Detecting Danger: Applying a Novel Immunological Concept to Intrusion Detection Systems'

INTRODUCTION In recent years computer systems have become increasingly complex and consequently the challenge of protecting these systems has become increasingly difficult. Various techniques have been implemented to counteract the misuse of computer systems in the form of firewalls, antivirus software and intrusion detection systems. The complexity of networks and dynamic nature of computer systems leaves current methods with significant room for improvement. Computer scientists have recently drawn inspiration from mechanisms found in biological systems and, in the context of computer security, have focused on the human immune system (HIS). The human immune system provides an example of a robust, distributed system that provides a high level of protection from constant attacks. By examining the precise mechanisms of the human immune system, it is hoped the paradigm will improve the performance of real intrusion detection systems. This paper presents an introduction to recent developments in the field of immunology. It discusses the incorporation of a novel immunological paradigm, Danger Theory, and how this concept is inspiring artificial immune systems (AIS). Applications within the context of computer security are outlined drawing direct reference to the underlying principles of Danger Theory and finally, the current state of intrusion detection systems is discussed and improvements suggested.

'Immune System Approaches to Intrusion Detection - A Review'

Abstract. The use of artificial immune systems in intrusion detection is an appealing concept for two reasons. Firstly, the human immune system provides the human body with a high level of protection from invading pathogens, in a robust, self-organised and distributed manner. Secondly, current techniques used in computer security are not able to cope with the dynamic and increasingly complex nature of computer systems and their security. It is hoped that biologically inspired approaches in this area, including the use of immune-based systems will be able to meet this challenge. Here we collate the algorithms used, the development of the systems and the outcome of their implementation. It provides an introduction and review of the key developments within this field, in addition to making suggestions for future research.

The analysis and detection of new psychoactive substances in biological matrices

New psychoactive substances (NPSs) have appeared on the recreational drug market at an unprecedented rate in recent years. Many are not new drugs but failed products of the pharmaceutical industry. The speed and variety of drugs entering the market poses a new complex challenge for the forensic toxicology community. The detection of these substances in biological matrices can be difficult as the exact compounds of interest may not be known. Many NPS are sold under the same brand name and therefore users themselves may not know what substances they have ingested. The majority of analytical methods for the detection of NPSs tend to focus on a specific class of compounds rather than a wide variety. In response to this, a robust and sensitive method was developed for the analysis of various NPS by solid phase extraction (SPE) with gas chromatography mass spectrometry (GCMS). Sample preparation and derivatisation were optimised testing a range of SPE cartridges and derivatising agents, as well as derivatisation incubation time and temperature. The final gas chromatography mass spectrometry method was validated in accordance with SWGTOX 2013 guidelines over a wide concentration range for both blood and urine for 23 and 25 analytes respectively. This included the validation of 8 NBOMe compounds in blood and 10 NBOMe compounds in urine. This GC-MS method was then applied to 8 authentic samples with concentrations compared to those originally identified by NMS laboratories. The rapid influx of NPSs has resulted in the re-analysis of samples and thus, the stability of these substances is crucial information. The stability of mephedrone was investigated, examining the effect that storage temperatures and preservatives had on analyte stability daily for 1 week and then weekly for 10 weeks. Several laboratories identified NPSs use through the cross-reactivity of these substances with existing screening protocols such as ELISA. The application of Immunalysis ketamine, methamphetamine and amphetamine ELISA kits for the detection of NPS was evaluated. The aim of this work was to determine if any cross-reactivity from NPS substances was observed, and to determine whether these existing kits would identify NPS use within biological samples. The cross- reactivity of methoxetamine, 3-MeO-PCE and 3-MeO-PCP for different commercially point of care test (POCT) was also assessed for urine. One of the newest groups of compounds to appear on the NPS market is the NBOMe series. These drugs pose a serious threat to public health due to their high potency, with fatalities already reported in the literature. These compounds are falsely marketed as LSD which increases the chance of adverse effects due to the potency differences between these 2 substances. A liquid chromatography tandem mass spectrometry (LC-MS/MS) method was validated in accordance with SWGTOX 2013 guidelines for the detection for 25B, 25C and 25I-NBOMe in urine and hair. Long-Evans rats were administered 25B-, 25C- and 25I-NBOMe at doses ranging from 30-300 µg/kg over a period of 10 days. Tail flick tests were then carried out on the rats in order to determine whether any analgesic effects were observed as a result of dosing. Rats were also shaved prior to their first dose and reshaved after the 10-day period. Hair was separated by colour (black and white) and analysed using the validated LC-MS/MS method, assessing the impact hair colour has on the incorporation of these drugs. Urine was collected from the rats, analysed using the validated LC-MS/MS method and screened for potential metabolites using both LC-MS/MS and quadrupole time of flight (QToF) instrumentation.

Immune System Approaches to Intrusion Detection - A Review

The use of artificial immune systems in intrusion detection is an appealing concept for two reasons. Firstly, the human immune system provides the human body with a high level of protection from invading pathogens, in a robust, self-organised and distributed manner. Secondly, current techniques used in computer security are not able to cope with the dynamic and increasingly complex nature of computer systems and their security. It is hoped that biologically inspired approaches in this area, including the use of immune-based systems will be able to meet this challenge. Here we review the algorithms used, the development of the systems and the outcome of their implementation. We provide an introduction and analysis of the key developments within this field, in addition to making suggestions for future research.

'Immune System Approaches to Intrusion Detection - A Review'

Abstract. The use of artificial immune systems in intrusion detection is an appealing concept for two reasons. Firstly, the human immune system provides the human body with a high level of protection from invading pathogens, in a robust, self-organised and distributed manner. Secondly, current techniques used in computer security are not able to cope with the dynamic and increasingly complex nature of computer systems and their security. It is hoped that biologically inspired approaches in this area, including the use of immune-based systems will be able to meet this challenge. Here we collate the algorithms used, the development of the systems and the outcome of their implementation. It provides an introduction and review of the key developments within this field, in addition to making suggestions for future research.

Detecting Danger: Applying a Novel Immunological Concept to Intrusion Detection Systems'

INTRODUCTION In recent years computer systems have become increasingly complex and consequently the challenge of protecting these systems has become increasingly difficult. Various techniques have been implemented to counteract the misuse of computer systems in the form of firewalls, antivirus software and intrusion detection systems. The complexity of networks and dynamic nature of computer systems leaves current methods with significant room for improvement. Computer scientists have recently drawn inspiration from mechanisms found in biological systems and, in the context of computer security, have focused on the human immune system (HIS). The human immune system provides an example of a robust, distributed system that provides a high level of protection from constant attacks. By examining the precise mechanisms of the human immune system, it is hoped the paradigm will improve the performance of real intrusion detection systems. This paper presents an introduction to recent developments in the field of immunology. It discusses the incorporation of a novel immunological paradigm, Danger Theory, and how this concept is inspiring artificial immune systems (AIS). Applications within the context of computer security are outlined drawing direct reference to the underlying principles of Danger Theory and finally, the current state of intrusion detection systems is discussed and improvements suggested.

Immune System Approaches to Intrusion Detection - A Review

The use of artificial immune systems in intrusion detection is an appealing concept for two reasons. Firstly, the human immune system provides the human body with a high level of protection from invading pathogens, in a robust, self-organised and distributed manner. Secondly, current techniques used in computer security are not able to cope with the dynamic and increasingly complex nature of computer systems and their security. It is hoped that biologically inspired approaches in this area, including the use of immune-based systems will be able to meet this challenge. Here we review the algorithms used, the development of the systems and the outcome of their implementation. We provide an introduction and analysis of the key developments within this field, in addition to making suggestions for future research.

Investigating novel approaches to the detection of virus neutralising antibodies to rabies and Rift Valley fever virus

Serosurveillance is a powerful tool fundamental to understanding infectious disease dynamics. The presence of virus neutralising antibody (VNAb) in sera is considered the best evidence of infection, or indeed vaccination, and the gold standard serological assay for their detection is the virus neutralisation test (VNT). However, VNTs are labour intensive, costly and time consuming. In addition, VNTs for the detection of antibodies to highly pathogenic viruses require the use of high containment facilities, restricting the application of these assays to the few laboratories with adequate facilities. As a result, robust serological data on such viruses are limited. In this thesis I develop novel VNTs for the detection of VNAb to two important, highly pathogenic, zoonotic viruses; rabies and Rift Valley fever virus (RVFV). The pseudotype-based neutralisation test developed in this study allows for the detection of rabies VNAb without the requirement for high containment facilities. This assay was utilised to investigate the presence of rabies VNAb in animals from a variety of ecological settings. In this thesis I present evidence of natural rabies infection in both domestic dogs and lions from rabies endemic settings. The assay was further used to investigate the kinetics of VNAb response to rabies vaccination in a cohort of free-roaming dogs. The RVFV neutralisation assay developed herein utilises a recombinant luciferase expressing RVFV, which allows for rapid, high-throughput serosurveillance of this important neglected pathogen. In this thesis I present evidence of RVFV infection in a variety of domestic and wildlife species from Northern Tanzania, in addition to the detection of low-level transmission of RVFV during interepidemic periods. Additionally, the investigation of a longitudinal cohort of domestic livestock also provided evidence of rapid waning of RVF VNAb following natural infection. Collectively, the serological data presented in this thesis are consistent with existing data in the literature generated using the gold standard VNTs. Increasing the availability of serological assays will allow the generation of robust serological data, which are imperative to enhancing our understanding of the complex, multi-host ecology of these two viruses.

Utility of a panviral microarray for detection of swine respiratory viruses in clinical samples

Several factors have recently converged, elevating the need for highly parallel diagnostic platforms that have the ability to detect many known, novel, and emerging pathogenic agents simultaneously. Panviral DNA microarrays represent the most robust approach for massively parallel viral surveillance and detection. The Virochip is a panviral DNA microarray that is capable of detecting all known viruses, as well as novel viruses related to known viral families, in a single assay and has been used to successfully identify known and novel viral agents in clinical human specimens. However, the usefulness and the sensitivity of the Virochip platform have not been tested on a set of clinical veterinary specimens with the high degree of genetic variance that is frequently observed with swine virus field isolates. In this report, we investigate the utility and sensitivity of the Virochip to positively detect swine viruses in both cell culture-derived samples and clinical swine samples. The Virochip successfully detected porcine reproductive and respiratory syndrome virus (PRRSV) in serum containing 6.10 × 10(2) viral copies per microliter and influenza A virus in lung lavage fluid containing 2.08 × 10(6) viral copies per microliter. The Virochip also successfully detected porcine circovirus type 2 (PCV2) in serum containing 2.50 × 10(8) viral copies per microliter and porcine respiratory coronavirus (PRCV) in turbinate tissue homogenate. Collectively, the data in this report demonstrate that the Virochip can successfully detect pathogenic viruses frequently found in swine in a variety of solid and liquid specimens, such as turbinate tissue homogenate and lung lavage fluid, as well as antemortem samples, such as serum.

Geometrical Methods in Multivariate Risk Management: Algorithms and Applications

This thesis builds a framework for evaluating downside risk from multivariate data via a special class of risk measures (RM). The peculiarity of the analysis lies in getting rid of strong data distributional assumptions and in orientation towards the most critical data in risk management: those with asymmetries and heavy tails. At the same time, under typical assumptions, such as the ellipticity of the data probability distribution, the conformity with classical methods is shown. The constructed class of RM is a multivariate generalization of the coherent distortion RM, which possess valuable properties for a risk manager. The design of the framework is twofold. The first part contains new computational geometry methods for the high-dimensional data. The developed algorithms demonstrate computability of geometrical concepts used for constructing the RM. These concepts bring visuality and simplify interpretation of the RM. The second part develops models for applying the framework to actual problems. The spectrum of applications varies from robust portfolio selection up to broader spheres, such as stochastic conic optimization with risk constraints or supervised machine learning.

Deep Learning Architectures for time of arrival detection in Acoustic Emissions Monitoring

Acoustic Emission (AE) monitoring can be used to detect the presence of damage as well as determine its location in Structural Health Monitoring (SHM) applications. Information on the time difference of the signal generated by the damage event arriving at different sensors is essential in performing localization. This makes the time of arrival (ToA) an important piece of information to retrieve from the AE signal. Generally, this is determined using statistical methods such as the Akaike Information Criterion (AIC) which is particularly prone to errors in the presence of noise. And given that the structures of interest are surrounded with harsh environments, a way to accurately estimate the arrival time in such noisy scenarios is of particular interest. In this work, two new methods are presented to estimate the arrival times of AE signals which are based on Machine Learning. Inspired by great results in the field, two models are presented which are Deep Learning models - a subset of machine learning. They are based on Convolutional Neural Network (CNN) and Capsule Neural Network (CapsNet). The primary advantage of such models is that they do not require the user to pre-define selected features but only require raw data to be given and the models establish non-linear relationships between the inputs and outputs. The performance of the models is evaluated using AE signals generated by a custom ray-tracing algorithm by propagating them on an aluminium plate and compared to AIC. It was found that the relative error in estimation on the test set was < 5% for the models compared to around 45% of AIC. The testing process was further continued by preparing an experimental setup and acquiring real AE signals to test on. Similar performances were observed where the two models not only outperform AIC by more than a magnitude in their average errors but also they were shown to be a lot more robust as compared to AIC which fails in the presence of noise.

Solid state micro and nanopore sensors for single entity detection

A general description of the work presented in this thesis can be divided into three areas of interest: micropore fabrication, nanopore modification, and their applications. The first part of the thesis is related to the novel, reliable, cost-effective, potable, mass-productive, robust, and ease of use micropore flowcell that works based on the RPS technique. Based on our first goal, which was finding an alternate materials and processes that would shorten production times while lowering costs and improving signal quality, the polyimide film was used as a substrate to create precise pores by femtosecond laser, and the resulting current blockades of different sizes of the nanoparticles were recorded. Based on the results, the device can detecting nano-sized particles by changing the current level. The experimental and theoretical investigation, scanning electron microscopy, and focus ion beam were performed to explain the micropore's performance. The second goal was design and fabrication of a leak-free, easy-to-assemble, and portable polymethyl methacrylate flowcell for nanopore experiments. Here, ion current rectification was studied in our nanodevice. We showed a self-assembly-based, controllable, and monitorable in situ Poly(l-lysine)- g-poly(ethylene glycol) coating method under voltage-driven electrolyte flow and electrostatic interaction between nanopore walls and PLL backbones. Using designed nanopore flowcell and in situ monolayer PLL-g-PEG functionalized 20±4 nm SiN nanopores, we observed non-sticky α-1 anti-trypsin protein translocation. additionally, we could show the enhancement of translocation events through this non-sticky nanopore, and also, estimate the volume of the translocated protein. In this study, by comparing the AAT protein translocation results from functionalized and non-functionalized nanopore we demonstrated the 105 times dwell time reduction (31-0.59ms), 25% amplitude enhancement (0.24-0.3 nA), and 15 times event’s number increase (1-15events/s) after functionalization in 1×PBS at physiological pH. Also, the AAT protein volume was measured, close to the calculated AAT protein hydrodynamic volume and previous reports.

Data-driven multivariate flood hazard modeling

The present Dissertation shows how recent statistical analysis tools and open datasets can be exploited to improve modelling accuracy in two distinct yet interconnected domains of flood hazard (FH) assessment. In the first Part, unsupervised artificial neural networks are employed as regional models for sub-daily rainfall extremes. The models aim to learn a robust relation to estimate locally the parameters of Gumbel distributions of extreme rainfall depths for any sub-daily duration (1-24h). The predictions depend on twenty morphoclimatic descriptors. A large study area in north-central Italy is adopted, where 2238 annual maximum series are available. Validation is performed over an independent set of 100 gauges. Our results show that multivariate ANNs may remarkably improve the estimation of percentiles relative to the benchmark approach from the literature, where Gumbel parameters depend on mean annual precipitation. Finally, we show that the very nature of the proposed ANN models makes them suitable for interpolating predicted sub-daily rainfall quantiles across space and time-aggregation intervals. In the second Part, decision trees are used to combine a selected blend of input geomorphic descriptors for predicting FH. Relative to existing DEM-based approaches, this method is innovative, as it relies on the combination of three characteristics: (1) simple multivariate models, (2) a set of exclusively DEM-based descriptors as input, and (3) an existing FH map as reference information. First, the methods are applied to northern Italy, represented with the MERIT DEM (∼90m resolution), and second, to the whole of Italy, represented with the EU-DEM (25m resolution). The results show that multivariate approaches may (a) significantly enhance flood-prone areas delineation relative to a selected univariate one, (b) provide accurate predictions of expected inundation depths, (c) produce encouraging results in extrapolation, (d) complete the information of imperfect reference maps, and (e) conveniently convert binary maps into continuous representation of FH.

Advancing Bag-of-visual-words Representations For Lesion Classification In Retinal Images.

Diabetic Retinopathy (DR) is a complication of diabetes that can lead to blindness if not readily discovered. Automated screening algorithms have the potential to improve identification of patients who need further medical attention. However, the identification of lesions must be accurate to be useful for clinical application. The bag-of-visual-words (BoVW) algorithm employs a maximum-margin classifier in a flexible framework that is able to detect the most common DR-related lesions such as microaneurysms, cotton-wool spots and hard exudates. BoVW allows to bypass the need for pre- and post-processing of the retinographic images, as well as the need of specific ad hoc techniques for identification of each type of lesion. An extensive evaluation of the BoVW model, using three large retinograph datasets (DR1, DR2 and Messidor) with different resolution and collected by different healthcare personnel, was performed. The results demonstrate that the BoVW classification approach can identify different lesions within an image without having to utilize different algorithms for each lesion reducing processing time and providing a more flexible diagnostic system. Our BoVW scheme is based on sparse low-level feature detection with a Speeded-Up Robust Features (SURF) local descriptor, and mid-level features based on semi-soft coding with max pooling. The best BoVW representation for retinal image classification was an area under the receiver operating characteristic curve (AUC-ROC) of 97.8% (exudates) and 93.5% (red lesions), applying a cross-dataset validation protocol. To assess the accuracy for detecting cases that require referral within one year, the sparse extraction technique associated with semi-soft coding and max pooling obtained an AUC of 94.2 ± 2.0%, outperforming current methods. Those results indicate that, for retinal image classification tasks in clinical practice, BoVW is equal and, in some instances, surpasses results obtained using dense detection (widely believed to be the best choice in many vision problems) for the low-level descriptors.

Chemical Immobilization Of Crosslinked Polymeric Ionic Liquids On Nitinol Wires Produces Highly Robust Sorbent Coatings For Solid-phase Microextraction.

Super elastic nitinol (NiTi) wires were exploited as highly robust supports for three distinct crosslinked polymeric ionic liquid (PIL)-based coatings in solid-phase microextraction (SPME). The oxidation of NiTi wires in a boiling (30%w/w) H2O2 solution and subsequent derivatization in vinyltrimethoxysilane (VTMS) allowed for vinyl moieties to be appended to the surface of the support. UV-initiated on-fiber copolymerization of the vinyl-substituted NiTi support with monocationic ionic liquid (IL) monomers and dicationic IL crosslinkers produced a crosslinked PIL-based network that was covalently attached to the NiTi wire. This alteration alleviated receding of the coating from the support, which was observed for an analogous crosslinked PIL applied on unmodified NiTi wires. A series of demanding extraction conditions, including extreme pH, pre-exposure to pure organic solvents, and high temperatures, were applied to investigate the versatility and robustness of the fibers. Acceptable precision of the model analytes was obtained for all fibers under these conditions. Method validation by examining the relative recovery of a homologous group of phthalate esters (PAEs) was performed in drip-brewed coffee (maintained at 60 °C) by direct immersion SPME. Acceptable recoveries were obtained for most PAEs in the part-per-billion level, even in this exceedingly harsh and complex matrix.