Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Sociocultural context as a facilitator of student learning of function concepts in mathematics

In Costa Rica, many secondary students have serious difficulties to establish relationships between mathematics and real-life contexts. They question the utilitarian role of the school mathematics. This fact motivated the research object of this report which evidences the need to overcome methodologies unrelated to students’ reality, toward new didactical options that help students to value mathematics, reasoning and its  applications, connecting it with their socio-cultural context. The research used a case study as a qualitative methodology and the social constructivism as an educational paradigm in which the knowledge is built by the student; as a product of his social interactions. A collection of learning situations was designed, validated, and implemented. It allowed establishing relationships between mathematical concepts and the socio-cultural context of participants. It analyzed the impact of students’socio-cultural context in their mathematics learning of basic concepts of real variable functions, consistent with the Ministry of Education (MEP) Official Program.  Among the results, it was found that using students’sociocultural context improved their motivational processes, mathematics sense making, and promoted cooperative social interactions. It was evidenced that contextualized learning situations favored concepts comprehension that allow students to see mathematics as a discipline closely related with their every-day life.

Integrating concrete and virtual materials in an elementary mathematics classroom : a case study of success with fractions

This paper describes an approach to introducing fraction concepts using generic software tools such as Microsoft Office's PowerPoint to create "virtual" materials for mathematics teaching and learning. This approach replicates existing concrete materials and integrates virtual materials with current non-computer methods of teaching primary students about fractions. The paper reports a case study of a 12-year-old student, Frank, who had an extremely limited understanding of fractions. Frank also lacked motivation for learning mathematics in general and interacted with his peers in a negative way during mathematics lessons. In just one classroom session involving the seamless integration of off-computer and on-computer activities, Frank acquired a basic understanding of simple common equivalent fractions. Further, he was observed as the session progressed to be an enthusiastic learner who offered to share his learning with his peers. The study's "virtual replication" approach for fractions involves the manipulation of concrete materials (folding paper regions) alongside the manipulation of their virtual equivalent (shading screen regions). As researchers have pointed out, the emergence of new technologies does not mean old technologies become redundant. Learning technologies have not replaced print and oral language or basic mathematical understanding. Instead, they are modifying, reshaping, and blending the ways in which humankind speaks, reads, writes, and works mathematically. Constructivist theories of learning and teaching argue that mathematics understanding is developed from concrete to pictorial to abstract and that, ultimately, mathematics learning and teaching is about refinement and expression of ideas and concepts. Therefore, by seamlessly integrating the use of concrete materials and virtual materials generated by computer software applications, an opportunity arises to enhance the teaching and learning value of both materials.

Recognising and respecting Torres Strait Islander mathematics knowledges and home languages through mainstream mathematics education [Abstract]

This abstract provides a preliminary discussion of the importance of recognising Torres Strait Islander knowledges and home languages of mathematics education. It stems from a project involving Torres Strait Islander Teachers and Teacher Aides and university based researchers who are working together to enhance the mathematics learning of students from Years 4-9. A key focus of the project is that mathematics is relevant and provides students with opportunities for further education, training and employment. Veronica Arbon (2008) questions the assumptions underpinning Western mainstream education as beneficial for Aboriginal and Torres Strait Islander people which assumes that it enables them to better participate in Australian society. She asks “how de we best achieve outcomes for and with Indigenous people conducive to our cultural, physical and economic sustainability as defined by us from Indigenous knowledge positions?” (p. 118). How does a mainstream education written to English conventions provide students with the knowledge and skills to participate in daily life, if it does not recognise the cultural identity of Indigenous students as it should (Priest, 2005; cf. Schnukal, 2003)? Arbon (2008) states that this view is now brought into question with calls for both ways education where mainstream knowledge and practices is blended with Indigenous cultural knowledges of learning. This project considers as crucial that cultural knowledges and experiences of Indigenous people to be valued and respected and given the currency in the same way that non Indigenous knowledge is (Taylor, 2003) for both ways education to work.

Learning power and language expressiveness

The topic of the present work is to study the relationship between the power of the learning algorithms on the one hand, and the expressive power of the logical language which is used to represent the problems to be learned on the other hand. The central question is whether enriching the language results in more learning power. In order to make the question relevant and nontrivial, it is required that both texts (sequences of data) and hypotheses (guesses) be translatable from the “rich” language into the “poor” one. The issue is considered for several logical languages suitable to describe structures whose domain is the set of natural numbers. It is shown that enriching the language does not give any advantage for those languages which define a monadic second-order language being decidable in the following sense: there is a fixed interpretation in the structure of natural numbers such that the set of sentences of this extended language true in that structure is decidable. But enriching the original language even by only one constant gives an advantage if this language contains a binary function symbol (which will be interpreted as addition). Furthermore, it is shown that behaviourally correct learning has exactly the same power as learning in the limit for those languages which define a monadic second-order language with the property given above, but has more power in case of languages containing a binary function symbol. Adding the natural requirement that the set of all structures to be learned is recursively enumerable, it is shown that it pays o6 to enrich the language of arithmetics for both finite learning and learning in the limit, but it does not pay off to enrich the language for behaviourally correct learning.

Learning to win process-control games watching game-masters

The present paper focuses on some interesting classes of process-control games, where winning essentially means successfully controlling the process. A master for one of these games is an agent who plays a winning strategy. In this paper we investigate situations in which even a complete model (given by a program) of a particular game does not provide enough information to synthesize—even incrementally—a winning strategy. However, if in addition to getting a program, a machine may also watch masters play winning strategies, then the machine is able to incrementally learn a winning strategy for the given game. Studied are successful learning from arbitrary masters and from pedagogically useful selected masters. It is shown that selected masters are strictly more helpful for learning than are arbitrary masters. Both for learning from arbitrary masters and for learning from selected masters, though, there are cases where one can learn programs for winning strategies from masters but not if one is required to learn a program for the master's strategy itself. Both for learning from arbitrary masters and for learning from selected masters, one can learn strictly more by watching m+1 masters than one can learn by watching only m. Last, a simulation result is presented where the presence of a selected master reduces the complexity from infinitely many semantic mind changes to finitely many syntactic ones.

Culture-fair assessment : challenging Indigenous students through effortful mathematics teaching

This paper reports on a mathematics education research project centred on teachers’ pedagogical practices and capacity to assess Indigenous Australian students in a culture-fair manner. The project has been funded by the Australian Research Council Linkage program and is being conducted in seven Catholic and Independent primary schools in north Queensland. Our Industry Partners are Catholic Education and the Association of Independent Schools, Queensland. The study aims to provide greater understanding about how to build more equitable assessment practices to address the issue of underperforming Aboriginal and Torres Strait Islander (ATSI) students in regional and remote Australia. The goal is to identify ways forward by attending to culture-fair assessment practice. The research is exploring the attitudes, beliefs and responses of Indigenous students to assessment in the context of mathematics learning with particular focus on teacher knowledge in these educational settings in relation to the design of assessment tasks that are authentic and engaging for these students in an accountability context. This approach highlights how teachers need to distinguish the ‘funds of knowledge’ (González, Moll, Floyd Tenery, Rivera, Rendón, Gonzales & Amanti, 2008) that Indigenous students draw on and how teachers need to be culturally responsive in their pedagogy to open up curriculum and assessment practice to allow for different ways of knowing and being

Early years teachers’ attitudes towards mathematics

Worldwide, there is considerable attention to providing a supportive mathematics learning environment for young children because attitude formation and achievement in these early years of schooling have a lifelong impact. Key influences on young children during these early years are their teachers. Practising early years teachers‟ attitudes towards mathematics influence the teaching methods they employ, which in turn, affects young students‟ attitudes towards mathematics, and ultimately, their achievement. However, little is known about practising early years teachers‟ attitudes to mathematics or how these attitudes form, which is the focus of this study. The research questions were: 1. What attitudes do practising early years teachers hold towards mathematics? 2. How did the teachers‟ mathematics attitudes form? This study adopted an explanatory case study design (Yin, 2003) to investigate practising early years teachers‟ attitudes towards mathematics and the formation of these attitudes. The research took place in a Brisbane southside school situated in a middle socio-economic area. The site was chosen due to its accessibility to the researcher. The participant group consisted of 20 early years teachers. They each completed the Attitude Towards Mathematics Inventory (ATMI) (Schackow, 2005), which is a 40 item instrument that measures attitudes across the four dimensions of attitude, namely value, enjoyment, self-confidence and motivation. The teachers‟ total ATMI scores were classified according to five quintiles: strongly negative, negative, neutral, positive and strongly positive. The results of the survey revealed that these teachers‟ attitudes ranged across only three categories with one teacher classified as strongly positive, twelve teachers classified as positive and seven teachers classified as neutral. No teachers were identified as having negative or strongly negative attitudes. Subsequent to the surveys, six teachers with a breadth of attitudes were selected from the original cohort to participate in open-ended interviews to investigate the formation of their attitudes. The interview data were analysed according to the four dimensions of attitudes (value, enjoyment, self-confidence, motivation) and three stages of education (primary, secondary, tertiary). Highlighted in the findings is the critical impact of schooling experiences on the formation of student attitudes towards mathematics. Findings suggest that primary school experiences are a critical influence on the attitudes of adults who become early years teachers. These findings also indicate the vital role tertiary institutions play in altering the attitudes of preservice teachers who have had negative schooling experiences. Experiences that teachers indicated contributed to the formation of positive attitudes in their own education were games, group work, hands-on activities, positive feedback and perceived relevance. In contrast, negative experiences that teachers stated influenced their attitudes were insufficient help, rushed teaching, negative feedback and a lack of relevance of the content. These findings together with the literature on teachers‟ attitudes and mathematics education were synthesized in a model titled a Cycle of Early Years Teachers’ Attitudes Towards Mathematics. This model explains positive and negative influences on attitudes towards mathematics and how the attitudes of adults are passed on to children, who then as adults themselves, repeat the cycle by passing on attitudes to a new generation. The model can provide guidance for practising teachers and for preservice and inservice education about ways to foster positive influences to attitude formation in mathematics and inhibit negative influences. Two avenues for future research arise from the findings of this study both relating to attitudes and secondary school experiences. The first question relates to the resilience of attitudes, in particular, how an individual can maintain positive attitudes towards mathematics developed in primary school, despite secondary school experiences that typically have a negative influence on attitude. The second question relates to the relationship between attitudes and achievement, specifically, why secondary students achieve good grades in mathematics despite a lack of enjoyment, which is one of the dimensions of attitude.

Does 'habitus' count in Chinese Australians' mathematics achievement?

Large-scale international comparative studies and cross-ethnic studies have revealed that Chinese students, whether living in China or overseas, consistently outperform their counterparts in mathematics achievement. These studies tended to explain this result from psychological, educational, or cultural perspectives. However, there is scant sociological investigation addressing Chinese students’ better mathematics achievement. Drawing on Bourdieu’s sociological theory, this study conceptualises Chinese Australians’ “Chineseness” by the notion of ‘habitus’ and considers this “Chineseness” generating but not determinating mechanism that underpins Chinese Australians’ mathematics learning. Two hundred and thirty complete responses from Chinese Australian participants were collected by an online questionnaire. Simple regression model statistically significantly well predicted mathematics achievement by “Chineseness” (F = 141.90, R = .62, t = 11.91, p < .001). Taking account of “Chineseness” as a sociological mechanism for Chinese Australians’ mathematics learning, this study complements psychological and educational impacts on better mathematics achievement of Chinese students revealed by previous studies. This study also challenges the cultural superiority discourse that attributes better mathematics achievement of Chinese students to cultural factors.

Reconceptualizing statistical learning in the early years

This chapter argues for the need to restructure children’s statistical experiences from the beginning years of formal schooling. The ability to understand and apply statistical reasoning is paramount across all walks of life, as seen in the variety of graphs, tables, diagrams, and other data representations requiring interpretation. Young children are immersed in our data-driven society, with early access to computer technology and daily exposure to the mass media. With the rate of data proliferation have come increased calls for advancing children’s statistical reasoning abilities, commencing with the earliest years of schooling (e.g., Langrall et al. 2008; Lehrer and Schauble 2005; Shaughnessy 2010; Whitin and Whitin 2011). Several articles (e.g., Franklin and Garfield 2006; Langrall et al. 2008) and policy documents (e.g., National Council of Teachers ofMathematics 2006) have highlighted the need for a renewed focus on this component of early mathematics learning, with children working mathematically and scientifically in dealing with realworld data. One approach to this component in the beginning school years is through data modelling (English 2010; Lehrer and Romberg 1996; Lehrer and Schauble 2000, 2007)...

Indigenous students transitioning to school : responses to pre-foundational mathematics

Australian Indigenous students' mathematics performance continues to be below that of non-Indigenous students. This occurs from the early years of school, due largely to knowledge and social differences on entry to formal schooling. This paper reports on a mathematics research project conducted in one Aboriginal community school in New South Wales, Australia. The project aimed to identify and explain the ways that young Australian Indigenous students (age 2-4 years) learn number language and processes, specifically attribute language, sorting, 1-1 correspondence and, counting. The project adopted a mixed methods approach. That is, the methodology was decolonising (Smith 1999) in that it collaborated with and gave benefit back to the Indigenous community and school being researched. It was qualitative and interpretative (Burns 2000) and incorporated an action-research teaching-experiment approach where and teachers collaborated with the researchers to try new teaching methods. This paper draws on data pertaining to students' response to diagnostic interview questions, the pre- and post-test results of the interview and photographic evidence as observations during mathematics learning time. Participants referred to in this paper include one female principal (N = 1), and the transition class of students' pre- (N = 6) and post-test (N = 3) results of the pre-foundational processes (also referred to as attributes). The results were encouraging with improvements in colour (34%), patterns (33%); capacity (38%). As a result of this project, our epistemology regarding the importance of finding out about students' pre-foundational knowledge and understandings and providing a culturally appropriate learning environment with resources has been built upon.

Chinese Australians’ Chineseness and their mathematics achievement : the role of habitus

Large-scale international comparative studies and cross-ethnic studies have revealed that Chinese students, living either in China or overseas, consistently outperform their counterparts in mathematics. Empirical research has discussed psychological, educational, and cultural reasons behind Chinese students’ better mathematics performance. However, there is scant sociological investigation of this phenomenon. The current mixed methods study aims to make a contribution in this regard. The study conceptualises Chineseness through Bourdieu’s sociological notion of habitus and considers this habitus of Chineseness generating, but not determining, mechanism that underpins commitment to mathematics learning. The study firstly analyses the responses of 230 Chinese Australian participants to a set of questionnaire items. Results indicate that the habitus of Chineseness significantly mediates the relationship between participants’ commitment to mathematics learning and their mathematics achievement. The study then reports on the interviews with five participants to add nuances and dynamics to the mediating role of habitus of Chineseness. The study complements the existing literature by providing sociological insight into the better mathematics achievement of Chinese students.

Handbook of International Research in Mathematics Education [3rd Ed.]

"This third edition ofthe Handbook of International Research in Mathematics Education provides a comprehensive overview of the most recent theoretical and practical developments in the field of mathematics education. Authored by an array of internationally recognized scholars and edited by Lyn English and David Kirshner, this collection brings together overviews and advances in mathematics education research spanning established and emerging topics, diverse workplace and school environments, and globally representative research priorities. New perspectives are presented on a range of critical topics including embodied learning, the theory-practice divide, new developments in the early years, educating future mathematics education professors, problem solving in a 21st century curriculum, culture and mathematics learning, complex systems, critical analysis of design-based research, multimodal technologies, and e-textbooks. Comprised of 12 revised and 17 new chapters, this edition extends the Handbook’s original themes for international research in mathematics education and remains in the process a definitive resource for the field."--Publisher website

Changing agendas in international research in mathematics education

Handbooks serve an important function for our research community in providing state-of-the-art summations, critiques, and extensions of existing trends in research. In the intervening years between the second and third editions of the Handbook of International Research in Mathematics Education, there have been stimulating developments in research, as well as new challenges in translating outcomes into practice. This third edition incorporates a number of new chapters representing areas of growth and challenge, in addition to substantially updated chapters from the second edition. As such, the Handbook addresses five core themes, namely, Priorities in International Mathematics Education Research, Democratic Access to Mathematics Learning, Transformations in Learning Contexts, Advances in Research Methodologies, and Influences of Advanced Technologies...

Learning from experience

Training courses for researchers are discussed in some detail. The preparation of researchers and of statisticians for consulting sessions, and the opportunities such sessions provide for training, are considered.