Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Truth in complex adaptive systems models should be based on truth by constructive verification

It is argued that the truth status of emergent properties of complex adaptive systems models should be based on an epistemology of proof by constructive verification and therefore on the ontological axioms of a non-realist logical system such as constructivism or intuitionism. ‘Emergent’ properties of complex adaptive systems (CAS) models create particular epistemological and ontological challenges. These challenges bear directly on current debates in the philosophy of mathematics and in theoretical computer science. CAS research, with its emphasis on computer simulation, is heavily reliant on models which explore the entailments of Formal Axiomatic Systems (FAS). The incompleteness results of Gödel, the incomputability results of Turing, and the Algorithmic Information Theory results of Chaitin, undermine a realist (platonic) truth model of emergent properties. These same findings support the hegemony of epistemology over ontology and point to alternative truth models such as intuitionism, constructivism and quasi-empiricism.

Revealing the whiteboard to blind students: An inclusive approach to provide mediation in synchronous e-learning activities

Promoting the inclusion of students with disabilities in e-learning systems has brought many challenges for researchers and educators. The use of synchronous communication tools such as interactive whiteboards has been regarded as an obstacle for inclusive education. In this paper, we present the proposal of an inclusive approach to provide blind students with the possibility to participate in live learning sessions with whiteboard software. The approach is based on the provision of accessible textual descriptions by a live mediator. With the accessible descriptions, students are able to navigate through the elements and explore the content of the class using screen readers. The method used for this study consisted of the implementation of a software prototype within a virtual learning environment and a case study with the participation of a blind student in a live distance class. The results from the case study have shown that this approach can be very effective, and may be a starting point to provide blind students with resources they had previously been deprived from. The proof of concept implemented has shown that many further possibilities may be explored to enhance the interaction of blind users with educational content in whiteboards, and further pedagogical approaches can be investigated from this proposal. (C) 2009 Elsevier Ltd. All rights reserved.

Design issues for knowledge artifacts

The notion of knowledge artifact has rapidly gained popularity in the fields of general knowledge management and more recently knowledge-based systems. The main goal on this paper is to propose and discuss a methodology for the design and implementation of knowledge-based systems founded on knowledge artifacts. We advocate that the systems built according to this methodology can be effective to convey the flow of knowledge between different communities of practice. Our methodology has been developed from the ground up, i.e. we have built some concrete systems based on the abstract notion of knowledge artifact and synthesized our methodology based on reflections upon our experiences building these systems. In this paper, we also describe the most relevant systems we have built and how they have guided us to the synthesis of our proposed methodology. (C) 2008 Elsevier B.V. All rights reserved.

An algorithm for automatic checking of exercises in a dynamic geometry system: iGeom

One of the key issues in e-learning environments is the possibility of creating and evaluating exercises. However, the lack of tools supporting the authoring and automatic checking of exercises for specifics topics (e.g., geometry) drastically reduces advantages in the use of e-learning environments on a larger scale, as usually happens in Brazil. This paper describes an algorithm, and a tool based on it, designed for the authoring and automatic checking of geometry exercises. The algorithm dynamically compares the distances between the geometric objects of the student`s solution and the template`s solution, provided by the author of the exercise. Each solution is a geometric construction which is considered a function receiving geometric objects (input) and returning other geometric objects (output). Thus, for a given problem, if we know one function (construction) that solves the problem, we can compare it to any other function to check whether they are equivalent or not. Two functions are equivalent if, and only if, they have the same output when the same input is applied. If the student`s solution is equivalent to the template`s solution, then we consider the student`s solution as a correct solution. Our software utility provides both authoring and checking tools to work directly on the Internet, together with learning management systems. These tools are implemented using the dynamic geometry software, iGeom, which has been used in a geometry course since 2004 and has a successful track record in the classroom. Empowered with these new features, iGeom simplifies teachers` tasks, solves non-trivial problems in student solutions and helps to increase student motivation by providing feedback in real time. (c) 2008 Elsevier Ltd. All rights reserved.

Localizing a global discipline - Designing new planning programs in Sri Lanka

In order to be relevant and useful in a fragmented developing country context, community and regional planning needs to shift away from the use of rigid tools to more flexible, adaptive approaches. An international review of planning curricula indicated a widespread consensus with respect to key competencies required of planners. This understanding was used in the development of new teaching programs at three Sri Lankan universities. Complementing the technical core knowledge areas, strong emphases on problem structuring, critical and strategic thinking, and the understanding of the political and institutional contexts appear to be crucial to making the agenda of planning for sustainable development more than a fashionable cliche. In order for these core areas to have relevance in a developing country context, however, planning curricula need to achieve a balance between local priorities and a global perspective.

The predictive power of homework assignments on student achievement in grade three

Homework has been a controversial issue in education for the past century. Research has been scarce and has yielded results at both ends of the spectrum. This study examined the relationship between homework performance (percent of homework completed and percent of homework correct), student characteristics (SAT-9 score, gender, ethnicity, and socio-economic status), perceptions, and challenges and academic achievement determined by the students' average score on weekly tests and their score on the FCAT NRT mathematics assessment. ^ The subjects for this study consisted of 143 students enrolled in Grade 3 at a suburban elementary school in Miami, Florida. Pearson's correlations were used to examine the associations of the predictor variables with average test scores and FCAT NRT scores. Additionally, simultaneous regression analyses were carried out to examine the influence of the predictor variables on each of the criterion variables. Hierarchical regression analyses were performed on the criterion variables from the predictor variables. ^ Homework performance was significantly correlated with average test score. Controlling for the other variables homework performance was highly related to average test score and FCAT NRT score. ^ This study lends support to the view that homework completion is highly related to student academic achievement at the lower elementary level. It is suggested that at the elementary level more consideration be given to the amount of homework completed by students and to utilize the information in formulating intervention strategies for student who may not be achieving at the appropriate levels. ^

The effect of reciprocal mapping on high-risk sixth-grade students' social studies achievement

Reading deficits in students in Grades 4 to 12 are evident in American schools. Informational text is particularly difficult for students. This quasi-experimental study (N=138) investigated sixth-grade students' achievement in social studies using the Reciprocal Mapping instructional routine, compared to sixth-grade students' achievement taught with a traditional approach. The Reciprocal Mapping instructional routine incorporated explicit instruction in text structure using graphic organizers. Students created their own graphic organizers and used them to write about social studies content. The comparison group used a traditional approach, students' reading the textbook and answering questions. Students for this study included sixth-graders in the seven sixth-grade classrooms in two public schools in a small, rural south Florida school district. A focus of this study was to determine the helpfulness of the intervention for at-risk readers. To determine students considered to be at-risk, the researcher used data from the reading portion of the Florida Comprehensive Assessment Test (FCAT), 2011-2012, that considers Level 1 and 2 as at-risk readers. The quasi-experimental study used a pretest-posttest control group design, with students assigned to treatment groups by class. Two teachers at the two rural sites were trained on the Reciprocal Mapping instructional routine and taught students in both the experimental and control groups for an equivalent amount of time over a 5-week period. Results of the 3 x 2 factorial ANCOVA found a significant positive difference favoring the experimental group's social studies achievement as compared to that of the comparison group as measured by the pre/post unit test from the social studies series (McGraw-Hill, 2013), when controlling for initial differences in students' reading FCAT scores. Interactions for high-risk struggling readers were investigated using the significance level p < .05. Due to no significant interaction the main effects of treatment were interpreted. The pretest was used as a covariate and the multivariate analysis was found to be significant. Therefore, analysis of covariance was run on each of the dependent variable as a follow-up. Reciprocal Mapping was found to be significant in posttest scores, independent of gender and level of risk, and while holding the pretest scores constant. Findings showed there was a significant difference in the performance of the high-risk reading students taught with the Reciprocal Mapping intervention who scored statistically better than students in the control group. Further study findings showed that teacher fidelity of implementation of the treatment had a statistically significant relationship in predicting posttest scores when controlling for pretest scores. Study results indicated that improving students' use of text structure through the Reciprocal Mapping instructional routine positively supported sixth-grade students' social studies achievement.

Effects of sex, third grade reading achievement and motivation as predictors of fourth grade reading achievement of Hispanic students: A path analysis

This study explored the topic of motivation for intermediate students combining both an objective criterion measure (i.e., standardized test scores) and the self-report of students on self-concept and value of reading. The purpose of this study was to examine how third grade reading achievement correlated with the motivation of fourth grade boys and girls, and, in turn, how motivation related to fourth grade reading achievement. The participants were fourth grade students (n=207) attending two public, elementary schools in Miami-Dade County who were of primarily Hispanic origin or descent. Data were collected using the Reading Survey portion of the Motivation to Read Profile (1996) which measures self-concept and value of reading in order to measure motivation and the Third and Fourth Grade Reading Florida Comprehensive Assessment Tests 2.0 (FCAT 2.0) to assess achievement. First, a one way Analysis of Variance (ANOVA) was conducted to determine whether motivation differed significantly between fourth grade boys and girls. Second, a path analysis was used to determine whether motivation mediated or moderated the association between FCAT 2.0 third and fourth grade scores. Results of the ANOVA indicated that motivation, as measured by the Motivation to Read Profile did not differ significantly by sex. Results from the path analysis indicated that the model was significant and that third grade FCAT 2.0 scores accounted for a significant amount of the variance in fourth grade FCAT 2.0 scores once motivation was entered. Results of the study demonstrated that motivation partially mediates, but does not moderate the relationship between FCAT 2.0 third and fourth grade scores. In conclusion, it can be determined that past student achievement for fourth grade students plays a role in current student achievement when motivation is also considered. It is therefore important in order to improve the quality of fourth grade student's current performance to take into account a student's motivation and past achievement. An effort must be made to address students' motivational needs whether through school wide programs or at the classroom level in addition or in conjunction with cognition. Future research on the effect of self-concept in reading achievement is recommended.

Teachers' experiences in and perceptions of their 12th-grade British literature classrooms

The purpose of this study was to understand the experiences and perceptions of 12th-grade literature teachers about curriculum, Post-Colonial literature, and students. Theories posed by Piaget (1995), Vygotsky (1995), and Rosenblatt (1995) formed the framework for this micro-ethnographic study. Seven teachers from public and private schools in South Florida participated in this two-phase study; three teachers in Phase I and four in Phase II. All participants completed individual semi-structured interviews and demographic surveys. In addition, four of the teachers were observed teaching. The analysis yielded three themes and two sub-themes: (a) knowledge concerned teachers' knowledge of British literature content and Post-Colonial authors and their literature; (b) freedom described teachers' freedom to choose how to teach their content. Included in this theme was dilemmas associated with 12th-grade classrooms which described issues that were pertinent to the 12th-grade teacher and classroom that were revealed by the study; and (c) thoughts about students described teachers' perceptions about students and how literature might affect the students. Two subthemes of knowledge were as follows:(1) text complexity described teacher responses to a Post-Colonial text's complexity and (2) student desirability/teachability described teachers' perception about how desirable Post-Colonial texts would be to students and whether teachers would be willing to teach these texts. The researcher offers recommendations for understanding factors associated with 12th-grade teachers perceptions and implications for enhancing the 12th-grade experience for teachers and curriculum, based on this study: (a) build teacher morale and capacity, (b) treat all students as integral components of the teaching and learning process; teachers in this study thought teaching disenfranchised learners was a form of punishment meted out by the administration, and (c) include more Post-Colonial authors in school curricula in colleges and schools as most teachers in this study did not study this type of literature nor knew how to teach it.

The effects of trained teachers' integration of dialogic reading discourse on Hispanic English Language Learners' literacy skills in kindergarten

This quasi-experimental Analysis of Covariance (ANCOVA) study explored whether the vocabulary and reading comprehension mean scores of Hispanic Kindergarten ELs whose teachers were trained to utilize Dialogic Reading (DR) discourse were higher than the mean scores of Hispanic ELs in kindergarten whose teachers were not trained to utilize DR discourse strategies. Sixty-three self-identified Hispanic, English Language Kindergarten students and four teachers participated in the study. The teachers were randomly assigned to either the experimental group (DR trained) or control group by drawing names from a hat. Student assignment to experimental versus comparison group was based on the teacher's assignment to either the experimental or comparison group. Thirty-one were assigned to the control group and 32 to the experimental group. The teachers were instructed to read the story to a group of six students (maximum) at a time, utilizing the DR discourse strategies they had been trained to implement. Subjects were read a story each week during the 8-week duration of the study. Teachers in the experimental group collaboratively selected 10 words each week from the Read Together Talk Together (RTTT) instructional stories that were utilized for vocabulary instruction. A test of homogeneity was conducted to evaluate whether the variance among the dependent variables was the same across the groups. An Analyses of Covariance (ANCOVA) was applied to analyze students' vocabulary and comprehension mean scores in the experimental group and the comparison group. The results of the study demonstrated a significant increase in the vocabulary and reading comprehension mean scores for the students whose teachers had been trained in DR discourse strategies. When comparing the two groups, the results revealed a statistically significant difference (p < 0.05). In conclusion, this study was conducted to explore how DR discourse may be an effective technique to teach literacy skills. The findings of this study showed that vocabulary knowledge and reading comprehension of Hispanic ELs were positively affected by the teachers' inclusion of dialogue during storybook reading. Its outcomes accentuated the need for teachers to provide assistance to ELs as they develop vocabulary knowledge and reading comprehension skills.

The use of visualization, onset-and-rime, story read-alouds, and discussion to improve diverse first graders' vocabulary and comprehension

It has long been known that vocabulary is essential in the development of reading. Because vocabulary leading to increased comprehension is important, it necessary to determine strategies for ensuring that the best methods of teaching vocabulary are used to help students make gains in vocabulary leading to reading comprehension. According to the National Reading Panel, multiple strategies that involve active engagement on the part of the student are more effective than the use of just one strategy. The purpose of this study was to determine if students' use of visualization, student-generated pictures of onset-and-rime-patterned vocabulary, and story read-alouds with discussion, would enable diverse first-grade students to increase their vocabulary and comprehension. In addition, this study examined the effect of the multimodal framework of strategies on English learners (ELs). This quasi-experimental study (N=69) was conducted in four first-grade classrooms in a low socio-economic school. Two treatment classes used a multimodal framework of strategies to learn weekly vocabulary words and comprehension. Two comparison classrooms used the traditional method of teaching weekly vocabulary and comprehension. Data sources included Florida Assessments for Instruction in Reading (FAIR), comprehension and vocabulary scores, and weekly MacMillan/McGraw Hill Treasures basal comprehension questions and onset-and-rime vocabulary questions. This research determined that the treatment had an effect in adjusted FAIR comprehension means by group, with the treatment group (adj M = 5.14) significantly higher than the comparison group ( adj M = -8.26) on post scores. However, the treatment means did not increase from pre to post, but the comparison means significantly decreased from pre to post as the materials became more challenging. For the FAIR vocabulary, there was a significant difference by group with the comparison adjusted post mean higher than the treatment's, although both groups significantly increased from pre to post. However, the FAIR vocabulary posttest was not part of the Treasures vocabulary, which was taught using the multimodal framework of strategies. The Treasures vocabulary scores were not significantly different by group on the assessment across the weeks, although the treatment means were higher than those of the comparison group. Continued research is needed in the area of vocabulary and comprehension instructional methods in order to determine strategies to increase diverse, urban students' performance.

Optimaliseren van leren in en rond PO, VO en MBO.

In deze presentatie wordt ingegaan op mogelijkheden het onderwijs voor en het leren van jonge kinderen en leerlingen in het PO, VO en MBO te optimaliseren.