Mathematical Analysis of Sensor Fusion for Intrusion Detection Systems

Fusion of multiple intrusion detection systems results in a more reliable and accurate detection for a wider class of intrusions. The paper presented here introduces the mathematical basis for sensor fusion and provides enough support for the acceptability of sensor fusion in performance enhancement of intrusion detection systems. The sensor fusion system is characterized and modeled with no knowledge of the intrusion detection systems and the intrusion detection data. The theoretical analysis is supported with an experimental illustration with three of the available intrusion detection systems using the DARPA 1999 evaluation data set.

Flux density calibration in diffuse optical tomographic systems

The solution of the forward equation that models the transport of light through a highly scattering tissue material in diffuse optical tomography (DOT) using the finite element method gives flux density (Phi) at the nodal points of the mesh. The experimentally measured flux (U-measured) on the boundary over a finite surface area in a DOT system has to be corrected to account for the system transfer functions (R) of various building blocks of the measurement system. We present two methods to compensate for the perturbations caused by R and estimate true flux density (Phi) from U-measured(cal). In the first approach, the measurement data with a homogeneous phantom (U-measured(homo)) is used to calibrate the measurement system. The second scheme estimates the homogeneous phantom measurement using only the measurement from a heterogeneous phantom, thereby eliminating the necessity of a homogeneous phantom. This is done by statistically averaging the data (U-measured(hetero)) and redistributing it to the corresponding detector positions. The experiments carried out on tissue mimicking phantom with single and multiple inhomogeneities, human hand, and a pork tissue phantom demonstrate the robustness of the approach. (C) 2013 Society of Photo-Optical Instrumentation Engineers (SPIE) DOI: 10.1117/1.JBO.18.2.026023]

Efficient Regular Expression Pattern Matching for Network Intrusion Detection Systems using Modified Word-based Automata

Network Intrusion Detection Systems (NIDS) intercept the traffic at an organization's network periphery to thwart intrusion attempts. Signature-based NIDS compares the intercepted packets against its database of known vulnerabilities and malware signatures to detect such cyber attacks. These signatures are represented using Regular Expressions (REs) and strings. Regular Expressions, because of their higher expressive power, are preferred over simple strings to write these signatures. We present Cascaded Automata Architecture to perform memory efficient Regular Expression pattern matching using existing string matching solutions. The proposed architecture performs two stage Regular Expression pattern matching. We replace the substring and character class components of the Regular Expression with new symbols. We address the challenges involved in this approach. We augment the Word-based Automata, obtained from the re-written Regular Expressions, with counter-based states and length bound transitions to perform Regular Expression pattern matching. We evaluated our architecture on Regular Expressions taken from Snort rulesets. We were able to reduce the number of automata states between 50% to 85%. Additionally, we could reduce the number of transitions by a factor of 3 leading to further reduction in the memory requirements.

A Novel Analytical Study of Different Channel Allocations and FWM Efficiencies in Optical WDM Systems

The optical WDM systems are usually affected by the Four Wave Mixing effects. This paper examines the different frequency allocations in terms of FWM efficiency for CWDM, DWDM and for three various proposed modes.

Optical detection of submicromolar levels of nitro explosives by a submicron sized metal-organic phosphor material

Two isomorphous submicron sized metal-organic network compounds, Y-2(PDA)(3)(H2O)1]center dot 2H(2)O (PDA = 1,4-phenylenediacetate), 1 and Y1.8Tb0.2(PDA)(3)(H2O)1]center dot 2H(2)O, Tb@1 have been synthesized by employing solvent assisted liquid grinding followed by heating at 180 degrees C for 1' min and washing with water. Single crystal X-ray data of bulk 1 confirmed a three dimensional porous structure. The structure and morphology of 1 and Tb@1 were systematically characterized by PXRD, TGA, DSC, IR, SEM and EDX analysis. Dehydrated Tb@1 Tb@1'] shows a high intense visible green emission upon exposure to UV light. The green emission of Tb@1' was used for the detection of nitro explosives, such as 2,4,6-trinitrophenol (TNP), 1,3-dinitro benzene (DNB), 2,4-dinitro toluene (DNT), nitro benzene (NB), and 4-nitro toluene (NT) in acetonitrile. The results show that the emission intensity of dehydrated Tb@1' can be quenched by all the nitro analytes used in the present work. Remarkably, Tb@1' exhibited a high efficiency for TNP, DNB and DNT detection with K-SV K-SV = quenching constant based on linear Stern-Volmer plot] values of 70 920, 44 000 and 35 430 M-1, respectively, which are the highest values amongst known metal-organic materials. Using this material submicromolar level (equivalent to 0.18 ppm), a detection of nitro explosives has been achieved.

A method of fraud & intrusion detection for e-payment systems in mobile

The need for paying with mobile devices has urged the development of payment systems for mobile electronic commerce. In this paper we have considered two important abuses in electronic payments systems for detection. The fraud, which is an intentional deception accomplished to secure an unfair gain, and an intrusion which are any set of actions that attempt to compromise the integrity, confidentiality or availability of a resource. Most of the available fraud and intrusion detection systems for e-payments are specific to the systems where they have been incorporated. This paper proposes a generic model called as Activity-Event-Symptoms(AES) model for detecting fraud and intrusion attacks which appears during payment process in the mobile commerce environment. The AES model is designed to identify the symptoms of fraud and intrusions by observing various events/transactions occurs during mobile commerce activity. The symptoms identification is followed by computing the suspicion factors for event attributes, and the certainty factor for a fraud and intrusion is generated using these suspicion factors. We have tested the proposed system by conducting various case studies, on the in-house established mobile commerce environment over wired and wire-less networks test bed.

Usefulness of DARPA dataset for intrusion detection system evaluation

The MIT Lincoln Laboratory IDS evaluation methodology is a practical solution in terms of evaluating the performance of Intrusion Detection Systems, which has contributed tremendously to the research progress in that field. The DARPA IDS evaluation dataset has been criticized and considered by many as a very outdated dataset, unable to accommodate the latest trend in attacks. Then naturally the question arises as to whether the detection systems have improved beyond detecting these old level of attacks. If not, is it worth thinking of this dataset as obsolete? The paper presented here tries to provide supporting facts for the use of the DARPA IDS evaluation dataset. The two commonly used signature-based IDSs, Snort and Cisco IDS, and two anomaly detectors, the PHAD and the ALAD, are made use of for this evaluation purpose and the results support the usefulness of DARPA dataset for IDS evaluation.

Selection of intrusion detection system threshold bounds for effective sensor fusion

The motivation behind the fusion of Intrusion Detection Systems was the realization that with the increasing traffic and increasing complexity of attacks, none of the present day stand-alone Intrusion Detection Systems can meet the high demand for a very high detection rate and an extremely low false positive rate. Multi-sensor fusion can be used to meet these requirements by a refinement of the combined response of different Intrusion Detection Systems. In this paper, we show the design technique of sensor fusion to best utilize the useful response from multiple sensors by an appropriate adjustment of the fusion threshold. The threshold is generally chosen according to the past experiences or by an expert system. In this paper, we show that the choice of the threshold bounds according to the Chebyshev inequality principle performs better. This approach also helps to solve the problem of scalability and has the advantage of failsafe capability. This paper theoretically models the fusion of Intrusion Detection Systems for the purpose of proving the improvement in performance, supplemented with the empirical evaluation. The combination of complementary sensors is shown to detect more attacks than the individual components. Since the individual sensors chosen detect sufficiently different attacks, their result can be merged for improved performance. The combination is done in different ways like (i) taking all the alarms from each system and avoiding duplications, (ii) taking alarms from each system by fixing threshold bounds, and (iii) rule-based fusion with a priori knowledge of the individual sensor performance. A number of evaluation metrics are used, and the results indicate that there is an overall enhancement in the performance of the combined detector using sensor fusion incorporating the threshold bounds and significantly better performance using simple rule-based fusion.

Ring Resonators and Micro Fluidics: Novel Design for Drug/Disease Detection

MEMS systems are technologically developed from integrated circuit industry to create miniature sensors and actuators. Originally these semiconductor processes and materials were used to build electrical and mechanical systems, but expanded to include biological, optical fluidic magnetic and other systems 12]. Here a novel approach is suggested where in two different fields are integrated via moems, micro fluidics and ring resonators. It is well known at any preliminary stage of disease onset, many physiological changes occur in the body fluids like saliva, blood, urine etc. The drawback till now was that current calibrations are not sensitive enough to detect the minor physiological changes. This is overcome using optical detector techniques 1]. The basic concepts of ring resonators, with slight variations can be used for optical detection of these minute disease markers. A well known fact of ring resonators is that a change in refractive index will trigger a shift in the resonant wavelength 5]. The trigger for the wavelength shift in the case discussed will be the presence of disease agents. To trap the disease agents specific antibody has to be used (e. g. BSA).

Improvement in Intrusion Detection With Advances in Sensor Fusion

Various intrusion detection systems (IDSs) reported in the literature have shown distinct preferences for detecting a certain class of attack with improved accuracy, while performing moderately on the other classes. In view of the enormous computing power available in the present-day processors, deploying multiple IDSs in the same network to obtain best-of-breed solutions has been attempted earlier. The paper presented here addresses the problem of optimizing the performance of IDSs using sensor fusion with multiple sensors. The trade-off between the detection rate and false alarms with multiple sensors is highlighted. It is illustrated that the performance of the detector is better when the fusion threshold is determined according to the Chebyshev inequality. In the proposed data-dependent decision ( DD) fusion method, the performance optimization of ndividual IDSs is first addressed. A neural network supervised learner has been designed to determine the weights of individual IDSs depending on their reliability in detecting a certain attack. The final stage of this DD fusion architecture is a sensor fusion unit which does the weighted aggregation in order to make an appropriate decision. This paper theoretically models the fusion of IDSs for the purpose of demonstrating the improvement in performance, supplemented with the empirical evaluation.

Demonstration of a microfluidic polarimeter

Traditional methods of detecting chiral molecules, such as optical rotation are not suitable for miniaturization, since, the magnitude of the rotation of polarization scales down linearly with the optical path length of the device. Since the origin of optical activity is due to difference of refractive indices between the two circularly polarized states of light, it is possible to detect chiral media by measuring the dependence of the angles of refraction on the polarization state of the incident light. This however is a weak effect and hence requires sensitive optical detection schemes, based on novel polarization modulation techniques. The device can be scaled down for applications involving small sample volumes. Fabrication details of a prototype microfluidic device are described.

A new approach for simple and rapid shape measurement of objects with surface discontinuities

A new approach for unwrapping phase maps, obtained during the measurement of 3-D surfaces using sinusoidal structured light projection technique, is proposed. "Takeda's method" is used to obtain the wrapped phase map. Proposed method of unwrapping makes use of an additional image of the object captured under the illumination of a specifically designed color-coded pattern. The new approach demonstrates, for the first time, a method of producing reliable unwrapping of objects even with surface discontinuities from a single-phase map. It is shown to be significantly faster and reliable than temporal phase unwrapping procedure that uses a complete exponential sequence. For example, if a measurement with the accuracy obtained by interrogating the object with S fringes in the projected pattern is carried out with both the methods, new method requires only 2 frames as compared to (log(2)S +1) frames required by the later method.

Wavelet transform analysis of truncated fringe patterns in 3-D surface profilometry

Wavelet transform analysis of projected fringe pattern for phase recovery in 3-D shape measurement of objects is investigated. The present communication specifically outlines and evaluates the errors that creep in to the reconstructed profiles when fringe images do not satisfy periodicity. Three specific cases that give raise to non-periodicity of fringe image are simulated and leakage effects caused by each one of them are analyzed with continuous complex Morlet wavelet transform. Same images are analyzed with FFT method to make a comparison of the reconstructed profiles with both methods. Simulation results revealed a significant advantage of wavelet transform profilometry (WTP), that the distortions that arise due to leakage are confined to the locations of discontinuity and do not spread out over the entire projection as in the case of Fourier transform profilometry (FTP).

Design and analysis of integrated optic quadrature phase shift keying modulator

Quadrature phase shift keying (QPSK) is one of the most popular modulation schemes in coherent optical communication systems for data rates in excess of 40 Gbps because of its high spectral efficiency. This paper proposes a simple method of implementing a QPSK modulator in integrated optic (IO) domain. The QPSK modulator is realized using standard IO components, such as Y-branches and electro-optic modulators (EOMs). Design optimization of EOM is carried out considering the fabrication constraints, miniaturization aspects, and simplicity. Also, the interdependency between electrode length, operating voltage, and electrode gap of an EOM has been captured in the form of a family of curves. These plots enable designing of EOMs for custom requirements. An innovative approach has been adopted in demonstrating the operation of IO QPSK modulator in terms of phase data extracted from beam propagation model. The results obtained by this approach have been verified using the conventional interferometric approach. The operation of the proposed IO QPSK modulator is experimentally demonstrated. The design of IO QPSK modulator is taken up as a part of a broader scheme that aims at generation of QPSK modulated microwave signal based on optical heterodyning. (C) 2014 Society of Photo-Optical Instrumentation Engineers (SPIE)

Performance analysis of FSO links under strong atmospheric turbulence conditions using various modulation schemes

Strong atmospheric turbulence is a major hindrance in wireless optical communication systems. In this paper, the performance of a wireless optical communication system is analyzed using different modulation formats such as, binary phase shift keying-subcarrier intensity modulation (BPSK-SIM), differential phase shift keying (DPSK), differential phase shift keying-subcarrier intensity modulation (DPSK-SIM), Mary pulse position modulation (M-PPM) and polarization shift keying (PoISK). The atmospheric channel is modeled for strong atmospheric turbulences with combined effect of turbulence and pointing errors. Novel closed-form analytical expressions for average bit error rate (BER), channel capacity and outage probability for the various modulation techniques, viz. BPSK-SIM, DPSK, DPSK-SIM, PoISK and M-PPM are derived. The simulated results for BER, channel capacity and outage probability of various modulation techniques are plotted and analyzed. (C) 2014 Elsevier GmbH. All rights reserved.