Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Damage assessment in structures using vibration characteristics

Changes in load characteristics, deterioration with age, environmental influences and random actions may cause local or global damage in structures, especially in bridges, which are designed for long life spans. Continuous health monitoring of structures will enable the early identification of distress and allow appropriate retrofitting in order to avoid failure or collapse of the structures. In recent times, structural health monitoring (SHM) has attracted much attention in both research and development. Local and global methods of damage assessment using the monitored information are an integral part of SHM techniques. In the local case, the assessment of the state of a structure is done either by direct visual inspection or using experimental techniques such as acoustic emission, ultrasonic, magnetic particle inspection, radiography and eddy current. A characteristic of all these techniques is that their application requires a prior localization of the damaged zones. The limitations of the local methodologies can be overcome by using vibration-based methods, which give a global damage assessment. The vibration-based damage detection methods use measured changes in dynamic characteristics to evaluate changes in physical properties that may indicate structural damage or degradation. The basic idea is that modal parameters (notably frequencies, mode shapes, and modal damping) are functions of the physical properties of the structure (mass, damping, and stiffness). Changes in the physical properties will therefore cause changes in the modal properties. Any reduction in structural stiffness and increase in damping in the structure may indicate structural damage. This research uses the variations in vibration parameters to develop a multi-criteria method for damage assessment. It incorporates the changes in natural frequencies, modal flexibility and modal strain energy to locate damage in the main load bearing elements in bridge structures such as beams, slabs and trusses and simple bridges involving these elements. Dynamic computer simulation techniques are used to develop and apply the multi-criteria procedure under different damage scenarios. The effectiveness of the procedure is demonstrated through numerical examples. Results show that the proposed method incorporating modal flexibility and modal strain energy changes is competent in damage assessment in the structures treated herein.

Detecting and characterising malicious executable payloads

Buffer overflow vulnerabilities continue to prevail and the sophistication of attacks targeting these vulnerabilities is continuously increasing. As a successful attack of this type has the potential to completely compromise the integrity of the targeted host, early detection is vital. This thesis examines generic approaches for detecting executable payload attacks, without prior knowledge of the implementation of the attack, in such a way that new and previously unseen attacks are detectable. Executable payloads are analysed in detail for attacks targeting the Linux and Windows operating systems executing on an Intel IA-32 architecture. The execution flow of attack payloads are analysed and a generic model of execution is examined. A novel classification scheme for executable attack payloads is presented which allows for characterisation of executable payloads and facilitates vulnerability and threat assessments, and intrusion detection capability assessments for intrusion detection systems. An intrusion detection capability assessment may be utilised to determine whether or not a deployed system is able to detect a specific attack and to identify requirements for intrusion detection functionality for the development of new detection methods. Two novel detection methods are presented capable of detecting new and previously unseen executable attack payloads. The detection methods are capable of identifying and enumerating the executable payload’s interactions with the operating system on the targeted host at the time of compromise. The detection methods are further validated using real world data including executable payload attacks.

Detecting attacks in encrypted networks using secret-sharing schemes

Secret-sharing schemes describe methods to securely share a secret among a group of participants. A properly constructed secret-sharing scheme guarantees that the share belonging to one participant does not reveal anything about the shares of others or even the secret itself. Besides being used to distribute a secret, secret-sharing schemes have also been used in secure multi-party computations and redundant residue number systems for error correction codes. In this paper, we propose that the secret-sharing scheme be used as a primitive in a Network-based Intrusion Detection System (NIDS) to detect attacks in encrypted Networks. Encrypted networks such as Virtual Private Networks (VPNs) fully encrypt network traffic which can include both malicious and non-malicious traffic. Traditional NIDS cannot monitor such encrypted traffic. We therefore describe how our work uses a combination of Shamir's secret-sharing scheme and randomised network proxies to enable a traditional NIDS to function normally in a VPN environment.

Screening, isolation, and decolonisation strategies in the control of meticillin resistant Staphylococcus aureus in intensive care units : cost effectiveness evaluation

Objective: To assess the cost-effectiveness of screening, isolation and decolonisation strategies in the control of methicillin-resistant Staphylococcus aureus (MRSA) in intensive care units (ICUs). Design: Economic evaluation. Setting: England and Wales. Population: ICU patients. Main outcome measures: Infections, deaths, costs, quality adjusted life years (QALYs), incremental cost-effectiveness ratios for alternative strategies, net monetary benefits (NMBs). Results: All strategies using isolation but not decolonisation improved health outcomes but increased costs. When MRSA prevalence on admission to the ICU was 5% and the willingness to pay per QALY gained was between £20,000 and £30,000, the best such strategy was to isolate only those patients at high risk of carrying MRSA (either pre-emptively or following identification by admission and weekly MRSA screening using chromogenic agar). Universal admission and weekly screening using polymerase chain reaction (PCR)-based MRSA detection coupled with isolation was unlikely to be cost-effective unless prevalence was high (10% colonised with MRSA on admission to the ICU). All decolonisation strategies improved health outcomes and reduced costs. While universal decolonisation (regardless of MRSA status) was the most cost-effective in the short-term, strategies using screening to target MRSA carriers may be preferred due to reduced risk of selecting for resistance. Amongst such targeted strategies, universal admission and weekly PCR screening coupled with decolonisation with nasal mupirocin was the most cost-effective. This finding was robust to ICU size, MRSA admission prevalence, the proportion of patients classified as high-risk, and the precise value of willingness to pay for health benefits. Conclusions: MRSA control strategies that use decolonisation are likely to be cost-saving in an ICU setting provided resistance is lacking, and combining universal PCR-based screening with decolonisation is likely to represent good value for money if untargeted decolonisation is considered unacceptable. In ICUs where decolonisation is not implemented there is insufficient evidence to support universal MRSA screening outside high prevalence settings.

A robot application to marine vessel inspection

Seagoing vessels have to undergo regular inspections, which are currently performed manually by ship surveyors. The main cost factor in a ship inspection is to provide access to the different areas of the ship, since the surveyor has to be close to the inspected parts, usually within arm's reach, either to perform a visual analysis or to take thickness measurements. The access to the structural elements in cargo holds, e.g., bulkheads, is normally provided by staging or by 'cherry-picking' cranes. To make ship inspections safer and more cost-efficient, we have introduced new inspection methods, tools, and systems, which have been evaluated in field trials, particularly focusing on cargo holds. More precisely, two magnetic climbing robots and a micro-aerial vehicle, which are able to assist the surveyor during the inspection, are introduced. Since localization of inspection data is mandatory for the surveyor, we also introduce an external localization system that has been verified in field trials, using a climbing inspection robot. Furthermore, the inspection data collected by the robotic systems are organized and handled by a spatial content management system that enables us to compare the inspection data of one survey with those from another, as well as to document the ship inspection when the robot team is used. Image-based defect detection is addressed by proposing an integrated solution for detecting corrosion and cracks. The systems' performance is reported, as well as conclusions on their usability, all in accordance with the output of field trials performed onboard two different vessels under real inspection conditions.

Spectral Sensing for Cognitive Radio: Estimation of Adaptive Frequency Hopping Signal

The issue of dynamic spectrum scene analysis in any cognitive radio network becomes extremely complex when low probability of intercept, spread spectrum systems are present in environment. The detection and estimation become more complex if frequency hopping spread spectrum is adaptive in nature. In this paper, we propose two phase approach for detection and estimation of frequency hoping signals. Polyphase filter bank has been proposed as the architecture of choice for detection phase to efficiently detect the presence of frequency hopping signal. Based on the modeling of frequency hopping signal it can be shown that parametric methods of line spectral analysis are well suited for estimation of frequency hopping signals if the issues of order estimation and time localization are resolved. An algorithm using line spectra parameter estimation and wavelet based transient detection has been proposed which resolves above issues in computationally efficient manner suitable for implementation in cognitive radio. The simulations show promising results proving that adaptive frequency hopping signals can be detected and demodulated in a non cooperative context, even at a very low signal to noise ratio in real time.

Spectral Sensing of Adaptive Frequency Hopping Signal for Cognitive Radio

The issue of dynamic spectrum scene analysis in any cognitive radio network becomes extremely complex when low probability of intercept, spread spectrum systems are present in environment. The detection and estimation become more complex if frequency hopping spread spectrum is adaptive in nature. In this paper, we propose two phase approach for detection and estimation of frequency hoping signals. Polyphase filter bank has been proposed as the architecture of choice for detection phase to efficiently detect the presence of frequency hopping signal. Based on the modeling of frequency hopping signal it can be shown that parametric methods of line spectral analysis are well suited for estimation of frequency hopping signals if the issues of order estimation and time localization are resolved. An algorithm using line spectra parameter estimation and wavelet based transient detection has been proposed which resolves above issues in computationally efficient manner suitable for implementation in cognitive radio. The simulations show promising results proving that adaptive frequency hopping signals can be detected and demodulated in a non cooperative context, even at a very low signal to noise ratio in real time.

Channel estimation relying on the minimum bit-error-ratio criterion for BPSK and QPSK signals

The authors consider the channel estimation problem in the context of a linear equaliser designed for a frequency selective channel, which relies on the minimum bit-error-ratio (MBER) optimisation framework. Previous literature has shown that the MBER-based signal detection may outperform its minimum-mean-square-error (MMSE) counterpart in the bit-error-ratio performance sense. In this study, they develop a framework for channel estimation by first discretising the parameter space and then posing it as a detection problem. Explicitly, the MBER cost function (CF) is derived and its performance studied, when transmitting binary phase shift keying (BPSK) and quadrature phase shift keying (QPSK) signals. It is demonstrated that the MBER based CF aided scheme is capable of outperforming existing MMSE, least square-based solutions.

Computational framework to integrate the effect of antigen recognition on disease epidemiology outcome: multi-scale approach

Human Leukocyte Antigen (HLA) plays an important role, in presenting foreign pathogens to our immune system, there by eliciting early immune responses. HLA genes are highly polymorphic, giving rise to diverse antigen presentation capability. An important factor contributing to enormous variations in individual responses to diseases is differences in their HLA profiles. The heterogeneity in allele specific disease responses decides the overall disease epidemiological outcome. Here we propose an agent based computational framework, capable of incorporating allele specific information, to analyze disease epidemiology. This framework assumes a SIR model to estimate average disease transmission and recovery rate. Using epitope prediction tool, it performs sequence based epitope detection for a given the pathogenic genome and derives an allele specific disease susceptibility index depending on the epitope detection efficiency. The allele specific disease transmission rate, that follows, is then fed to the agent based epidemiology model, to analyze the disease outcome. The methodology presented here has a potential use in understanding how a disease spreads and effective measures to control the disease.

Herpetofaunal Inventories of the National Parks of South Florida and the Caribbean: Volume II. Virgin Islands National Park

Amphibian declines and extinctions have been documented around the world, often in protected natural areas. Concern for this alarming trend has focused attention on the need to document all species of amphibians that occur within U.S. National Parks and to search for any signs that amphibians may be declining. This study, an inventory of amphibian species in Virgin Islands National Park, was conducted from 2001 to 2003. The goals of the project were to create a georeferenced inventory of amphibian species, use new analytical techniques to estimate proportion of sites occupied by each species, look for any signs of amphibian decline (missing species, disease, die-offs, etc.), and to establish a protocol that could be used for future monitoring efforts. Several sampling methods were used to accomplish these goals. Visual encounter surveys and anuran vocalization surveys were conducted in all habitats throughout the park to estimate the proportion of sites or proportion of area occupied (PAO) by amphibian species in each habitat. Line transect methods were used to estimate density of some amphibian species and double observer analysis was used to refine counts based on detection probabilities. Opportunistic collections were used to augment the visual encounter methods for rare species. Data were collected during four sampling periods and every major trail system throughout the park was surveyed. All of the amphibian species believed to occur on St. John were detected during these surveys. One species not previously reported, the Cuban treefrog (Osteopilus septentrionalis), was also added to the species list. That species and two others (Eleutherodactylus coqui and Eleutherodactylus lentus) bring the total number of introduced amphibians on St. John to three. We detected most of the reptile species thought to occur on St. John, but our methods were less suitable for reptiles compared to amphibians. No amphibian species appear to be in decline at this time. We found no evidence of disease or of malformations. Our surveys provide a snapshot picture of the status of the amphibian species, so continued monitoring would be necessary to determine long-term trends, but several potential threats to amphibians were identified. Invasive species, especially the Cuban treefrog, have the potential to decrease populations of native amphibians. Introduced mammalian predators are also a potential threat, especially to the reptiles of St. John, and mammalian grazers might have indirect effects on amphibians and reptiles through habitat modification. Finally, loss of habitat to development outside the park boundary could harm some important populations of amphibians and reptiles on the island.

Vibration response of a wind-turbine planetary gear set in the presence of a localized planet bearing defect

In a wind-turbine gearbox, planet bearings exhibit a high failure rate and are considered as one of the most critical components. Development of efficient vibration based fault detection methods for these bearings requires a thorough understanding of their vibration signature. Much work has been done to study the vibration properties of healthy planetary gear sets and to identify fault frequencies in fixed-axis bearings. However, vibration characteristics of planetary gear sets containing localized planet bearing defects (spalls or pits) have not been studied so far. In this paper, we propose a novel analytical model of a planetary gear set with ring gear flexibility and localized bearing defects as two key features. The model is used to simulate the vibration response of a planetary system in the presence of a defective planet bearing with faults on inner or outer raceway. The characteristic fault signature of a planetary bearing defect is determined and sources of modulation sidebands are identified. The findings from this work will be useful to improve existing sensor placement strategies and to develop more sophisticated fault detection algorithms. Copyright © 2011 by ASME.

An efficient approach of modelling the flexural cracking behaviour of un-notched plain concrete prisms subject to monotonic and cyclic loading

In the field of vibration-based damage detection of concrete structures efficient damage models are needed to better understand changes in the vibration properties of cracked structures. These models should quantitatively replicate the damage mechanisms in concrete and easily be used as damage detection tools. In this paper, the flexural cracking behaviour of plain concrete prisms subject to monotonic and cyclic loading regimes under displacement control is tested experimentally and modelled numerically. Four-point bending tests on simply supported un-notched prisms are conducted, where the cracking process is monitored using a digital image correlation system. A numerical model, with a single crack at midspan, is presented where the cracked zone is modelled using the fictitious crack approach and parts outside that zone are treated in a linear-elastic manner. The model considers crack initiation, growth and closure by adopting cyclic constitutive laws. A multi-variate Newton-Raphson iterative solver is used to solve the non-linear equations to ensure equilibrium and compatibility at the interface of the cracked zone. The numerical results agree well with the experiments for both loading scenarios. The model shows good predictions of the degradation of stiffness with increasing load. It also approximates the crack-mouth-opening-displacement when compared with the experimental data of the digital image correlation system. The model is found to be computationally efficient as it runs full analysis for cyclic loading in less than 2. min, and it can therefore be used within the damage detection process. © 2013 Elsevier Ltd.

Integrated ZnO surface acoustic wave microfluidic components for biosensor

This paper describes the novel nanocrystalline film ZnO surface acoustic wave devices, which demonstrate their great potential for the portable disease diagnostic system with integrated functions of microfluidic transport, mixing and biosensing. The devices can be easily integrated with electronic control circuitry and fabricated with low temperature process on Si, glass or even polymer substrates. The liquid convection and internal streaming patterns was easily induced by acoustic wave at signal voltages. With further increase in applied voltage to above 20V, the liquid droplet was pushed forward. Immunoreaction-based bio-detection PSA/ACT, all based on SAW devices on thin film piezoelectric ZnO on Si substrate was demonstrated. © 2009 CBMS.

Progress in electrochemiluminescent analysis

The recent progress in electrochemiluminescent (ECL) assay is reviewed. This review begins with the fundamental researches in ECL, including the discovery of new ECL-active species, such as biochemical, organic and metallorganic materials, digital modeling of ECL process, the flow cells used in ECL assay, and electrochemiluminescent sensor. The application of ECL in environmental analysis, immunoassay, nucleotide acid hybridization sensor. The applications of ECL in environmental analysis, immunooassay, nucleic acid hybridization assay, and other aspects are reviewed with the latest references in detail. Finally, the main problems in the further investigation are outlooked, so are its prospects.