Detecting stealthy attacks: Efficient monitoring of suspicious activities on computer networks

Stealthy attackers move patiently through computer networks - taking days, weeks or months to accomplish their objectives in order to avoid detection. As networks scale up in size and speed, monitoring for such attack attempts is increasingly a challenge. This paper presents an efficient monitoring technique for stealthy attacks. It investigates the feasibility of proposed method under number of different test cases and examines how design of the network affects the detection. A methodological way for tracing anonymous stealthy activities to their approximate sources is also presented. The Bayesian fusion along with traffic sampling is employed as a data reduction method. The proposed method has the ability to monitor stealthy activities using 10-20% size sampling rates without degrading the quality of detection.

Reversibility Iteration Method to Understand Reaction Networks and to Solve Micro-Kinetics in Heterogeneous Catalysis

Solving microkinetics of catalytic systems, which bridges microscopic processes and macroscopic reaction rates, is currently vital for understanding catalysis in silico. However, traditional microkinetic solvers possess several drawbacks that make the process slow and unreliable for complicated catalytic systems. In this paper, a new approach, the so-called reversibility iteration method (RIM), is developed to solve microkinetics for catalytic systems. Using the chemical potential notation we previously proposed to simplify the kinetic framework, the catalytic systems can be analytically illustrated to be logically equivalent to the electric circuit, and the reaction rate and coverage can be calculated by updating the values of reversibilities. Compared to the traditional modified Newton iteration method (NIM), our method is not sensitive to the initial guess of the solution and typically requires fewer iteration steps. Moreover, the method does not require arbitrary-precision arithmetic and has a higher probability of successfully solving the system. These features make it ∼1000 times faster than the modified Newton iteration method for the systems we tested. Moreover, the derived concept and the mathematical framework presented in this work may provide new insight into catalytic reaction networks.

Comparison of module detection algorithms in protein networks and investigation of the biological meaning of predicted modules

Background
It is generally acknowledged that a functional understanding of a biological system can only be obtained by an understanding of the collective of molecular interactions in form of biological networks. Protein networks are one particular network type of special importance, because proteins form the functional base units of every biological cell. On a mesoscopic level of protein networks, modules are of significant importance because these building blocks may be the next elementary functional level above individual proteins allowing to gain insight into fundamental organizational principles of biological cells.
Results
In this paper, we provide a comparative analysis of five popular and four novel module detection algorithms. We study these module prediction methods for simulated benchmark networks as well as 10 biological protein interaction networks (PINs). A particular focus of our analysis is placed on the biological meaning of the predicted modules by utilizing the Gene Ontology (GO) database as gold standard for the definition of biological processes. Furthermore, we investigate the robustness of the results by perturbing the PINs simulating in this way our incomplete knowledge of protein networks.
Conclusions
Overall, our study reveals that there is a large heterogeneity among the different module prediction algorithms if one zooms-in the biological level of biological processes in the form of GO terms and all methods are severely affected by a slight perturbation of the networks. However, we also find pathways that are enriched in multiple modules, which could provide important information about the hierarchical organization of the system

Integrating functional connectivity and climate change in the design of protected area networks

Le rapide déclin actuel de la biodiversité est inquiétant et les activités humaines en sont la cause directe. De nombreuses aires protégées ont été mises en place pour contrer cette perte de biodiversité. Afin de maximiser leur efficacité, l’amélioration de la connectivité fonctionnelle entre elles est requise. Les changements climatiques perturbent actuellement les conditions environnementales de façon globale. C’est une menace pour la biodiversité qui n’a pas souvent été intégrée lors de la mise en place des aires protégées, jusqu’à récemment. Le mouvement des espèces, et donc la connectivité fonctionnelle du paysage, est impacté par les changements climatiques et des études ont montré qu’améliorer la connectivité fonctionnelle entre les aires protégées aiderait les espèces à faire face aux impacts des changements climatiques. Ma thèse présente une méthode pour concevoir des réseaux d’aires protégées tout en tenant compte des changements climatiques et de la connectivité fonctionnelle. Mon aire d’étude est la région de la Gaspésie au Québec (Canada). La population en voie de disparition de caribou de la Gaspésie-Atlantique (Rangifer tarandus caribou) a été utilisée comme espèce focale pour définir la connectivité fonctionnelle. Cette petite population subit un déclin continu dû à la prédation et la modification de son habitat, et les changements climatiques pourraient devenir une menace supplémentaire. J’ai d’abord construit un modèle individu-centré spatialement explicite pour expliquer et simuler le mouvement du caribou. J’ai utilisé les données VHF éparses de la population de caribou et une stratégie de modélisation patron-orienté pour paramétrer et sélectionner la meilleure hypothèse de mouvement. Mon meilleur modèle a reproduit la plupart des patrons de mouvement définis avec les données observées. Ce modèle fournit une meilleure compréhension des moteurs du mouvement du caribou de la Gaspésie-Atlantique, ainsi qu’une estimation spatiale de son utilisation du paysage dans la région. J’ai conclu que les données éparses étaient suffisantes pour ajuster un modèle individu-centré lorsqu’utilisé avec une modélisation patron-orienté. Ensuite, j’ai estimé l’impact des changements climatiques et de différentes actions de conservation sur le potentiel de mouvement du caribou. J’ai utilisé le modèle individu-centré pour simuler le mouvement du caribou dans des paysages hypothétiques représentant différents scénarios de changements climatiques et d’actions de conservation. Les actions de conservation représentaient la mise en place de nouvelles aires protégées en Gaspésie, comme définies par le scénario proposé par le gouvernement du Québec, ainsi que la restauration de routes secondaires à l’intérieur des aires protégées. Les impacts des changements climatiques sur la végétation, comme définis dans mes scénarios, ont réduit le potentiel de mouvement du caribou. La restauration des routes était capable d’atténuer ces effets négatifs, contrairement à la mise en place des nouvelles aires protégées. Enfin, j’ai présenté une méthode pour concevoir des réseaux d’aires protégées efficaces et j’ai proposé des nouvelles aires protégées à mettre en place en Gaspésie afin de protéger la biodiversité sur le long terme. J’ai créé de nombreux scénarios de réseaux d’aires protégées en étendant le réseau actuel pour protéger 12% du territoire. J’ai calculé la représentativité écologique et deux mesures de connectivité fonctionnelle sur le long terme pour chaque réseau. Les mesures de connectivité fonctionnelle représentaient l’accès général aux aires protégées pour le caribou de la Gaspésie-Atlantique ainsi que son potentiel de mouvement à l’intérieur. J’ai utilisé les estimations de potentiel de mouvement pour la période de temps actuelle ainsi que pour le futur sous différents scénarios de changements climatiques pour représenter la connectivité fonctionnelle sur le long terme. Le réseau d’aires protégées que j’ai proposé était le scénario qui maximisait le compromis entre les trois caractéristiques de réseau calculées. Dans cette thèse, j’ai expliqué et prédit le mouvement du caribou de la Gaspésie-Atlantique sous différentes conditions environnementales, notamment des paysages impactés par les changements climatiques. Ces résultats m’ont aidée à définir un réseau d’aires protégées à mettre en place en Gaspésie pour protéger le caribou au cours du temps. Je crois que cette thèse apporte de nouvelles connaissances sur le comportement de mouvement du caribou de la Gaspésie-Atlantique, ainsi que sur les actions de conservation qui peuvent être prises en Gaspésie afin d’améliorer la protection du caribou et de celle d’autres espèces. Je crois que la méthode présentée peut être applicable à d’autres écosystèmes aux caractéristiques et besoins similaires.

Scheduling of track inspection and maintenance activities in railroad networks

The U.S. railroad companies spend billions of dollars every year on railroad track maintenance in order to ensure safety and operational efficiency of their railroad networks. Besides maintenance costs, other costs such as train accident costs, train and shipment delay costs and rolling stock maintenance costs are also closely related to track maintenance activities. Optimizing the track maintenance process on the extensive railroad networks is a very complex problem with major cost implications. Currently, the decision making process for track maintenance planning is largely manual and primarily relies on the knowledge and judgment of experts. There is considerable potential to improve the process by using operations research techniques to develop solutions to the optimization problems on track maintenance. In this dissertation study, we propose a range of mathematical models and solution algorithms for three network-level scheduling problems on track maintenance: track inspection scheduling problem (TISP), production team scheduling problem (PTSP) and job-to-project clustering problem (JTPCP). TISP involves a set of inspection teams which travel over the railroad network to identify track defects. It is a large-scale routing and scheduling problem where thousands of tasks are to be scheduled subject to many difficult side constraints such as periodicity constraints and discrete working time constraints. A vehicle routing problem formulation was proposed for TISP, and a customized heuristic algorithm was developed to solve the model. The algorithm iteratively applies a constructive heuristic and a local search algorithm in an incremental scheduling horizon framework. The proposed model and algorithm have been adopted by a Class I railroad in its decision making process. Real-world case studies show the proposed approach outperforms the manual approach in short-term scheduling and can be used to conduct long-term what-if analyses to yield managerial insights. PTSP schedules capital track maintenance projects, which are the largest track maintenance activities and account for the majority of railroad capital spending. A time-space network model was proposed to formulate PTSP. More than ten types of side constraints were considered in the model, including very complex constraints such as mutual exclusion constraints and consecution constraints. A multiple neighborhood search algorithm, including a decomposition and restriction search and a block-interchange search, was developed to solve the model. Various performance enhancement techniques, such as data reduction, augmented cost function and subproblem prioritization, were developed to improve the algorithm. The proposed approach has been adopted by a Class I railroad for two years. Our numerical results show the model solutions are able to satisfy all hard constraints and most soft constraints. Compared with the existing manual procedure, the proposed approach is able to bring significant cost savings and operational efficiency improvement. JTPCP is an intermediate problem between TISP and PTSP. It focuses on clustering thousands of capital track maintenance jobs (based on the defects identified in track inspection) into projects so that the projects can be scheduled in PTSP. A vehicle routing problem based model and a multiple-step heuristic algorithm were developed to solve this problem. Various side constraints such as mutual exclusion constraints and rounding constraints were considered. The proposed approach has been applied in practice and has shown good performance in both solution quality and efficiency.

Combining Collaborative Networks and Knowledge Management: The SENAI Case

Part 19: Knowledge Management in Networks

Preserving and interpreting the mining company office : landscape, space and technological change in the management of the copper industry

The purpose of this research is to examine the role of the mining company office in the management of the copper industry in Michigan’s Keweenaw Peninsula between 1901 and 1946. Two of the largest and most influential companies were examined – the Calumet & Hecla Mining Company and the Quincy Mining Company. Both companies operated for more than forty years under general managers who were arguably the most influential people in the management of each company. James MacNaughton, general manager at Calumet and Hecla, worked from 1901 through 1941; Charles Lawton, general manager at Quincy Mining Company, worked from 1905 through 1946. In this case, both of these managers were college-educated engineers and adopted scientific management techniques to operate their respective companies. This research focused on two main goals. The first goal of this project was to address the managerial changes in Michigan’s copper mining offices of the early twentieth century. This included the work of MacNaughton and Lawton, along with analysis of the office structures themselves and what changes occurred through time. The second goal of the project was to create a prototype virtual exhibit for use at the Quincy Mining Company office. A virtual exhibit will allow visitors the opportunity to visit the office virtually, experiencing the office as an office worker would have in the early twentieth century. To meet both goals, this project used various research materials, including archival sources, oral histories, and material culture to recreate the history of mining company management in the Copper Country.

Host and Network Optimizations for Performance Enhancement and Energy Efficiency in Data Center Networks

Modern data centers host hundreds of thousands of servers to achieve economies of scale. Such a huge number of servers create challenges for the data center network (DCN) to provide proportionally large bandwidth. In addition, the deployment of virtual machines (VMs) in data centers raises the requirements for efficient resource allocation and find-grained resource sharing. Further, the large number of servers and switches in the data center consume significant amounts of energy. Even though servers become more energy efficient with various energy saving techniques, DCN still accounts for 20% to 50% of the energy consumed by the entire data center. The objective of this dissertation is to enhance DCN performance as well as its energy efficiency by conducting optimizations on both host and network sides. First, as the DCN demands huge bisection bandwidth to interconnect all the servers, we propose a parallel packet switch (PPS) architecture that directly processes variable length packets without segmentation-and-reassembly (SAR). The proposed PPS achieves large bandwidth by combining switching capacities of multiple fabrics, and it further improves the switch throughput by avoiding padding bits in SAR. Second, since certain resource demands of the VM are bursty and demonstrate stochastic nature, to satisfy both deterministic and stochastic demands in VM placement, we propose the Max-Min Multidimensional Stochastic Bin Packing (M3SBP) algorithm. M3SBP calculates an equivalent deterministic value for the stochastic demands, and maximizes the minimum resource utilization ratio of each server. Third, to provide necessary traffic isolation for VMs that share the same physical network adapter, we propose the Flow-level Bandwidth Provisioning (FBP) algorithm. By reducing the flow scheduling problem to multiple stages of packet queuing problems, FBP guarantees the provisioned bandwidth and delay performance for each flow. Finally, while DCNs are typically provisioned with full bisection bandwidth, DCN traffic demonstrates fluctuating patterns, we propose a joint host-network optimization scheme to enhance the energy efficiency of DCNs during off-peak traffic hours. The proposed scheme utilizes a unified representation method that converts the VM placement problem to a routing problem and employs depth-first and best-fit search to find efficient paths for flows.

Development and Verification of Control and Protection Strategies in Hybrid AC/DC Power Systems for Smart Grid Applications

Modern power networks incorporate communications and information technology infrastructure into the electrical power system to create a smart grid in terms of control and operation. The smart grid enables real-time communication and control between consumers and utility companies allowing suppliers to optimize energy usage based on price preference and system technical issues. The smart grid design aims to provide overall power system monitoring, create protection and control strategies to maintain system performance, stability and security. This dissertation contributed to the development of a unique and novel smart grid test-bed laboratory with integrated monitoring, protection and control systems. This test-bed was used as a platform to test the smart grid operational ideas developed here. The implementation of this system in the real-time software creates an environment for studying, implementing and verifying novel control and protection schemes developed in this dissertation. Phasor measurement techniques were developed using the available Data Acquisition (DAQ) devices in order to monitor all points in the power system in real time. This provides a practical view of system parameter changes, system abnormal conditions and its stability and security information system. These developments provide valuable measurements for technical power system operators in the energy control centers. Phasor Measurement technology is an excellent solution for improving system planning, operation and energy trading in addition to enabling advanced applications in Wide Area Monitoring, Protection and Control (WAMPAC). Moreover, a virtual protection system was developed and implemented in the smart grid laboratory with integrated functionality for wide area applications. Experiments and procedures were developed in the system in order to detect the system abnormal conditions and apply proper remedies to heal the system. A design for DC microgrid was developed to integrate it to the AC system with appropriate control capability. This system represents realistic hybrid AC/DC microgrids connectivity to the AC side to study the use of such architecture in system operation to help remedy system abnormal conditions. In addition, this dissertation explored the challenges and feasibility of the implementation of real-time system analysis features in order to monitor the system security and stability measures. These indices are measured experimentally during the operation of the developed hybrid AC/DC microgrids. Furthermore, a real-time optimal power flow system was implemented to optimally manage the power sharing between AC generators and DC side resources. A study relating to real-time energy management algorithm in hybrid microgrids was performed to evaluate the effects of using energy storage resources and their use in mitigating heavy load impacts on system stability and operational security.

Leveraging Symbiotic Relationships for Emulation of Computer Networks

The lack of analytical models that can accurately describe large-scale networked systems makes empirical experimentation indispensable for understanding complex behaviors. Research on network testbeds for testing network protocols and distributed services, including physical, emulated, and federated testbeds, has made steady progress. Although the success of these testbeds is undeniable, they fail to provide: 1) scalability, for handling large-scale networks with hundreds or thousands of hosts and routers organized in different scenarios, 2) flexibility, for testing new protocols or applications in diverse settings, and 3) inter-operability, for combining simulated and real network entities in experiments. This dissertation tackles these issues in three different dimensions. First, we present SVEET, a system that enables inter-operability between real and simulated hosts. In order to increase the scalability of networks under study, SVEET enables time-dilated synchronization between real hosts and the discrete-event simulator. Realistic TCP congestion control algorithms are implemented in the simulator to allow seamless interactions between real and simulated hosts. SVEET is validated via extensive experiments and its capabilities are assessed through case studies involving real applications. Second, we present PrimoGENI, a system that allows a distributed discrete-event simulator, running in real-time, to interact with real network entities in a federated environment. PrimoGENI greatly enhances the flexibility of network experiments, through which a great variety of network conditions can be reproduced to examine what-if questions. Furthermore, PrimoGENI performs resource management functions, on behalf of the user, for instantiating network experiments on shared infrastructures. Finally, to further increase the scalability of network testbeds to handle large-scale high-capacity networks, we present a novel symbiotic simulation approach. We present SymbioSim, a testbed for large-scale network experimentation where a high-performance simulation system closely cooperates with an emulation system in a mutually beneficial way. On the one hand, the simulation system benefits from incorporating the traffic metadata from real applications in the emulation system to reproduce the realistic traffic conditions. On the other hand, the emulation system benefits from receiving the continuous updates from the simulation system to calibrate the traffic between real applications. Specific techniques that support the symbiotic approach include: 1) a model downscaling scheme that can significantly reduce the complexity of the large-scale simulation model, resulting in an efficient emulation system for modulating the high-capacity network traffic between real applications; 2) a queuing network model for the downscaled emulation system to accurately represent the network effects of the simulated traffic; and 3) techniques for reducing the synchronization overhead between the simulation and emulation systems.

Mixed Spatial and Nonspatial Problems in Location Based Services

With hundreds of millions of users reporting locations and embracing mobile technologies, Location Based Services (LBSs) are raising new challenges. In this dissertation, we address three emerging problems in location services, where geolocation data plays a central role. First, to handle the unprecedented growth of generated geolocation data, existing location services rely on geospatial database systems. However, their inability to leverage combined geographical and textual information in analytical queries (e.g. spatial similarity joins) remains an open problem. To address this, we introduce SpsJoin, a framework for computing spatial set-similarity joins. SpsJoin handles combined similarity queries that involve textual and spatial constraints simultaneously. LBSs use this system to tackle different types of problems, such as deduplication, geolocation enhancement and record linkage. We define the spatial set-similarity join problem in a general case and propose an algorithm for its efficient computation. Our solution utilizes parallel computing with MapReduce to handle scalability issues in large geospatial databases. Second, applications that use geolocation data are seldom concerned with ensuring the privacy of participating users. To motivate participation and address privacy concerns, we propose iSafe, a privacy preserving algorithm for computing safety snapshots of co-located mobile devices as well as geosocial network users. iSafe combines geolocation data extracted from crime datasets and geosocial networks such as Yelp. In order to enhance iSafe's ability to compute safety recommendations, even when crime information is incomplete or sparse, we need to identify relationships between Yelp venues and crime indices at their locations. To achieve this, we use SpsJoin on two datasets (Yelp venues and geolocated businesses) to find venues that have not been reviewed and to further compute the crime indices of their locations. Our results show a statistically significant dependence between location crime indices and Yelp features. Third, review centered LBSs (e.g., Yelp) are increasingly becoming targets of malicious campaigns that aim to bias the public image of represented businesses. Although Yelp actively attempts to detect and filter fraudulent reviews, our experiments showed that Yelp is still vulnerable. Fraudulent LBS information also impacts the ability of iSafe to provide correct safety values. We take steps toward addressing this problem by proposing SpiDeR, an algorithm that takes advantage of the richness of information available in Yelp to detect abnormal review patterns. We propose a fake venue detection solution that applies SpsJoin on Yelp and U.S. housing datasets. We validate the proposed solutions using ground truth data extracted by our experiments and reviews filtered by Yelp.

Improving surgery operations by means of cloud systems and distributed user interfaces

Surgical interventions are usually performed in an operation room; however, access to the information by the medical team members during the intervention is limited. While in conversations with the medical staff, we observed that they attach significant importance to the improvement of the information and communication direct access by queries during the process in real time. It is due to the fact that the procedure is rather slow and there is lack of interaction with the systems in the operation room. These systems can be integrated on the Cloud adding new functionalities to the existing systems the medical expedients are processed. Therefore, such a communication system needs to be built upon the information and interaction access specifically designed and developed to aid the medical specialists. Copyright 2014 ACM.