Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Work and economic security in the 21st century

In recent decades there has been a transformation of two central concepts of modernity – labour and the household. Ela Bhatt – the founder of the Self-Employed Women’s Association of India (SEWA), has made an important contribution to this transformation. Through the emergence of unions such as SEWA, the notion of who represents labour is being broadened; the marginalised are finding an institutional voice. Increasingly, the household is being recognised as a site of both production and reproduction. SEWA is not a traditional trade union that aims, through collective bargaining with an employer, to improve its members’ wages and working conditions as sellers of their labour power. Instead, it aims to empower women economically in the informal economy by bringing them into the mainstream economy as owners of their labour. The union dimension of SEWA builds their collective power through struggle; the cooperative dimension translates their bargaining power into the economic and social development of its members and their community. Besides, Bhatt’s approach to the self-employed was a direct challenge to the ILO’s tripartism when it was established in the early seventies. The first part of the paper provides a short biography of Ela Bhatt, describes the origins of SEWA, analyses a ‘classification struggle’ over how and who is to define what a worker is. In the second part the author considers SEWAs innovative organizing strategy and is rethinking modernity in the labour context. In the conclusion the paper discusses the lessons that can be learnt from Ela Bhatt.

Optimising contributions of goat farming to household economic success and food security in three production systems in Ethiopia

The study aims to analyse factors affecting contributions of goat farming to household economic success and food security in three goat production systems of Ethiopia. A study was conducted in three districts of Ethiopia representing arid agro-pastoral (AAP), semi-arid agro-pastoral (SAAP) and highland mixed crop-livestock (HMCL) systems involving 180 goat keeping households. Gross margin (GM) and net benefit (NB1 and NB2) were used as indicators of economic success of goat keeping. NB1 includes in-kind benefits of goats (consumption and manure), while NB2 additionally constitutes intangible benefits (insurance and finance). Household dietary diversity score (HDDS) was used as a proxy indicator of food security. GM was significantly affected by an off-take rate and flock size interaction (P<0.001). The increment of GM due to increased off-take rate was more prominent for farmers with bigger flocks. Interaction between flock size and production system significantly (P<0.001) affected both NB1 and NB2. The increment of NB1 and NB2 by keeping larger flocks was higher in AAP system, due to higher in-kind and intangible benefits of goats in this system. Effect of goat flock size as a predictor of household dietary diversity was not significant (P>0.05). Nevertheless, a significant positive correlation (P<0.05) was observed between GM from goats and HDDS in AAP system, indicating the indirect role of goat production for food security. The study indicated that extent of utilising tangible and intangible benefits of goats varied among production systems and these differences should be given adequate attention in designing genetic improvement programs.

Local food security initiatives: systemic limitations in Vancouver, Canada

This paper approaches the topic of urban/community gardening not through the lens of urban theory per se but in light of basic farming realities such as growing season and land availability. Food security comprises availability and affordability. In the context of North American and Western European societies, only food affordability normally merits public discourse. In practice, governments have little or no means to change food affordability, in view of prevailing capitalistic free-market structures. In the current wave of popular exuberance, civic politicians and others have promoted the belief that community gardening could be the pathway to produce affordable food. The formidable obstacles to this pursuit include the availability of (low-cost) land within the highly-densified city limit, insufficient ambient temperature and water supply during the growing season and the contemporary structure of society. Overcoming these fundamental hurdles carries significant negative environmental and economic consequences.

Ecosystem services and adaptation for agriculture and food security: analysis of two decades (1991–2011) of financing by the Global Environment Facility

Investing in global environmental and adaptation benefits in the context of agriculture and food security initiatives can play an important role in promoting sustainable intensification. This is a priority for the Global Environment Facility (GEF), created in 1992 with a mandate to serve as financial mechanism of several multilateral environmental agreements. To demonstrate the nature and extent of GEF financing, we conducted an assessment of the entire portfolio over a period of two decades (1991–2011) to identify projects with direct links to agriculture and food security. A cohort of 192 projects and programs were identified and used as a basis for analyzing trends in GEF financing. The projects and programs together accounted for a total GEF financing of US$1,086.8 million, and attracted an additional US$6,343.5 million from other sources. The value-added of GEF financing for ecosystem services and resilience in production systems was demonstrated through a diversity of interventions in the projects and programs that utilized US$810.6 million of the total financing. The interventions fall into the following four main categories in accordance with priorities of the GEF: sustainable land management (US$179.3 million), management of agrobiodiversity (US$113.4 million), sustainable fisheries and water resource management (US$379.8 million), and climate change adaptation (US$138.1 million). By aligning GEF priorities with global aspirations for sustainable intensification of production systems, the study shows that it is possible to help developing countries tackle food insecurity while generating global environmental benefits for a healthy and resilient planet.

The role of organic farming for food security: local nexus with a global view

A convergence of factors has made food security one of the most important global issues. It has been the core concept of the Milan Expo 2015, whose title, Feeding the Planet, Energy for Life, embodied the challenge to provide the world’s growing population with a sustainable, secure supply of safe, nutritious, and affordable high-quality food using less land with lower inputs. Meeting the food security agenda using current agricultural production techniques cannot be achieved without serious degradation to the environment, including soil degradation, loss of biodiversity and climate change. Organic farming is seen as a solution to the challenge of sustainable food production, as it provides more nutritious food, with less or no pesticide residues and lower use of inputs. A limit of organic farming is its restricted capability of producing food compared to conventional agriculture, thus being an inefficient approach to food production and to food security. The authors maintain, on the basis of a scientific literature review, that organic soils tend to retain the physical, chemical and biological properties over the long term, while maintaining stable levels of productivity and thereby ensuring long-term food production and safety. Furthermore, the productivity gap of organic crops may be worked out by further investment in research and in particular into diversification techniques. Moreover, strong scientific evidence indicates that organic agricultural systems deliver greater ecosystem services and social benefits.

Perception of quality in certified organic pineapples by farmers in Kayunga district, Central Uganda: Implications for food security

In East Africa, Uganda is one of the major producers of organic pineapples for export. These pineapples are mainly produced in central Uganda and have to meet stringent quality standards before they can be allowed on international markets. These quality standards may put considerable strain on farmers and may not be wholly representative of their quality interpretation. The aim of this paper is therefore, to determine the Ugandan organic pineapple farmers’ quality perception, the activities they carry out in order to attain that quality and challenges (production, postharvest & marketing) faced on the same. Qualitative semi-structured interviews were carried out among 28 organic pineapple farmers in Kayunga district, central Uganda. Findings suggest that quality of organic pineapples is mainly perceived in terms of product attributes particularly appearance followed by food security provision. Certification plays a minor role in what farmers describe as organic quality. High production input costs (labour and coffee husks) coupled with a stagnant premium are some of the major challenges faced by farmers in attaining organic quality. The paper argues that currently there are concealed negative food security effects embroiled in these pineapple schemes. It is recommended that the National Organic Agricultural Movement of Uganda (NOGAMU) works with all relevant stakeholders to have the farmer premium price raised and an official organic policy enacted.

Collection: Security Group 15 The Pyjamas INFO2009 0910

student created resource collection, poster, slide set, ref list

INFO2009 Group 6 - Data Security & the Data Protection Act

Content related to the second INFO2009 assignment for Group 6's radio interview on data security and the DPA

INFO2009 Group 21 - A Poster and set of Resources on Computer Security

This contains a poster advertising the resources. The resource is a profile folder on five topics, as well as a website, a quiz, and an interactive game.

Cyber Crime

Talk given by Gary Kibby from SOCA at the Web Science Industry Week in Dec 2012. Readings and task taken from previous years.

Privacy and Security - background grey literature online

Background reading for coursework to prepare a technical report as part of the orientation phase. These items are business documents (i.e. grey literature) which might be read as a prelude or complement to finding information in peer reviewed academic publications. grey literature links and articles to be used in preparation of technical report. See also overview guidance document for this assignment http://www.edshare.soton.ac.uk/8017/