Data Mining for Network Intrusion Detection : A comparison of data mining algorithms and an analysis of relevant features for detecting cyber-attacks

Data mining can be defined as the extraction of implicit, previously un-known, and potentially useful information from data. Numerous re-searchers have been developing security technology and exploring new methods to detect cyber-attacks with the DARPA 1998 dataset for Intrusion Detection and the modified versions of this dataset KDDCup99 and NSL-KDD, but until now no one have examined the performance of the Top 10 data mining algorithms selected by experts in data mining. The compared classification learning algorithms in this thesis are: C4.5, CART, k-NN and Naïve Bayes. The performance of these algorithms are compared with accuracy, error rate and average cost on modified versions of NSL-KDD train and test dataset where the instances are classified into normal and four cyber-attack categories: DoS, Probing, R2L and U2R. Additionally the most important features to detect cyber-attacks in all categories and in each category are evaluated with Weka’s Attribute Evaluator and ranked according to Information Gain. The results show that the classification algorithm with best performance on the dataset is the k-NN algorithm. The most important features to detect cyber-attacks are basic features such as the number of seconds of a network connection, the protocol used for the connection, the network service used, normal or error status of the connection and the number of data bytes sent. The most important features to detect DoS, Probing and R2L attacks are basic features and the least important features are content features. Unlike U2R attacks, where the content features are the most important features to detect attacks.

Distributed and compressed MIKEY mode to secure end-to-end communications in the Internet of things.

Multimedia Internet KEYing protocol (MIKEY) aims at establishing secure credentials between two communicating entities. However, existing MIKEY modes fail to meet the requirements of low-power and low-processing devices. To address this issue, we combine two previously proposed approaches to introduce a new distributed and compressed MIKEY mode for the Internet of Things. Indeed, relying on a cooperative approach, a set of third parties is used to discharge the constrained nodes from heavy computational operations. Doing so, the preshared mode is used in the constrained part of network, while the public key mode is used in the unconstrained part of the network. Furthermore, to mitigate the communication cost we introduce a new header compression scheme that reduces the size of MIKEY’s header from 12 Bytes to 3 Bytes in the best compression case. Preliminary results show that our proposed mode is energy preserving whereas its security properties are preserved untouched.

On-light: optical social network

Social networks are a recent phenomenon of communication, with a high prevalence of young users. This concept serves as a motto for a multidisciplinary project, which aims to create a simple communication network, using light as the transmission medium. Mixed team, composed by students from secondary and higher education schools, are partners on the development of an optical transceiver. A LED lamp array and a small photodiode are the optical transmitter and receiver, respectively. Using several transceivers aligned with each other, this con guration creates a ring communication network, enabling the exchange of messages between users. Through this project, some concepts addressed in physics classes from secondary schools (e.g. photoelectric phenomena and the properties of light) are experimentally veri ed and used to communicate, in a classroom or a laboratory.

Strategic Context, Organizational Features and Network Performances: A Survey on Collaborative Networked Organizations of Italian SMEs

Part 15: Performance Management Frameworks

Wireless Network Analytics for Next Generation Spectrum Awareness

The importance of networks, in their broad sense, is rapidly and massively growing in modern-day society thanks to unprecedented communication capabilities offered by technology. In this context, the radio spectrum will be a primary resource to be preserved and not wasted. Therefore, the need for intelligent and automatic systems for in-depth spectrum analysis and monitoring will pave the way for a new set of opportunities and potential challenges. This thesis proposes a novel framework for automatic spectrum patrolling and the extraction of wireless network analytics. It aims to enhance the physical layer security of next generation wireless networks through the extraction and the analysis of dedicated analytical features. The framework consists of a spectrum sensing phase, carried out by a patrol composed of numerous radio-frequency (RF) sensing devices, followed by the extraction of a set of wireless network analytics. The methodology developed is blind, allowing spectrum sensing and analytics extraction of a network whose key features (i.e., number of nodes, physical layer signals, medium access protocol (MAC) and routing protocols) are unknown. Because of the wireless medium, over-the-air signals captured by the sensors are mixed; therefore, blind source separation (BSS) and measurement association are used to estimate the number of sources and separate the traffic patterns. After the separation, we put together a set of methodologies for extracting useful features of the wireless network, i.e., its logical topology, the application-level traffic patterns generated by the nodes, and their position. The whole framework is validated on an ad-hoc wireless network accounting for MAC protocol, packet collisions, nodes mobility, the spatial density of sensors, and channel impairments, such as path-loss, shadowing, and noise. The numerical results obtained by extensive and exhaustive simulations show that the proposed framework is consistent and can achieve the required performance.

Security enhancements and flaws of emerging communication technologies

The multi-faced evolution of network technologies ranges from big data centers to specialized network infrastructures and protocols for mission-critical operations. For instance, technologies such as Software Defined Networking (SDN) revolutionized the world of static configuration of the network - i.e., by removing the distributed and proprietary configuration of the switched networks - centralizing the control plane. While this disruptive approach is interesting from different points of view, it can introduce new unforeseen vulnerabilities classes. One topic of particular interest in the last years is industrial network security, an interest which started to rise in 2016 with the introduction of the Industry 4.0 (I4.0) movement. Networks that were basically isolated by design are now connected to the internet to collect, archive, and analyze data. While this approach got a lot of momentum due to the predictive maintenance capabilities, these network technologies can be exploited in various ways from a cybersecurity perspective. Some of these technologies lack security measures and can introduce new families of vulnerabilities. On the other side, these networks can be used to enable accurate monitoring, formal verification, or defenses that were not practical before. This thesis explores these two fields: by introducing monitoring, protections, and detection mechanisms where the new network technologies make it feasible; and by demonstrating attacks on practical scenarios related to emerging network infrastructures not protected sufficiently. The goal of this thesis is to highlight this lack of protection in terms of attacks on and possible defenses enabled by emerging technologies. We will pursue this goal by analyzing the aforementioned technologies and by presenting three years of contribution to this field. In conclusion, we will recapitulate the research questions and give answers to them.

A formal analysis of blockchain consensus

In this thesis, we analyse these protocols using PRISM+, our extension of the probabilistic model checker PRISM with blockchain types and operations upon them. This allows us to model the behaviour of key participants in the protocols and describe the protocols as a parallel composition of PRISM+ processes. Through our analysis of the Bitcoin model, we are able to understand how forks (where different nodes have different versions of the blockchain) occur and how they depend on specific parameters of the protocol, such as the difficulty of the cryptopuzzle and network communication delays. Our results corroborate the statement that considering confirmed the transactions in blocks at depth larger than 5 is reasonable because the majority of miners have consistent blockchains up-to that depth with probability of almost 1. We also study the behaviour of the Bitcoin network with churn miners (nodes that leave and rejoin the network) and with different topologies (linear topology, ring topology, tree topology and fully connected topology). PRISM+ is therefore used to analyse the resilience of Hybrid Casper when changing various basic parameters of the protocol, such as block creation rates and penalty determination strategies. We also study the robustness of Hybrid Casper against two known attacks: the Eclipse attack (where an attacker controls a significant portion of the network's nodes and can prevent other nodes from receiving new transactions) and the majority attack (where an attacker controls a majority of the network's nodes and can manipulate the blockchain to their advantage).

Structural Connectivity Of The Default Mode Network And Cognition In Alzheimer׳s Disease.

Disconnectivity between the Default Mode Network (DMN) nodes can cause clinical symptoms and cognitive deficits in Alzheimer׳s disease (AD). We aimed to examine the structural connectivity between DMN nodes, to verify the extent in which white matter disconnection affects cognitive performance. MRI data of 76 subjects (25 mild AD, 21 amnestic Mild Cognitive Impairment subjects and 30 controls) were acquired on a 3.0T scanner. ExploreDTI software (fractional Anisotropy threshold=0.25 and the angular threshold=60°) calculated axial, radial, and mean diffusivities, fractional anisotropy and streamline count. AD patients showed lower fractional anisotropy (P=0.01) and streamline count (P=0.029), and higher radial diffusivity (P=0.014) than controls in the cingulum. After correction for white matter atrophy, only fractional anisotropy and radial diffusivity remained significantly lower in AD compared to controls (P=0.003 and P=0.05). In the parahippocampal bundle, AD patients had lower mean and radial diffusivities (P=0.048 and P=0.013) compared to controls, from which only radial diffusivity survived for white matter adjustment (P=0.05). Regression models revealed that cognitive performance is also accounted for by white matter microstructural values. Structural connectivity within the DMN is important to the execution of high-complexity tasks, probably due to its relevant role in the integration of the network.

Finding Quasi-Optimal Network Topologies for Information Transmission in Active Networks

This work clarifies the relation between network circuit (topology) and behaviour (information transmission and synchronization) in active networks, e.g. neural networks. As an application, we show how one can find network topologies that are able to transmit a large amount of information, possess a large number of communication channels, and are robust under large variations of the network coupling configuration. This theoretical approach is general and does not depend on the particular dynamic of the elements forming the network, since the network topology can be determined by finding a Laplacian matrix (the matrix that describes the connections and the coupling strengths among the elements) whose eigenvalues satisfy some special conditions. To illustrate our ideas and theoretical approaches, we use neural networks of electrically connected chaotic Hindmarsh-Rose neurons.

Remote control of CNC machines using the CyberOPC communication system over public networks

During the last few years, the evolution of fieldbus and computers networks allowed the integration of different communication systems involving both production single cells and production cells, as well as other systems for business intelligence, supervision and control. Several well-adopted communication technologies exist today for public and non-public networks. Since most of the industrial applications are time-critical, the requirements of communication systems for remote control differ from common applications for computer networks accessing the Internet, such as Web, e-mail and file transfer. The solution proposed and outlined in this work is called CyberOPC. It includes the study and the implementation of a new open communication system for remote control of industrial CNC machines, making the transmission delay for time-critical control data shorter than other OPC-based solutions, and fulfilling cyber security requirements.

Implementation of a Control Loop Experiment in a Network-Based Control System With LonWorks Technology and IP Networks

Considering the increasing popularity of network-based control systems and the huge adoption of IP networks (such as the Internet), this paper studies the influence of network quality of service (QoS) parameters over quality of control parameters. An example of a control loop is implemented using two LonWorks networks (CEA-709.1) interconnected by an emulated IP network, in which important QoS parameters such as delay and delay jitter can be completely controlled. Mathematical definitions are provided according to the literature, and the results of the network-based control loop experiment are presented and discussed.

Comparing lock-in ranges and transient responses of second- and third-order phase-locked loops in master-slave clock distribution networks

The distribution of clock signals throughout the nodes of a network is essential for several applications. in control and communication with the phase-locked loop (PLL) being the component for electronic synchronization process. In systems with master-slave (MS) strategies, the PLLs are the slave nodes responsible for providing reliable clocks in all nodes of the network. As PLLs have nonlinear phase detection, double-frequency terms appear and filtering becomes necessary. Imperfections in filtering process cause oscillations around the synchronous state worsening the performance of the clock distribution process. The behavior of one-way master-slave (OWMS) clock distribution networks is studied and performances of first- and second-order filter processes are compared, concerning lock-in ranges and responses to perturbations of the synchronous state. (c) 2007 Elsevier GmbH. All rights reserved.

An evaluation of the Keep on Talking program for maintaining communication skills into old

Communication skills change with age as a result of sensory deficits, memory loss, and increasing word finding difficulties The Keep on Talking program (L. Hickson, H. Barnett, L. Worrall, & E. Yiu, 1994) was developed to assist older people to develop their own strategies for maintaining communication skills into old age. Two hundred and fifty-two healthy older people were recruited from the community and were assessed on a battery of communication assessments on entry to the study and at 1 year after entry. The experimental group (n = 120) participated in the 5-week group Keep on Talking program run by volunteers A further 130 control subjects were assessed only. The short-term effectiveness of the program was evaluated using a short knowledge based and attitudinal questionnaire and qualitative written feedback. At the I-year follow up, subjects were also asked whether they had taken any action as a result of the project. Results concluded that there was a significant difference between the number of correct questionnaire responses on the knowledge based items and the ratings on the attitudinal items pre- and postprogram questionnaire for the experimental subjects. Qualitative written feedback was positive with many participants remarking on the amount of information that they had acquired. Forty-eight experimental and 69 control subjects (n = 117) were assessed I year later, and there was a significant difference between the groups in terms of the number of subjects who reported having taken action as a result of the program. The Keep on Talking program increased knowledge about communication, produced a positive change in attitude toward the importance of communication, and encouraged participants to take action to maintain their communication skills. Maintaining communication skills may prevent social isolation. This simple 5-hour group program has been effective in empowering participants to maintain. their communication skills as they age.

The impact of interpersonal and intergroup communication accommodation on perceptions of Chinese students in Australia

Using the framework of communication accommodation theory the authors examined convergence and maintenance on evaluations of Chinese and Australian students. In Study 1, Australian students judged interactions between an Anglo-Australian. and another interactant who either maintained his or converged in speech style. Results indicated that participants were aware of convergence but that speaker ethnicity (Anglo-Australian, Chinese Australian or Chinese national) was a stronger influence on evaluations and future intentions to interact with the speaker In Study 2, Australian students judged Chinese speakers who maintained communication style or converged on interpersonal speech markers, intergroup markers, or both types of markers. Results indicated that the more participants defined themselves in intergroup terms, the more positively they judged intergroup convergence relative to interpersonal convergence and maintenance. This points to the importance of distinguishing between, convergence on interpersonal and intergroup speech markers, and underlines the role of individual differences in the evaluation of convergence.

The making and the actions of the Holy Inquisition Commissioners` network in Colonial Minas Gerais

Through the study of the action of the inquisition commissioners, this article seeks to reveal the relations between the Portuguese Inquisition and the ecclesiastical structure of the Minas Gerais State Captaincy in the colonial period. The focus of the analysis will be the making and the action of the network of Holy Inquisition commissioners in the gold Captaincy. What was the profile of these commissioners? How were they recruited from the local ecclesiastical hierarchy? What was the role assigned to them in the inquisitional action that took place in Minas Gerais? How did they act? What was the relationship between the introduction of the commissioners into the local ecclesiastical structures and the commissioners` inquisitorial activities?