Classification Trees as a Technique for Creating Anomaly-Based Intrusion Detection Systems

Intrusion detection is a critical component of security information systems. The intrusion detection process attempts to detect malicious attacks by examining various data collected during processes on the protected system. This paper examines the anomaly-based intrusion detection based on sequences of system calls. The point is to construct a model that describes normal or acceptable system activity using the classification trees approach. The created database is utilized as a basis for distinguishing the intrusive activity from the legal one using string metric algorithms. The major results of the implemented simulation experiments are presented and discussed as well.

Convection induced by instabilities in the presence of a transverse seepage

The transition of laterally heated flows in a vertical layer and in the presence of a streamwise pressure gradient is examined numerically for the case of different values Prandtl number. The stability analysis of the basic flow for the pure hydrodynamic case ( Pr = 0 ) was reported in [1]. We find that in the absence of transverse pumping the previously known critical parameters are recovered [2], while as the strength of the Poiseuille flow component is increased the convective motion is delayed considerably. Following the linear stability analysis for the vertical channel flow our attention is focused on a study of the finite am- plitude secondary travelling-wave (TW) solutions that develop from the perturbations of the transverse roll type imposed on the basic flow and temperature profiles. The linear stability of the secondary TWs against three-dimensional perturbations is also examined and it is shown that the bifurcating tertiary flows are phase-locked to the secondary TWs.

Numerical Investigation of the Effect of Magnetic Field on Natural Convection in a Curved-Shape Enclosure

This investigation reports the magnetic field effect on natural convection heat transfer in a curved-shape enclosure. The numerical investigation is carried out using the control volume-based-finite element method (CVFEM). The numerical investigations are performed for various values of Hartmann number and Rayleigh number. The obtained results are depicted in terms of streamlines and isotherms which show the significant effects of Hartmann number on the fluid flow and temperature distribution inside the enclosure. Also, it was found that the Nusselt number decreases with an increase in the Hartmann number.

Espessura da zona de transição do manto sob a Província Borborema, NE Brasil, através de conversões Ps telessísmicas

The mantle transition zone is defined by two seismic discontinuities, nominally at 410 and 660 km depth, which result from transformations in the mineral olivine. The topography of these discontinuities provides information about lateral temperature changes in the transition zone. In this work, P-to-S conversions from teleseismic events recorded at 32 broadband stations in the Borborema Province were used to determine the transition zone thickness beneath this region and to investigate whether there are lateral temperature changes within this depth range. For this analysis, stacking and migration of receiver functions was performed. In the Borborema Province, geophysical studies have revealed a geoid anomaly which could reflect the presence of a thermal anomaly related to the origin of intraplate volcanism and uplift that marked the evolution of the Province in the Cenozoic. Several models have been proposed to explain these phenomena, which include those invoking the presence of a deep-seated mantle plume and those invoking shallower sources, such as small-scale convection cells. The results of this work show that no thermal anomalies are present at transition zone depths, as significant variations in the transition zone thickness were not observed. However, regions of depressed topography for both discontinuities (410 and 660 km) that approximately overlap in space were identified, suggesting that lower-thanaverage, lateral variations in seismic velocity above 410 km depth may exist below the the Borborema Province. This is consistent with the presence of a thermally-induced, low-density body independently inferred from analysis of geoid anomalies. Therefore, the magma source responsible for the Cenozoic intraplate volcanism and related uplift in the Province, is likely to be confined above the upper mantle transition zone.

Anomaly detection from time-changing environmental sensor data streams

This thesis stems from the project with real-time environmental monitoring company EMSAT Corporation. They were looking for methods to automatically ag spikes and other anomalies in their environmental sensor data streams. The problem presents several challenges: near real-time anomaly detection, absence of labeled data and time-changing data streams. Here, we address this problem using both a statistical parametric approach as well as a non-parametric approach like Kernel Density Estimation (KDE). The main contribution of this thesis is extending the KDE to work more effectively for evolving data streams, particularly in presence of concept drift. To address that, we have developed a framework for integrating Adaptive Windowing (ADWIN) change detection algorithm with KDE. We have tested this approach on several real world data sets and received positive feedback from our industry collaborator. Some results appearing in this thesis have been presented at ECML PKDD 2015 Doctoral Consortium.

Data mining and visualization for anomaly detection and diagnosis in civil structures

Peer reviewed

Antarctic free-air and complete Bouguer gravity anomaly grid

Gravity surveying is challenging in Antarctica because of its hostile environment and inaccessibility. Nevertheless, many ground-based, airborne and shipborne gravity campaigns have been completed by the geophysical and geodetic communities since the 1980s. We present the first modern Antarctic-wide gravity data compilation derived from 13 million data points covering an area of 10 million km**2, which corresponds to 73% coverage of the continent. The remove-compute-restore technique was applied for gridding, which facilitated levelling of the different gravity datasets with respect to an Earth Gravity Model derived from satellite data alone. The resulting free-air and Bouguer gravity anomaly grids of 10 km resolution are publicly available. These grids will enable new high-resolution combined Earth Gravity Models to be derived and represent a major step forward towards solving the geodetic polar data gap problem. They provide a new tool to investigate continental-scale lithospheric structure and geological evolution of Antarctica.

Seafloor spreading magnetic anomaly isochron map compilation for the Weddell Sea and Scotia Sea

The deep sea sedimentary record is an archive of the pre-glacial to glacial development of Antarctica and changes in climate, tectonics and ocean circulation. Identification of the pre-glacial, transitional and full glacial components in the sedimentary record is necessary for ice sheet reconstruction and to build circum-Antarctic sediment thickness grids for past topography and bathymetry reconstructions, which constrain paleoclimate models. A ~3300 km long Weddell Sea to Scotia Sea transect consisting of multichannel seismic reflection data from various organisations, were used to interpret new horizons to define the initial basin-wide seismostratigraphy and to identify the pre-glacial to glacial components. We mapped seven main units of which three are in the inferred Cretaceous-Paleocene pre-glacial regime, one in the Eocene-Oligocene transitional regime and three units in the Miocene-Pleistocene full glacial climate regime. Sparse borehole data from ODP leg 113 and SHALDRIL constrain the ages of the upper three units. Compiled seafloor spreading magnetic anomalies constrain the basement ages and the hypothetical age model. In many cases, the new horizons and stratigraphy contradict the interpretations in local studies. Each seismic sedimentary unit and its associated base horizon are continuous and traceable for the entire transect length, but reflect a lateral change in age whilst representing the same deposition process. The up to 1240 m thick pre-glacial seismic units form a mound in the central Weddell Sea basin and, in conjunction with the eroded flank geometry, support the interpretation of a Cretaceous proto-Weddell Gyre. The base reflector of the transitional seismic unit, which marks the initial ice sheet advances to the outer shelf, has a lateral model age of 26.6-15.5 Ma from southeast to northwest. The Pliocene-Pleistocene glacial deposits reveals lower sedimentations rates, indicating a reduced sediment supply. Sedimentation rates for the pre-glacial, transitional and full glacial components are highest around the Antarctic Peninsula, indicating higher erosion and sediment supply of a younger basement. We interpret an Eocene East Antarctic Ice Sheet expansion, Oligocene grounding of the West Antarctic Ice Sheet and Early Miocene grounding of the Antarctic Peninsula Ice Sheet.

Towards convection-resolving, global atmospheric simulations with the Model for Prediction Across Scales (MPAS) v3.1: an extreme scaling experiment, links to sourcecode of model and grides

The Model for Prediction Across Scales (MPAS) is a novel set of Earth system simulation components and consists of an atmospheric model, an ocean model and a land-ice model. Its distinct features are the use of unstructured Voronoi meshes and C-grid discretisation to address shortcomings of global models on regular grids and the use of limited area models nested in a forcing data set, with respect to parallel scalability, numerical accuracy and physical consistency. This concept allows one to include the feedback of regional land use information on weather and climate at local and global scales in a consistent way, which is impossible to achieve with traditional limited area modelling approaches. Here, we present an in-depth evaluation of MPAS with regards to technical aspects of performing model runs and scalability for three medium-size meshes on four different high-performance computing (HPC) sites with different architectures and compilers. We uncover model limitations and identify new aspects for the model optimisation that are introduced by the use of unstructured Voronoi meshes. We further demonstrate the model performance of MPAS in terms of its capability to reproduce the dynamics of the West African monsoon (WAM) and its associated precipitation in a pilot study. Constrained by available computational resources, we compare 11-month runs for two meshes with observations and a reference simulation from the Weather Research and Forecasting (WRF) model. We show that MPAS can reproduce the atmospheric dynamics on global and local scales in this experiment, but identify a precipitation excess for the West African region. Finally, we conduct extreme scaling tests on a global 3?km mesh with more than 65 million horizontal grid cells on up to half a million cores. We discuss necessary modifications of the model code to improve its parallel performance in general and specific to the HPC environment. We confirm good scaling (70?% parallel efficiency or better) of the MPAS model and provide numbers on the computational requirements for experiments with the 3?km mesh. In doing so, we show that global, convection-resolving atmospheric simulations with MPAS are within reach of current and next generations of high-end computing facilities.

Video anomaly detection in real-time on a Power-Aware Heterogeneous Platform

FPGAs and GPUs are often used when real-time performance in video processing is required. An accelerated processor is chosen based on task-specific priorities (power consumption, processing time and detection accuracy), and this decision is normally made once at design time. All three characteristics are important, particularly in battery-powered systems. Here we propose a method for moving selection of processing platform from a single design-time choice to a continuous run time one.We implement Histogram of Oriented Gradients (HOG) detectors for cars and people and Mixture of Gaussians (MoG) motion detectors running across FPGA, GPU and CPU in a heterogeneous system. We use this to detect illegally parked vehicles in urban scenes. Power, time and accuracy information for each detector is characterised. An anomaly measure is assigned to each detected object based on its trajectory and location, when compared to learned contextual movement patterns. This drives processor and implementation selection, so that scenes with high behavioural anomalies are processed with faster but more power hungry implementations, but routine or static time periods are processed with power-optimised, less accurate, slower versions. Real-time performance is evaluated on video datasets including i-LIDS. Compared to power-optimised static selection, automatic dynamic implementation mapping is 10% more accurate but draws 12W extra power in our testbed desktop system.

Contextual anomaly detection in crowded surveillance scenes

This work addresses the problem of detecting human behavioural anomalies in crowded surveillance environments. We focus in particular on the problem of detecting subtle anomalies in a behaviourally heterogeneous surveillance scene. To reach this goal we implement a novel unsupervised context-aware process. We propose and evaluate a method of utilising social context and scene context to improve behaviour analysis. We find that in a crowded scene the application of Mutual Information based social context permits the ability to prevent self-justifying groups and propagate anomalies in a social network, granting a greater anomaly detection capability. Scene context uniformly improves the detection of anomalies in both datasets. The strength of our contextual features is demonstrated by the detection of subtly abnormal behaviours, which otherwise remain indistinguishable from normal behaviour.

The changing epidemiology of Ebstein's anomaly and its relationship with maternal mental health conditions: a European registry-based study

OBJECTIVES: The aim of this study was to describe the epidemiology of Ebstein's anomaly in Europe and its association with maternal health and medication exposure during pregnancy.

DESIGN: We carried out a descriptive epidemiological analysis of population-based data.

SETTING: We included data from 15 European Surveillance of Congenital Anomalies Congenital Anomaly Registries in 12 European countries, with a population of 5.6 million births during 1982-2011. Participants Cases included live births, fetal deaths from 20 weeks gestation, and terminations of pregnancy for fetal anomaly. Main outcome measures We estimated total prevalence per 10,000 births. Odds ratios for exposure to maternal illnesses/medications in the first trimester of pregnancy were calculated by comparing Ebstein's anomaly cases with cardiac and non-cardiac malformed controls, excluding cases with genetic syndromes and adjusting for time period and country.

RESULTS: In total, 264 Ebstein's anomaly cases were recorded; 81% were live births, 2% of which were diagnosed after the 1st year of life; 54% of cases with Ebstein's anomaly or a co-existing congenital anomaly were prenatally diagnosed. Total prevalence rose over time from 0.29 (95% confidence interval (CI) 0.20-0.41) to 0.48 (95% CI 0.40-0.57) (p<0.01). In all, nine cases were exposed to maternal mental health conditions/medications (adjusted odds ratio (adjOR) 2.64, 95% CI 1.33-5.21) compared with cardiac controls. Cases were more likely to be exposed to maternal β-thalassemia (adjOR 10.5, 95% CI 3.13-35.3, n=3) and haemorrhage in early pregnancy (adjOR 1.77, 95% CI 0.93-3.38, n=11) compared with cardiac controls.

CONCLUSIONS: The increasing prevalence of Ebstein's anomaly may be related to better and earlier diagnosis. Our data suggest that Ebstein's anomaly is associated with maternal mental health problems generally rather than lithium or benzodiazepines specifically; therefore, changing or stopping medications may not be preventative. We found new associations requiring confirmation.

Combined Conduction-Convection-Radiation Heat Transfer of Slip Flow inside a Micro-channel Filled with a Cellular Porous Material

Combined conduction–convection–radiation heat transfer is investigated numerically in a micro-channel filled with a saturated cellular porous medium, with the channel walls held at a constant heat flux. Invoking the velocity slip and temperature jump, the thermal behaviour of the porous–fluid system are studied by considering hydrodynamically fully developed flow and applying the Darcy–Brinkman flow model. One energy equation model based on the local thermal equilibrium condition is adopted to evaluate the temperature field within the porous medium. Combined conduction and radiation heat transfer is treated as an effective conduction process with a temperature-dependent effective thermal conductivity. Results are reported in terms of the average Nusselt number and dimensionless temperature distribution, as a function of velocity slip coefficient, temperature jump coefficient, porous medium shape parameter and radiation parameters. Results show that increasing the radiation parameter (Tr)(Tr) and the temperature jump coefficient flattens the dimensionless temperature profile. The Nusselt numbers are more sensitive to the variation in the temperature jump coefficient rather than to the velocity slip coefficient. Such that for high porous medium shape parameter, the Nusselt number is found to be independent of velocity slip. Furthermore, it is found that as the temperature jump coefficient increases, the Nusselt number decrease. In addition, for high temperature jump coefficients, the Nusselt number is found to be insensitive to the radiation parameters and porous medium shape parameter. It is also concluded that compared with the conventional macro-channels, wherein using a porous material enhances the rate of heat transfer (up to about 40 % compared to the clear channel), insertion of a porous material inside a micro-channel in slip regime does not effectively enhance the rate of heat transfer that is about 2 %.