaining model stability and reliability. The experimental results indicate that our method outperforms five baseline methods in adaptability across three datasets and provides interpretability for samples experiencing concept drift.

Numerous electronic health records (EHRs) offer valuable opportunities for understanding patients’ health status at different stages, namely health progression. Extracting the health progression patterns allows researchers to perform accurate predictive analysis of patient outcomes. However, most existing works on this task suffer from the following two limitations: 1) the diverse dependencies among heterogeneous medical entities are overlooked, which leads to the one-sided modeling of patients’ status and 2) the extraction granularity of patient’s health progression patterns is coarse, limiting the model’s ability to accurately infer the patient’s future status. To address these challenges, a pretrained Health progression network via heterogeneous medical information fusion, HealthNet, is proposed in this article. Specifically, a global heterogeneous graph in HealthNet is built to integrate heterogeneous medical entities and the dependencies among them. In addition, the proposed health progression network is designed to model hierarchical medical event sequences. By this method, the fine-grained health progression patterns of patients’ health can be captured. The experimental results on real disease datasets demonstrate that HealthNet outperforms the state-of-the-art models for both diagnosis prediction task and mortality prediction task.

Malware poses a great threat to information security such as user data, privacy, and assets. Early detection before it has a real impact is the main countermeasure. However, the diversity of carriers and technologies has led to a huge gap between the training scenarios and actual scenarios of detection methods. This makes it difficult for supervision-based detection frameworks to identify new malware variants and complicates threat response. We propose a novel method that integrates frequency domain techniques with feature alignment to enhance variant malware detection, reducing distribution differences between labeled (source) and new (target) samples. By converting malware into grayscale images and applying discrete cosine transform (DCT) for improved feature extraction, followed by feature extraction via a deep residual network from both domains, our model systematically aligns features. This alignment is achieved through a tailored domain adaptation technique involving the minimization of classification and domain alignment losses, which ensures the consistent learning of features across varied domains. Such rigorous alignment not only enhances detection accuracy for both known and variant malware but also supports simultaneous detection across significant distribution differences. We conduct extensive experiments on two real-world datasets to evaluate the performance of various deep learning models under consistent and inconsistent domain distributions. Compared to existing methods, our approach improves accuracy by an average of 1.4% on the BIG2015 dataset, 3.2% on the MDA dataset, 2.75% on the Malimg dataset, and also achieves the best performance on the MaleVis dataset, with similar gains in precision, recall, and F1-score across all datasets.