An Alternative Approach To Computer System Security Monitoring And Enhancement Through System Call Sequence Analysis

Modern computer systems are plagued with stability and security problems: applications lose data, web servers are hacked, and systems crash under heavy load. Many of these problems or anomalies arise from rare program behavior caused by attacks or errors. A substantial percentage of the web-based attacks are due to buffer overflows. Many methods have been devised to detect and prevent anomalous situations that arise from buffer overflows. The current state-of-art of anomaly detection systems is relatively primitive and mainly depend on static code checking to take care of buffer overflow attacks. For protection, Stack Guards and I-leap Guards are also used in wide varieties.This dissertation proposes an anomaly detection system, based on frequencies of system calls in the system call trace. System call traces represented as frequency sequences are profiled using sequence sets. A sequence set is identified by the starting sequence and frequencies of specific system calls. The deviations of the current input sequence from the corresponding normal profile in the frequency pattern of system calls is computed and expressed as an anomaly score. A simple Bayesian model is used for an accurate detection.Experimental results are reported which show that frequency of system calls represented using sequence sets, captures the normal behavior of programs under normal conditions of usage. This captured behavior allows the system to detect anomalies with a low rate of false positives. Data are presented which show that Bayesian Network on frequency variations responds effectively to induced buffer overflows. It can also help administrators to detect deviations in program flow introduced due to errors.

Anomaly Detection Using System Call Sequence Sets.

This paper discusses our research in developing a generalized and systematic method for anomaly detection. The key ideas are to represent normal program behaviour using system call frequencies and to incorporate probabilistic techniques for classification to detect anomalies and intrusions. Using experiments on the sendmail system call data, we demonstrate that concise and accurate classifiers can be constructed to detect anomalies. An overview of the approach that we have implemented is provided.

Code clones in program test sequence identification

Code clones are portions of source code which are similar to the original program code. The presence of code clones is considered as a bad feature of software as the maintenance of software becomes difficult due to the presence of code clones. Methods for code clone detection have gained immense significance in the last few years as they play a significant role in engineering applications such as analysis of program code, program understanding, plagiarism detection, error detection, code compaction and many more similar tasks. Despite of all these facts, several features of code clones if properly utilized can make software development process easier. In this work, we have pointed out such a feature of code clones which highlight the relevance of code clones in test sequence identification. Here program slicing is used in code clone detection. In addition, a classification of code clones is presented and the benefit of using program slicing in code clone detection is also mentioned in this work.

Underwater Target Localization, Tracking and Classification

Underwater target localization and tracking attracts tremendous research interest due to various impediments to the estimation task caused by the noisy ocean environment. This thesis envisages the implementation of a prototype automated system for underwater target localization, tracking and classification using passive listening buoy systems and target identification techniques. An autonomous three buoy system has been developed and field trials have been conducted successfully. Inaccuracies in the localization results, due to changes in the environmental parameters, measurement errors and theoretical approximations are refined using the Kalman filter approach. Simulation studies have been conducted for the tracking of targets with different scenarios even under maneuvering situations. This system can as well be used for classifying the unknown targets by extracting the features of the noise emanations from the targets.

DNA Sequence Representation methods

DNA sequence representation methods are used to denote a gene structure effectively and help in similarities/dissimilarities analysis of coding sequences. Many different kinds of representations have been proposed in the literature. They can be broadly classified into Numerical, Graphical, Geometrical and Hybrid representation methods. DNA structure and function analysis are made easy with graphical and geometrical representation methods since it gives visual representation of a DNA structure. In numerical method, numerical values are assigned to a sequence and digital signal processing methods are used to analyze the sequence. Hybrid approaches are also reported in the literature to analyze DNA sequences. This paper reviews the latest developments in DNA Sequence representation methods. We also present a taxonomy of various methods. A comparison of these methods where ever possible is also done

A Realization Of An Fpga Sub System For Reducing Odometric Localization Errors In Wheeled Mobile Robots

This paper introduces a simple and efficient method and its implementation in an FPGA for reducing the odometric localization errors caused by over count readings of an optical encoder based odometric system in a mobile robot due to wheel-slippage and terrain irregularities. The detection and correction is based on redundant encoder measurements. The method suggested relies on the fact that the wheel slippage or terrain irregularities cause more count readings from the encoder than what corresponds to the actual distance travelled by the vehicle. The standard quadrature technique is used to obtain four counts in each encoder period. In this work a three-wheeled mobile robot vehicle with one driving-steering wheel and two-fixed rear wheels in-axis, fitted with incremental optical encoders is considered. The CORDIC algorithm has been used for the computation of sine and cosine terms in the update equations. The results presented demonstrate the effectiveness of the technique

An Encoded Infrared Sheet Of Light Navigational Beacon System For Precise Localization Of Indoor Mobile Robot Vehicles

A new localization approach to increase the navigational capabilities and object manipulation of autonomous mobile robots, based on an encoded infrared sheet of light beacon system, which provides position errors smaller than 0.02m is presented in this paper. To achieve this minimal position error, a resolution enhancement technique has been developed by utilising an inbuilt odometric/optical flow sensor information. This system respects strong low cost constraints by using an innovative assembly for the digitally encoded infrared transmitter. For better guidance of mobile robot vehicles, an online traffic signalling capability is also incorporated. Other added features are its less computational complexity and online localization capability all these without any estimation uncertainty. The constructional details, experimental results and computational methodologies of the system are also described

Genetic algorithm based indicator sequence method for exon prediction

Considerable research effort has been devoted in predicting the exon regions of genes. The binary indicator (BI), Electron ion interaction pseudo potential (EIIP), Filter method are some of the methods. All these methods make use of the period three behavior of the exon region. Even though the method suggested in this paper is similar to above mentioned methods , it introduces a set of sequences for mapping the nucleotides selected by applying genetic algorithm and found to be more promising

On the localization of electrons and holes in Hg_n and rare-gas clusters

We have used a microscopic theory to study the size dependence of the degree of localization of the valence electrons and holes in neutral an ionized rare-gas and Hg_n clusters. We discuss under which circumstances localization of the electrons and holes is favoured. We have calculated the ionization potential of Xe_n, Kr_n and small Hg_n clusters. Good agreement with experiments is obtained. We have also determined the dependence of the ionization potential on cluster structure.

Ground state correlation energy of the Be-sequence for Z = 4-20 in MCDF approximation

The ground state (J = 0) electronic correlation energy of the 4-electron Be-sequence is calculated in the Multi-Configuration Dirac-Fock approximation for Z = 4-20. The 4 electrons were distributed over the configurations arising from the 1s, 2s, 2p, 3s, 3p and 3d orbitals. Theoretical values obtained here are in good agreement with experimental correlation energies.

Protein Folding Simulations: Confinement, External Fields and Sequence Design

The present Thesis looks at the problem of protein folding using Monte Carlo and Langevin simulations, three topics in protein folding have been studied: 1) the effect of confining potential barriers, 2) the effect of a static external field and 3) the design of amino acid sequences which fold in a short time and which have a stable native state (global minimum). Regarding the first topic, we studied the confinement of a small protein of 16 amino acids known as 1NJ0 (PDB code) which has a beta-sheet structure as a native state. The confinement of proteins occurs frequently in the cell environment. Some molecules called Chaperones, present in the cytoplasm, capture the unfolded proteins in their interior and avoid the formation of aggregates and misfolded proteins. This mechanism of confinement mediated by Chaperones is not yet well understood. In the present work we considered two kinds of potential barriers which try to mimic the confinement induced by a Chaperon molecule. The first kind of potential was a purely repulsive barrier whose only effect is to create a cavity where the protein folds up correctly. The second kind of potential was a barrier which includes both attractive and repulsive effects. We performed Wang-Landau simulations to calculate the thermodynamical properties of 1NJ0. From the free energy landscape plot we found that 1NJ0 has two intermediate states in the bulk (without confinement) which are clearly separated from the native and the unfolded states. For the case of the purely repulsive barrier we found that the intermediate states get closer to each other in the free energy landscape plot and eventually they collapse into a single intermediate state. The unfolded state is more compact, compared to that in the bulk, as the size of the barrier decreases. For an attractive barrier modifications of the states (native, unfolded and intermediates) are observed depending on the degree of attraction between the protein and the walls of the barrier. The strength of the attraction is measured by the parameter $\epsilon$. A purely repulsive barrier is obtained for $\epsilon=0$ and a purely attractive barrier for $\epsilon=1$. The states are changed slightly for magnitudes of the attraction up to $\epsilon=0.4$. The disappearance of the intermediate states of 1NJ0 is already observed for $\epsilon =0.6$. A very high attractive barrier ($\epsilon \sim 1.0$) produces a completely denatured state. In the second topic of this Thesis we dealt with the interaction of a protein with an external electric field. We demonstrated by means of computer simulations, specifically by using the Wang-Landau algorithm, that the folded, unfolded, and intermediate states can be modified by means of a field. We have found that an external field can induce several modifications in the thermodynamics of these states: for relatively low magnitudes of the field ($<2.06 \times 10^8$ V/m) no major changes in the states are observed. However, for higher magnitudes than ($6.19 \times 10^8$ V/m) one observes the appearance of a new native state which exhibits a helix-like structure. In contrast, the original native state is a $\beta$-sheet structure. In the new native state all the dipoles in the backbone structure are aligned parallel to the field. The design of amino acid sequences constitutes the third topic of the present work. We have tested the Rate of Convergence criterion proposed by D. Gridnev and M. Garcia ({\it work unpublished}). We applied it to the study of off-lattice models. The Rate of Convergence criterion is used to decide if a certain sequence will fold up correctly within a relatively short time. Before the present work, the common way to decide if a certain sequence was a good/bad folder was by performing the whole dynamics until the sequence got its native state (if it existed), or by studying the curvature of the potential energy surface. There are some difficulties in the last two approaches. In the first approach, performing the complete dynamics for hundreds of sequences is a rather challenging task because of the CPU time needed. In the second approach, calculating the curvature of the potential energy surface is possible only for very smooth surfaces. The Rate of Convergence criterion seems to avoid the previous difficulties. With this criterion one does not need to perform the complete dynamics to find the good and bad sequences. Also, the criterion does not depend on the kind of force field used and therefore it can be used even for very rugged energy surfaces.

Zytogenetische Untersuchungen zur Bestimmung der chromosomalen Aneuploidie in der Karzinogenese sowie für die Frühdiagnostik des Pankreaskarzinoms

Bauchspeicheldrüsenkrebs ist die vierthäufigste Krebstodesursache in Deutschland. Durch die tiefe Lage des Organs im Körperinneren und das späte Auftreten von Symptomen erfolgt die Diagnose meist zu einem sehr späten Zeitpunkt, zu dem eine Resektion des Tumors in 80% der Fälle nicht mehr möglich ist. Die Hälfte der Patienten verstirbt bereits im ersten Jahr nach Diagnosestellung. Nach heutiger Erkenntnis entwickeln sich Adenokarzinome der Bauchspeicheldrüse über schrittweise histologische Veränderungen, die sogenannten PanIN Läsionen (pancreatic intraepithelial neoplasia). Bis heute fehlen jedoch klinisch einsetzbare Parameter für die Früherkennung des Karzinoms und seiner Vorstufen. Bisher ist nicht vollständig geklärt, welche molekularen Veränderungen hierbei eine wesentliche Rolle spielen. Das Ziel der vorliegenden Arbeit ist, die molekular- und zytogenetische Mutationsinzidenz und -Sequenz im Verlauf der neoplastischen Progression in der PanIN-Sequenz aufzuklären. Unter Anwendung der Fluoreszenz-in-situ-Hybridisierung (FISH) wird weiterführend die Frage beantwortet, ob sich der Nachweis von zytogenetischen Veränderungen in Zellen, die endoskopisch aus dem Pankreassekret gewonnen wurden, als neuartiger Ansatz für eine Frühdiagnostik nutzen lassen. Die molekulargenetischen Analysen zeigen, dass die PanIN-Läsionen aus Geweben mit chronischer Pankreatitis denen aus Geweben mit Karzinomen gleichzusetzen sind. Veränderungen in der Anzahl einzelner Chromosomen, sowie Basenmutationen finden sich bereits in den frühesten Gangläsionen. Die diffuse Verteilung von Genmutationen lässt einen mutagenen Feldeffekt vermuten, in welchem endogene (z.B. Pankreasenzyme, oxidativer Stress) und/oder exogene (z.B. Nikotin, Alkohol) Noxen auf verschiedene Pankreasgänge während einer langen Zeit einwirken. Auf der Basis der erhaltenen Daten kann angenommen werden, dass die prä-neoplastischen Läsionen in Geweben mit chronischer Pankreatitis eine Progression durchlaufen, in der sich sporadische Defekte wie Basenmutationen und Mitosefehler (Aneuplodien) akkumulieren. Die biologische Relevanz für die Tumorentstehung sollte jedoch immer im klinischen Kontext betrachtet werden. In Kombination mit weiteren Parametern (z.B. Alter, Dauer der Pankreatitis) könnte dies eine Möglichkeit bieten, das Risiko für die Entstehung eines Karzinoms individuell zu bestimmen und somit Patienten frühzeitig genug vor der Manifestation eines Tumors einer (Teil-)Resektion des Organs zuzuführen.