Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Risks, resources and reason: understanding smallholder decisions around farming system interventions in Eastern Indonesia

Adoption of new cattle management practices by Indonesian smallholders occurs less as a ‘technology transfer’ in the classical sense but rather as a series of conscious decisions by farming households weighing risks and resources as well as matching innovations to livelihood strategies. This paper uncovers the context of decisions and communication of innovations by way of social networks. The research looks at two geographically distinct cases where new cattle management practices have been introduced. We apply the lens of a common sense framework initially introduced by Clifford Geertz. Smallholder decisions are analysed within a socio-cultural context and a particular set of resources, risks and livelihood objectives. We show that the respective value placed on land, cattle and food security is central to adoption of new cattle management techniques. Far from accepting everything novel, smallholders are selective and willing to make changes to their farming system if they do not conflict with livelihood strategies. Innovations are communicated through a range of existing social networks and are either matched to existing livelihood strategies or perceived as stepping-stones out of agriculture.

1st Kassel Student Workshop on Security in Distributed Systems

With this document, we provide a compilation of in-depth discussions on some of the most current security issues in distributed systems. The six contributions have been collected and presented at the 1st Kassel Student Workshop on Security in Distributed Systems (KaSWoSDS’08). We are pleased to present a collection of papers not only shedding light on the theoretical aspects of their topics, but also being accompanied with elaborate practical examples. In Chapter 1, Stephan Opfer discusses Viruses, one of the oldest threats to system security. For years there has been an arms race between virus producers and anti-virus software providers, with no end in sight. Stefan Triller demonstrates how malicious code can be injected in a target process using a buffer overflow in Chapter 2. Websites usually store their data and user information in data bases. Like buffer overflows, the possibilities of performing SQL injection attacks targeting such data bases are left open by unwary programmers. Stephan Scheuermann gives us a deeper insight into the mechanisms behind such attacks in Chapter 3. Cross-site scripting (XSS) is a method to insert malicious code into websites viewed by other users. Michael Blumenstein explains this issue in Chapter 4. Code can be injected in other websites via XSS attacks in order to spy out data of internet users, spoofing subsumes all methods that directly involve taking on a false identity. In Chapter 5, Till Amma shows us different ways how this can be done and how it is prevented. Last but not least, cryptographic methods are used to encode confidential data in a way that even if it got in the wrong hands, the culprits cannot decode it. Over the centuries, many different ciphers have been developed, applied, and finally broken. Ilhan Glogic sketches this history in Chapter 6.

Conceptual information systems discussed through an IT-security tool

Conceptual Information Systems are based on a formalization of the concept of "concept" as it is discussed in traditional philosophical logic. This formalization supports a human-centered approach to the development of Information Systems. We discuss this approach by means of an implemented Conceptual Information System for supporting IT security management in companies and organizations.

Local food security and principle of organic farming (from farm to fork) in context of food culture in Indonesia: Minangkabau's case study

The basic idea behind improving local food security consists of two paths; first, accessibility (price, stock) and second, availability (quantity and biodiversity); both are perquisites to the provision of nutrients and a continuous food supply with locally available resources. The objectives of this thesis are to investigate if indigenous knowledge still plays an important role in traditional farming in the Minangkabau`s culture, thus supporting local food security. If the indigenous knowledge still plays a role in food culture in the Minangkabau`s culture which is linked to the matrilineal role and leads to a sound nutrition. Further, it should be tested if marantau influences traditional farming and food culture in Minangkabau`s, and if the local government plays a role in changing of traditional farming systems and food culture. Furthermore this thesis wants to prove if education and gender are playing a role in changing traditional farming system and food culture, and if the mass media affects traditional farming systems and food culture for the Minangkabau. The study was completed at four locations in West Sumatera; Nagari Ulakan (NU) (coastal area), Nagari Aia Batumbuak (NAB) (hilly area), Nagari Padang Laweh Malalo (NPLM) (lake area), Nagari Pandai Sikek (NPS) (hilly area). The rainfall ranged from 1400- 4800 mm annually with fertile soils. Data was collected by using PRA (Participatory Rural Appraisal) to investigate indigenous knowledge (IK) and its interactions, which is also combining with in depth-interview, life history, a survey using semi-structured-questionnaire, pictures, mapping, and expert interview. The data was collected from June - September 2009 and June 2010. The materials are; map of area, list of names, questionnaires, voices recorder, note book, and digital camera. The sampling method was snowball sampling which resulted in the qualitative and quantitative data taken. For qualitative data, ethnography and life history was used. For quantitative, a statistical survey with a semi-structured questionnaire was used. 50 respondents per each site participated voluntarily. Data was analyzed by performing MAXQDA 10, and F4 audio analysis software (created and developed by Philip-University Marburg). The data is clustered based on causality. The results show that; the role of IK on TFS (traditional farming system) shown on NPLM which has higher food crop biodiversity in comparison to the other three places even though it has relatively similar temperature and rainfall. This high food crop biodiversity is due to the awareness of local people who realized that they lived in unfavourable climate and topography; therefore they are more prepared for any changes that may occur. Carbohydrate intake is 100 % through rice even though they are growing different staple crops. Whereas most of the people said in the interviews that not eating rice is like not really eating for them. In addition to that, mothers still play an important role in kitchen activities. But when the agriculture income is low, mothers have to decide whether to change the meals or to feel insecure about their food supply. Marantau yields positive impact through the remittances it provides to invest on the farm. On the other hand, it results in fewer workers for agriculture, and therefore a negative impact on the transfer of IK. The investigation showed that the local government has a PTS (Padi Tanam Sabatang) programme which still does not guarantee that the farmers are getting sufficient revenue from their land. The low agricultural income leads to situation of potential food insecurity. It is evident that education is equal among men and women, but in some cases women tend to leave school earlier because of arranged marriages or the distances of school from their homes. Men predominantly work in agriculture and fishing, while women work in the kitchen. In NAB, even though women work on farmland they earn less then men. Weaving (NPS) and kitchen activity is recognized as women’s work, which also supports the household income. Mass media is not yielding any changes in TFS and food culture in these days. The traditional farming system has changed because of intensive agricultural extension which has introduced new methods of agriculture for the last three decades (since the 1980’s). There is no evidence that they want to change any of their food habits because of the mass media despite the lapau activity which allows them to get more food choices, instead preparing traditional meal at home. The recommendations of this thesis are: 1) The empowerment of farmers. It is regarding the self sufficient supply of manure, cooperative seed, and sustainable farm management. Farmers should know – where are they in their state of knowledge – so they can use their local wisdom and still collaborate with new sources of knowledge. Farmers should learn the prognosis of supply and demand next prior to harvest. There is a need for farm management guidelines; that can be adopted from both their local wisdom and modern knowledge. 2) Increase of non-agricultural income Increasing the non-agricultural income is strongly recommended. The remittances can be invested on non-agricultural jobs. 3) The empowerment of the mother. The mother plays an important role in farm to fork activities; the mother can be an initiator and promoter of cultivating spices in the backyard. Improvement of nutritional knowledge through information and informal public education can be done through arisan ibu-ibu and lapau activity. The challenges to apply these recommendations are: 1) The gap between institutions and organizations of local governments. There is more than one institution involved in food security policy. 2) Training and facilities for field extension agriculture (FEA) is needed because the rapid change of interaction between local government and farmer’s dependent on this agency.

Climate change and hunger as the challenges in the global food system

In the last decades, there has been a growing tendency towards international trade and globalisation, particularly leading to a significant increase in flows of agricultural commodities worldwide. From a macroeconomic perspective, the commodity projections are more optimistic than the previous years and the long run tendency shows an increasing demand for feedstock. However, the strong shifts of shocks and fluctuations (in terms of prices and volumes) are a concern to global food security, with the number of hungry people rising to nearly one billion. Agriculture is a main user of natural resources, and it has a strong link with rural societies and the environment. Forecasted impacts from climate change, limited productive endorsements and emerging rivals on crop production, such bio-energy, aggravate the panorama on food scarcity. In this context, it is a great challenge on farming and food systems to reduce global hunger and produce in sustainable ways adequate supplies for food, feed, and non-food uses. The main objective of this work is to question the sustainability of food and agriculture systems. It is particularly interesting to know its role and if it will be able to respond to a growing population with increasing food demand in a world where pressure on land, water and other natural resources are already evident, and, moreover, climate change will also condition and impact the outcome. Furthermore, a deeper focus will be set on developing countries, which are expected to emerge and take a leading role in the international arena. This short paper is structured as follows: Section I, “Introduction”, describes the social situation regarding hunger, Section II, “Global Context”, attempts to summarise the current scenario in the international trading scheme and present the emerging rivals for primary resources, and in Section III, “Climate Change”, presents an overview of possible changes in the sector and future perspectives in the field. Finally, in Section IV, “Conclusion”, the main conclusions are presented.

Contradictions within the Modern Food System: Nutritional Disbalance across the Globe, Its Main Drivers and Possible Ways Out

Contemporary food production, given the degree of technology being applied in it and the present state of scientific knowledge, should be able to feed the world. Corresponding statistics show that in fact the volumes of modern food production confirm this statement. Yet, the present nutritional situation across the globe leaves much to be desired: on the one hand the numbers of undernourished and malnourished people are still high and even growing in some regions, and on the other hand there is an increasing number of overweight and obese people who are experiencing (or are at risk of) adverse health impacts as consequences. The question arises how this situation is possible given the present state of food production and knowledge, and also in terms of nutrition basics when talking about the latter. When arguing about the main causes of the present situation with nutrition across the globe, it is the modern food system with its distortions that is often criticised with emphasis placed on inappropriate food distribution as one of the key problems. However it is not only food distribution that shapes inequalities in terms of food availability and accessibility – there is a number of other factors contributing to this situation including political influences. Each of the drivers of the present situation might affect more than one part and have outcomes in different dimensions. Therefore it makes sense to apply a holistic approach when viewing the modern food system, embracing all the elements and existing relationships between them for this will facilitate taking appropriate actions in order to target the desired outcome in the best possible way. Applying a systematic approach and linking various elements with corresponding interactions among them allows for picturing all the possible outcomes and hence finding the way for a better solution on global level – a solution to the present problem with nutritional disbalance across the globe.

Impact on Policy Responses to Food Price Crisis and Rural Food Security in Sri Lanka

In Sri Lanka policy responses have direct impacts on rural dwellers. Over 80% of Sri Lanka’s population live in rural areas and 90% of them represent low income dwellers. Their production system may be hampered by fragmented landholding, poor economics of scale, low investment levels resulting from poor financial services as well as inappropriate or limited technology. They are vulnerable to price hikes of basic foods and food security issues due to fragmented landholding and poor financial services. Policy measures to reduce the transmission of higher international prices in domestic markets exist to protect the food security of the vulnerable population. This paper will discuss the food policy and strategies implemented by the government and outside to the above facts this paper also describes the effectiveness of the policies forwarded by the government. The objective of this study is to analyse the impact of policy responses to the food price crisis and rural food security in Sri Lanka. Outside of the above facts this study also treats the impact of policies and decisions on the nutritional condition of rural dwellers. Furthermore this study is to analyse the fluctuation of buying power with the price hikes and the relation of above facts with issues like malnutrition. This paper discusses why policy makers should pay greater attention to rural dwellers and describes the multiple pathways through which food price increases have on rural people. It also provides evidence of the impact of this crisis in particular, through hidden hunger, and discusses how current policy responses should adjust and improve to protect the rural dwellers in the short and long term.

Connecting the Water and Carbon Cycles for the Generation of Food Security and Ecosystem Services

Water scarcity and food insecurity are pervasive issues in the developing world and are also intrinsically linked to one another. Through the connection of the water cycle and the carbon cycle this study illustrates that synergistic benefits can be realized by small scale farmers through the implementation of waste water irrigated agroforestry. The WaNuLCAS model is employed using La Huerta agroforestry site in Texcoco, South Central Mexico, as the basis for parameterization. The results of model simulations depicting scenarios of water scarcity and waste water irrigation clearly show that the addition of waste water greatly increases the agroforestry system’s generation of crop yields, above- and below-ground biomass, soil organic matter and carbon storage potential. This increase in carbon sequestration by the system translates into better local food security, diversified household income through payments for ecosystem services and contributes to the mitigation of global climate change.

Optimising contributions of goat farming to household economic success and food security in three production systems in Ethiopia

The study aims to analyse factors affecting contributions of goat farming to household economic success and food security in three goat production systems of Ethiopia. A study was conducted in three districts of Ethiopia representing arid agro-pastoral (AAP), semi-arid agro-pastoral (SAAP) and highland mixed crop-livestock (HMCL) systems involving 180 goat keeping households. Gross margin (GM) and net benefit (NB1 and NB2) were used as indicators of economic success of goat keeping. NB1 includes in-kind benefits of goats (consumption and manure), while NB2 additionally constitutes intangible benefits (insurance and finance). Household dietary diversity score (HDDS) was used as a proxy indicator of food security. GM was significantly affected by an off-take rate and flock size interaction (P<0.001). The increment of GM due to increased off-take rate was more prominent for farmers with bigger flocks. Interaction between flock size and production system significantly (P<0.001) affected both NB1 and NB2. The increment of NB1 and NB2 by keeping larger flocks was higher in AAP system, due to higher in-kind and intangible benefits of goats in this system. Effect of goat flock size as a predictor of household dietary diversity was not significant (P>0.05). Nevertheless, a significant positive correlation (P<0.05) was observed between GM from goats and HDDS in AAP system, indicating the indirect role of goat production for food security. The study indicated that extent of utilising tangible and intangible benefits of goats varied among production systems and these differences should be given adequate attention in designing genetic improvement programs.

The function of SIFamide, PDF, and further neuropeptides in the circadian system of Rhyparobia maderae

Der täglich Wechsel von Hell- und Dunkelphasen führte während der Evolution zur Entwicklung innerer Uhren in nahezu allen Organismen. In der Schabe Rhyparobia maderae lokalisierten Läsions- und Transplantationsexperimente die innere Uhr in der akzessorischen Medulla (AME). Dieses kleine birnenförmige Neuropil am ventromedianen Rand der Medulla ist mit etwa 240 Neuronen assoziiert, die eine hohe Anzahl an zum Teil kolokalisierten Neuropeptiden und Neurotransmittern exprimieren. Diese Signalstoffe scheinen essentiell zu sein für die Synchronisation der inneren Uhr mit der Umwelt, der Kopplung der beiden bilateralen AME, der Aufrechterhaltung des circadianen Rhythmus sowie der zeitlichen Steuerung bestimmter Verhaltensweisen. Während die Funktion einiger dieser neuronalen Botenstoffe bereits gut untersucht ist, fehlt sie für andere. Zudem ist noch ungeklärt, wann einzelne Botenstoffe im circadianen Netzwerk agieren. Im Fokus dieser Studie lag daher die Erforschung der Funktion von SIFamide und Corazonin im circadianen Netzwerk sowie die weitere Untersuchung der Funktionen der Neuropeptide MIP und PDF. Es konnte gezeigt werden, dass SIFamide auch in R. maderae in vier großen neurosekretorischen Zellen in der pars intercerebralis exprimiert wird. Varikosenreiche SIFamide-immureaktive (-ir) Fasern innervieren eine Vielzahl an Neuropilen und finden sich auch in der Hüllregion der AME. Injektionsexperimente resultierten in einer monophasischen Phasen-Antwort-Kurve (PRC) mit einer Verzögerung zur frühen subjektiven Nacht. SIFamide ist also ein Eingangssignal für das circadiane Netzwerk und könnte in der Kontrolle der Schalf/Wach-Homöostase involviert sein. Auch Corazonin fungiert als Eingangssignal. Da die Injektionsexperimente in einer monophasischen PRC mit einem Phasenvorschub zur späten subjektiven Nacht resultierten, ist davon auszugehen, dass die Corazonin-ir AME-Zelle Bestandteil des Morning-Oszillator-Netzwerkes in R. maderae ist. Darüber hinaus zeigten Backfill-Experimente, dass MIP an der Kopplung beider AMAE beteiligt ist. ELISA-Quantifizierungen der PDF-Level im Tagesverlauf ergaben Schwankungen in der Konzentration, die auf eine Ausschüttung des Peptids während des Tages hindeuten – ähnlich wie es in Drosophila melanogaster der Fall ist. Dies spiegelt sich in der vervollständigten bimodalen PDF-PRC wieder. Hier führen Injektionen zu einem Phasenvorschub, bevor maximale Peptidlevel erreicht werden, sowie zu einer Phasenverzögerung, sobald die Peptidlevel wieder zu sinken beginnen. Die PRCs erlauben somit Rückschlüsse auf den Zeitpunkt der maximalen Peptidfreisetzung. PDF-ir Neuriten findet sich zudem in sämtlichen Ganglien des ventralen Strickleiternervensystems, was eine Funktion in der Kontrolle der Prozesse impliziert, die durch die Mustergeneratoren in Thorakal- und Abdominalganglien gesteuert werden.