Adaptive Real-time Anomaly-based Intrusion Detection using Data Mining and Machine Learning Techniques

Die zunehmende Vernetzung der Informations- und Kommunikationssysteme führt zu einer weiteren Erhöhung der Komplexität und damit auch zu einer weiteren Zunahme von Sicherheitslücken. Klassische Schutzmechanismen wie Firewall-Systeme und Anti-Malware-Lösungen bieten schon lange keinen Schutz mehr vor Eindringversuchen in IT-Infrastrukturen. Als ein sehr wirkungsvolles Instrument zum Schutz gegenüber Cyber-Attacken haben sich hierbei die Intrusion Detection Systeme (IDS) etabliert. Solche Systeme sammeln und analysieren Informationen von Netzwerkkomponenten und Rechnern, um ungewöhnliches Verhalten und Sicherheitsverletzungen automatisiert festzustellen. Während signatur-basierte Ansätze nur bereits bekannte Angriffsmuster detektieren können, sind anomalie-basierte IDS auch in der Lage, neue bisher unbekannte Angriffe (Zero-Day-Attacks) frühzeitig zu erkennen. Das Kernproblem von Intrusion Detection Systeme besteht jedoch in der optimalen Verarbeitung der gewaltigen Netzdaten und der Entwicklung eines in Echtzeit arbeitenden adaptiven Erkennungsmodells. Um diese Herausforderungen lösen zu können, stellt diese Dissertation ein Framework bereit, das aus zwei Hauptteilen besteht. Der erste Teil, OptiFilter genannt, verwendet ein dynamisches "Queuing Concept", um die zahlreich anfallenden Netzdaten weiter zu verarbeiten, baut fortlaufend Netzverbindungen auf, und exportiert strukturierte Input-Daten für das IDS. Den zweiten Teil stellt ein adaptiver Klassifikator dar, der ein Klassifikator-Modell basierend auf "Enhanced Growing Hierarchical Self Organizing Map" (EGHSOM), ein Modell für Netzwerk Normalzustand (NNB) und ein "Update Model" umfasst. In dem OptiFilter werden Tcpdump und SNMP traps benutzt, um die Netzwerkpakete und Hostereignisse fortlaufend zu aggregieren. Diese aggregierten Netzwerkpackete und Hostereignisse werden weiter analysiert und in Verbindungsvektoren umgewandelt. Zur Verbesserung der Erkennungsrate des adaptiven Klassifikators wird das künstliche neuronale Netz GHSOM intensiv untersucht und wesentlich weiterentwickelt. In dieser Dissertation werden unterschiedliche Ansätze vorgeschlagen und diskutiert. So wird eine classification-confidence margin threshold definiert, um die unbekannten bösartigen Verbindungen aufzudecken, die Stabilität der Wachstumstopologie durch neuartige Ansätze für die Initialisierung der Gewichtvektoren und durch die Stärkung der Winner Neuronen erhöht, und ein selbst-adaptives Verfahren eingeführt, um das Modell ständig aktualisieren zu können. Darüber hinaus besteht die Hauptaufgabe des NNB-Modells in der weiteren Untersuchung der erkannten unbekannten Verbindungen von der EGHSOM und der Überprüfung, ob sie normal sind. Jedoch, ändern sich die Netzverkehrsdaten wegen des Concept drif Phänomens ständig, was in Echtzeit zur Erzeugung nicht stationärer Netzdaten führt. Dieses Phänomen wird von dem Update-Modell besser kontrolliert. Das EGHSOM-Modell kann die neuen Anomalien effektiv erkennen und das NNB-Model passt die Änderungen in Netzdaten optimal an. Bei den experimentellen Untersuchungen hat das Framework erfolgversprechende Ergebnisse gezeigt. Im ersten Experiment wurde das Framework in Offline-Betriebsmodus evaluiert. Der OptiFilter wurde mit offline-, synthetischen- und realistischen Daten ausgewertet. Der adaptive Klassifikator wurde mit dem 10-Fold Cross Validation Verfahren evaluiert, um dessen Genauigkeit abzuschätzen. Im zweiten Experiment wurde das Framework auf einer 1 bis 10 GB Netzwerkstrecke installiert und im Online-Betriebsmodus in Echtzeit ausgewertet. Der OptiFilter hat erfolgreich die gewaltige Menge von Netzdaten in die strukturierten Verbindungsvektoren umgewandelt und der adaptive Klassifikator hat sie präzise klassifiziert. Die Vergleichsstudie zwischen dem entwickelten Framework und anderen bekannten IDS-Ansätzen zeigt, dass der vorgeschlagene IDSFramework alle anderen Ansätze übertrifft. Dies lässt sich auf folgende Kernpunkte zurückführen: Bearbeitung der gesammelten Netzdaten, Erreichung der besten Performanz (wie die Gesamtgenauigkeit), Detektieren unbekannter Verbindungen und Entwicklung des in Echtzeit arbeitenden Erkennungsmodells von Eindringversuchen.

Online Learning of Non-stationary Sequences

We consider an online learning scenario in which the learner can make predictions on the basis of a fixed set of experts. The performance of each expert may change over time in a manner unknown to the learner. We formulate a class of universal learning algorithms for this problem by expressing them as simple Bayesian algorithms operating on models analogous to Hidden Markov Models (HMMs). We derive a new performance bound for such algorithms which is considerably simpler than existing bounds. The bound provides the basis for learning the rate at which the identity of the optimal expert switches over time. We find an analytic expression for the a priori resolution at which we need to learn the rate parameter. We extend our scalar switching-rate result to models of the switching-rate that are governed by a matrix of parameters, i.e. arbitrary homogeneous HMMs. We apply and examine our algorithm in the context of the problem of energy management in wireless networks. We analyze the new results in the framework of Information Theory.

Models of Learning and Motivation

A brief skim through educational theory intended for students registered on a single module in Technology Enhanced Learning. Startes with Blooms taxonomy, travles through instructivism and constructivism and on to theories of motivation/

Actitudes de los directivos en torno a la adopción del e-learning como herramienta de trabajo en las empresas

El desarrollo del presente documento constituye una investigación sobre las actitudes de los directivos frente a la adopción del e-learning como herramienta de trabajo en las organizaciones de Bogotá. Para ello se realizó una encuesta a 101 directivos, tomando como base el tipo de muestreo de conveniencia; esto con el objetivo de identificar sus actitudes frente al uso del e-learning y su influencia dentro de la organización. Como resultado se obtuvo que las actitudes de los directivos influencian en el uso de herramientas e-learning, así como también en las acciones que promueven su uso y en las actitudes de los empleados; por otro lado se identificó que las creencias relacionadas con la apropiación de herramientas e-learning y los factores facilitadores del uso de estas, influencian en las actitudes de los directivos. Lo anterior, corresponde a los análisis llevados a cabo a partir de los resultados contrastados con los estudios empíricos hallados y el marco teórico desarrollado.

Primary science : teaching theory and practice.

Este texto es una guía para la enseñanza de la ciencia primaria según lo establecido en las normas profesionales para la acreditación docente (QTS) en Inglaterra y el Reino Unido. Cada capítulo incluye estudios de casos de situaciones para ayudar a los alumnos a establecer el vínculo entre la teoría y la enseñanza práctica en el aula. También se incluyen en cada capítulo resúmenes de investigaciones clave para guiar a los estudiantes en una comprensión más profunda de los fundamentos teóricos de la enseñanza, ideas para actividades prácticas en el aula y un glosario de los principales términos científicos.

An analysis of the moderating effects of age in the acceptance of Learning Management Systems. 'Análisis del efecto moderador de la edad en la aceptación de sistemas e-learning LMS'.

Resumen basado en el de la publicación

Fases y clasificaci??n de adoptantes de blended learning en contextos universitarios : aplicaci??n del an??lisis CHAID

Resumen basado en el de la publicaci??n

Gradient-based reinforcement learning techniques for underwater robotics behavior learning

Darrerament, l'interès pel desenvolupament d'aplicacions amb robots submarins autònoms (AUV) ha crescut de forma considerable. Els AUVs són atractius gràcies al seu tamany i el fet que no necessiten un operador humà per pilotar-los. Tot i això, és impossible comparar, en termes d'eficiència i flexibilitat, l'habilitat d'un pilot humà amb les escasses capacitats operatives que ofereixen els AUVs actuals. L'utilització de AUVs per cobrir grans àrees implica resoldre problemes complexos, especialment si es desitja que el nostre robot reaccioni en temps real a canvis sobtats en les condicions de treball. Per aquestes raons, el desenvolupament de sistemes de control autònom amb l'objectiu de millorar aquestes capacitats ha esdevingut una prioritat. Aquesta tesi tracta sobre el problema de la presa de decisions utilizant AUVs. El treball presentat es centra en l'estudi, disseny i aplicació de comportaments per a AUVs utilitzant tècniques d'aprenentatge per reforç (RL). La contribució principal d'aquesta tesi consisteix en l'aplicació de diverses tècniques de RL per tal de millorar l'autonomia dels robots submarins, amb l'objectiu final de demostrar la viabilitat d'aquests algoritmes per aprendre tasques submarines autònomes en temps real. En RL, el robot intenta maximitzar un reforç escalar obtingut com a conseqüència de la seva interacció amb l'entorn. L'objectiu és trobar una política òptima que relaciona tots els estats possibles amb les accions a executar per a cada estat que maximitzen la suma de reforços totals. Així, aquesta tesi investiga principalment dues tipologies d'algoritmes basats en RL: mètodes basats en funcions de valor (VF) i mètodes basats en el gradient (PG). Els resultats experimentals finals mostren el robot submarí Ictineu en una tasca autònoma real de seguiment de cables submarins. Per portar-la a terme, s'ha dissenyat un algoritme anomenat mètode d'Actor i Crític (AC), fruit de la fusió de mètodes VF amb tècniques de PG.

Innovative use of vodcast (Video-Podcast) to enrich learning experience in structures laboratory

Students may have difficulty in understanding some of the complex concepts which they have been taught in the general areas of science and engineering. Whilst practical work such as a laboratory based examination of the performance of structures has an important role in knowledge construction this does have some limitations. Blended learning supports different learning styles, hence further benefits knowledge building. This research involves an empirical study of how vodcasts (video-podcasts) can be used to enrich learning experience in the structural properties of materials laboratory of an undergraduate course. Students were given the opportunity of downloading and viewing the vodcasts on the theory before and after the experimental work. It is the choice of the students when (before or after, before and after) and how many times they would like to view the vodcasts. In blended learning, the combination of face-to-face teaching, vodcasts, printed materials, practical experiments, writing reports and instructors’ feedbacks benefits different learning styles of the learners. For the preparation of the practical, the students were informed about the availability of the vodcasts prior to the practical session. After the practical work, students submitted an individual laboratory report for the assessment of the structures laboratory. The data collection consisted of a questionnaire completed by the students, follow-up semi-structured interviews and the practical reports submitted by them for assessment. The results from the questionnaire were analysed quantitatively, whilst the data from the assessment reports were analysed qualitatively. The analysis shows that most of the students who have not fully grasped the theory after the practical, managed to gain the required knowledge by viewing the vodcasts. According to their feedbacks, the students felt that they have control over how to use the material and to view it as many times as they wish. Some students who have understood the theory may choose to view it once or not at all. Their understanding was demonstrated by their explanations in their reports, and was illustrated by the approach they took to explicate the results of their experimental work. The research findings are valuable to instructors who design, develop and deliver different types of blended learning, and are beneficial to learners who try different blended approaches. Recommendations were made on the role of the innovative application of vodcasts in the knowledge construction for structures laboratory and to guide future work in this area of research.

Blended learning approach to include the innovative use of vodcasts (video-podcasts) to enrich students learning experience in structures laboratory

Students may have difficulty in understanding some of the complex concepts which they have been taught in the general areas of science and engineering. Whilst practical work such as a laboratory based examination of the performance of structures has an important role in knowledge construction this does have some limitations. Blended learning supports different learning styles, hence further benefits knowledge building. This research involves the empirical studies of how an innovative use of vodcasts (video-podcasts) can enrich learning experience in the structural properties of materials laboratory of an undergraduate course. Students were given the opportunity of downloading and viewing the vodcasts on the theory before and after the experimental work. It is the choice of the students when (before or after, before and after) and how many times they would like to view the vodcasts. In blended learning, the combination of face-to-face teaching, vodcasts, printed materials, practical experiments, writing reports and instructors’ feedbacks benefits different learning styles of the learners. For the preparation of the practical laboratory work, the students were informed about the availability of the vodcasts prior to the practical session. After the practical work, students submit an individual laboratory report for the assessment of the structures laboratory. The data collection consists of a questionnaire completed by the students, and the practical reports submitted by them for assessment. The results from the questionnaire were analysed quantitatively, whilst the data from the assessment reports were analysed qualitatively. The analysis shows that students who have not fully grasped the theory after the practical were successful in gaining the required knowledge by viewing the vodcasts. Some students who have understood the theory may choose to view it once or not at all. Their understanding was demonstrated by the quality of their explanations in their reports. This is illustrated by the approach they took to explicate the results of their experimental work, for example, they can explain how to calculate the Young’s Modulus properly and provided the correct value for it. The research findings are valuable to instructors who design, develop and deliver different types of blended learning, and beneficial to learners who try different blended approaches. Recommendations were made on the role of the innovative application of vodcasts in the knowledge construction for structures laboratory and to guide future work in this area of research.

A perspective on chaos theory: Potential applications to intelligent buildings

Mathematical models have been vitally important in the development of technologies in building engineering. A literature review identifies that linear models are the most widely used building simulation models. The advent of intelligent buildings has added new challenges in the application of the existing models as an intelligent building requires learning and self-adjusting capabilities based on environmental and occupants' factors. It is therefore argued that the linearity is an impropriate basis for any model of either complex building systems or occupant behaviours for control or whatever purpose. Chaos and complexity theory reflects nonlinear dynamic properties of the intelligent systems excised by occupants and environment and has been used widely in modelling various engineering, natural and social systems. It is proposed that chaos and complexity theory be applied to study intelligent buildings. This paper gives a brief description of chaos and complexity theory and presents its current positioning, recent developments in building engineering research and future potential applications to intelligent building studies, which provides a bridge between chaos and complexity theory and intelligent building research.

Designing Year 12 strategy training in listening and writing: from theory to practice

This article outlines some of the key issues involved in developing a programme of strategy training for learners of French, in listening and in writing. It highlights the theoretical perspectives and research findings on listening and writing that informed the selection of strategies to teach learners and thence the development of appropriate materials. Examples of these materials are given as well as advice regarding their use. The article concludes with suggestions for how strategy training might be incorporated into teachers' own work with learners.

An instructional design model for constructivist learning

The emergent requirements for effective e-learning calls for a paradigm shift for instructional design. Constructivist theory and semiotics offer a sound underpinning to enable such revolutionary change by employing the concepts of Learning Objects. E-learning guidelines adopted by the industry have led successfully to the development of training materials. Inadequacy and deficiency of those methods for Higher Education have been identified in this paper. Based on the best practice in industry and our empirical research, we present an instructional design model with practical templates for constructivist learning.

Neurofuzzy mixture of experts network parallel learning and model construction algorithms

A connection between a fuzzy neural network model with the mixture of experts network (MEN) modelling approach is established. Based on this linkage, two new neuro-fuzzy MEN construction algorithms are proposed to overcome the curse of dimensionality that is inherent in the majority of associative memory networks and/or other rule based systems. The first construction algorithm employs a function selection manager module in an MEN system. The second construction algorithm is based on a new parallel learning algorithm in which each model rule is trained independently, for which the parameter convergence property of the new learning method is established. As with the first approach, an expert selection criterion is utilised in this algorithm. These two construction methods are equivalent in their effectiveness in overcoming the curse of dimensionality by reducing the dimensionality of the regression vector, but the latter has the additional computational advantage of parallel processing. The proposed algorithms are analysed for effectiveness followed by numerical examples to illustrate their efficacy for some difficult data based modelling problems.

Adapting to new challenges: extension theory and practice for the 21st century

Twenty first century challenges facing agriculture include climate change, threats to food security for a growing population and downward economic pressures on rural livelihoods. Addressing these challenges will require innovation in extension theory, policy and education, at a time when the dominance of the state in the provision of knowledge and information services to farmers and rural entrepreneurs continues to decline. This paper suggests that extension theory is catching up with and helping us to understand innovative extension practice, and therefore provides a platform for improving rural development policies and strategies. Innovation is now less likely to be spoken of as something to be passed on to farmers, than as a continuing process of creativity and adaptation that can be nurtured and sustained. Innovation systems and innovation platforms are concepts that recognise the multiple factors that lead to farmers’ developing, adapting and applying new ideas and the importance of linking all actors in the value chain to ensure producers can access appropriate information and advice for decision making at all stages in the production process. Concepts of social learning, group development and solidarity, social capital, collective action and empowerment all help to explain and therefore to apply more effectively group extension approaches in building confidence and sustaining innovation. A challenge facing educators is to ensure the curricula for aspiring extension professionals in our higher education institutions are regularly reviewed and keep up with current and future developments in theory, policy and practice.