Detecção de eventos de segurança de redes por intermédio de técnicas estatísticas e associativas aplicadas a fluxos de dados

Pós-graduação em Ciência da Computação - IBILCE

Statistical model applied to NetFlow for network intrusion detection

The computers and network services became presence guaranteed in several places. These characteristics resulted in the growth of illicit events and therefore the computers and networks security has become an essential point in any computing environment. Many methodologies were created to identify these events; however, with increasing of users and services on the Internet, many difficulties are found in trying to monitor a large network environment. This paper proposes a methodology for events detection in large-scale networks. The proposal approaches the anomaly detection using the NetFlow protocol, statistical methods and monitoring the environment in a best time for the application. © 2010 Springer-Verlag Berlin Heidelberg.

Market-driven security-constrained transmission network expansion planning

This paper presents a Bi-level Programming (BP) approach to solve the Transmission Network Expansion Planning (TNEP) problem. The proposed model is envisaged under a market environment and considers security constraints. The upper-level of the BP problem corresponds to the transmission planner which procures the minimization of the total investment and load shedding cost. This upper-level problem is constrained by a single lower-level optimization problem which models a market clearing mechanism that includes security constraints. Results on the Garver's 6-bus and IEEE 24-bus RTS test systems are presented and discussed. Finally, some conclusions are drawn. © 2011 IEEE.

Network node with wireless and wired interfaces: Nios II processor and uClinux to development of a NCAP embedded (IEEE 1451.1) with two interfaces, wireless (IEEE 1451.5) and wired (IEEE p1451.2)

This paper presents a NCAP embedded on DE2 kit with Nios II processor and uClinux to development of a network gateway with two interfaces, wireless (ZigBee) and wired (RS232) based on IEEE 1451. Both the communications, wireless and wired, were developed to be point-to-point and working with the same protocols, based on IEEE 1451.0-2007. The tests were made using a microcomputer, which through of browser was possible access the web page stored in the DE2 kit and send commands of control and monitoring to both TIMs (WTIM and STIM). The system describes a different form of development of the NCAP node to be applied in different environments with wired or wireless in the same node. © 2011 IEEE.

Performance evaluation of the fuzzy ARTMAP for network intrusion detection

Recently, considerable research work have been conducted towards finding fast and accurate pattern classifiers for training Intrusion Detection Systems (IDSs). This paper proposes using the so called Fuzzy ARTMAT classifier to detect intrusions in computer network. Our investigation shows, through simulations, how efficient such a classifier can be when used as the learning mechanism of a typical IDS. The promising evaluation results in terms of both detection accuracy and training duration indicate that the Fuzzy ARTMAP is indeed viable for this sort of application.

Atmospheric Models Applied to DGPS and RTK Network in Brazil: Preliminary Results

Several positioning techniques have been developed to explore the GPS capability to provide precise coordinates in real time. However, a significant problem to all techniques is the ionosphere effect and the troposphere refraction. Recent researches in Brazil, at São Paulo State University (UNESP), have been trying to tackle these problems. In relation to the ionosphere effects it has been developed a model named Mod_Ion. Concerning tropospheric refraction, a model of Numerical Weather Prediction(NWP) has been used to compute the zenithal tropospheric delay (ZTD). These two models have been integrated with two positioning methods: DGPS (Differential GPS) and network RTK (Real Time Kinematic). These two positioning techniques are being investigated at São Paulo State University (UNESP), Brazil. The in-house DGPS software was already finalized and has provided very good results. The network RTK software is still under development. Therefore, only preliminary results from this method using the VRS (Virtual Reference Station) concept are presented.

Continuous-time and discrete-time sliding mode control accomplished using a computer

A computer-based sliding mode control (SMC) is analysed. The control law is accomplished using a computer and A/D and D/A converters. Two SMC designs are presented. The first one is a continuous-time conventional SMC design, with a variable structure law, which does not take into consideration the sampling period. The second one is a discrete-time SMC design, with a smooth sliding law, which does not have a structure variable and takes into consideration the sampling period. Both techniques are applied to control an inverted pendulum system. The performance of both the continuous-time and discrete-time controllers are compared. Simulations and experimental results are shown and the effectiveness of the proposed techniques is analysed.

Malware distributed collection and pre-classification system using honeypot technology

Malware has become a major threat in the last years due to the ease of spread through the Internet. Malware detection has become difficult with the use of compression, polymorphic methods and techniques to detect and disable security software. Those and other obfuscation techniques pose a problem for detection and classification schemes that analyze malware behavior. In this paper we propose a distributed architecture to improve malware collection using different honeypot technologies to increase the variety of malware collected. We also present a daemon tool developed to grab malware distributed through spam and a pre-classification technique that uses antivirus technology to separate malware in generic classes. © 2009 SPIE.

Proposal of an On-demand Software Deployment System Based on Application Streaming, Virtualization Techniques and P2P Transport

This paper presents the work in progress of an on-demand software deployment system based on application virtualization concepts which eliminates the need of software installation and configuration on each computer. Some mechanisms were created, such as mapping of utilization of resources by the application to improve the software distribution and startup; a virtualization middleware which give all resources needed for the software execution; an asynchronous P2P transport used to optimizing distribution on the network; and off-line support where the user can execute the application even when the server is not available or when is out of the network. © Springer-Verlag Berlin Heidelberg 2010.

Virtual instrumentation: A practical approach to control and supervision process

This work describes a control and supervision application takes into account the virtual instrumentation advantages to control and supervision industrial manufacturing stations belonging to the modular production system MPS® by Festo. These stations integrate sensors, actuators, conveyor belt and other industrial elements. The focus in this approach was to replace the use of programmable logic controllers by a computer equipped with a software application based on Labview and, together, performs the functions of traditional instruments and PLCs. The manufacturing stations had their processes modeled and simulated in Petri nets. After the models were implemented in Labview environment. Tests and previous similar works in MPS® installed in Automation Laboratory, at UNESP Sorocaba campus, showed the materials and methods used in this work allow the successful use of virtual instrumentation. The results indicate the technology as an advantageous approach for the automation of industrial processes, with gains in flexibility and reduction in project cost. © 2011 IEEE.

Architecture for peer-to-peer databases with routing queries using ant colony algorithm and semantic support

In a peer-to-peer network, the nodes interact with each other by sharing resources, services and information. Many applications have been developed using such networks, being a class of such applications are peer-to-peer databases. The peer-to-peer databases systems allow the sharing of unstructured data, being able to integrate data from several sources, without the need of large investments, because they are used existing repositories. However, the high flexibility and dynamicity of networks the network, as well as the absence of a centralized management of information, becomes complex the process of locating information among various participants in the network. In this context, this paper presents original contributions by a proposed architecture for a routing system that uses the Ant Colony algorithm to optimize the search for desired information supported by ontologies to add semantics to shared data, enabling integration among heterogeneous databases and the while seeking to reduce the message traffic on the network without causing losses in the amount of responses, confirmed by the improve of 22.5% in this amount. © 2011 IEEE.

A malware detection system inspired on the human immune system

Malicious programs (malware) can cause severe damage on computer systems and data. The mechanism that the human immune system uses to detect and protect from organisms that threaten the human body is efficient and can be adapted to detect malware attacks. In this paper we propose a system to perform malware distributed collection, analysis and detection, this last inspired by the human immune system. After collecting malware samples from Internet, they are dynamically analyzed so as to provide execution traces at the operating system level and network flows that are used to create a behavioral model and to generate a detection signature. Those signatures serve as input to a malware detector, acting as the antibodies in the antigen detection process. This allows us to understand the malware attack and aids in the infection removal procedures. © 2012 Springer-Verlag.

Kappa-PSO-ARTMAP Fuzzy: uma metodologia para detecção de intrusos baseado em seleção de atributos e otimização de parâmetros numa rede neural ARTMAP Fuzzy

Pós-graduação em Engenharia Elétrica - FEIS

Determinants of bird species richness, endemism, and island network roles in Wallacea and the West Indies: is geography sufficient or does current and historical climate matter?

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

XSOFT: estudo de reconhecimento, exploração e prevenção de vulnerabilidades de software através de uma distribuição LINUX

This work aims to give greater visibility to the issue of software security, due to people talk a lot in security conferences, that much of both IT (Information Technology) staff and, more specifically, IS (Information Security) staff does not know this, and, thanks to the spread of the mobile computing and of the cloud computing, this lack of deeper knowledge on this subject is increasingly becoming worrisome. It aims too, make applications to be developed in a security manner, priorizing the security of the information processed. It attempts to demonstrate the secure coding techniques, the principles of software security, the means to identify software vulnerabilities, the cutting-edge software exploitation techniques and the mechanisms of mitigation. Nowadays, the security guys are in charge of the most of the security tests in applications, audits and pentests, and it is undeniable that the so-called security experts, most often come from computer network field, having few experience in software development and programming. Therefore, the development process does not consider the security issue, thanks to the lack of knowledge on the subject by the developer, and the security tests could be improved whether security experts had a greater know-how on application development. Given this problem, the goal here is to integrate information security with software development, spreading out the process of secure software development. To achieve this, a Linux distribution with proof of concept applicati... (Complete abstract click electronic access below)