An Investigation of "Benford's" Law Divergence and Machine Learning Techniques for "Intra-Class" Separability of Fingerprint Images

Protecting a fingerprint database against attackers is very vital in order to protect against false acceptance rate or false rejection rate. A key property in distinguishing fingerprint images is by exploiting the characteristics of these different types of fingerprint images. The aim of this paper is to perform the classification of fingerprint images using the Ben-ford's law divergence values and machine learning techniques. The usage of these Ben-ford's law divergence values as features fed into the machine learning techniques has proved to be very effective and efficient in the classification of fingerprint images. The effectiveness of our proposed methodology was demonstrated on five datasets, achieving very high classification "accuracies" of 100% for the Decision Tree and CNN. However, the "Naive" Bayes, and Logistic Regression achieved "accuracies" of 95.95%, and 90.54%, respectively. These results showed that Ben-ford's law features and machine learning techniques especially Decision Tree and CNN can be effectively applied for the classification of fingerprint images.

"Flow Size Difference" Can Make a Difference: Detecting Malicious TCP Network Flows Based on Benford's Law

Statistical characteristics of network traffic have attracted a significant amount of research for automated network intrusion detection, some of which looked at applications of natural statistical laws such as Zipf's law, Benford's law and the Pareto distribution. In this paper, we present the application of Benford's law to a new network flow metric "flow size difference", which have not been studied before by other researchers, to build an unsupervised flow-based intrusion detection system (IDS). The method was inspired by our observation on a large number of TCP flow datasets where normal flows tend to follow Benford's law closely but malicious flows tend to deviate significantly from it. The proposed IDS is unsupervised, so it can be easily deployed without any training. It has two simple operational parameters with a clear semantic meaning, allowing the IDS operator to set and adapt their values intuitively to adjust the overall performance of the IDS. We tested the proposed IDS on two (one closed and one public) datasets, and proved its efficiency in terms of AUC (area under the ROC curve). Our work showed the "flow size difference" has a great potential to improve the performance of any flow-based network IDSs.