Data Mining for Network Intrusion Detection : A comparison of data mining algorithms and an analysis of relevant features for detecting cyber-attacks

Data mining can be defined as the extraction of implicit, previously un-known, and potentially useful information from data. Numerous re-searchers have been developing security technology and exploring new methods to detect cyber-attacks with the DARPA 1998 dataset for Intrusion Detection and the modified versions of this dataset KDDCup99 and NSL-KDD, but until now no one have examined the performance of the Top 10 data mining algorithms selected by experts in data mining. The compared classification learning algorithms in this thesis are: C4.5, CART, k-NN and Naïve Bayes. The performance of these algorithms are compared with accuracy, error rate and average cost on modified versions of NSL-KDD train and test dataset where the instances are classified into normal and four cyber-attack categories: DoS, Probing, R2L and U2R. Additionally the most important features to detect cyber-attacks in all categories and in each category are evaluated with Weka’s Attribute Evaluator and ranked according to Information Gain. The results show that the classification algorithm with best performance on the dataset is the k-NN algorithm. The most important features to detect cyber-attacks are basic features such as the number of seconds of a network connection, the protocol used for the connection, the network service used, normal or error status of the connection and the number of data bytes sent. The most important features to detect DoS, Probing and R2L attacks are basic features and the least important features are content features. Unlike U2R attacks, where the content features are the most important features to detect attacks.

Multiple face detection at different resolutions for perceptual user interfaces

[EN]This paper describes in detail a real-time multiple face detection system for video streams. The system adds to the good performance provided by a window shift approach, the combination of different cues available in video streams due to temporal coherence. The results achieved by this combined solution outperform the basic face detector obtaining a 98% success rate for around 27000 images, providing additionally eye detection and a relation between the successive detections in time by means of detection threads.

A Reliable Downscaling of ECG Signals for the Detection of T wave Heterogeneity Features

In cardiovascular disease the definition and the detection of the ECG parameters related to repolarization dynamics in post MI patients is still a crucial unmet need. In addition, the use of a 3D sensor in the implantable medical devices would be a crucial mean in the assessment or prediction of Heart Failure status, but the inclusion of such feature is limited by hardware and firmware constraints. The aim of this thesis is the definition of a reliable surrogate of the 500 Hz ECG signal to reach the aforementioned objective. To evaluate the worsening of reliability due to sampling frequency reduction on delineation performance, the signals have been consecutively down sampled by a factor 2, 4, 8 thus obtaining the ECG signals sampled at 250, 125 and 62.5 Hz, respectively. The final goal is the feasibility assessment of the detection of the fiducial points in order to translate those parameters into meaningful clinical parameter for Heart Failure prediction, such as T waves intervals heterogeneity and variability of areas under T waves. An experimental setting for data collection on healthy volunteers has been set up at the Bakken Research Center in Maastricht. A 16 – channel ambulatory system, provided by TMSI, has recorded the standard 12 – Leads ECG, two 3D accelerometers and a respiration sensor. The collection platform has been set up by the TMSI property software Polybench, the data analysis of such signals has been performed with Matlab. The main results of this study show that the 125 Hz sampling rate has demonstrated to be a good candidate for a reliable detection of fiducial points. T wave intervals proved to be consistently stable, even at 62.5 Hz. Further studies would be needed to provide a better comparison between sampling at 250 Hz and 125 Hz for areas under the T waves.

Quantitative and Qualitative Trade-Off Analysis of Drowsy Driver Detection Methods: Single Electrode Wearable EEG Device, Multi-Electrode Wearable EEG Device, and Head-Mounted Gyroscope

Drowsy driving impairs motorists’ ability to operate vehicles safely, endangering both the drivers and other people on the road. The purpose of the project is to find the most effective wearable device to detect drowsiness. Existing research has demonstrated several options for drowsiness detection, such as electroencephalogram (EEG) brain wave measurement, eye tracking, head motions, and lane deviations. However, there are no detailed trade-off analyses for the cost, accuracy, detection time, and ergonomics of these methods. We chose to use two different EEG headsets: NeuroSky Mindwave Mobile (single-electrode) and Emotiv EPOC (14- electrode). We also tested a camera and gyroscope-accelerometer device. We can successfully determine drowsiness after five minutes of training using both single and multi-electrode EEGs. Devices were evaluated using the following criteria: time needed to achieve accurate reading, accuracy of prediction, rate of false positives vs. false negatives, and ergonomics and portability. This research will help improve detection devices, and reduce the number of future accidents due to drowsy driving.

Improving the stability of an oxime based electrochemical microsensor for organo-phosphate vapor detection

A micro gas sensor has been developed by our group for the detection of organo-phosphate vapors using an aqueous oxime solution. The analyte diffuses from the high flow rate gas stream through a porous membrane to the low flow rate aqueous phase. It reacts with the oxime PBO (1-Phenyl-1,2,3,-butanetrione 2-oxime) to produce cyanide ions, which are then detected electrochemically from the change in solution potential. Previous work on this oxime based electrochemistry indicated that the optimal buffer pH for the aqueous solution was approximately 10. A basic environment is needed for the oxime anion to form and the detection reaction to take place. At this specific pH, the potential response of the sensor to an analyte (such as acetic anhydride) is maximized. However, sensor response slowly decreases as the aqueous oxime solution ages, by as much as 80% in first 24 hours. The decrease in sensor response is due to cyanide which is produced during the oxime degradation process, as evidenced by the cyanide selective electrode. Solid phase micro-extraction carried out on the oxime solution found several other possible degradation products, including acetic acid, N-hydroxy benzamide, benzoic acid, benzoyl cyanide, 1-Phenyl 1,3-butadione, 2-isonitrosoacetophenone and an imine derived from the oxime. It was concluded that degradation occurred through nucleophilic attack by a hydroxide or oxime anion to produce cyanide, as well as a nitrogen atom rearrangement similar to Beckmann rearrangement. The stability of the oxime in organic solvents is most likely due to the lack of water, and specifically hydroxide ions. The reaction between oxime and organo-phosphate to produce cyanide ions requires hydroxide ions, and therefore pure organic solvents are not compatible with the current micro-sensor electrochemistry. By combining a concentrated organic oxime solution with the basic aqueous buffer just prior to being used in the detection process, oxime degradation can be avoided while preserving the original electrochemical detection scheme. Based on beaker cell experiments with selective cyanide sensitive electrodes, ethanol was chosen as the best organic solvent due to its stabilizing effect on the oxime, minimal interference with the aqueous electrochemistry, and compatibility with the current microsensor material (PMMA). Further studies showed that ethanol had a small effect on micro-sensor performance by reducing the rate of cyanide production and decreasing the overall response time. To avoid incomplete mixing of the aqueous and organic solutions, they were pre-mixed externally at a 10:1 ratio, respectively. To adapt the microsensor design to allow for mixing to take place within the device, a small serpentine channel component was fabricated with the same dimensions and material as the original sensor. This allowed for seamless integration of the microsensor with the serpentine mixing channel. Mixing in the serpentine microchannel takes place via diffusion. Both detector potential response and diffusional mixing improve with increased liquid residence time, and thus decreased liquid flowrate. Micromixer performance was studies at a 10:1 aqueous buffer to organic solution flow rate ratio, for a total rate of 5.5 μL/min. It was found that the sensor response utilizing the integrated micromixer was nearly identical to the response when the solutions were premixed and fed at the same rate.

The analysis and detection of new psychoactive substances in biological matrices

New psychoactive substances (NPSs) have appeared on the recreational drug market at an unprecedented rate in recent years. Many are not new drugs but failed products of the pharmaceutical industry. The speed and variety of drugs entering the market poses a new complex challenge for the forensic toxicology community. The detection of these substances in biological matrices can be difficult as the exact compounds of interest may not be known. Many NPS are sold under the same brand name and therefore users themselves may not know what substances they have ingested. The majority of analytical methods for the detection of NPSs tend to focus on a specific class of compounds rather than a wide variety. In response to this, a robust and sensitive method was developed for the analysis of various NPS by solid phase extraction (SPE) with gas chromatography mass spectrometry (GCMS). Sample preparation and derivatisation were optimised testing a range of SPE cartridges and derivatising agents, as well as derivatisation incubation time and temperature. The final gas chromatography mass spectrometry method was validated in accordance with SWGTOX 2013 guidelines over a wide concentration range for both blood and urine for 23 and 25 analytes respectively. This included the validation of 8 NBOMe compounds in blood and 10 NBOMe compounds in urine. This GC-MS method was then applied to 8 authentic samples with concentrations compared to those originally identified by NMS laboratories. The rapid influx of NPSs has resulted in the re-analysis of samples and thus, the stability of these substances is crucial information. The stability of mephedrone was investigated, examining the effect that storage temperatures and preservatives had on analyte stability daily for 1 week and then weekly for 10 weeks. Several laboratories identified NPSs use through the cross-reactivity of these substances with existing screening protocols such as ELISA. The application of Immunalysis ketamine, methamphetamine and amphetamine ELISA kits for the detection of NPS was evaluated. The aim of this work was to determine if any cross-reactivity from NPS substances was observed, and to determine whether these existing kits would identify NPS use within biological samples. The cross- reactivity of methoxetamine, 3-MeO-PCE and 3-MeO-PCP for different commercially point of care test (POCT) was also assessed for urine. One of the newest groups of compounds to appear on the NPS market is the NBOMe series. These drugs pose a serious threat to public health due to their high potency, with fatalities already reported in the literature. These compounds are falsely marketed as LSD which increases the chance of adverse effects due to the potency differences between these 2 substances. A liquid chromatography tandem mass spectrometry (LC-MS/MS) method was validated in accordance with SWGTOX 2013 guidelines for the detection for 25B, 25C and 25I-NBOMe in urine and hair. Long-Evans rats were administered 25B-, 25C- and 25I-NBOMe at doses ranging from 30-300 µg/kg over a period of 10 days. Tail flick tests were then carried out on the rats in order to determine whether any analgesic effects were observed as a result of dosing. Rats were also shaved prior to their first dose and reshaved after the 10-day period. Hair was separated by colour (black and white) and analysed using the validated LC-MS/MS method, assessing the impact hair colour has on the incorporation of these drugs. Urine was collected from the rats, analysed using the validated LC-MS/MS method and screened for potential metabolites using both LC-MS/MS and quadrupole time of flight (QToF) instrumentation.

Precoder Detection for Cooperative Decode-and-Forward Relaying in OFDMA Systems

We consider an LTE network where a secondary user acts as a relay, transmitting data to the primary user using a decode-and-forward mechanism, transparent to the base-station (eNodeB). Clearly, the relay can decode symbols more reliably if the employed precoder matrix indicators (PMIs) are known. However, for closed loop spatial multiplexing (CLSM) transmit mode, this information is not always embedded in the downlink signal, leading to a need for effective methods to determine the PMI. In this thesis, we consider 2x2 MIMO and 4x4 MIMO downlink channels corresponding to CLSM and formulate two techniques to estimate the PMI at the relay using a hypothesis testing framework. We evaluate their performance via simulations for various ITU channel models over a range of SNR and for different channel quality indicators (CQIs). We compare them to the case when the true PMI is known at the relay and show that the performance of the proposed schemes are within 2 dB at 10% block error rate (BLER) in almost all scenarios. Furthermore, the techniques add minimal computational overhead over existent receiver structure. Finally, we also identify scenarios when using the proposed precoder detection algorithms in conjunction with the cooperative decode-and-forward relaying mechanism benefits the PUE and improves the BLER performance for the PUE. Therefore, we conclude from this that the proposed algorithms as well as the cooperative relaying mechanism at the CMR can be gainfully employed in a variety of real-life scenarios in LTE networks.

Domestic Rhodnius ecuadoriensis (Hemiptera, Reduviidae) infestation in Northern Peru: a comparative trial of detection methods during a six-month follow-up

Two passive methods in the assessment of intradomiciliary infestation by Rhodnius ecuadoriensis were tested: (i) the Gomes Nuñez sensor box (GN), (ii) sheets of white typing paper and (iii) one active timed manual method. The study was carried out in the Alto Chicama River Valley, Province of Gran Chimú, Department of La Libertad. The study design consisted of an initial searching of triatomines inside of the domestic environment by the manual capture active procedure (man/hour) covering all the studied houses. Then, matched pairs of GN boxes and paper sheets were simultaneously installed in the bedrooms of 207 households distributed in 19 localities. A comparative prospective trial of these passive detection devices were monitored at 2, 4 and, finally 6 months follow-up. Parasitological Trypanosoma rangeli and/or T. cruzi infections were investigated in two houses with high level of infestation by R. ecuadoriensis.16.9% of the 207 households investigated by an initial active manual method were infested with R. ecuadoriensis. The proportion of infested houses fluctuated from 6.2 to 55.5% amongst the 19 localities investigated. T. rangeli natural infection was detected in R.ecuadoriensis specimens collected in two households. Parasite rates in the bugs ranged from 16.6 to 21.7% respectively. The most striking fact was an average rate of salivary gland infection ranging from 7.4 to 8.3%. At the end of the sixth month period, a cumulative incidence of 31.4% of positive GN boxes against 15.9% for paper sheets was recorded. All three methods combined detected domestic infestation in 129 (62.3%) of the 207 houses studied in the 19 localities. The range of houses infested varies from 6.7% to 92.9%. In areas with low bug density infestation rates, the methodology experienced in our studies, seems to be the best choice for investigations on domestic R. ecuadoriensis populations.

Exchange rate dynamics, structural breaks, and central bank interventions in Colombia

We evaluate the effectiveness of the Colombian Central Bank´s interventions in the foreign exchange market during the period 2000 to 2014 -- We examine the stochastic process that describes the exchange rate, with a focus on the detection of structural breaks or unit roots in the data to determine whether the Central Bank´s interventions were effective -- We find that the exchange rate can be described either by a random walk or by a trend-stationary model with multiple breaks -- In neither cases do we find any evidence that the exchange rate was affected by the Central Bank interventions

Detection of all four dengue serotypes in Aedes aegypti female mosquitoes collected in a rural area in Colombia

The Aedes aegypti vector for dengue virus (DENV) has been reported in urban and periurban areas. The information about DENV circulation in mosquitoes in Colombian rural areas is limited, so we aimed to evaluate the presence of DENV in Ae. aegypti females caught in rural locations of two Colombian municipalities, Anapoima and La Mesa. Mosquitoes from 497 rural households in 44 different rural settlements were collected. Pools of about 20 Ae. aegypti females were processed for DENV serotype detection. DENV in mosquitoes was detected in 74% of the analysed settlements with a pool positivity rate of 62%. The estimated individual mosquito infection rate was 4.12% and the minimum infection rate was 33.3/1,000 mosquitoes. All four serotypes were detected; the most frequent being DENV-2 (50%) and DENV-1 (35%). Two-three serotypes were detected simultaneously in separate pools. This is the first report on the co-occurrence of natural DENV infection of mosquitoes in Colombian rural areas. The findings are important for understanding dengue transmission and planning control strategies. A potential latent virus reservoir in rural areas could spill over to urban areas during population movements. Detecting DENV in wild-caught adult mosquitoes should be included in the development of dengue epidemic forecasting models.

An Innovative Method of Increasing Early Detection for Skin Cancer in Australia

Abstract Objective: To evaluate a family practice intervention to encourage patients to request a skin examination during their consultation. Methods: Family physicians in Queensland, Australia, were randomized to intervention or control groups. In the intervention group, materials were provided by the office receptionist and supported by the family physician. Results: The rate of full-body skin examination was 99.3/ 1000 consultations in intervention-group practices compared to 22.4/ 1000 in control-group practices (p

Mixed genotype Hepatitis C virus infections: incidence in Scotland and methods for detection

The diagnosis of mixed genotype hepatitis C virus (HCV) infection is rare and information on incidence in the UK, where genotypes 1a and 3 are the most prevalent, is sparse. Considerable variations in the efficacies of direct-acting antivirals (DAAs) for the HCV genotypes have been documented and the ability of DAAs to treat mixed genotype HCV infections remains unclear, with the possibility that genotype switching may occur. In order to estimate the prevalence of mixed genotype 1a/3 infections in Scotland, a cohort of 512 samples was compiled and then screened using a genotype-specific nested PCR assay. Mixed genotype 1a/3 infections were found in 3.8% of samples tested, with a significantly higher prevalence rate of 6.7% (p<0.05) observed in individuals diagnosed with genotype 3 infections than genotype 1a (0.8%). An analysis of the samples using genotypic-specific qPCR assays found that in two-thirds of samples tested, the minor strain contributed <1% of the total viral load. The potential of deep sequencing methods for the diagnosis of mixed genotype infections was assessed using two pan-genotypic PCR assays compatible with the Illumina MiSeq platform that were developed targeting the E1-E2 and NS5B regions of the virus. The E1-E2 assay detected 75% of the mixed genotype infections, proving to be more sensitive than the NS5B assay which identified only 25% of the mixed infections. Studies of sequence data and linked patient records also identified significantly more neurological disorders in genotype 3 patients. Evidence of distinctive dinucleotide expression within the genotypes was also uncovered. Taken together these findings raise interesting questions about the evolutionary history of the virus and indicate that there is still more to understand about the different genotypes. In an era where clinical medicine is frequently more personalised, the development of diagnostic methods for HCV providing increased patient stratification is increasingly important. This project has shown that sequence-based genotyping methods can be highly discriminatory and informative, and their use should be encouraged in diagnostic laboratories. Mixed genotype infections were challenging to identify and current deep sequencing methods were not as sensitive or cost-effective as Sanger-based approaches in this study. More research is needed to evaluate the clinical prognosis of patients with mixed genotype infection and to develop clinical guidelines on their treatment.

A real time Taqman RT-PCR for the detection of rabbit hemorrhagic disease virus 2 (RHDV2)

As key prey, the wild rabbit downsize constitutes a major drawback on the endangered Iberian lynx (Lynx pardinus) re-introduction in the Iberia. Several captive breeding units mostly located in Alentejo, endeavour the wild rabbit repopulation of depleted areas assigned for the lynx re-introduction. Here we report an RHDV2 outbreak that occurred in early 2016 in a wild rabbit captive breeding unit located in Barrancos municipality. The estimated mortality rate between March and April 2016 was approximately 8.67%. Anatomopathologic examination was carried out for 13 victimized rabbits. Molecular characterization was based on the complete vp60 capsid gene. The 13 rabbit carcasses investigated showed typical macroscopic RHD lesions testing positive to RHDV2- RNA. Comparison of the vp60 nucleotide sequences obtained from two specimens with others publically available disclosed similarities below 98.22% with RHDV2 strains originated in the Iberia and Azores and revealed that the two identical strains from Barrancos-2016 contain six unique single synonymous nucleotide polymorphisms. In the phylogenetic analysis performed, the Barrancos-2016 strains clustered apart from other known strains, meaning they may represent new evolutionary RHDV2 lineages. No clear epidemiological link could be traced for this outbreak where the mortalities were lower compared with previous years. Yet, network analysis suggested a possible connection between the missing intermediates from which the strains from Barrancos 2013, 2014 and 2016 have derived. It is therefore possible that RHDV2 has circulated endemically in the region since 2012, with periodic epizootic occurrences. Still, six years after its emergence in wild rabbits, RHDV2 continues to pose difficulties to the establishment of natural wild rabbit populations that are crucial for the self-sustainability of the local ecosystems.

Quality controls for the Mu2e electromagnetic calorimeter and R&D studies for the muon capture rate determination

According to the SM, while Lepton Flavour Violation is allowed in the neutral sector, Charged Lepton Flavour Violation (CLFV) processes are forbidden. The Mu2e Experiment at Fermilab will search for the CLFV process of neutrinoless conversion of a muon into an electron within the field of an Al nucleus. The Mu2e detectors and its state-of-the-art superconducting magnetic system are presented, with special focus put to the electromagnetic crystal calorimeter. The calorimeter is composed by two annular disks, each one hosting pure CsI crystals read-out by custom silicon photomultipliers (SiPMs). The SiPMs are amplified by custom electronics (FEE) and are glued to copper holders in group of 2 SiPMs and 2 FEE boards thus forming a crystal Readout Unit. These Readout Units are being tested at the Quality Control (QC) Station, whose design, realization and operations are presented in this work. The QC Station allows to determine the gain, the response and the photon detection efficiency of each unit and to evaluate the dependence of these parameters from the supply voltage and temperature. The station is powered by two remotely-controlled power supplies and monitored thanks to a Slow Control system which is also illustrated in this work. In this thesis, we also demonstrated that the calorimeter can perform its own measurement of the Mu2e normalization factor, i.e. the counting of the 1.8 MeV photon line produced in nuclear muon captures. A specific calorimeter sub-system called CAPHRI, composed by four LYSO crystals with SiPM readout, has been designed and tested. We simulated the capability of this system on performing this task showing that it can get a faster and more reliable measurement of the muon capture rates with respect to the current Mu2e detector dedicated to this measurement. The characterization of energy resolution and response uniformity of the four procured LYSO crystals are llustrated.

Development of a health parameters tracking wearable device for detection of stress episodes and principles of panic attacks

A proof of concept for a wearable device is presented to help patients who suffer from panic attacks due to panic disorder. The aim of this device is to enable such patients manage these stressful episodes by guiding them to regulate their breathing and by informing the care taker. Panic attack prediction is deployed that can enable the healthcare providers to not only monitor and manage the panic attacks of a patient but also carry out an early intervention to reduce the symptom severity of the approaching panic attack. The patient can acquire the help they need, ultimately regaining control. The concept of panic attack prediction can lead to a personalized treatment of the patient. The study is conducted using a small real-world dataset, and only two primary symptoms of panic attack are used. These symptoms include pacing heart rate and hyperventilation or abnormal breathing rate. This thesis project is developed in collaboration with ALTEN italia and all the required hardware is provided by them.