Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Investigation of support vector machine for the detection of architectural distortion in mammographic images

This paper investigates detection of architectural distortion in mammographic images using support vector machine. Hausdorff dimension is used to characterise the texture feature of mammographic images. Support vector machine, a learning machine based on statistical learning theory, is trained through supervised learning to detect architectural distortion. Compared to the Radial Basis Function neural networks, SVM produced more accurate classification results in distinguishing architectural distortion abnormality from normal breast parenchyma.

The chaos machine: analogue computing rediscovered (1)

Analogue computers provide actual rather than virtual representations of model systems. They are powerful and engaging computing machines that are cheap and simple to build. This two-part Retronics article helps you build (and understand!) your own analogue computer to simulate the Lorenz butterfly that's become iconic for Chaos theory.

Modelling QoS of a pervasive MVNO/M2M using semi-group theory

This paper aims to develop a mathematical model based on semi-group theory, which allows to improve quality of service (QoS), including the reduction of the carbon path, in a pervasive environment of a Mobile Virtual Network Operator (MVNO). This paper generalise an interrelationship Machine to Machine (M2M) mathematical model, based on semi-group theory. This paper demonstrates that using available technology and with a solid mathematical model, is possible to streamline relationships between building agents, to control pervasive spaces so as to reduce the impact in carbon footprint through the reduction of GHG.

Modelling capability and affordance as properties of human/machine resource systems

Understanding how and why the capability of one set of business resources, its structural arrangements and mechanisms compared to another works can provide competitive advantage in terms of new business processes and product and service development. However, most business models of capability are descriptive and lack formal modelling language to qualitatively and quantifiably compare capabilities, Gibson’s theory of affordance, the potential for action, provides a formal basis for a more robust and quantitative model, but most formal affordance models are complex and abstract and lack support for real-world applications. We aim to understand the ‘how’ and ‘why’ of business capability, by developing a quantitative and qualitative model that underpins earlier work on Capability-Affordance Modelling – CAM. This paper integrates an affordance based capability model and the formalism of Coloured Petri Nets to develop a simulation model. Using the model, we show how capability depends on the space time path of interacting resources, the mechanism of transition and specific critical affordance factors relating to the values of the variables for resources, people and physical objects. We show how the model can identify the capabilities of resources to enable the capability to inject a drug and anaesthetise a patient.

An Information Theory framework for two-stage binary image operator design

The design of translation invariant and locally defined binary image operators over large windows is made difficult by decreased statistical precision and increased training time. We present a complete framework for the application of stacked design, a recently proposed technique to create two-stage operators that circumvents that difficulty. We propose a novel algorithm, based on Information Theory, to find groups of pixels that should be used together to predict the Output Value. We employ this algorithm to automate the process of creating a set of first-level operators that are later combined in a global operator. We also propose a principled way to guide this combination, by using feature selection and model comparison. Experimental results Show that the proposed framework leads to better results than single stage design. (C) 2009 Elsevier B.V. All rights reserved.

Machine translation and the disruption of foreign language learning activities

This study examines the question of how language teachers in a highly technology-friendly university environment view machine translation and the implications that this has for the personal learning environments of students. It brings an activity-theory perspective to the question, examining the ways that the introduction of new tools can disrupt the relationship between different elements in an activity system. This perspective opens up for an investigation of the ways that new tools have the potential to fundamentally alter traditional learning activities. In questionnaires and group discussions, respondents showed general agreement that although use of machine translation by students could be considered cheating, students are bound to use it anyway, and suggested that teachers focus on the kinds of skills students would need when using machine translation and design assignments and exams to practice and assess these skills. The results of the empirical study are used to reflect upon questions of what the roles of teachers and students are in a context where many of the skills that a person needs to be able to interact in a foreign language increasingly can be outsourced to laptops and smartphones.

Essays on banking theory and history of financial arrangements

Esta tese contém dois capítulos, cada um lidando com a teoria e a história dos bancos e arranjos financeiros. No capítulo 1, busca-se extender uma economia Diamond-Dybvig com monitoramento imperfeito dos saques antecipados e realizar uma comparação do bem estar social em cada uma das alocações possíveis, como proposto em Presscott and Weinberg(2003). Esse monitoramento imperfeito é implementado a partir da comunicação indireta ( através de um meio de pagamento) entre os agentes e a máquina de depósitos e saques que é um agregado do setor produtivo e financeiro. A extensão consiste em estudar alocações onde uma fração dos agentes pode explorar o monitoramento imperfeito e fraudar a alocação contratada ao consumirem mais cedo além do limite, usando múltiplos meios de pagamento. Com a punição limitada no período de consumo tardio, essa nova alocação pode ser chamada de uma alocação separadora em contraste com as alocações agregadoras onde o agente com habilidade de fraudar é bloqueado por um meio de pagamento imune a fraude, mas custoso, ou por receber consumo futuro suficiente para tornar a fraude desinteressante. A comparação de bem estar na gama de parâmetros escolhida mostra que as alocações separadoras são ótimas para as economias com menor dotação e as agregadoras para as de nível intermediário e as ricas. O capítulo termina com um possível contexto histórico para o modelo, o qual se conecta com a narrativa histórica encontrada no capítulo 2. No capítulo 2 são exploradas as propriedade quantitativas de um sistema de previsão antecedente para crises financeiras, com as váriaveis sendo escolhidas a partir de um arcabouço de ``boom and bust'' descrito mais detalhadamente no apêndice 1. As principais variáveis são: o crescimento real nos preços de imóveis e ações, o diferencial entre os juros dos títulos governamentais de 10 anos e a taxa de 3 meses no mercado inter-bancário e o crescimento nos ativos totais do setor bancário. Essas variáveis produzem uma taxa mais elevada de sinais corretos para as crises bancárias recentes (1984-2008) do que os sistemas de indicadores antecedentes comparáveis. Levar em conta um risco de base crescente ( devido à tendência de acumulação de distorções no sistema de preços relativos em expansões anteriores) também provê informação e eleva o número de sinais corretos em países que não passaram por uma expansão creditícia e nos preços de ativos tão vigorosa.

Neural network based on adaptive resonance theory with continuous training for multi-configuration transient stability analysis of electric power systems

This work presents a methodology to analyze electric power systems transient stability for first swing using a neural network based on adaptive resonance theory (ART) architecture, called Euclidean ARTMAP neural network. The ART architectures present plasticity and stability characteristics, which are very important for the training and to execute the analysis in a fast way. The Euclidean ARTMAP version provides more accurate and faster solutions, when compared to the fuzzy ARTMAP configuration. Three steps are necessary for the network working, training, analysis and continuous training. The training step requires much effort (processing) while the analysis is effectuated almost without computational effort. The proposed network allows approaching several topologies of the electric system at the same time; therefore it is an alternative for real time transient stability of electric power systems. To illustrate the proposed neural network an application is presented for a multi-machine electric power systems composed of 10 synchronous machines, 45 buses and 73 transmission lines. (C) 2010 Elsevier B.V. All rights reserved.

Variable structure controller and observer applied to induction machine

This work will propose the control of an induction machine in field coordinates with imposed stator current based on theory of variable structure control and sliding mode. We describe the model of an induction machine in field coordinates with imposed stator current and we show the design of variable structure control and sliding mode to get a desirable dynamic performance of that plant. To estimate the inaccessible states we will use a state observer (estimator) based on field coordinates induction machine. We will present the results of simulations in any operation condition (start, speed reversal and load) and with parameters variation of the machine compared to a PI control scheme.

Inverter-fed linear asynchronous machine

The behaviors of an arc-shaped stator induction machine (the sector-motor) and a disc-secondary linear induction motor are analyzed in this work for different values of the frequency. Variable frequency is produced by a voltage source controlled-current inverter which keeps constant the r.m.s. value of the phase current, also assuring a sinusoidal waveform. For the simulations of the machine developed thrust, an equivalent circuit is used. It is obtained through the application of the one-dimensional theory to the modeling. The circuit parameters take into account the end effects, always present is these kind of machines. The phase current waveforms are analyzed for their harmonic contents. Experimental measurements were carried out in laboratory and are presented with the simulations, for comparison.

Identification of synchronous machine parameters using load rejection test data

This work shows a computational methodology for the determination of synchronous machines parameters using load rejection test data. By machine modeling one can obtain the quadrature parameters through a load rejection under an arbitrary reference, reducing the present difficulties. The proposed method is applied to a real machine.

Machine vision and planning applied on assembby line of multiple products

This article describes the use of Artificial Intelligence (IA) techniques applied in cells of a manufacturing system. Machine Vision was used to identify pieces and their positions of two different products to be assembled in the same productive line. This information is given as input for an IA planner embedded in the manufacturing system. Therefore, initial and final states are sent automatically to the planner capable to generate assembly plans for a robotic cell, in real time.

Machine Translation: Translators' Friend or Foe?

This paper discusses the impact of machine translation on the language industry, specifically addressing its effect on translators. It summarizes the history of the development of machine translation, explains the underlying theory that ties machine translation to its practical applications, and describes the different types of machine translation as well as other tools familiar to translators. There are arguments for and against its use, as well as evaluation methods for testing it. Internet and real-time communication are featured for their role in the increase of machine translation use. The potential that this technology has in the future of professional translation is examined. This paper shows that machine translation will continue to be increasingly used whether translators like it or not.