Detecting stealthy attacks: Efficient monitoring of suspicious activities on computer networks

Stealthy attackers move patiently through computer networks - taking days, weeks or months to accomplish their objectives in order to avoid detection. As networks scale up in size and speed, monitoring for such attack attempts is increasingly a challenge. This paper presents an efficient monitoring technique for stealthy attacks. It investigates the feasibility of proposed method under number of different test cases and examines how design of the network affects the detection. A methodological way for tracing anonymous stealthy activities to their approximate sources is also presented. The Bayesian fusion along with traffic sampling is employed as a data reduction method. The proposed method has the ability to monitor stealthy activities using 10-20% size sampling rates without degrading the quality of detection.

Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid

The BlackEnergy malware targeting critical infrastructures has a long history. It evolved over time from a simple DDoS platform to a quite sophisticated plug-in based malware. The plug-in architecture has a persistent malware core with easily installable attack specific modules for DDoS, spamming, info-stealing, remote access, boot-sector formatting etc. BlackEnergy has been involved in several high profile cyber physical attacks including the recent Ukraine power grid attack in December 2015. This paper investigates the evolution of BlackEnergy and its cyber attack capabilities. It presents a basic cyber attack model used by BlackEnergy for targeting industrial control systems. In particular, the paper analyzes cyber threats of BlackEnergy for synchrophasor based systems which are used for real-time control and monitoring functionalities in smart grid. Several BlackEnergy based attack scenarios have been investigated by exploiting the vulnerabilities in two widely used synchrophasor communication standards: (i) IEEE C37.118 and (ii) IEC 61850-90-5. Specifically, the paper addresses reconnaissance, DDoS, man-in-the-middle and replay/reflection attacks on IEEE C37.118 and IEC 61850-90-5. Further, the paper also investigates protection strategies for detection and prevention of BlackEnergy based cyber physical attacks.

Bridge weigh-in-motion system and Structural Health Monitoring using fiber optic sensors

There have been over 3000 bridge weigh-in-motion (B-WIM) installations in 25 countries worldwide, this has led vast improvements in post processing of B-WIM systems since its introduction in the 1970’s. This paper introduces a new low-power B-WIM system using fibre optic sensors (FOS). The system consisted of a series of FOS which were attached to the soffit of an existing integral bridge with a single span of 19m. The site selection criteria and full installation process has been detailed in the paper. A method of calibration was adopted using live traffic at the bridge site and based on this calibration the accuracy of the system was determined.

Field Testing and Development of Novel SHM systems at Queen’s University Belfast

Ageing and deterioration of infrastructure is a challenge facing transport authorities. In
particular, there is a need for increased bridge monitoring in order to provide adequate
maintenance and to guarantee acceptable levels of transport safety. The Intelligent
Infrastructure group at Queens University Belfast (QUB) are working on a number of aspects
of infrastructure monitoring and this paper presents summarised results from three distinct
monitoring projects carried out by this group. Firstly the findings from a project on next
generation Bridge Weight in Motion (B-WIM) are reported, this includes full scale field testing
using fibre optic strain sensors. Secondly, results from early phase testing of a computer
vision system for bridge deflection monitoring are reported on. This research seeks to exploit
recent advances in image processing technology with a view to developing contactless
bridge monitoring approaches. Considering the logistical difficulty of installing sensors on a
‘live’ bridge, contactless monitoring has some inherent advantages over conventional
contact based sensing systems. Finally the last section of the paper presents some recent
findings on drive by bridge monitoring. In practice a drive-by monitoring system will likely
require GPS to allow the response of a given bridge to be identified; this study looks at the
feasibility of using low-cost GPS sensors for this purpose, via field trials. The three topics
outlined above cover a spectrum of SHM approaches namely, wired monitoring, contactless
monitoring and drive by monitoring

Implementation of a drive-by monitoring system for transport infrastructure utilising GNSS

Ageing and deterioration of infrastructure is a challenge facing transport authorities. In particular, there is a need for increased bridge monitoring in order to provide adequate maintenance, prioritise allocation of funds and guarantee acceptable levels of transport safety. Existing bridge structural health monitoring (SHM) techniques typically involve direct instrumentation of the bridge with sensors and equipment for the measurement of properties such as frequencies of vibration. These techniques are important as they can indicate the deterioration of the bridge condition. However, they can be labour intensive and expensive due to the requirement for on-site installations. In recent years, alternative low-cost indirect vibrationbased SHM approaches have been proposed which utilise the dynamic response of a vehicle to carry out “drive-by” pavement and/or bridge monitoring. The vehicle is fitted with sensors on its axles thus reducing the need for on-site installations. This paper investigates the use of low-cost sensors incorporating global navigation satellite systems (GNSS) for implementation of the drive-by system in practice, via field trials with an instrumented vehicle. The potential of smartphone technology to be harnessed for drive by monitoring is established, while smartphone GNSS tracking applications are found to compare favourably in terms of accuracy, cost and ease of use to professional GNSS devices.

Monitoring and model updating of an FRP pedestrian truss bridge

This paper presents the results of a real bridge field experiment, carried out on a fiber reinforced polymer (FRP) pedestrian truss bridge of which nodes are reinforced with stainless steel plates. The aim of this paper is to identify the dynamic parameters of this bridge by using both conventional techniques and a model updating algorithm. In the field experiment, the bridge was instrumented with accelerometers at a number of locations on the bridge deck, recording both vertical and transverse vibrations. It was excited via jump tests at particular locations along its span and the resulting acceleration signals are used to identify dynamic parameters, such as the bridge mode shape, natural frequency and damping constant. Pedestrianinduced vibrations are also measured and utilized to identify dynamic parameters of the bridge. For a complete analysis of the bridge, a numerical model of the FRP bridge is created whose properties are calibrated utilizing a model updating algorithm. Comparable frequencies and mode shapes to those from the experiment were obtained by the FE models considering the reinforcement by increasing elastic modulus at every node of the bridge by stainless steel plate. Moreover, considering boundary conditions at both ends as fixed in the model resulted in modal properties comparable/similar to those from the experiment. This study also demonstrated that the effect of reinforcement and boundary conditions must be properly considered in an FE model to analyze real behavior of the FRP bridge.

Monitoring sandy shores morphologies by DGPS: a practical tool to generate digital elevation models

The highly dynamic nature of some sandy shores with continuous morphological changes require the development of efficient and accurate methodological strategies for coastal hazard assessment and morphodynamic characterisation. During the past decades, the general methodological approach for the establishment of coastal monitoring programmes was based on photogrammetry or classical geodetic techniques. With the advent of new geodetic techniques, space-based and airborne-based, new methodologies were introduced in coastal monitoring programmes. This paper describes the development of a monitoring prototype that is based on the use of global positioning system (GPS). The prototype has a GPS multiantenna mounted on a fast surveying platform, a land vehicle appropriate for driving in the sand (four-wheel quad). This system was conceived to perform a network of shore profiles in sandy shores stretches (subaerial beach) that extend for several kilometres from which high-precision digital elevation models can be generated. An analysis of the accuracy and precision of some differential GPS kinematic methodologies is presented. The development of an adequate survey methodology is the first step in morphodynamic shore characterisation or in coastal hazard assessment. The sample method and the computational interpolation procedures are important steps for producing reliable three-dimensional surface maps that are real as possible. The quality of several interpolation methods used to generate grids was tested in areas where there were data gaps. The results obtained allow us to conclude that with the developed survey methodology, it is possible to Survey sandy shores stretches, under spatial scales of kilometers, with a vertical accuracy of greater than 0.10 m in the final digital elevation models.

A review of Parkinson’s disease cardinal and dyskinetic motor symptoms assessment methods using sensor systems

This paper is reviewing objective assessments of Parkinson’s disease(PD) motor symptoms, cardinal, and dyskinesia, using sensor systems. It surveys the manifestation of PD symptoms, sensors that were used for their detection, types of signals (measures) as well as their signal processing (data analysis) methods. A summary of this review’s finding is represented in a table including devices (sensors), measures and methods that were used in each reviewed motor symptom assessment study. In the gathered studies among sensors, accelerometers and touch screen devices are the most widely used to detect PD symptoms and among symptoms, bradykinesia and tremor were found to be mostly evaluated. In general, machine learning methods are potentially promising for this. PD is a complex disease that requires continuous monitoring and multidimensional symptom analysis. Combining existing technologies to develop new sensor platforms may assist in assessing the overall symptom profile more accurately to develop useful tools towards supporting better treatment process.

Development of a Wireless MEMS Multifunction Sensor System and Field Demonstration of Embedded Sensors for Monitoring Concrete Pavements, TR-637, 2016

Pavements tend to deteriorate with time under repeated traffic and/or environmental loading. By detecting pavement distresses and damage early enough, it is possible for transportation agencies to develop more effective pavement maintenance and rehabilitation programs and thereby achieve significant cost and time savings. The structural health monitoring (SHM) concept can be considered as a systematic method for assessing the structural state of pavement infrastructure systems and documenting their condition. Over the past several years, this process has traditionally been accomplished through the use of wired sensors embedded in bridge and highway pavement. However, the use of wired sensors has limitations for long-term SHM and presents other associated cost and safety concerns. Recently, micro-electromechanical sensors and systems (MEMS) and nano-electromechanical systems (NEMS) have emerged as advanced/smart-sensing technologies with potential for cost-effective and long-term SHM. This two-pronged study evaluated the performance of commercial off-the-shelf (COTS) MEMS sensors embedded in concrete pavement (Final Report Volume I) and developed a wireless MEMS multifunctional sensor system for health monitoring of concrete pavement (Final Report Volume II).

Monitoring Infection Risk for Air and Soil Borne Fungal Plant Pathogens using Antibody and DNA Techniques and Mathematical Models describing Environmental Parameters

Economic losses resulting from disease development can be reduced by accurate and early detection of plant pathogens. Early detection can provide the grower with useful information on optimal crop rotation patterns, varietal selections, appropriate control measures, harvest date and post harvest handling. Classical methods for the isolation of pathogens are commonly used only after disease symptoms. This frequently results in a delay in application of control measures at potentially important periods in crop production. This paper describes the application of both antibody and DNA based systems to monitor infection risk of air and soil borne fungal pathogens and the use of this information with mathematical models describing risk of disease associated with environmental parameters.

Event Monitoring Based On Web Services for Heterogeneous Event Sources

This article discusses event monitoring options for heterogeneous event sources as they are given in nowadays heterogeneous distributed information systems. It follows the central assumption, that a fully generic event monitoring solution cannot provide complete support for event monitoring; instead, event source specific semantics such as certain event types or support for certain event monitoring techniques have to be taken into account. Following from this, the core result of the work presented here is the extension of a configurable event monitoring (Web) service for a variety of event sources. A service approach allows us to trade genericity for the exploitation of source specific characteristics. It thus delivers results for the areas of SOA, Web services, CEP and EDA.

On precise three-dimensional environment modeling via UAV-based photogrammetric systems

Abstract : Images acquired from unmanned aerial vehicles (UAVs) can provide data with unprecedented spatial and temporal resolution for three-dimensional (3D) modeling. Solutions developed for this purpose are mainly operating based on photogrammetry concepts, namely UAV-Photogrammetry Systems (UAV-PS). Such systems are used in applications where both geospatial and visual information of the environment is required. These applications include, but are not limited to, natural resource management such as precision agriculture, military and police-related services such as traffic-law enforcement, precision engineering such as infrastructure inspection, and health services such as epidemic emergency management. UAV-photogrammetry systems can be differentiated based on their spatial characteristics in terms of accuracy and resolution. That is some applications, such as precision engineering, require high-resolution and high-accuracy information of the environment (e.g. 3D modeling with less than one centimeter accuracy and resolution). In other applications, lower levels of accuracy might be sufficient, (e.g. wildlife management needing few decimeters of resolution). However, even in those applications, the specific characteristics of UAV-PSs should be well considered in the steps of both system development and application in order to yield satisfying results. In this regard, this thesis presents a comprehensive review of the applications of unmanned aerial imagery, where the objective was to determine the challenges that remote-sensing applications of UAV systems currently face. This review also allowed recognizing the specific characteristics and requirements of UAV-PSs, which are mostly ignored or not thoroughly assessed in recent studies. Accordingly, the focus of the first part of this thesis is on exploring the methodological and experimental aspects of implementing a UAV-PS. The developed system was extensively evaluated for precise modeling of an open-pit gravel mine and performing volumetric-change measurements. This application was selected for two main reasons. Firstly, this case study provided a challenging environment for 3D modeling, in terms of scale changes, terrain relief variations as well as structure and texture diversities. Secondly, open-pit-mine monitoring demands high levels of accuracy, which justifies our efforts to improve the developed UAV-PS to its maximum capacities. The hardware of the system consisted of an electric-powered helicopter, a high-resolution digital camera, and an inertial navigation system. The software of the system included the in-house programs specifically designed for camera calibration, platform calibration, system integration, onboard data acquisition, flight planning and ground control point (GCP) detection. The detailed features of the system are discussed in the thesis, and solutions are proposed in order to enhance the system and its photogrammetric outputs. The accuracy of the results was evaluated under various mapping conditions, including direct georeferencing and indirect georeferencing with different numbers, distributions and types of ground control points. Additionally, the effects of imaging configuration and network stability on modeling accuracy were assessed. The second part of this thesis concentrates on improving the techniques of sparse and dense reconstruction. The proposed solutions are alternatives to traditional aerial photogrammetry techniques, properly adapted to specific characteristics of unmanned, low-altitude imagery. Firstly, a method was developed for robust sparse matching and epipolar-geometry estimation. The main achievement of this method was its capacity to handle a very high percentage of outliers (errors among corresponding points) with remarkable computational efficiency (compared to the state-of-the-art techniques). Secondly, a block bundle adjustment (BBA) strategy was proposed based on the integration of intrinsic camera calibration parameters as pseudo-observations to Gauss-Helmert model. The principal advantage of this strategy was controlling the adverse effect of unstable imaging networks and noisy image observations on the accuracy of self-calibration. The sparse implementation of this strategy was also performed, which allowed its application to data sets containing a lot of tie points. Finally, the concepts of intrinsic curves were revisited for dense stereo matching. The proposed technique could achieve a high level of accuracy and efficiency by searching only through a small fraction of the whole disparity search space as well as internally handling occlusions and matching ambiguities. These photogrammetric solutions were extensively tested using synthetic data, close-range images and the images acquired from the gravel-pit mine. Achieving absolute 3D mapping accuracy of 11±7 mm illustrated the success of this system for high-precision modeling of the environment.

Development of a transitioning approach to reduce surface water volumes in combined sewer systems

The overarching goal of this research is to establish a successful forum for a transition from the existing paradigm of managing wastewater infrastructure to a more sustainable paradigm that achieves a more efficient utilisation of wastewater assets. A transitioning approach to support a more efficient utilisation of surface water and wastewater assets and infrastructure is proposed and developed. The determined transitioning approach possesses key stages namely developing the arena, developing the agenda, case study, and monitoring. The case study stage investigates a drainage utility identifying their improvement drivers, the removal of surface water through detailed drainage modelling and the financial examination of the costs incurred under the various scenarios conducted. Understanding the implications of removing/attenuating surface water from the network is improved through obtaining data by detailed drainage modelling. Infoworks software is used to investigate and assess the current and future operational scenarios of a wastewater system operating over one calendar year. Modelling scenarios were conducted removing surface water from selected areas focusing on the volumes requiring pumping and durations of pumping station(s) operation prior to treatment during storm conditions. The financial implication of removing surface water in combined sewer systems is examined in three main components. Firstly the costs of electricity incurred at the single sewage pumping station (SPS) investigated during the various scenarios modelled require to be addressed. Secondly the costs to retrofit sustainable urban drainage system (SUDS) solutions needs to be identified. Thirdly the implications of removing surface water for the drainage utility at the national level and the potential saving for householder’s committing to a surface water disconnection rebate scheme. When addressed at the macro level i.e., with over 2,100 pumping stations, some operating in sequence and contained within one drainage utility annually treating 315,360 megalitres the significance of the same multiple quantifiable and intangible benefits becomes amplified. The research aims, objectives and findings are presented to the identified and convened stakeholders. The transitioning approach developed encourages positive discourse between stakeholders. The level of success of the transitioning approach determined is then tested using a quantitative methodology through the completion of questionnaires. From the questionnaires completed the respondents unanimously agreed that surface water flows should be removed as well as reduced from the combined sewer system. The respondents agreed that the removal of surface water from a typical combined sewer system is justified by applying a transitioning approach focusing on the energy consumption required to pump increased volumes during storm events. This response is significant based upon the economic evidence and is contrary to the respondents previous position that finance was their most influencing factor. When provided with other potentially available benefits the respondents were even more supportive of the justification to remove surface water from the combined sewer system. The combined findings of the work presented in this thesis provide further justification that the transitioning approach applied to the removal of surface water from a typical combined sewer system, as determined in this research has been successful.

Design, modelling, simulation and integration of cyber physical systems: methods and applications

The main drivers for the development and evolution of Cyber Physical Systems (CPS) are the reduction of development costs and time along with the enhancement of the designed products. The aim of this survey paper is to provide an overview of different types of system and the associated transition process from mechatronics to CPS and cloud-based (IoT) systems. It will further consider the requirement that methodologies for CPS-design should be part of a multi-disciplinary development process within which designers should focus not only on the separate physical and computational components, but also on their integration and interaction. Challenges related to CPS-design are therefore considered in the paper from the perspectives of the physical processes, computation and integration respectively. Illustrative case studies are selected from different system levels starting with the description of the overlaying concept of Cyber Physical Production Systems (CPPSs). The analysis and evaluation of the specific properties of a sub-system using a condition monitoring system, important for the maintenance purposes, is then given for a wind turbine.

User Behavioral Modeling of Web-based Systems for Continuous User Authentication

Authentication plays an important role in how we interact with computers, mobile devices, the web, etc. The idea of authentication is to uniquely identify a user before granting access to system privileges. For example, in recent years more corporate information and applications have been accessible via the Internet and Intranet. Many employees are working from remote locations and need access to secure corporate files. During this time, it is possible for malicious or unauthorized users to gain access to the system. For this reason, it is logical to have some mechanism in place to detect whether the logged-in user is the same user in control of the user's session. Therefore, highly secure authentication methods must be used. We posit that each of us is unique in our use of computer systems. It is this uniqueness that is leveraged to "continuously authenticate users" while they use web software. To monitor user behavior, n-gram models are used to capture user interactions with web-based software. This statistical language model essentially captures sequences and sub-sequences of user actions, their orderings, and temporal relationships that make them unique by providing a model of how each user typically behaves. Users are then continuously monitored during software operations. Large deviations from "normal behavior" can possibly indicate malicious or unintended behavior. This approach is implemented in a system called Intruder Detector (ID) that models user actions as embodied in web logs generated in response to a user's actions. User identification through web logs is cost-effective and non-intrusive. We perform experiments on a large fielded system with web logs of approximately 4000 users. For these experiments, we use two classification techniques; binary and multi-class classification. We evaluate model-specific differences of user behavior based on coarse-grain (i.e., role) and fine-grain (i.e., individual) analysis. A specific set of metrics are used to provide valuable insight into how each model performs. Intruder Detector achieves accurate results when identifying legitimate users and user types. This tool is also able to detect outliers in role-based user behavior with optimal performance. In addition to web applications, this continuous monitoring technique can be used with other user-based systems such as mobile devices and the analysis of network traffic.