Automated feature engineering for HTTP tunnel detection

Generating discriminative input features is a key requirement for achieving highly accurate classifiers. The process of generating features from raw data is known as feature engineering and it can take significant manual effort. In this paper we propose automated feature engineering to derive a suite of additional features from a given set of basic features with the aim of both improving classifier accuracy through discriminative features, and to assist data scientists through automation. Our implementation is specific to HTTP computer network traffic. To measure the effectiveness of our proposal, we compare the performance of a supervised machine learning classifier built with automated feature engineering versus one using human-guided features. The classifier addresses a problem in computer network security, namely the detection of HTTP tunnels. We use Bro to process network traffic into base features and then apply automated feature engineering to calculate a larger set of derived features. The derived features are calculated without favour to any base feature and include entropy, length and N-grams for all string features, and counts and averages over time for all numeric features. Feature selection is then used to find the most relevant subset of these features. Testing showed that both classifiers achieved a detection rate above 99.93% at a false positive rate below 0.01%. For our datasets, we conclude that automated feature engineering can provide the advantages of increasing classifier development speed and reducing development technical difficulties through the removal of manual feature engineering. These are achieved while also maintaining classification accuracy.

Comparison of the sensitivity of different sensor technologies to imbalance severity in low speed wind turbines

Imbalance is not only a direct major cause of downtime in wind turbines, but also accelerates the degradation of neighbouring and downstream components (e.g. main bearing, generator). Along with detection, the imbalance quantification is also essential as some residual imbalance always exist even in a healthy turbine. Three different commonly used sensor technologies (vibration, acoustic emission and electrical measurements) are investigated in this work to verify their sensitivity to different imbalance grades. This study is based on data obtained by experimental tests performed on a small scale wind turbine drive train test-rig for different shaft speeds and imbalance levels. According to the analysis results, electrical measurements seem to be the most suitable for tracking the development of imbalance.

Detection of Tsunami Wave Generation and Propagation Using Fiber Bragg Grating Sensors

This paper describes the design and development of a Fiber Bragg Grating (FBG) sensor system for monitoring tsunami waves generated in the deep ocean. An experimental setup was designed and fabricated to simulate the generation and propagation of a tsunami wave. The characteristics and efficiency of the developed FBG sensor was evaluated with a standard commercial Digiquartz sensor. For real time monitoring of tsunami waves, FBG sensors bonded to a cantilever is used and the wavelength shifts (Delta lambda(B)) in the reflected spectra resulting from the strain/pressure imparted on the FBGs have been recorded using a high-speed Micron Optics FBG interrogation system. The parameters sensed are the signal burst during tsunami generation and pressure variations at different places as the tsunami wave propagates away from the source of generation. The results obtained were compared with the standard commercial sensor used in tsunami detection. The observations suggest that the FBG sensor was highly sensitive and free from many of the constraints associated with the commercial tsunameter.

A scalable network port scan detection system on FPGA

With ever increasing network speed, scalable and reliable detection of network port scans has become a major challenge. In this paper, we present a scalable and flexible architecture and a novel algorithm, to detect and block port scans in real time. The proposed architecture detects fast scanners as well as stealth scanners having large inter-probe periods. FPGA implementation of the proposed system gives an average throughput of 2 Gbps with a system clock frequency of 100 MHz on Xilinx Virtex-II Pro FPGA. Experimental results on real network trace show the effectiveness of the proposed system in detecting and blocking network scans with very low false positives and false negatives.

Sensor networks for geospatial event detection - theory and applications

This thesis presents theories, analyses, and algorithms for detecting and estimating parameters of geospatial events with today's large, noisy sensor networks. A geospatial event is initiated by a significant change in the state of points in a region in a 3-D space over an interval of time. After the event is initiated it may change the state of points over larger regions and longer periods of time. Networked sensing is a typical approach for geospatial event detection. In contrast to traditional sensor networks comprised of a small number of high quality (and expensive) sensors, trends in personal computing devices and consumer electronics have made it possible to build large, dense networks at a low cost. The changes in sensor capability, network composition, and system constraints call for new models and algorithms suited to the opportunities and challenges of the new generation of sensor networks. This thesis offers a single unifying model and a Bayesian framework for analyzing different types of geospatial events in such noisy sensor networks. It presents algorithms and theories for estimating the speed and accuracy of detecting geospatial events as a function of parameters from both the underlying geospatial system and the sensor network. Furthermore, the thesis addresses network scalability issues by presenting rigorous scalable algorithms for data aggregation for detection. These studies provide insights to the design of networked sensing systems for detecting geospatial events. In addition to providing an overarching framework, this thesis presents theories and experimental results for two very different geospatial problems: detecting earthquakes and hazardous radiation. The general framework is applied to these specific problems, and predictions based on the theories are validated against measurements of systems in the laboratory and in the field.

Topics in LIGO-related physics: interferometric speed meters and tidal work

In the quest to develop viable designs for third-generation optical interferometric gravitational-wave detectors, one strategy is to monitor the relative momentum or speed of the test-mass mirrors, rather than monitoring their relative position. The most straightforward design for a speed-meter interferometer that accomplishes this is described and analyzed in Chapter 2. This design (due to Braginsky, Gorodetsky, Khalili, and Thorne) is analogous to a microwave-cavity speed meter conceived by Braginsky and Khalili. A mathematical mapping between the microwave speed meter and the optical interferometric speed meter is developed and used to show (in accord with the speed being a quantum nondemolition observable) that in principle the interferometric speed meter can beat the gravitational-wave standard quantum limit (SQL) by an arbitrarily large amount, over an arbitrarily wide range of frequencies . However, in practice, to reach or beat the SQL, this specific speed meter requires exorbitantly high input light power. The physical reason for this is explored, along with other issues such as constraints on performance due to optical dissipation.

Chapter 3 proposes a more sophisticated version of a speed meter. This new design requires only a modest input power and appears to be a fully practical candidate for third-generation LIGO. It can beat the SQL (the approximate sensitivity of second-generation LIGO interferometers) over a broad range of frequencies (~ 10 to 100 Hz in practice) by a factor h/h_SQL ~ √W^(SQL)_(circ)/W_circ. Here W_circ is the light power circulating in the interferometer arms and W_SQL ≃ 800 kW is the circulating power required to beat the SQL at 100 Hz (the LIGO-II power). If squeezed vacuum (with a power-squeeze factor e^-2R) is injected into the interferometer's output port, the SQL can be beat with a much reduced laser power: h/h_SQL ~ √W^(SQL)_(circ)/W_circe^-2R. For realistic parameters (e^-2R ≃ 10 and W_circ ≃ 800 to 2000 kW), the SQL can be beat by a factor ~ 3 to 4 from 10 to 100 Hz. [However, as the power increases in these expressions, the speed meter becomes more narrow band; additional power and re-optimization of some parameters are required to maintain the wide band.] By performing frequency-dependent homodyne detection on the output (with the aid of two kilometer-scale filter cavities), one can markedly improve the interferometer's sensitivity at frequencies above 100 Hz.

Chapters 2 and 3 are part of an ongoing effort to develop a practical variant of an interferometric speed meter and to combine the speed meter concept with other ideas to yield a promising third- generation interferometric gravitational-wave detector that entails low laser power.

Chapter 4 is a contribution to the foundations for analyzing sources of gravitational waves for LIGO. Specifically, it presents an analysis of the tidal work done on a self-gravitating body (e.g., a neutron star or black hole) in an external tidal field (e.g., that of a binary companion). The change in the mass-energy of the body as a result of the tidal work, or "tidal heating," is analyzed using the Landau-Lifshitz pseudotensor and the local asymptotic rest frame of the body. It is shown that the work done on the body is gauge invariant, while the body-tidal-field interaction energy contained within the body's local asymptotic rest frame is gauge dependent. This is analogous to Newtonian theory, where the interaction energy is shown to depend on how one localizes gravitational energy, but the work done on the body is independent of that localization. These conclusions play a role in analyses, by others, of the dynamics and stability of the inspiraling neutron-star binaries whose gravitational waves are likely to be seen and studied by LIGO.

Foot contact detection for sprint training

We introduce a new algorithm to automatically identify the time and pixel location of foot contact events in high speed video of sprinters. We use this information to autonomously synchronise and overlay multiple recorded performances to provide feedback to athletes and coaches during their training sessions. The algorithm exploits the variation in speed of different parts of the body during sprinting. We use an array of foreground accumulators to identify short-term static pixels and a temporal analysis of the associated static regions to identify foot contacts. We evaluated the technique using 13 videos of three sprinters. It successfully identifed 55 of the 56 contacts, with a mean localisation error of 1.39±1.05 pixels. Some videos were also seen to produce additional, spurious contacts. We present heuristics to help identify the true contacts. © 2011 Springer-Verlag Berlin Heidelberg.

Nanowire and graphene architectures for room temperature THz detection

Antenna-coupled field effect transistors have been developed as plasma-wave THz detectors in both InAs nanowire and graphene channel material. Room temperature operation has been achieved up to frequencies of 1.5 THz, with noise equivalent powers as low as a few 10-11 W/Hz1/2, and high-speed response. © 2012 IEEE.

Fast, sensitive and low-noise nanowire and graphene field effect transistors for room-temperature detection of Terahertz quantum cascade laser emission

Antenna-coupled field effect transistors have been developed as plasma-wave THz detectors in both InAs nanowire and graphene channel materials. Room temperature operation has been achieved up to 3 THz, with noise equivalent power levels < 10-10 W/Hz1/2, and high-speed response already suitable for large area THz imaging applications. © 2013 IEEE.

Estimated detection distance of a baiji's (Chinese river dolphin, Lipotes vexillifer) whistles using a passive acoustic survey method

Source levels and phonation intervals of whistles produced by a free-ranging baiji (Chinese river dolphin) were measured in the seminatural reserve of Shishou in Hubei, China. A total of 43 whistles were recorded over 12 recording sessions. The mean dominant frequency (the frequency at the highest energy) was 5.7 kHz (s.d.=0.67). The calculated source level was 143.2 dB rms re 1 mu Pa (s.d.=5.8). Most phonation intervals were shorter than 460 s, and the average interval was 205 s (s.d. = 254). Theoretical detection range of baiji's whistle was 6600 m at the present study site, but it could reduce a couple of hundred meters in practical noisy situation in the Yangtze River. Sporadic phonation (205 s interval on average) with relatively faint signal of baiji was considered, to be difficult to be detected by a towing hydrophone system. Stationed monitoring or slow speed towing of hydrophones along the river current is recommended. (c) 2006 Acoustical Society of America.

Frequency mixing and phase detection functionalities of three-terminal ballistic junctions

Three-terminal ballistic junctions (TBJs) are fabricated from a high-mobility InP/In0.75Ga0.25As heterostructure by electron-beam lithography. The voltage output from the central branch is measured as a function of the voltages applied to the left and right branches of the TBJs. The measurements show that the TBJs possess an intrinsic nonlinearity. Based on this nonlinearity, a novel room-temperature functional frequency mixer and phase detector are realized. The TBJ frequency mixer and phase detector are expected to have advantages over traditional circuits in terms of simple structure, small size and high speed, and can be used as a new type of building block in nanoelectronics.

Research of Face Detection System Applied for Detecting Faces with Complex Background and Illumination

An effective face detection system used for detecting multi pose frontal face in gray images is presented. Image preprocessing approaches are applied to reduce the influence of the complex illumination. Eye-analog pairing and improved multiple related template matching are used to glancing and accurate face detecting, respectively. To shorten the time cost of detecting process, we employ prejudge rules in checking candidate image segments before template matching. Test by our own face database with complicated illumination and background, the system has high calculation speed and illumination independency, and obtains good experimental results.

A Novel Architecture of Vision Chip for Fast Traffic Lane Detection and FPGA Implementation

This paper presents a novel architecture of vision chip for fast traffic lane detection (FTLD). The architecture consists of a 32*32 SIMD processing element (PE) array processor and a dual-core RISC processor. The PE array processor performs low-level pixel-parallel image processing at high speed and outputs image features for high-level image processing without I/O bottleneck. The dual-core processor carries out high-level image processing. A parallel fast lane detection algorithm for this architecture is developed. The FPGA system with a CMOS image sensor is used to implement the architecture. Experiment results show that the system can perform the fast traffic lane detection at 50fps rate. It is much faster than previous works and has good robustness that can operate in various intensity of light. The novel architecture of vision chip is able to meet the demand of real-time lane departure warning system.

End-column amperometric detection of 6-mercaptopurine by capillary zone electrophoresis

End-column amperometric detection of 6-mercaptopurine by capillary zone electrophoresis was described with high resolution and speed. The detection conditions were optimized and the electrochemical behavior was observed. Under the optimal conditions: detection potential of 1.2 V ( vs. Ag/AgCl), operating voltage of 15 kV, sample injection of 3 s at 15 kV and 10 mmol/l Na2HPO4 buffer, the detection limit for 6-MP was as low as 1 x 10(-7) mol/L and the linear range was from 5 x 10(-4) to 5 x 10(-6) mol/L with the relative coefficient of 0.995. The RSD of reproducibility for peak current and migration time was 2.5% and 1.2%, respectively. This method was utilized in assay real sample of human mine and bovine serum albumin containing 6-mercaptopurine.

Contextual models for object detection using boosted random fields

We seek to both detect and segment objects in images. To exploit both local image data as well as contextual information, we introduce Boosted Random Fields (BRFs), which uses Boosting to learn the graph structure and local evidence of a conditional random field (CRF). The graph structure is learned by assembling graph fragments in an additive model. The connections between individual pixels are not very informative, but by using dense graphs, we can pool information from large regions of the image; dense models also support efficient inference. We show how contextual information from other objects can improve detection performance, both in terms of accuracy and speed, by using a computational cascade. We apply our system to detect stuff and things in office and street scenes.