An Optimum-Path Forest framework for intrusion detection in computer networks

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

Boosting optimum-path forest clustering through harmony Search and its applications for intrusion detection in computer networks

In this paper we propose a nature-inspired approach that can boost the Optimum-Path Forest (OPF) clustering algorithm by optimizing its parameters in a discrete lattice. The experiments in two public datasets have shown that the proposed algorithm can achieve similar parameters' values compared to the exhaustive search. Although, the proposed technique is faster than the traditional one, being interesting for intrusion detection in large scale traffic networks. © 2012 IEEE.

Intrusion detection in computer networks using optimum-path forest clustering

Nowadays, organizations face the problem of keeping their information protected, available and trustworthy. In this context, machine learning techniques have also been extensively applied to this task. Since manual labeling is very expensive, several works attempt to handle intrusion detection with traditional clustering algorithms. In this paper, we introduce a new pattern recognition technique called Optimum-Path Forest (OPF) clustering to this task. Experiments on three public datasets have showed that OPF classifier may be a suitable tool to detect intrusions on computer networks, since it outperformed some state-of-the-art unsupervised techniques. © 2012 IEEE.

Web-based OERs in Computer Networks

Learning and teaching processes are continually changing. Therefore, design of learning technologies has gained interest in educators and educational institutions from secondary school to higher education. This paper describes the successfully use in education of social learning technologies and virtual laboratories designed by the authors, as well as videos developed by the students. These tools, combined with other open educational resources based on a blended-learning methodology, have been employed to teach the subject of Computer Networks. We have verified not only that the application of OERs into the learning process leads to a significantly improvement of the assessments, but also that the combination of several OERs enhances their effectiveness. These results are supported by, firstly, a study of both students’ opinion and students’ behaviour over five academic years, and, secondly, a correlation analysis between the use of OERs and the grades obtained by students.

Product cipher negotiation with on-line evaluation for private communication over computer networks

A method is proposed to offer privacy in computer communications, using symmetric product block ciphers. The security protocol involved a cipher negotiation stage, in which two communicating parties select privately a cipher from a public cipher space. The cipher negotiation process includes an on-line cipher evaluation stage, in which the cryptographic strength of the proposed cipher is estimated. The cryptographic strength of the ciphers is measured by confusion and diffusion. A method is proposed to describe quantitatively these two properties. For the calculation of confusion and diffusion a number of parameters are defined, such as the confusion and diffusion matrices and the marginal diffusion. These parameters involve computationally intensive calculations that are performed off-line, before any communication takes place. Once they are calculated, they are used to obtain estimation equations, which are used for on-line, fast evaluation of the confusion and diffusion of the negotiated cipher. A technique proposed in this thesis describes how to calculate the parameters and how to use the results for fast estimation of confusion and diffusion for any cipher instance within the defined cipher space.

An end to end architecture for ubiquitous super-fast broadband

There is growing pressure to ensure that future broadband networks are both super fast and ubiquitously available to all users without the need for large government subsidies, this requires a radical change to network architectures. © OSA 2013.

Towards simulation and emulation of large-scale computer networks

Developing analytical models that can accurately describe behaviors of Internet-scale networks is difficult. This is due, in part, to the heterogeneous structure, immense size and rapidly changing properties of today's networks. The lack of analytical models makes large-scale network simulation an indispensable tool for studying immense networks. However, large-scale network simulation has not been commonly used to study networks of Internet-scale. This can be attributed to three factors: 1) current large-scale network simulators are geared towards simulation research and not network research, 2) the memory required to execute an Internet-scale model is exorbitant, and 3) large-scale network models are difficult to validate. This dissertation tackles each of these problems. ^ First, this work presents a method for automatically enabling real-time interaction, monitoring, and control of large-scale network models. Network researchers need tools that allow them to focus on creating realistic models and conducting experiments. However, this should not increase the complexity of developing a large-scale network simulator. This work presents a systematic approach to separating the concerns of running large-scale network models on parallel computers and the user facing concerns of configuring and interacting with large-scale network models. ^ Second, this work deals with reducing memory consumption of network models. As network models become larger, so does the amount of memory needed to simulate them. This work presents a comprehensive approach to exploiting structural duplications in network models to dramatically reduce the memory required to execute large-scale network experiments. ^ Lastly, this work addresses the issue of validating large-scale simulations by integrating real protocols and applications into the simulation. With an emulation extension, a network simulator operating in real-time can run together with real-world distributed applications and services. As such, real-time network simulation not only alleviates the burden of developing separate models for applications in simulation, but as real systems are included in the network model, it also increases the confidence level of network simulation. This work presents a scalable and flexible framework to integrate real-world applications with real-time simulation.^

Leveraging symbiotic relationships for emulation of computer networks

The lack of analytical models that can accurately describe large-scale networked systems makes empirical experimentation indispensable for understanding complex behaviors. Research on network testbeds for testing network protocols and distributed services, including physical, emulated, and federated testbeds, has made steady progress. Although the success of these testbeds is undeniable, they fail to provide: 1) scalability, for handling large-scale networks with hundreds or thousands of hosts and routers organized in different scenarios, 2) flexibility, for testing new protocols or applications in diverse settings, and 3) inter-operability, for combining simulated and real network entities in experiments. This dissertation tackles these issues in three different dimensions. First, we present SVEET, a system that enables inter-operability between real and simulated hosts. In order to increase the scalability of networks under study, SVEET enables time-dilated synchronization between real hosts and the discrete-event simulator. Realistic TCP congestion control algorithms are implemented in the simulator to allow seamless interactions between real and simulated hosts. SVEET is validated via extensive experiments and its capabilities are assessed through case studies involving real applications. Second, we present PrimoGENI, a system that allows a distributed discrete-event simulator, running in real-time, to interact with real network entities in a federated environment. PrimoGENI greatly enhances the flexibility of network experiments, through which a great variety of network conditions can be reproduced to examine what-if questions. Furthermore, PrimoGENI performs resource management functions, on behalf of the user, for instantiating network experiments on shared infrastructures. Finally, to further increase the scalability of network testbeds to handle large-scale high-capacity networks, we present a novel symbiotic simulation approach. We present SymbioSim, a testbed for large-scale network experimentation where a high-performance simulation system closely cooperates with an emulation system in a mutually beneficial way. On the one hand, the simulation system benefits from incorporating the traffic metadata from real applications in the emulation system to reproduce the realistic traffic conditions. On the other hand, the emulation system benefits from receiving the continuous updates from the simulation system to calibrate the traffic between real applications. Specific techniques that support the symbiotic approach include: 1) a model downscaling scheme that can significantly reduce the complexity of the large-scale simulation model, resulting in an efficient emulation system for modulating the high-capacity network traffic between real applications; 2) a queuing network model for the downscaled emulation system to accurately represent the network effects of the simulated traffic; and 3) techniques for reducing the synchronization overhead between the simulation and emulation systems.

Detecting stealthy attacks: Efficient monitoring of suspicious activities on computer networks

Stealthy attackers move patiently through computer networks - taking days, weeks or months to accomplish their objectives in order to avoid detection. As networks scale up in size and speed, monitoring for such attack attempts is increasingly a challenge. This paper presents an efficient monitoring technique for stealthy attacks. It investigates the feasibility of proposed method under number of different test cases and examines how design of the network affects the detection. A methodological way for tracing anonymous stealthy activities to their approximate sources is also presented. The Bayesian fusion along with traffic sampling is employed as a data reduction method. The proposed method has the ability to monitor stealthy activities using 10-20% size sampling rates without degrading the quality of detection.

Leveraging Symbiotic Relationships for Emulation of Computer Networks

The lack of analytical models that can accurately describe large-scale networked systems makes empirical experimentation indispensable for understanding complex behaviors. Research on network testbeds for testing network protocols and distributed services, including physical, emulated, and federated testbeds, has made steady progress. Although the success of these testbeds is undeniable, they fail to provide: 1) scalability, for handling large-scale networks with hundreds or thousands of hosts and routers organized in different scenarios, 2) flexibility, for testing new protocols or applications in diverse settings, and 3) inter-operability, for combining simulated and real network entities in experiments. This dissertation tackles these issues in three different dimensions. First, we present SVEET, a system that enables inter-operability between real and simulated hosts. In order to increase the scalability of networks under study, SVEET enables time-dilated synchronization between real hosts and the discrete-event simulator. Realistic TCP congestion control algorithms are implemented in the simulator to allow seamless interactions between real and simulated hosts. SVEET is validated via extensive experiments and its capabilities are assessed through case studies involving real applications. Second, we present PrimoGENI, a system that allows a distributed discrete-event simulator, running in real-time, to interact with real network entities in a federated environment. PrimoGENI greatly enhances the flexibility of network experiments, through which a great variety of network conditions can be reproduced to examine what-if questions. Furthermore, PrimoGENI performs resource management functions, on behalf of the user, for instantiating network experiments on shared infrastructures. Finally, to further increase the scalability of network testbeds to handle large-scale high-capacity networks, we present a novel symbiotic simulation approach. We present SymbioSim, a testbed for large-scale network experimentation where a high-performance simulation system closely cooperates with an emulation system in a mutually beneficial way. On the one hand, the simulation system benefits from incorporating the traffic metadata from real applications in the emulation system to reproduce the realistic traffic conditions. On the other hand, the emulation system benefits from receiving the continuous updates from the simulation system to calibrate the traffic between real applications. Specific techniques that support the symbiotic approach include: 1) a model downscaling scheme that can significantly reduce the complexity of the large-scale simulation model, resulting in an efficient emulation system for modulating the high-capacity network traffic between real applications; 2) a queuing network model for the downscaled emulation system to accurately represent the network effects of the simulated traffic; and 3) techniques for reducing the synchronization overhead between the simulation and emulation systems.

Concurrency detection on finish-to-start activity precedence networks

We explore the finish-to-start precedence relations of project activities used in scheduling problems. From these relations, we devise a method to identify groups of activities that could execute concurrently, i.e. activities in the same group can all execute in parallel. The method derives a new set of relations to describe the concurrency. Then, it is represented by an undirected graph and the maximal cliques problem identifies the groups. We provide a running example with a project from our previous studies in resource constrained project cost minimization together with an example application on the concurrency detection method: the evaluation of the resource stress.

Ontogeny of Sleeping in Color - Linking melanism to sleep architecture and rhythmicity variation in wild barn owl nestlings

The function of sleep remains unknown. To gain insight into the function of sleep in natural conditions, I assessed variation in sleep architecture and its link with fitness-related phenotypic traits. I considered melanin-based coloration because its underlying genetic basis is very well known giving an opportunity to examine whether some genes pleiotropically regulate both coloration and sleep. The melanocortin system is known to generate covariation between melanin-based coloration and other phenotypes like behaviour, physiology and life history traits. I investigated whether this system of genes could participate in the co-expression of coloration and sleep. I carried out a study with nestling barn owls (Tyto alba) in order to tackle the potential link between variation in color traits and the ontogeny of sleep under natural conditions. For this I established a suitable method for recording the brain activity (electroencephalogram) of owls in nature. Birds are especially interesting, because they convergently evolved sleep states similar to those exhibited by mammals. As in mammals, I found that in owlets time spent in rapid eye movement (REM) sleep declines with age, a relationship thought to eflect developmental changes in the brain. Thus this developmental trajectory appears to reflect a fundamental feature of sleep. Additionally, I discovered an association between a gene involved in melanism expressed in the feather follicles (proprotein convertase subtilisin/kexin type 2, PCSK2) and the age-related changes in sleep in the brain. Nestlings with higher expression levels of PCSK2 showed a more precocial pattern of sleep development and a higher degree of melanin-based coloration compared to nestlings with lower PCSK2 expression. Also sleep architecture and the development of rhythmicity in brain and physical activity was related to plumage traits of the nestlings and their biological parents. This pattern during ontogeny might reflect differences in life l history strategies, antipredator behaviour and developmental pace. Therefore, differently colored individuals may differentially deal with trade-offs between the costs and benefits of sleep which in turn lead to differences in brain organization and ultimately fitness. These results should stimulate evolutionary biologists to consider sleep as a major life history trait. Résumé La fonction du sommeil reste inconnue. Afin d'acquérir une meilleur compréhension de la fonction du sommeil dans les conditions naturelles, j'ai analysé la variation dans l'architecture du sommeil et son lien avec d'autres traits phénotypiques liés au succès reproducteur (fitness). J'ai choisi et examiné la coloration mélanique, car ses bases génétiques sont bien connues et il est ainsi possible d'étudier si certains gènes, de façon pléiotropique régulent à la fois la coloration et le sommeil. J'ai exploré si ce système génétique était impliqué dans la co-expression de la coloration et du sommeil. J'ai effectué mon étude sur des poussins de chouette effraie (Tyto alba) en condition naturelle, pour rechercher ce lien potentiel entre la variation de la coloration et l'ontogenèse du sommeil. Dans ce but, j'ai établi une méthodologie permettant d'enregistrer l'activité cérébrale (électroencéphalogramme) des chouettes dans la nature. Les oiseaux sont particulièrement intéressants car ils ont développé, par évolution convergente, des phases de sommeil similaires à celles des mammifères. De manière semblable à ce qui a été montré chez les mammifères, j'ai découvert que le temps passé dans le sommeil paradoxal diminue avec l'âge des poussins. On pense que ceci est dû aux changements développementaux au niveau du cerveau. Cette trajectoire développementale semble refléter une caractéristique fondamentale du sommeil. J'ai également découvert une association entre l'un des gènes impliqué dans le mélanisme, exprimé dans les follicules plumeux (proprotein convertase subtilisin/kexin type 2, PCSK2), et les changements dans la structure du sommeil avec l'âge. Les poussins ayant un niveau d'expression génétique élevé de la PCSK2 présentent une structure du sommeil plus précoce et un taux de coloration dû à la mélanine plus élevé que des poussins avec un niveau d'expression moindre de la PCSK2. L'architecture du sommeil et le développement de la rythmicité dans le cerveau ainsi que l'activité physique sont également liés à la coloration des plumes des poussins et pourraient ainsi refléter des différences de stratégies d'histoire de vie, de comportements anti-prédateur et de vitesses développementales. Ainsi, des individus de coloration différente sembleraient traiter différemment les coûts et les bénéfices du sommeil, ce qui aurait des conséquences sur l'organisation cérébrale et pour finir, sur le succès reproducteur. Ces résultats devraient encourager les biologistes évolutionnistes à considérer le sommeil comme un important trait d'histoire de vie. Zusammenfassung Die Funktion von Schlaf ist noch unbekannt. Um mehr Einsicht in diese unter natürlichen Bedingungen zu bekommen, habe ich die Variation in der Schlafarchitektur und die Verknüpfung mit phänotypischen Merkmalen, die mit der Fitness zusammenhängen, studiert. Ich habe mir melanin-basierte Färbung angesehen, da die zugrunde liegende genetische Basis bekannt ist und somit die Möglichkeit gegeben ist, zu untersuchen, ob einige Gene beides regulieren, Färbung und Schlaf. Das melanocortin System generiert eine Kovariation zwischen melanin-basierter Färbung und anderen phänotypischer Merkmale wie Verhalten, Physiologie und Überlebensstrategien. Ich habe untersucht, ob dieses Gensystem an einer gleichzeitigen Steuerung von Färbung und Schlaf beteiligt ist. Dazu habe ich Schleiereulen (Tyto alba) studiert um einen möglichen Zusammenhang zwischen der Variation in der Pigmentierung und der Entwicklung des Schlafs unter natürlichen Bedingungen zu entdecken. Für diese Studie entwickelte ich eine Methode um die Gehirnaktivität (Elektroenzephalogramm) bei Eulen in der Natur aufzunehmen. Vögel sind besonders interessant, da sie die gleichen Schlafstadien aufweisen wie Säugetiere und diese unabhängig konvergent entwickelt haben. Genauso wie bei Säugetieren nahm die Dauer des sogenannten ,,rapid eye movement" (REM) - Schlafes mit zunehmendem Alter ab. Es wird angenommen, dass dieser Zusammenhang die Entwicklung des Gehirns widerspiegelt. Daher scheint dieses Entwicklungsmuster ein fundamentaler Aspekt von Schlaf zu sein. Zusätzlich entdeckte ich einen Zusammenhang zwischen der Aktivität eines Gens in den Federfollikeln (proprotein convertase subtilisin/kexin type 2, PCSK2), das für die Ausprägung schwarzer Punkte auf den Federn der Eulen verantwortlich ist, und den altersabhängigen Änderungen im Schlafmuster im Gehirn. Küken mit höherer Aktivität von PCSK2 zeigten eine frühreifere Schlafentwicklung und eine dunklere Färbung als Küken mit niedriger PCSK2 Aktivität. Die Architekture des Schlafes und die Entwicklung der Rhythmik im Gehirn und die der physischen Aktivität ist mit der Färbung des Gefieders von den Küken und ihren Eltern verknüpft. Dieses Muster während der Entwicklung kann Unterschiede in Überlebensstrategien, Feindabwehrverhalten und in der Entwicklungsgeschwindigkeit reflektieren. Unterschiedlich gefärbte Individuen könnten unterschiedliche Strategien haben um zwischen den Kosten und Nutzen von Schlaf zu entscheiden, was zu Unterschieden in der Gehirnstruktur führen kann und letztendlich zur Fitness. Diese Ergebnisse sollten Evolutionsbiologen stimulieren Schlaf als einen wichtigen Bestandteil des Lebens zu behandeln.

Business IT Alignment from Business Model to Enterprise Architecture

In this paper, we show how business model modelling can be connected to IT infrastructure, drawing parallels from enterprise architecture models such as ArchiMate. We then show how the proposed visualization based on enterprise architecture, with a strong focus on business model strategy, can help IT alignment, at both the business model and the IT infrastructure level.

Using cursor measures to determine appropriate computer input assistance for motion-impaired users

People with motion-impairments can often have difficulty with accurate control of standard pointing devices for computer input. The nature of the difficulties may vary, so to be most effective, methods of assisting cursor control must be suited to each user's needs. The work presented here involves a study of cursor trajectories as a means of assessing the requirements of motion-impaired computer users. A new cursor characteristic is proposed that attempts to capture difficulties with moving the cursor in a smooth trajectory. A study was conducted to see if haptic tunnels could improve performance in "point and click" tasks. Results indicate that the tunnels reduced times to target for those users identified by the new characteristic as having the most difficulty moving in a smooth trajectory. This suggests that cursor characteristics have potential applications in performing assessments of a user's cursor control capabilities which can then be used to determine appropriate methods of assistance.