Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Anisotropic adaptive resolution of boundary layers for heat conduction problems

We deal with the numerical solution of heat conduction problems featuring steep gradients. In order to solve the associated partial differential equation a finite volume technique is used and unstructured grids are employed. A discrete maximum principle for triangulations of a Delaunay type is developed. To capture thin boundary layers incorporating steep gradients an anisotropic mesh adaptation technique is implemented. Computational tests are performed for an academic problem where the exact solution is known as well as for a real world problem of a computer simulation of the thermoregulation of premature infants.

Stability of preconditioned finite volume schemes at low Mach numbers

In [4], Guillard and Viozat propose a finite volume method for the simulation of inviscid steady as well as unsteady flows at low Mach numbers, based on a preconditioning technique. The scheme satisfies the results of a single scale asymptotic analysis in a discrete sense and comprises the advantage that this can be derived by a slight modification of the dissipation term within the numerical flux function. Unfortunately, it can be observed by numerical experiments that the preconditioned approach combined with an explicit time integration scheme turns out to be unstable if the time step Dt does not satisfy the requirement to be O(M2) as the Mach number M tends to zero, whereas the corresponding standard method remains stable up to Dt=O(M), M to 0, which results from the well-known CFL-condition. We present a comprehensive mathematical substantiation of this numerical phenomenon by means of a von Neumann stability analysis, which reveals that in contrast to the standard approach, the dissipation matrix of the preconditioned numerical flux function possesses an eigenvalue growing like M-2 as M tends to zero, thus causing the diminishment of the stability region of the explicit scheme. Thereby, we present statements for both the standard preconditioner used by Guillard and Viozat [4] and the more general one due to Turkel [21]. The theoretical results are after wards confirmed by numerical experiments.

Duplication coefficients via generating functions

In this paper, we solve the duplication problem P_n(ax) = sum_{m=0}^{n}C_m(n,a)P_m(x) where {P_n}_{n>=0} belongs to a wide class of polynomials, including the classical orthogonal polynomials (Hermite, Laguerre, Jacobi) as well as the classical discrete orthogonal polynomials (Charlier, Meixner, Krawtchouk) for the specific case a = −1. We give closed-form expressions as well as recurrence relations satisfied by the duplication coefficients.

Computations in Relative Algebraic K-Groups

Let G be finite group and K a number field or a p-adic field with ring of integers O_K. In the first part of the manuscript we present an algorithm that computes the relative algebraic K-group K_0(O_K[G],K) as an abstract abelian group. We solve the discrete logarithm problem, both in K_0(O_K[G],K) and the locally free class group cl(O_K[G]). All algorithms have been implemented in MAGMA for the case K = \IQ. In the second part of the manuscript we prove formulae for the torsion subgroup of K_0(\IZ[G],\IQ) for large classes of dihedral and quaternion groups.

Applications and modelling in mathematics teaching

The aim of this paper is a comprehensive presentation of some important basic and general aspects of the topic applications and modelling, with emphasis on the secondary school level. Owing to the review character of this paper, some overlap with the survey paper Blum and Niss (1989) for ICME-6 in Budapest is inevitable. The paper will consist of three parts. In part 1, I shall try to clarify some basic concepts and remind the reader of a few application and modelling examples suitable for teaching. In part 2, I shall formulate some general aims for mathematics instruction and, on that basis, summarise the most important arguments for and against applications and modelling in mathematics teaching. Finally, in part 3, I shall discuss some relevant instructional aspects resulting from the considerations in part 2.

Mathematical modelling in mathematics education and instruction

This paper aims at giving a concise survey of the present state-of-the-art of mathematical modelling in mathematics education and instruction. It will consist of four parts. In part 1, some basic concepts relevant to the topic will be clarified and, in particular, mathematical modelling will be defined in a broad, comprehensive sense. Part 2 will review arguments for the inclusion of modelling in mathematics teaching at schools and universities, and identify certain schools of thought within mathematics education. Part 3 will describe the role of modelling in present mathematics curricula and in everyday teaching practice. Some obstacles for mathematical modelling in the classroom will be analysed, as well as the opportunities and risks of computer usage. In part 4, selected materials and resources for teaching mathematical modelling, developed in the last few years in America, Australia and Europe, will be presented. The examples will demonstrate many promising directions of development.

Analysis of applications and of conceptions for an application-oriented mathematics instruction

In connection with the (revived) demand for considering applications in the teaching of mathematics, various schemata or lists of criteria have been developed since the end of the sixties, which set up requirements about closeness to the real world or about the type of mathematics being used, and which have made it possible to analyze the available applications in their light. After having stated the problem (in section 1), we present (in section 2) a sketch of some of the best known of these and of some earlier schemata, although we are not aiming for a complete picture. Then (in section 3) we distinguish among different dimensions.in the analysis of applications. With this as a basis, we develop (in section 4) our own suggestion for categorizing types of applications and conceptions for an application-oriented mathematics instruction. Then (in section 5) we illustrate our schemata by some examples of performed evaluations. Finally (in section 6), we present some preliminary first results of the analysis of teaching conceptions.

On Solutions of Holonomic Divided-Difference Equations on Non-Uniform Lattices

The main aim of this paper is the development of suitable bases (replacing the power basis x^n (n\in\IN_\le 0) which enable the direct series representation of orthogonal polynomial systems on non-uniform lattices (quadratic lattices of a discrete or a q-discrete variable). We present two bases of this type, the first of which allows to write solutions of arbitrary divided-difference equations in terms of series representations extending results given in [16] for the q-case. Furthermore it enables the representation of the Stieltjes function which can be used to prove the equivalence between the Pearson equation for a given linear functional and the Riccati equation for the formal Stieltjes function. If the Askey-Wilson polynomials are written in terms of this basis, however, the coefficients turn out to be not q-hypergeometric. Therefore, we present a second basis, which shares several relevant properties with the first one. This basis enables to generate the defining representation of the Askey-Wilson polynomials directly from their divided-difference equation. For this purpose the divided-difference equation must be rewritten in terms of suitable divided-difference operators developed in [5], see also [6].

Characterization theorem for classical orthogonal polynomials on non-uniform lattices: The functional approach

Using the functional approach, we state and prove a characterization theorem for classical orthogonal polynomials on non-uniform lattices (quadratic lattices of a discrete or a q-discrete variable) including the Askey-Wilson polynomials. This theorem proves the equivalence between seven characterization properties, namely the Pearson equation for the linear functional, the second-order divided-difference equation, the orthogonality of the derivatives, the Rodrigues formula, two types of structure relations,and the Riccati equation for the formal Stieltjes function.

On Connection, Linearization and Duplication Coefficients of Classical Orthogonal Polynomials

In this work, we have mainly achieved the following: 1. we provide a review of the main methods used for the computation of the connection and linearization coefficients between orthogonal polynomials of a continuous variable, moreover using a new approach, the duplication problem of these polynomial families is solved; 2. we review the main methods used for the computation of the connection and linearization coefficients of orthogonal polynomials of a discrete variable, we solve the duplication and linearization problem of all orthogonal polynomials of a discrete variable; 3. we propose a method to generate the connection, linearization and duplication coefficients for q-orthogonal polynomials; 4. we propose a unified method to obtain these coefficients in a generic way for orthogonal polynomials on quadratic and q-quadratic lattices. Our algorithmic approach to compute linearization, connection and duplication coefficients is based on the one used by Koepf and Schmersau and on the NaViMa algorithm. Our main technique is to use explicit formulas for structural identities of classical orthogonal polynomial systems. We find our results by an application of computer algebra. The major algorithmic tools for our development are Zeilberger’s algorithm, q-Zeilberger’s algorithm, the Petkovšek-van-Hoeij algorithm, the q-Petkovšek-van-Hoeij algorithm, and Algorithm 2.2, p. 20 of Koepf's book "Hypergeometric Summation" and it q-analogue.