Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Statistical Analysis of Eco-Toxicologic Data of Mammals from a Polluted Area

Several eco-toxicological studies have shown that insectivorous mammals, due to their feeding habits, easily accumulate high amounts of pollutants in relation to other mammal species. To assess the bio-accumulation levels of toxic metals and their in°uence on essential metals, we quantified the concentration of 19 elements (Ca, K, Fe, B, P, S, Na, Al, Zn, Ba, Rb, Sr, Cu, Mn, Hg, Cd, Mo, Cr and Pb) in bones of 105 greater white-toothed shrews (Crocidura russula) from a polluted (Ebro Delta) and a control (Medas Islands) area. Since chemical contents of a bio-indicator are mainly compositional data, conventional statistical analyses currently used in eco-toxicology can give misleading results. Therefore, to improve the interpretation of the data obtained, we used statistical techniques for compositional data analysis to define groups of metals and to evaluate the relationships between them, from an inter-population viewpoint. Hypothesis testing on the adequate balance-coordinates allow us to confirm intuition based hypothesis and some previous results. The main statistical goal was to test equal means of balance-coordinates for the two defined populations. After checking normality, one-way ANOVA or Mann-Whitney tests were carried out for the inter-group balances

Robust Factor Analysis for Compositional Data

Factor analysis as frequent technique for multivariate data inspection is widely used also for compositional data analysis. The usual way is to use a centered logratio (clr) transformation to obtain the random vector y of dimension D. The factor model is then y = Λf + e (1) with the factors f of dimension k < D, the error term e, and the loadings matrix Λ. Using the usual model assumptions (see, e.g., Basilevsky, 1994), the factor analysis model (1) can be written as Cov(y) = ΛΛT + ψ (2) where ψ = Cov(e) has a diagonal form. The diagonal elements of ψ as well as the loadings matrix Λ are estimated from an estimation of Cov(y). Given observed clr transformed data Y as realizations of the random vector y. Outliers or deviations from the idealized model assumptions of factor analysis can severely effect the parameter estimation. As a way out, robust estimation of the covariance matrix of Y will lead to robust estimates of Λ and ψ in (2), see Pison et al. (2003). Well known robust covariance estimators with good statistical properties, like the MCD or the S-estimators (see, e.g. Maronna et al., 2006), rely on a full-rank data matrix Y which is not the case for clr transformed data (see, e.g., Aitchison, 1986). The isometric logratio (ilr) transformation (Egozcue et al., 2003) solves this singularity problem. The data matrix Y is transformed to a matrix Z by using an orthonormal basis of lower dimension. Using the ilr transformed data, a robust covariance matrix C(Z) can be estimated. The result can be back-transformed to the clr space by C(Y ) = V C(Z)V T where the matrix V with orthonormal columns comes from the relation between the clr and the ilr transformation. Now the parameters in the model (2) can be estimated (Basilevsky, 1994) and the results have a direct interpretation since the links to the original variables are still preserved. The above procedure will be applied to data from geochemistry. Our special interest is on comparing the results with those of Reimann et al. (2002) for the Kola project data

Data collection and analysis

A presentation on the collection and analysis of data taken from SOES 6018. This module aims to ensure that MSc Oceanography, MSc Marine Science, Policy & Law and MSc Marine Resource Management students are equipped with the skills they need to function as professional marine scientists, in addition to / in conjuction with the skills training in other MSc modules. The module covers training in fieldwork techniques, communication & research skills, IT & data analysis and professional development.

Análisis del impacto del tamaño de los activos en la cuenta de resultados mediante la utilización de espacios de fase y análisis de recurrencia

Los resultados financieros de las organizaciones son objeto de estudio y análisis permanente, predecir sus comportamientos es una tarea permanente de empresarios, inversionistas, analistas y académicos. En el presente trabajo se explora el impacto del tamaño de los activos (valor total de los activos) en la cuenta de resultados operativos y netos, analizando inicialmente la relación entre dichas variables con indicadores tradicionales del análisis financiero como es el caso de la rentabilidad operativa y neta y con elementos de estadística descriptiva que permiten calificar los datos utilizados como lineales o no lineales. Descubriendo posteriormente que los resultados financieros de las empresas vigiladas por la Superintendencia de Sociedades para el año 2012, tienen un comportamiento no lineal, de esta manera se procede a analizar la relación de los activos y los resultados con la utilización de espacios de fase y análisis de recurrencia, herramientas útiles para sistemas caóticos y complejos. Para el desarrollo de la investigación y la revisión de la relación entre las variables de activos y resultados financieros se tomó como fuente de información los reportes financieros del cierre del año 2012 de la Superintendencia de Sociedades (Superintendencia de Sociedades, 2012).

Metacognitive knowledge and self-regulation: A qualitative lecture of students functioning in writing

This research emerges from the world-wide problematic concerning student's failure. It particularly analyzes the meta-cognitive competences in the writing process of this population. Based on Flavell's (1992) viewpoint about meta-cognition and the socio-cognitive approach of self-regulation, two variables were measured: meta-cognitive knowledge and self-regulation strategies. A qualitative study was conducted on a sample of 12 French students at first year university. This study uses a specific technique of interview known as "explicitation interview". The data analysis included the categorization, codification and quantification of the information obtained with the interviews. In conclusion, even though the students had metacognitive knowledge related to the written tasks, they did not show strategies that could help to go beyond the descriptive modality of written discourses by taking into account the readers' expectations. Their writing processes focused on transcription of ideas with little control on the planning and revision phases.

Análisis predictivo de los eventos adversos relacionados con los indicadores de eficiencia hospitalaria de una IPS de Bogotá

En este estudio se realizó un análisis predictivo de la aparición de eventos adversos de los pacientes de una IPS de Bogotá, Mederi Hospital Universitario de Barrios Unidos (HUBU) durante el año 2013; relacionados con los indicadores de eficiencia hospitalaria (Porcentaje de ocupación hospitalaria, número de egresos hospitalarios, promedio de estancia hospitalaria, número de egresos de urgencias, promedio de estancia en urgencias). Los datos fueron exportados a una matriz de análisis de las variables cualitativas; fueron presentadas con frecuencias absolutas y relativas, las variables cuantitativas (edad, tiempos de estancia) fueron presentadas con media, desviaciones estándar. Se agruparon los datos de eventos adversos y de eficiencia hospitalaria en una nueva matriz que permitiera el análisis predictivo la nueva matriz fue exportada al software de modelación estadístico Eviews 6.5; se especificaron modelos predictivos multivariados para la variable número de eventos adversos, respecto de los indicadores de eficiencia hospitalaria y se estimaron las probabilidades de ocurrencia, análisis de correlación y multicolinealidad; los resultados se presentaron en tablas de estimación para cada modelo, se restringieron los eventos adversos prevenibles y no prevenibles información obtenida a través de un sistema de información que registra los factores relacionados con la ocurrencia de eventos adversos en salud, a través del sistema de reporte de eventos en salud, reporte en las historias clínicas, reporte individual, reporte por servicio, análisis de datos y estudios de caso, de la misma forma fueron extraídos los datos de eficiencia hospitalaria para el mismo periodo. El análisis y gestión de eventos adversos pretende establecer estrategias de mejoramiento continuo y análisis de resultados frente a los indicadores de eficiencia que permitan intervención de los factores de riesgo operativo de los servicios del Hospital Universitario de Barrios Unidos (HUBU), relacionados con eventos adversos en la atención de los pacientes en especial se debe enfocar en la gestión de los egresos de pacientes de acuerdo a los resultados obtenidos con el fin de alinearse y fortalecer las políticas de seguridad del paciente para brindar una atención integral con calidad y eficiencia, disminuyendo las quejas en la atención, las glosas, los riesgos jurídicos, de acuerdo al modelo predictivo estudiado.

Educação ambiental na escola : percepções / concepções dos atores pertencentes a esse cenário

Nesse trabalho investigamos de que maneira a escola vem desenvolvendo as questões referentes à educação ambiental enquanto tema transversal e interdisciplinar. Levantamos informações sobre como a Educação Ambiental vem sendo desenvolvida na prática pedagógica de uma escola da rede pública estadual da cidade de Mossoró/RN - Brasil. Onde foi identificada a percepção dos atores envolvidos no processo de educação ambiental, a saber: o nível de consciência ecológica, manifestada pelos alunos, suas práticas em relação aos problemas ambientais vivenciados; a abordagem do docente, frente à temática; bem como a percepção dos representantes do poder, como o professor, a diretoria da escola, a secretária de educação do estado e gerente de meio ambiente do município de Mossoró – RN. Contando com um apanhado bibliográfico com autores como Saviani (2008), Dias (2004), Gadotti (2008), Paulo Freire (1991), Sato (2012), Loureiro (2004), Leff (2010), entre outros. Para essa investigação utilizamos uma abordagem qualitativa e quantitativa, sendo desenvolvido 4 entrevistas com os representantes do poder e um questionário que foi aplicado com os alunos da escola, depois de respondidos esses dados foram tabulados em planilhas do Excel a fim de serem lançados para análises estatísticas, logo em seguida foram tratados através da construção de um banco de dados na planilha eletrônica Microsoft Excel. Após a digitação da base de dados, o banco foi exportado para o software SPSS versão 13.0 no qual foi realizada a análise. Para análise dos dados foram calculadas as frequências observadas e percentuais das percepções dos alunos acerca do julgamento, procedimentos utilizados pela escola, itens associados, problemas e temas relacionados ao meio ambiente. Além das frequências calculadas foram construídos os gráficos para cada distribuição. Já a análise qualitativa de conteúdo possui como estratégia de análise a interpretação qualitativa de emparelhamento de dados. Percebemos que nossos sujeitos acreditam que a educação ambiental vem como instrumento para modificação de comportamentos humanos, é através da educação que modificamos atitudes e conscientizamos a nossa população aos cuidados para com o nosso planeta. Nesta investigação identificamos que 83,1% dos alunos disseram estar bastante consciente da problemática ambiental, e ainda, 71,8% dos discentes disseram que estão bastante motivados para desenvolver projetos de educação ambiental na sua escola. Todavia não foi constatado isso pelos representantes do poder os quais afirma que esses não possuem o nível de consciência ecológica identificada pelos alunos, podendo perceber uma visão crítica por parte dos representantes do poder a respeito da temática, diferente dos discentes que dizem ter consciência, contudo suas práticas não condizem com a realidade. Acreditamos que se a Educação Ambiental fosse introduzida como componente curricular obrigatória essa poderia ser trabalhada de maneira mais direta e contundente a fim de formamos cidadãos verdadeiramente consciente da questão ambiental, uma vez que essa deve ir além dos muros da escola, a questão ambiental é uma questão também social, necessitamos de intervenções a nível global afim de todos contribuírem de maneira significativa para sustentabilidade.

Educação ambiental na perspectiva da sustentabilidade no ambiente do projovem urbano

A preocupação central dessa pesquisa foi compreender se dá o ensino da Educação Ambiental na perspectiva da sustentabilidade, no cotidiano da sala de aula no Projovem Urbano na região metropolitana do Recife, Pernambuco, Brasil. A pesquisa foi desenvolvida com 110 alunos de ambos os sexos, de escolas públicas da RMR e matriculados no curso do Projovem e 10 professores que lecionam nesse projeto. Para isso aplicamos o questionário adaptado com os alunos e com os professores utilizamos uma entrevista semi-estruturada. Na realização da Análise dos dados quantitativos utilizamos o Software Package for Social Sciences – SPSS versão 18.0 e na elaboração dos gráficos o Software Microsoft Excel 2007; enquanto a análise dos dados qualitativos foi orientada pela Análise do Discurso – AD. Os resultados demonstram que apesar de A Educação Ambiental e a Sustentabilidade serem um tema recente, já está fazendo parte das salas de aulas objetivando a formação de cidadãos conscientes das suas atitudes para com o meio ambiente. Podemos verificar que ainda faz necessário o investimento cada vez mais na educação para que possamos formar cada vez mais cidadãos a fim de mantermos uma relação harmoniosa entre o homem e a natureza, possibilitando com isso um ambiente sustentável para a presente e futuras gerações. Com base na pesquisa, podemos verificar que ainda é pouco o investimento em palestras, reuniões e eventos voltados para os professores, para que os mesmo possuam mais conhecimento para aplicar de melhor forma de acordo com a necessidade da comunidade em que a escola está inserida com o intuito de promover sempre a EA e a sustentabilidade, além de proporcionar um melhor ambiente para a comunidade, com a minimização dos problemas enfrentados pelos mesmos, como é a questão do lixo, que não é apenas uma questão ambiental, mas também de saúde, já que o mesmo pode transmitir várias doenças através dos insetos, roedores e outros.

Jpowder: a Java-based program for the display and examination of powder diffraction data

The ability to display and inspect powder diffraction data quickly and efficiently is a central part of the data analysis process. Whilst many computer programs are capable of displaying powder data, their focus is typically on advanced operations such as structure solution or Rietveld refinement. This article describes a lightweight software package, Jpowder, whose focus is fast and convenient visualization and comparison of powder data sets in a variety of formats from computers with network access. Jpowder is written in Java and uses its associated Web Start technology to allow ‘single-click deployment’ from a web page, http://www.jpowder.org. Jpowder is open source, free and available for use by anyone.

Fully automated software solution for protein quantitation by global metabolic labeling with stable isotopes

Metabolic stable isotope labeling is increasingly employed for accurate protein (and metabolite) quantitation using mass spectrometry (MS). It provides sample-specific isotopologues that can be used to facilitate comparative analysis of two or more samples. Stable Isotope Labeling by Amino acids in Cell culture (SILAC) has been used for almost a decade in proteomic research and analytical software solutions have been established that provide an easy and integrated workflow for elucidating sample abundance ratios for most MS data formats. While SILAC is a discrete labeling method using specific amino acids, global metabolic stable isotope labeling using isotopes such as (15)N labels the entire element content of the sample, i.e. for (15)N the entire peptide backbone in addition to all nitrogen-containing side chains. Although global metabolic labeling can deliver advantages with regard to isotope incorporation and costs, the requirements for data analysis are more demanding because, for instance for polypeptides, the mass difference introduced by the label depends on the amino acid composition. Consequently, there has been less progress on the automation of the data processing and mining steps for this type of protein quantitation. Here, we present a new integrated software solution for the quantitative analysis of protein expression in differential samples and show the benefits of high-resolution MS data in quantitative proteomic analyses.

Farmers’ attitudes to disease risk management in England: a comparative analysis of sheep and pig farmers

The UK Department for Environment, Food and Rural Affairs (Defra) identified practices to reduce the risk of animal disease outbreaks. We report on the response of sheep and pig farmers in England to promotion of these practices. A conceptual framework was established from research on factors influencing adoption of animal health practices, linking knowledge, attitudes, social influences and perceived constraints to the implementation of specific practices. Qualitative data were collected from nine sheep and six pig enterprises in 2011. Thematic analysis explored attitudes and responses to the proposed practices, and factors influencing the likelihood of implementation. Most feel they are doing all they can reasonably do to minimise disease risk and that practices not being implemented are either not relevant or ineffective. There is little awareness and concern about risk from unseen threats. Pig farmers place more emphasis than sheep farmers on controlling wildlife, staff and visitor management and staff training. The main factors that influence livestock farmers’ decision on whether or not to implement a specific disease risk measure are: attitudes to, and perceptions of, disease risk; attitudes towards the specific measure and its efficacy; characteristics of the enterprise which they perceive as making a measure impractical; previous experience of a disease or of the measure; and the credibility of information and advice. Great importance is placed on access to authoritative information with most seeing vets as the prime source to interpret generic advice from national bodies in the local context. Uptake of disease risk measures could be increased by: improved risk communication through the farming press and vets to encourage farmers to recognise hidden threats; dissemination of credible early warning information to sharpen farmers’ assessment of risk; and targeted information through training events, farming press, vets and other advisers, and farmer groups, tailored to the different categories of livestock farmer.

Scaling up data mining techniques to large datasets using parallel and distributed processing

Advances in hardware and software technology enable us to collect, store and distribute large quantities of data on a very large scale. Automatically discovering and extracting hidden knowledge in the form of patterns from these large data volumes is known as data mining. Data mining technology is not only a part of business intelligence, but is also used in many other application areas such as research, marketing and financial analytics. For example medical scientists can use patterns extracted from historic patient data in order to determine if a new patient is likely to respond positively to a particular treatment or not; marketing analysts can use extracted patterns from customer data for future advertisement campaigns; finance experts have an interest in patterns that forecast the development of certain stock market shares for investment recommendations. However, extracting knowledge in the form of patterns from massive data volumes imposes a number of computational challenges in terms of processing time, memory, bandwidth and power consumption. These challenges have led to the development of parallel and distributed data analysis approaches and the utilisation of Grid and Cloud computing. This chapter gives an overview of parallel and distributed computing approaches and how they can be used to scale up data mining to large datasets.

Developing construction professional services in the international market: SWOT analysis of China

Construction professional services (CPSs), such as architecture, engineering, and consultancy, are not only high value-added profit centers in their own right but also have a knock-on effect on other businesses, such as construction and the export of materials and machinery. Arguably, competition in the international construction market has shifted to these knowledge-intensive CPS areas. Yet CPSs represent a research frontier that has received scant attention. This research aims to enrich the body of knowledge on CPSs by examining strengths, weaknesses, opportunities, and threats (SWOT) of Chinese CPSs (CCPSs) in the international context. It does so by triangulating theories with quantitative and qualitative data gleaned from yearbooks, annual reports, interviews, seminars, and interactions with managers in major CCPS companies. It is found that CCPSs present both strengths and weaknesses in talents, administration systems, and development strategies in dealing with the external opportunities and threats brought about by globalization and market evolution. Low price, which has helped the Chinese construction business to succeed in the international market, is also a major CCPS strength. An opportunity for CCPSs is the relatively strong delivery capability possessed by Chinese contractors; by partnering with them CCPSs can better establish themselves in the international arena. This is probably the first ever comprehensive study on the performance of CCPSs in the international marketplace. The research is conducted at an opportune time, particularly when the world is witnessing the burgeoning force of Chinese businesses in many areas including manufacturing, construction, and, potentially, professional services. It adds new insights to the knowledge body of CPSs and provides valuable references to other countries faced with the challenge of developing CPS business efficiently in the international market.

Developing construction professional services in the international market: a SWOT analysis of China

In contrast to their bustling construction counterparts, Chinese construction professional services (CPS) such as architecture, engineering, and consultancy, seem still to be stagnant in the international market. CPS are not only high value-added profit centers in their own right, but also have a knock-on effect on subsequent businesses such as construction, and the export of materials and machinery. Arguably, competition in the international construction market has shifted to knowledge-intensive CPS. Yet,CPS represent a research area that has been paid scant attention. This research aims to add to the body of knowledge of CPS by examining strengths, weaknesses, opportunities, and threats (SWOT) of Chinese CPS (CCPS) in the international context. It does so by triangulating theories with quantitative and qualitative data gleaned from yearbooks, annual reports, interviews, seminars, and interactions with managers in major CCPS companies. It is found that CCPS present both strengths and weaknesses in talents, administration systems, and development strategies in dealing with the external opportunities and threats brought about by globalization and market evolvement. Low price, which has helped the Chinese construction business to succeed in the international market, is also a CCPS major strength. An opportunity for CCPS is the relatively strong delivery capability possessed by Chinese contractors. By partnering with them CCPS can better edge into the international arena. This is probably the first ever comprehensive study in investigating the performance of CCPS in the international market. The research is also timely, particularly when the world is witnessing the burgeoning force of Chinese businesses in many areas including manufacturing, construction, and potentially, professional services.