Teams rather than individuals : collaborative intrusion detection

We propose CIMD (Collaborative Intrusion and Malware Detection), a scheme for the realization of collaborative intrusion detection approaches. We argue that teams, respectively detection groups with a common purpose for intrusion detection and response, improve the measures against malware. CIMD provides a collaboration model, a decentralized group formation and an anonymous communication scheme. Participating agents can convey intrusion detection related objectives and associated interests for collaboration partners. These interests are based on intrusion objectives and associated interests for collaboration partners. These interests are based on intrusion detection related ontology, incorporating network and hardware configurations and detection capabilities. Anonymous Communication provided by CIMD allows communication beyond suspicion, i.e. the adversary can not perform better than guessing an IDS to be the source of a message at random. The evaluation takes place with the help of NeSSi² (www.nessi2.de), the Network Security Simulator, a dedicated environment for analysis of attacks and countermeasures in mid-scale and large-scale networks. A CIMD prototype is being built based on the JIAC agent framework(www.jiac.de).

A formal method for attack modelling and detection

This paper presents a formal methodology for attack modeling and detection for networks. Our approach has three phases. First, we extend the basic attack tree approach 1 to capture (i) the temporal dependencies between components, and (ii) the expiration of an attack. Second, using the enhanced attack trees (EAT) we build a tree automaton that accepts a sequence of actions from input stream if there is a traverse of an attack tree from leaves to the root node. Finally, we show how to construct an enhanced parallel automaton (EPA) that has each tree automaton as a subroutine and can process the input stream by considering multiple trees simultaneously. As a case study, we show how to represent the attacks in IEEE 802.11 and construct an EPA for it.

Monitoring android for collaborative anomaly detection : a first architectural draft

Our daily lives become more and more dependent upon smartphones due to their increased capabilities. Smartphones are used in various ways, e.g. for payment systems or assisting the lives of elderly or disabled people. Security threats for these devices become more and more dangerous since there is still a lack of proper security tools for protection. Android emerges as an open smartphone platform which allows modification even on operating system level and where third-party developers first time have the opportunity to develop kernel-based low-level security tools. Android quickly gained its popularity among smartphone developers and even beyond since it bases on Java on top of "open" Linux in comparison to former proprietary platforms which have very restrictive SDKs and corresponding APIs. Symbian OS, holding the greatest market share among all smartphone OSs, was even closing critical APIs to common developers and introduced application certification. This was done since this OS was the main target for smartphone malwares in the past. In fact, more than 290 malwares designed for Symbian OS appeared from July 2004 to July 2008. Android, in turn, promises to be completely open source. Together with the Linux-based smartphone OS OpenMoko, open smartphone platforms may attract malware writers for creating malicious applications endangering the critical smartphone applications and owners privacy. Since signature-based approaches mainly detect known malwares, anomaly-based approaches can be a valuable addition to these systems. They base on mathematical algorithms processing data that describe the state of a certain device. For gaining this data, a monitoring client is needed that has to extract usable information (features) from the monitored system. Our approach follows a dual system for analyzing these features. On the one hand, functionality for on-device light-weight detection is provided. But since most algorithms are resource exhaustive, remote feature analysis is provided on the other hand. Having this dual system enables event-based detection that can react to the current detection need. In our ongoing research we aim to investigates the feasibility of light-weight on-device detection for certain occasions. On other occasions, whenever significant changes are detected on the device, the system can trigger remote detection with heavy-weight algorithms for better detection results. In the absence of the server respectively as a supplementary approach, we also consider a collaborative scenario. Here, mobile devices sharing a common objective are enabled by a collaboration module to share information, such as intrusion detection data and results. This is based on an ad-hoc network mode that can be provided by a WiFi or Bluetooth adapter nearly every smartphone possesses.

Solving inherent problems of anomaly detection by cooperation

Anomaly detection compensates shortcomings of signature-based detection such as protecting against Zero-Day exploits. However, Anomaly Detection can be resource-intensive and is plagued by a high false-positive rate. In this work, we address these problems by presenting a Cooperative Intrusion Detection approach for the AIS, the Artificial Immune System, as an example for an anomaly detection approach. In particular we show, how the cooperative approach reduces the false-positive rate of the detection and how the overall detection process can be organized to account for the resource constraints of the participating devices. Evaluations are carried out with the novel network simulation environment NeSSi as well as formally with an extension to the epidemic spread model SIR

Power of QTL detection using association tests with family controls

The power of testing for a population-wide association between a biallelic quantitative trait locus and a linked biallelic marker locus is predicted both empirically and deterministically for several tests. The tests were based on the analysis of variance (ANOVA) and on a number of transmission disequilibrium tests (TDT). Deterministic power predictions made use of family information, and were functions of population parameters including linkage disequilibrium, allele frequencies, and recombination rate. Deterministic power predictions were very close to the empirical power from simulations in all scenarios considered in this study. The different TDTs had very similar power, intermediate between one-way and nested ANOVAs. One-way ANOVA was the only test that was not robust against spurious disequilibrium. Our general framework for predicting power deterministically can be used to predict power in other association tests. Deterministic power calculations are a powerful tool for researchers to plan and evaluate experiments and obviate the need for elaborate simulation studies.

Evaluation of strain energy based damage indices for flexural crack detection of RC beams

Vibration Based Damage Identification Techniques which use modal data or their functions, have received significant research interest in recent years due to their ability to detect damage in structures and hence contribute towards the safety of the structures. In this context, Strain Energy Based Damage Indices (SEDIs), based on modal strain energy, have been successful in localising damage in structuers made of homogeneous materials such as steel. However, their application to reinforced concrete (RC) structures needs further investigation due to the significant difference in the prominent damage type, the flexural crack. The work reported in this paper is an integral part of a comprehensive research program to develop and apply effective strain energy based damage indices to assess damage in reinforced concrete flexural members. This research program established (i) a suitable flexural crack simulation technique, (ii) four improved SEDI's and (iii) programmable sequentional steps to minimise effects of noise. This paper evaluates and ranks the four newly developed SEDIs and existing seven SEDIs for their ability to detect and localise flexural cracks in RC beams. Based on the results of the evaluations, it recommends the SEDIs for use with single and multiple vibration modes.

Pt/Nanostructured RuO2/SiC Schottky Diode based hydrogen gas sensors

In this paper, we report the development of novel Pt/nanostructured RuO2/SiC Schottky diode based sensors for hydrogen gas applications. The nanostructured ruthenium oxide thin films were deposited on SiC substrates using radio frequency sputtering technique. Scanning electron microscopy revealed the sputtered RuO2 layer consists of nano-cubular structures with dimensions ranging between 10 and 50 nm. X-ray diffraction confirmed the presence of tetragonal ruthenium (IV) oxide, with preferred orientation along the (101) lattice plane. The current-voltage characteristics of the sensors were investigated towards hydrogen gas in synthetic air at different temperatures from 25 °C to 240 °C. The dynamic responses of the sensors were studied at an optimum temperature of 240 °C and a voltage shift of 304 mV was recorded toward 1% hydrogen gas.

Experimental and computer simulation validation of ultrasound phase interference created by lateral inhomogeneity of transit time in replica bone marrow composite models

Purpose: The measurement of broadband ultrasonic attenuation (BUA) in cancellous bone for the assessment of osteoporosis follows a parabolic-type dependence with bone volume fraction; having minima values corresponding to both entire bone and entire marrow. Langton has recently proposed that the primary BUA mechanism may be significant phase interference due to variations in propagation transit time through the test sample as detected over the phase-sensitive surface of the receive ultrasound transducer. This fundamentally simple concept assumes that the propagation of ultrasound through a complex solid : liquid composite sample such as cancellous bone may be considered by an array of parallel ‘sonic rays’. The transit time of each ray is defined by the proportion of bone and marrow propagated, being a minimum (tmin) solely through bone and a maximum (tmax) solely through marrow. A Transit Time Spectrum (TTS), ranging from tmin to tmax, may be defined describing the proportion of sonic rays having a particular transit time, effectively describing lateral inhomogeneity of transit time over the surface of the receive ultrasound transducer. Phase interference may result from interaction of ‘sonic rays’ of differing transit times. The aim of this study was to test the hypothesis that there is a dependence of phase interference upon the lateral inhomogenity of transit time by comparing experimental measurements and computer simulation predictions of ultrasound propagation through a range of relatively simplistic solid:liquid models exhibiting a range of lateral inhomogeneities. Methods: A range of test models was manufactured using acrylic and water as surrogates for bone and marrow respectively. The models varied in thickness in one dimension normal to the direction of propagation, hence exhibiting a range of transit time lateral inhomogeneities, ranging from minimal (single transit time) to maximal (wedge; ultimately the limiting case where each sonic ray has a unique transit time). For the experimental component of the study, two unfocused 1 MHz ¾” broadband diameter transducers were utilized in transmission mode; ultrasound signals were recorded for each of the models. The computer simulation was performed with Matlab, where the transit time and relative amplitude of each sonic ray was calculated. The transit time for each sonic ray was defined as the sum of transit times through acrylic and water components. The relative amplitude considered the reception area for each sonic ray along with absorption in the acrylic. To replicate phase-sensitive detection, all sonic rays were summed and the output signal plotted in comparison with the experimentally derived output signal. Results: From qualtitative and quantitative comparison of the experimental and computer simulation results, there is an extremely high degree of agreement of 94.2% to 99.0% between the two approaches, supporting the concept that propagation of an ultrasound wave, for the models considered, may be approximated by a parallel sonic ray model where the transit time of each ray is defined by the proportion of ‘bone’ and ‘marrow’. Conclusions: This combined experimental and computer simulation study has successfully demonstrated that lateral inhomogeneity of transit time has significant potential for phase interference to occur if a phase-sensitive ultrasound receive transducer is implemented as in most commercial ultrasound bone analysis devices.

Breast cancer detection from thermal images using bispectral invariant features

Highly sensitive infrared (IR) cameras provide high-resolution diagnostic images of the temperature and vascular changes of breasts. These images can be processed to emphasize hot spots that exhibit early and subtle changes owing to pathology. The resulting images show clusters that appear random in shape and spatial distribution but carry class dependent information in shape and texture. Automated pattern recognition techniques are challenged because of changes in location, size and orientation of these clusters. Higher order spectral invariant features provide robustness to such transformations and are suited for texture and shape dependent information extraction from noisy images. In this work, the effectiveness of bispectral invariant features in diagnostic classification of breast thermal images into malignant, benign and normal classes is evaluated and a phase-only variant of these features is proposed. High resolution IR images of breasts, captured with measuring accuracy of ±0.4% (full scale) and temperature resolution of 0.1 °C black body, depicting malignant, benign and normal pathologies are used in this study. Breast images are registered using their lower boundaries, automatically extracted using landmark points whose locations are learned during training. Boundaries are extracted using Canny edge detection and elimination of inner edges. Breast images are then segmented using fuzzy c-means clustering and the hottest regions are selected for feature extraction. Bispectral invariant features are extracted from Radon projections of these images. An Adaboost classifier is used to select and fuse the best features during training and then classify unseen test images into malignant, benign and normal classes. A data set comprising 9 malignant, 12 benign and 11 normal cases is used for evaluation of performance. Malignant cases are detected with 95% accuracy. A variant of the features using the normalized bispectrum, which discards all magnitude information, is shown to perform better for classification between benign and normal cases, with 83% accuracy compared to 66% for the original.

Pt/Nanograined ZnO/SiC Schottky diode based hydrogen and propene sensor

A nanostructured Schottky diode was fabricated to sense hydrogen and propene gases in the concentration range of 0.06% to 1%. The ZnO sensitive layer was deposited on SiC substrate by pulse laser deposition technique. Scanning electron microscopy and X-ray diffraction characterisations revealed presence of wurtzite structured ZnO nanograins grown in the direction of (002) and (004). The nanostructured diode was investigated at optimum operating temperature of 260 °C. At a constant reverse current of 1 mA, the voltage shifts towards 1% hydrogen and 1% propene were measured as 173.3 mV and 191.8 mV, respectively.

Hydrogen sensing properties of Pt/Lanthanum oxide- molybdenum oxide nanoplatelet/SiC based Schottky diode

An investigation of the electrical and hydrogen sensing properties of a novel Schottky diode based on a nanostructured lanthanum oxide-molybdenum oxide compound is presented herein. Molybdenum oxide (MoO3) nanoplatelets were grown on SiC substrates via thermal evaporation which was then subsequently coated with lanthanum oxide (La2O3) by RF sputtering. The current-voltage characteristics and hydrogen sensing performance (change in barrier height and sensitivity as well as the dynamic response) were examined from 25 to 300°C. At 180°C, a voltage shift of 2.23V was measured from the sensor while exposed to 1% hydrogen gas under a 100 μA constant reverse bias current. The results indicate that the presence of a La2O3 thin layer substantially improves the hydrogen sensitivity of the MoO3 nanoplatelets.

Hydrogen gas sensors based on thermally evaporated nanostructured MoO3 Schottky diode : a comparative study

In this paper, a comparative study of Pt/nanostructured MoO3/SiC Schottky diode based hydrogen gas sensors is presented. MoO3 nanostructured films with three different morphologies (nanoplatelets, nanoplateletsnanowires and nano-flowers) were deposited on SiC by thermal evaporation. We compare the current-voltage characteristics and the dynamic response of these sensors as they are exposed to hydrogen gas at temperatures up to 250°C. Results indicate that the sensor based on MoO3 nanoflowers exhibited the highest sensitivity (in terms of a 5.79V voltage shift) towards 1% hydrogen; while the sensor based on MoO3 nanoplatelets showed the quickest response (t90%- 40s).

Pt/MoO3 nano-flower/SiC Schottky diode based hydrogen gas sensor

In this paper, we report the development of a novel Pt/MoO3 nano-flower/SiC Schottky diode based device for hydrogen gas sensing applications. The MoO3 nanostructured thin films were deposited on SiC substrates via thermal evaporation. Morphological characterization of the nanostructured MoO3 by scanning electron microscopy revealed randomly orientated thin nanoplatelets in a densely packed formation of nano-flowers with dimensions ranging from 250 nm to 1 μm. Current-voltage characteristics of the sensor were measured at temperatures from 25°C to 250°C. The sensor showed greater sensitivity in a reverse bias condition than in forward bias. Dynamic response of the sensor was investigated towards different concentrations of hydrogen gas in a synthetic air mixture at 250°C and a large voltage shift of 5.7 V was recorded upon exposure to 1% hydrogen.

A comparison of forward and reverse bias operation in a Pt/nanostructured ZnO Schottky diode based hydrogen sensor

A hydrogen gas sensor based on Pt/nanostructured ZnO Schottky diode has been developed. Our proposed theoretical model allows for the explanation of superior dynamic performance of the reverse biased diode when compared to the forward bias operation. The sensor was evaluated with low concentration H2 gas exposures over a temperature range of 280°C to 430°C. Upon exposure to H2 gas, the effective change in free carrier concentration at the Pt/structured ZnO interface is amplified by an enhancement factor, effectively lowering the reverse barrier, producing a large voltage shift. The lowering of the reverse barrier permits a faster response in reverse bias operation, than in forward bias operation.

Generator coherency and area detection in large power systems

This paper provides a new general approach for defining coherent generators in power systems based on the coherency in low frequency inter-area modes. The disturbance is considered to be distributed in the network by applying random load changes which is the random walk representation of real loads instead of a single fault and coherent generators are obtained by spectrum analysis of the generators velocity variations. In order to find the coherent areas and their borders in the inter-connected networks, non-generating buses are assigned to each group of coherent generator using similar coherency detection techniques. The method is evaluated on two test systems and coherent generators and areas are obtained for different operating points to provide a more accurate grouping approach which is valid across a range of realistic operating points of the system.