Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

An Interval Intelligent-based Approach for Fault Detection and Modelling

Not considered in the analytical model of the plant, uncertainties always dramatically decrease the performance of the fault detection task in the practice. To cope better with this prevalent problem, in this paper we develop a methodology using Modal Interval Analysis which takes into account those uncertainties in the plant model. A fault detection method is developed based on this model which is quite robust to uncertainty and results in no false alarm. As soon as a fault is detected, an ANFIS model is trained in online to capture the major behavior of the occurred fault which can be used for fault accommodation. The simulation results understandably demonstrate the capability of the proposed method for accomplishing both tasks appropriately

Tratamiento de Artritis reumatoide con antagonistas del factor de necrosis tumoral alfa y su asociación con el desarrollo de melanoma cutáneo: revisión sistemática de la literatura y meta-análisis.

Introducción: El tratamiento con antagonistas del factor de necrosis tumoral alfa (anti TNF) ha impactado el pronóstico y la calidad de vida de los pacientes con artritis reumatoide (AR) positivamente, sin embargo, se interroga un incremento en el riesgo de desarrollar melanoma. Objetivo: Conocer la asociación entre el uso de anti TNF y el desarrollo de melanoma maligno en pacientes con AR. Metodología: Se realizó una búsqueda sistemática en MEDLINE, EMBASE, COCHRANE LIBRARY y LILACS para ensayos clínicos, estudios observacionales, revisiones y meta-análisis en pacientes adultos con diagnóstico de AR y manejo con anti TNF (Certolizumab pegol, Adalimumab, Etanercept, Infliximab y Golimumab). Resultados: 37 estudios clínicos cumplieron los criterios de inclusión para el meta-análisis, con una población de 16567 pacientes. El análisis de heterogeneidad no fue significativo (p=1), no se encontró diferencia en el riesgo entre los grupos comparados DR -0.00 (IC 95% -0.001; -0.001). Un análisis adicional de los estudios en los que se reportó al menos 1 caso de melanoma (4222 pacientes) tampoco mostró diferencia en el riesgo DR -0.00 (IC 95% -0.004 ; -0.003). Conclusión: En la evidencia disponible a la fecha no encontramos asociación significativa entre el tratamiento con anti TNF en pacientes con diagnóstico de AR y el desarrollo de melanoma cutáneo.

Alteraciones en el material genético de pintores de carros expuestos a solventes orgánicos en una localidad de Bogotá

Los solventes orgánicos son sustancias químicas que por sus propiedades físico-químicas son fácilmente inhalados o absorbidos por la piel, pueden causar daños de diversa índole en la salud. En Colombia existen normas que contemplan las medidas de protección, sin embargo persiste la informalidad en el sector de pintores de autos, por lo cual los trabajadores expuestos, a largo plazo pueden ver afectada su salud. En este estudio se analizó la relación entre individuos expuestos laboralmente a los solventes orgánicos versus no expuestos con respecto a la longitud de sus telómeros y formación de fragilidades. Se emplearon muestras de sangre extraídas por venopunción, recolectada en dos tubos: uno con Heparina, destinado al cultivo de linfocitos, para obtener cromosomas metafásicos y evaluar en ellos la presencia de fragilidades; el otro tubo con EDTA, fue empleado para la extracción de ADN y se utilizó para obtener los valores de longitud telomérica mediante la técnica de PCR cuantitativa. Los análisis estadísticos se realizaron aplicando la prueba de rangos de Wilcoxon, en el caso de la presencia de fragilidades se analizó la razón No.Fragilidades/No.Metafases, aplicando el método de Wilcoxon se encontró que existe diferencia estadísticamente significativa entre expuestos y no expuestos (p = 0,036), en donde los expuestos presentan mayor frecuencia de fragilidades. Por otra parte el valor relativo de longitud telomérica del grupo de expuestos fue mayor que el observado en el grupo de no expuestos, esta diferencia fue estadísticamente significativa (Wilcoxon, p = 0.002).

Biflavonoids from Araucaria angustifolia protect against DNA UV-Induced damage

Ultraviolet radiation is one of the most deleterious forms of radiation to terrestrial organisms and is involved in formation of mutagenic pyrimidine dimers and oxidized nucleotides. The biflavonoid fraction (BFF), extracted from needles of Araucaria angustifolia was capable of protecting calf thymus DNA from damage induced by UV radiation. This occurred through prevention of cyclobutane thymine dimer and 8-oxo-7,8-dihydro-2`-deoxyguanosine formation, this being quantified by high-performance liquid chromatography coupled to tandem mass spectrometry (HPLC-MS/MS) in a multiple reaction monitoring mode (MRM) and by HPLC-coulometric detection, respectively. (C) 2009 Elsevier Ltd. All rights reserved.

Evidence that OGG1 glycosylase protects neurons against oxidative DNA damage and cell death under ischemic conditions

7,8-Dihydro-8-oxoguanine DNA glycosylase (OGG1) is a major DNA glycosylase involved in base-excision repair (BER) of oxidative DNA damage to nuclear and mitochondrial DNA (mtDNA). We used OGG1-deficient (OGG1(-/-)) mice to examine the possible roles of OGG1 in the vulnerability of neurons to ischemic and oxidative stress. After exposure of cultured neurons to oxidative and metabolic stress levels of OGG1 in the nucleus were elevated and mitochondria exhibited fragmentation and increased levels of the mitochondrial fission protein dynamin-related protein 1 (Drp1) and reduced membrane potential. Cortical neurons isolated from OGG1(-/-) mice were more vulnerable to oxidative insults than were OGG1(+/+) neurons, and OGG1(-/-) mice developed larger cortical infarcts and behavioral deficits after permanent middle cerebral artery occlusion compared with OGG1(+/+) mice. Accumulations of oxidative DNA base lesions (8-oxoG, FapyAde, and FapyGua) were elevated in response to ischemia in both the ipsilateral and contralateral hemispheres, and to a greater extent in the contralateral cortex of OGG1(-/-) mice compared with OGG1(+/+) mice. Ischemia-induced elevation of 8-oxoG incision activity involved increased levels of a nuclear isoform OGG1, suggesting an adaptive response to oxidative nuclear DNA damage. Thus, OGG1 has a pivotal role in repairing oxidative damage to nuclear DNA under ischemic conditions, thereby reducing brain damage and improving functional outcome. Journal of Cerebral Blood Flow & Metabolism (2011) 31, 680-692; doi:10.1038/jcbfm.2010.147; published online 25 August 2010

Ultrasensitive Simultaneous Quantification of 1,N(2)-Etheno-2 `-deoxyguanosine and 1,N(2-)Propano-2 `-deoxyguanosine in DNA by an Online Liquid Chromatography-Electrospray Tandem Mass Spectrometry Assay

Exocyclic DNA adducts produced by exogenous and endogenous compounds are emerging as potential tools to study a variety of human diseases and air pollution exposure. A highly sensitive method involving online reverse-phase high performance liquid chromatography with electrospray tandem mass spectrometry detection in the multiple reaction monitoring mode and employing stable isotope-labeled internal standards was developed for the simultaneous quantification of 1,N(2)-etheno-2`-deoxyguanosine (1,N(2)-epsilon dGuo) and 1,N(2)-propano-2`-deoxyguanosine (1,N(2)-propanodGuo) in DNA. This methodology permits direct online quantification of 2`-deoxyguanosine and ca. 500 amol of adducts in 100 mu g of hydrolyzed DNA M the same analysis. Using the newly developed technique, accurate determinations of 1,N(2)-etheno-2`-deoxyguanosine and 1,N2-propano-2`-deoxyguanosine levels in DNA extracts of human cultured cells (4.01 +/- 0.32 1,N(2)-epsilon dGuo/10(8) dGuo and 3.43 +/- 0.33 1,N(2)-propanodGuo/10(8) dGuo) and rat tissue (liver, 2.47 +/- 0.61 1,N(2)-epsilon dGuo/10(8) dGuo and 4.61 +/- 0.69 1,N(2)-propanodGuo/108 dGuo; brain, 2.96 +/- 1.43,N(2)-epsilon dGuo/10(8) dGuo and 5.66 +/- 3.70 1,N(2)-propanoclGuo/10(8) dGuo; and lung, 0,87 +/- 0.34 1,N(2)-edGuo/ 10(8) dGuo and 2.25 +/- 1.72 1,N(2)-propanodGuo/10(8) dGuo) were performed. The method described herein can be used to study the biological significance of exocyclic DNA adducts through the quantification of different adducts in humans and experimental an with pathological conditions and after air pollution exposure.

Fully electrochemical hyphenated flow system for preconcentration, cleanup, stripping, capillary electrophoresis with stacking and contactless conductivity detection of trace heavy metals

Successful coupling of electrochemical preconcentration (EPC) to capillary electrophoresis (CE) with contactless conductivity detection (C(4)D) is reported for the first time. The EPC-CE interface comprises a dual glassy carbon electrode (GCE) block, a spacer and an upper block with flow inlet and outlet, pseudo-reference electrode and a fitting for the CE silica column, consisting of an orifice perpendicular to the surface of a glassy carbon electrode with a bushing inside to ensure a tight press fit. The end of the capillary in contact with the GCE is slant polished, thus defining a reproducible distance from the electrode surface to the column bore. First results with EPC-CE-C(4)D are very promising, as revealed by enrichment factors of two orders of magnitude for Tl, Cu, Pb and Cd ion peak area signals. Detection limits for 10 min deposition time fall around 20 nmol L(-1) with linear calibration curves over a wide range. Besides preconcentration, easy matrix exchange between accumulation and stripping/injection favors procedures like sample cleanup and optimization of pH, ionic strength and complexing power. This was demonstrated for highly saline samples by using a low conductivity buffer for stripping/injection to improve separation and promote field-enhanced sample stacking during electromigration along the capillary. (C) 2010 Elsevier B.V. All rights reserved.

Automated two-dimensional separation flow system with electrochemical preconcentration, stripping, capillary electrophoresis and contactless conductivity detection for trace metal ion analysis

This paper describes the automation of a fully electrochemical system for preconcentration, cleanup, separation and detection, comprising the hyphenation of a thin layer electrochemical flow cell with CE coupled with contactless conductivity detection (CE-C(4)D). Traces of heavy metal ions were extracted from the pulsed-flowing sample and accumulated on a glassy carbon working electrode by electroreduction for some minutes. Anodic stripping of the accumulated metals was synchronized with hydrodynamic injection into the capillary. The effect of the angle of the slant polished tip of the CE capillary and its orientation against the working electrode in the electrochemical preconcentration (EPC) flow cell and of the accumulation time were studied, aiming at maximum CE-C(4)D signal enhancement. After 6 min of EPC, enhancement factors close to 50 times were obtained for thallium, lead, cadmium and copper ions, and about 16 for zinc ions. Limits of detection below 25 nmol/L were estimated for all target analytes but zinc. A second separation dimension was added to the CE separation capabilities by staircase scanning of the potentiostatic deposition and/or stripping potentials of metal ions, as implemented with the EPC-CE-C(4)D flow system. A matrix exchange between the deposition and stripping steps, highly valuable for sample cleanup, can be straightforwardly programmed with the multi-pumping flow management system. The automated simultaneous determination of the traces of five accumulable heavy metals together with four non-accumulated alkaline and alkaline earth metals in a single run was demonstrated, to highlight the potentiality of the system.

Structural FRF acquisition via electric impedance measurement applied to damage location

Continuing development of new materials makes systems lighter and stronger permitting more complex systems to provide more functionality and flexibility that demands a more effective evaluation of their structural health. Smart material technology has become an area of increasing interest in this field. The combination of smart materials and artificial neural networks can be used as an excellent tool for pattern recognition, turning their application adequate for monitoring and fault classification of equipment and structures. In order to identify the fault, the neural network must be trained using a set of solutions to its corresponding forward Variational problem. After the training process, the net can successfully solve the inverse variational problem in the context of monitoring and fault detection because of their pattern recognition and interpolation capabilities. The use of structural frequency response function is a fundamental portion of structural dynamic analysis, and it can be extracted from measured electric impedance through the electromechanical interaction of a piezoceramic and a structure. In this paper we use the FRF obtained by a mathematical model (FEM) in order to generate the training data for the neural networks, and the identification of damage can be done by measuring electric impedance, since suitable data normalization correlates FRF and electrical impedance.

Relationship between DNA damage and sperm head birefringence

Birefringence or double refraction is the decomposition of a ray of light into two rays when it passes through an anisotropic material such as quartz. Sperm cells have been demonstrated to be optically anisotropic. The objective of this study was to evaluate the relationship between the pattern of human sperm head birefringence (SHBF) and DNA damage. A total of 26 patients with normal semen were included. DNA damage (fragmentation and denaturation) was evaluated in the sperm head in the context of birefringence, both total (SHBF-T) and partial (SHBF-P), by terminal deoxyribonucleotidyl transferase (TdT)-mediated dUDP nick-end labelling assay and acridine orange fluorescence, respectively. Positive DNA fragmentation in spermatozoa with SHBF-T (205/1053; 19.5%) was significantly higher (P < 0.0001) than in spermatozoa that presented SHBF-P (60/820; 7.3%). However, the percentage of denatured DNA in spermatozoa with SHBF-T (824/1256; 65.6%) was not significantly different from the ones with SHBF-P (666/1009; 66.0%). In conclusion, the data support a positive relationship between spermatozoa with total SHBF in their head and increased DNA fragmentation. (C) 2011, Reproductive Healthcare Ltd. Published by Elsevier Ltd. All rights reserved.

Protective effects of lemongrass (Cymbopogon citratus STAPF) essential oil on DNA damage and carcinogenesis in female Balb/C mice

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

Detection of cracks in scratching tests in ceramic materials through acoustic emission

The mechanisms of material removal and the interactions among scratches performed in ceramic materials were investigated using acoustic emission signals, and scanning electron microscopy, in scratching experiments. Several testing conditions were used to produce different types of removing mechanism on a glass as well as on a polycrystalline alumina sample composed by heterogeneous grain size. It is known that the material removing process on a polycrystalline ceramic involves intergranular microfracture and grain dislodgement, unlike the chipping produced by the extension of lateral cracks in non-granular materials, such as glass. Distinct settings for velocities, loads, and two types of diamond indenter were tested. The material removal was carried out by three different methods of scratching: single passes, repeated overlapping passes, and parallel scratches. As a general result, there was a clear relationship between the acoustic emission signals and the damage intensity occurred in the material removal. More specifically, there were differences in the acoustic emission signal levels in the scratches made on the alumina and on the glass owing to the material removal mechanisms associated with the structure of these materials. A gradual increase in the acoustic emission levels was observed when the number of repeated passes was increased as a result of the damage accumulation process followed by severe material removal. It was also noticed that the acoustic emission signals were capable of reflecting the interactions between two parallel scratches.

DETECTION OF SALMONELLA-TYPHIMURIUM IN A BROILER CHICKEN FLOCK

An outbreak of Salmonella typhimurium in a commercial broiler chicken flock is reported. The signs of the disease started on the 5th day-old. The symptoms, the gross alterations and the damage to the birds and to the farm are discussed.

Automation in fault detection using neural network and model updating

In this article, an implementation of structural health monitoring process automation based on vibration measurements is proposed. The work presents an alternative approach which intent is to exploit the capability of model updating techniques associated to neural networks to be used in a process of automation of fault detection. The updating procedure supplies a reliable model which permits to simulate any damage condition in order to establish direct correlation between faults and deviation in the response of the model. The ability of the neural networks to recognize, at known signature, changes in the actual data of a model in real time are explored to investigate changes of the actual operation conditions of the system. The learning of the network is performed using a compressed spectrum signal created for each specific type of fault. Different fault conditions for a frame structure are evaluated using simulated data as well as measured experimental data.