Introduction to Wireless Intrusion Detection Systems

The IDS (Intrusion Detection System) is a common means of protecting networked systems from attack or malicious misuse. The development and rollout of an IDS can take many different forms in terms of equipment, protocols, connectivity, cost and automation. This is particularly true of WIDS (Wireless Intrusion Detection Systems) which have many more opportunities and challenges associated with data transmission through an open, shared medium.
The operation of a WIDS is a multistep process from origination of an attack through to human readable evaluation. Attention to the performance of each of the processes in the chain from attack detection to evaluation is imperative if an optimum solution is to be sought. At present, research focuses very much on each discrete aspect of a WIDS with little consideration to the operation of the whole system. Taking a holistic view of the technology shows the interconnectivity and inter-dependence between stages, leading to improvements and novel research areas for investigation.
This chapter will outline the general structure of Wireless Intrusion Detection Systems and briefly describe the functions of each development stage, categorised into the following 6 areas:
• Threat Identification,
• Architecture,
• Data Collection,
• Intrusion Detection,
• Alert Correlation,
• Evaluation.
These topics will be considered in broad terms designed for those new to the area. Focus will be placed on ensuring the readers are aware of the impact of choices made at early stages in WIDS development on future stages.

A Critical Review of Screening Methods for the Detection of Chloramphenicol, Thiamphenicol, and Florfenicol Residues in Foodstuffs

This article gives an extensive overview of the wide range of analytical procedures developed for the detection of amphenicol antibiotic residues (chloramphenicol, thiamphenicol, and florfenicol) in many different types of foodstuffs (milk, meat, eggs, honey, seafood). Screening methods such as microbial inhibition methods, antibody-based immunoassays using conventional and biosensor-based detection systems, and some methods based on alternative recognition systems are described. The relative advantages and disadvantages of these methods are discussed and compared. The current status and future trends and developments in the need for accurate and rapid detection of this group of antimicrobials are also discussed.

Unique Challenges in WiFi Intrusion Detection

The Intrusion Detection System (IDS) is a common means of protecting networked systems from attack or malicious misuse. The deployment of an IDS can take many different forms dependent on protocols, usage and cost. This is particularly true of Wireless Intrusion Detection Systems (WIDS) which have many detection challenges associated with data transmission through an open, shared medium, facilitated by fundamental changes at the Physical and MAC layers. WIDS need to be considered in more detail at these lower layers than their wired counterparts as they face unique challenges. The remainder of this chapter will investigate three of these challenges where WiFi deviates significantly from that of wired counterparts:

• Attacks Specific to WiFi Networks: Outlining the additional threats which WIDS must account for: Denial of Service, Encryption Bypass and AP Masquerading attacks.

• The Effect of Deployment Architecture on WIDS Performance: Demonstrating that the deployment environment of a network protected by a WIDS can influence the prioritisation of attacks.

• The Importance of Live Data in WiFi Research: Investigating the different choices for research data sources with an emphasis on encouraging live network data collection for future WiFi research.

The effect of probe interval estimation on attack detection performance of a WLAN independent intrusion detection system

A new niche of densely populated, unprotected networks is becoming more prevalent in public areas such as Shopping Malls, defined here as independent open-access networks, which have attributes that make attack detection more challenging than in typical enterprise networks. To address these challenges, new detection systems which do not rely on knowledge of internal device state are investigated here. This paper shows that this lack of state information requires an additional metric (The exchange timeout window) for detection of WLAN Denial of Service Probe Flood attacks. Variability in this metric has a significant influence on the ability of a detection system to reliably detect the presence of attacks. A parameter selection method is proposed which is shown to provide reliability and repeatability in attack detection in WLANs. Results obtained from ongoing live trials are presented that demonstrate the importance of accurately estimating probe request and probe response timeouts in future Independent Intrusion Detection Systems.

Feature Selection for Anomaly Detection Using Optical Emission Spectroscopy

To maintain the pace of development set by Moore's law, production processes in semiconductor manufacturing are becoming more and more complex. The development of efficient and interpretable anomaly detection systems is fundamental to keeping production costs low. As the dimension of process monitoring data can become extremely high anomaly detection systems are impacted by the curse of dimensionality, hence dimensionality reduction plays an important role. Classical dimensionality reduction approaches, such as Principal Component Analysis, generally involve transformations that seek to maximize the explained variance. In datasets with several clusters of correlated variables the contributions of isolated variables to explained variance may be insignificant, with the result that they may not be included in the reduced data representation. It is then not possible to detect an anomaly if it is only reflected in such isolated variables. In this paper we present a new dimensionality reduction technique that takes account of such isolated variables and demonstrate how it can be used to build an interpretable and robust anomaly detection system for Optical Emission Spectroscopy data.

Use of a novel micro-fluidic device to create arrays for multiplex analysis of large and small molecular weight compounds by surface plasmon resonance

There is an increasing demand to develop biosensor monitoring devices capable of biomarker profiling for predicting animal adulteration and detecting multiple chemical contaminants or toxins in food produce. Surface plasmon resonance (SPR) biosensors are label free detection systems that monitor the binding of specific biomolecular recognition elements with binding partners. Essential to this technology are the production of biochips where a selected binding partner, antibody, biomarker protein or low molecular weight contaminant, is immobilised. A micro-fluidic immobilisation device allowing the covalent attachment of up to 16 binding partners in a linear array on a single surface has been developed for compatibility with a prototype multiplex SPR analyser.

The immobilisation unit and multiplex SPR analyser were respectively evaluated in their ability to be fit-for-purpose for binding partner attachment and detection of high and low molecular weight molecules. The multiplexing capability of the dual technology was assessed using phycotoxin concentration analysis as a model system. The parent compounds of four toxin groups were immobilised within a single chip format and calibration curves were achieved. The chip design and SPR technology allowed the compartmentalisation of the binding interactions for each toxin group offering the added benefit of being able to distinguish between toxin families and perform concentration analysis. This model is particularly contemporary with the current drive to replace biological methods for phycotoxin screening.

Obfuscation: The Hidden Malware

A cyberwar exists between malware writers and antimalware researchers. At this war's heart rages a weapons race that originated in the 80s with the first computer virus. Obfuscation is one of the latest strategies to camouflage the telltale signs of malware, undermine antimalware software, and thwart malware analysis. Malware writers use packers, polymorphic techniques, and metamorphic techniques to evade intrusion detection systems. The need exists for new antimalware approaches that focus on what malware is doing rather than how it's doing it.

Uptake, translocation and transformation of arsenate and arsenite in sunflower (Helianthus annuus):formation of arsenic-phytochelatin complexes during exposure to high arsenic concentrations

The aim of the study was to determine the time-dependent formation of arsenic-phytochelatin (As-PC) complexes in the roots, stems and leaves of an arsenic-nontolerant plant (Helianthus annuus) during exposure to 66 mol l(-1) arsenite (As(III)) or arsenate (As(V)). We used our previously developed method of simultaneous element-specific (inductively coupled plasma mass spectrometry, ICP-MS) and molecular-specific (electrospray-ionization mass spectrometry, ES-MS) detection systems interfaced with a suitable chromatographic column and eluent conditions, which enabled us to identify and quantify As-PC complexes directly. Roots of As-exposed H. annuus contained up to 14 different arsenic species, including the complex of arsenite with two (gamma-Glu-Cys)(2)-Gly molecules [As((III))-(PC(2))(2)], the newly identified monomethylarsonic phytochelatin-2 or (gamma-Glu-Cys)(2)-Gly CH(3)As (MA((III))-PC(2)) and at least eight not yet identified species. The complex of arsenite with (gamma-Glu-Cys)(3)-Gly (As((III))-PC(3)) and the complex of arsenite with glutathione (GSH) and (gamma-Glu-Cys)(2)-Gly (GS-As((III))-PC(2)) were present in all samples (roots, stems and leaves) taken from plants exposed to As. The GS-As((III))-PC(2) complex was the dominant complex after 1 h of exposure. As((III))-PC(3) became the predominant As-PC complex after 3 h, binding up to 40% of the As present in the exposed plants. No As-PC complexes were found in sap (mainly xylem sap from the root system), in contrast to roots, stems and leaves, which is unequivocal evidence that As-PC complexes are not involved in the translocation of As from root to leaves of H. annuus.

The nature of arsenic-phytochelatin complexes in Holcus lanatus and Pteris cretica

We have developed a method to extract and separate phytochelatins (PCs)-metal(loid) complexes using parallel metal(loid)-specific (inductively coupled plasma-mass spectrometry) and organic-specific (electrospray ionization-mass spectrometry) detection systems-and use it here to ascertain the nature of arsenic (As)-PC complexes in plant extracts. This study is the first unequivocal report, to our knowledge, of PC complex coordination chemistry in plant extracts for any metal or metalloid ion. The As-tolerant grass Holcus lanatus and the As hyperaccumulator Pteris cretica were used as model plants. In an in vitro experiment using a mixture of reduced glutathione (GS), PC(2), and PC(3), As preferred the formation of the arsenite [As((III))]-PC(3) complex over GS-As((III))-PC(2), As((III))-(GS)(3), As((III))-PC(2), or As((III))-(PC(2))(2) (GS: glutathione bound to arsenic via sulphur of cysteine). In H. lanatus, the As((III))-PC(3) complex was the dominant complex, although reduced glutathione, PC(2), and PC(3) were found in the extract. P. cretica only synthesizes PC(2) and forms dominantly the GS-As((III))-PC(2) complex. This is the first evidence, to our knowledge, for the existence of mixed glutathione-PC-metal(loid) complexes in plant tissues or in vitro. In both plant species, As is dominantly in non-bound inorganic forms, with 13% being present in PC complexes for H. lanatus and 1% in P. cretica.

Fault Diagnostics for Internal Combustion Engines – Current and Future Techniques

The adoption of each new level of automotive emissions legislation often requires the introduction of additional emissions reduction techniques or the development of existing emissions control systems. This, in turn, usually requires the implementation of new sensors and hardware which must subsequently be monitored by the on-board fault detection systems. The reliable detection and diagnosis of faults in these systems or sensors, which result in the tailpipe emissions rising above the progressively lower failure thresholds, provides enormous challenges for OBD engineers. This paper gives a review of the field of fault detection and diagnostics as used in the automotive industry. Previous work is discussed and particular emphasis is placed on the various strategies and techniques employed. Methodologies such as state estimation, parity equations and parameter estimation are explained with their application within a physical model diagnostic structure. The utilization of symptoms and residuals in the diagnostic process is also discussed. These traditional physical model based diagnostics are investigated in terms of their limitations. The requirements from the OBD legislation are also addressed. Additionally, novel diagnostic techniques, such as principal component analysis (PCA) are also presented as a potential method of achieving the monitoring requirements of current and future OBD legislation.

Implementation Experiences from Smart Grid Security Applications and Outlook on Future Research

Experiences from smart grid cyber-security incidents in the past decade have raised questions on the applicability and effectiveness of security measures and protection mechanisms applied to the grid. In this chapter we focus on the security measures applied under real circumstances in today’s smart grid systems. Beginning from real world example implementations, we first review cyber-security facts that affected the electrical grid, from US blackout incidents, to the Dragonfly cyber-espionage campaign currently focusing on US and European energy firms. Provided a real world setting, we give information related to energy management of a smart grid looking also in the optimization techniques that power control engineers perform into the grid components. We examine the application of various security tools in smart grid systems, such as intrusion detection systems, smart meter authentication and key management using Physical Unclonable Functions, security analytics and resilient control algorithms. Furthermore we present evaluation use cases of security tools applied on smart grid infrastructure test-beds that could be proved important prior to their application in the real grid, describing a smart grid intrusion detection system application and security analytics results. Anticipated experimental results from the use-cases and conclusions about the successful transitions of security measures to real world smart grid operations will be presented at the end of this chapter.

A comparison of the estrous behavior of Holstein-Friesian cows when cubicle-housed and at pasture

This study compared estrous behavior of dairy cows kept in cubicle housing and fed a total mixed ration diet (HOUSED treatment) with that of cows kept at pasture with concentrate supplementation (PASTURE treatment). Behavior was compared both in the 48 h around standing estrus and during the standing estrus period. The 23 spring-calving Holstein-Friesians in each treatment were observed directly three times per day for nine weeks. The occurrence of nine selected behaviors associated with estrus was recorded during 20 min observation sessions. Twelve standing estrus events from each treatment were selected for analysis of the frequency of these nine behaviours over the 48 h around standing estrus. Milk progesterone profiles were used to confirm the dates of standing estrus events. Attempting to mount other cows, sniffing the anogenital region of other cows, resting the chin on other cows, receiving chin rests and head-to-head butts all showed significant changes in frequency in the 48 h around standing estrus in both treatments, reaching a peak during standing estrus (P ≤ 0.05). Mounting other cows increased significantly in the PASTURE treatment around standing estrus (P <0.001), but not in the HOUSED treatment. The frequency of ano-genital sniffs received by the animals in the PASTURE treatment also increased significantly around standing estrus (P <0.01) but not in the HOUSED treatment. When the animals were in standing estrus there was a significantly higher frequency of standing to be mounted in PASTURE than in HOUSED cows (median (q1, q3) PASTURE = 2.5 (1.0, 3.0), HOUSED = 0.0 (0.0, 1.0)) (P <0.01), but no difference in the frequency of the other eight sexual behaviors recorded. HOUSED cows did not exhibit the same increase in mounting during the standing estrus period as PASTURE cows and received fewer mounts in observation sessions during standing estrus. These results have implications for the use of estrus detection systems that rely solely on mounting behavior in cubicle-housed dairy cows. © 2012 Elsevier Inc.

Entanglement detection in hybrid optomechanical systems

We study a device formed by a Bose-Einstein condensate (BEC) coupled to the field of a cavity with a moving end mirror and find a working point such that the mirror-light entanglement is reproduced by the BEC-light quantum correlations. This provides an experimentally viable tool for inferring mirror-light entanglement with only a limited set of assumptions. We prove the existence of tripartite entanglement in the hybrid device, persisting up to temperatures of a few milli-Kelvin, and discuss a scheme to detect it.