An Alternative Approach To Computer System Security Monitoring And Enhancement Through System Call Sequence Analysis

Modern computer systems are plagued with stability and security problems: applications lose data, web servers are hacked, and systems crash under heavy load. Many of these problems or anomalies arise from rare program behavior caused by attacks or errors. A substantial percentage of the web-based attacks are due to buffer overflows. Many methods have been devised to detect and prevent anomalous situations that arise from buffer overflows. The current state-of-art of anomaly detection systems is relatively primitive and mainly depend on static code checking to take care of buffer overflow attacks. For protection, Stack Guards and I-leap Guards are also used in wide varieties.This dissertation proposes an anomaly detection system, based on frequencies of system calls in the system call trace. System call traces represented as frequency sequences are profiled using sequence sets. A sequence set is identified by the starting sequence and frequencies of specific system calls. The deviations of the current input sequence from the corresponding normal profile in the frequency pattern of system calls is computed and expressed as an anomaly score. A simple Bayesian model is used for an accurate detection.Experimental results are reported which show that frequency of system calls represented using sequence sets, captures the normal behavior of programs under normal conditions of usage. This captured behavior allows the system to detect anomalies with a low rate of false positives. Data are presented which show that Bayesian Network on frequency variations responds effectively to induced buffer overflows. It can also help administrators to detect deviations in program flow introduced due to errors.

Acoustic radiation and scattering from cylindrical bodies and analysis of transducer arrays

New mathematical methods to analytically investigate linear acoustic radiation and scattering from cylindrical bodies and transducer arrays are presented. Three problems of interest involving cylinders in an infinite fluid are studied. In all the three problems, the Helmholtz equation is used to model propagation through the fluid and the beam patterns of arrays of transducers are studied. In the first problem, a method is presented to determine the omni-directional and directional far-field pressures radiated by a cylindrical transducer array in an infinite rigid cylindrical baffle. The solution to the Helmholtz equation and the displacement continuity condition at the interface between the array and the surrounding water are used to determine the pressure. The displacement of the surface of each transducer is in the direction of the normal to the array and is assumed to be uniform. Expressions are derived for the pressure radiated by a sector of the array vibrating in-phase, the entire array vibrating in-phase, and a sector of the array phase-shaded to simulate radiation from a rectangular piston. It is shown that the uniform displacement required for generating a source level of 220 dB ref. μPa @ 1m that is omni directional in the azimuthal plane is in the order of 1 micron for typical arrays. Numerical results are presented to show that there is only a small difference between the on-axis pressures radiated by phased cylindrical arrays and planar arrays. The problem is of interest because cylindrical arrays of projectors are often used to search for underwater objects. In the second problem, the errors, when using data-independent, classical, energy and split beam correlation methods, in finding the direction of arrival (DOA) of a plane acoustic wave, caused by the presence of a solid circular elastic cylindrical stiffener near a linear array of hydrophones, are investigated. Scattering from the effectively infinite cylinder is modeled using the exact axisymmetric equations of motion and the total pressures at the hydrophone locations are computed. The effect of the radius of the cylinder, a, the distance between the cylinder and the array, b, the number of hydrophones in the array, 2H, and the angle of incidence of the wave, α, on the error in finding the DOA are illustrated using numerical results. For an array that is about 30 times the wavelength and for small angles of incidence (α<10), the error in finding the DOA using the energy method is less than that using the split beam correlation method with beam steered to α; and in some cases, the error increases when b increases; and the errors in finding the DOA using the energy method and the split beam correlation method with beam steered to α vary approximately as a7 / 4 . The problem is of interest because elastic stiffeners – in nearly acoustically transparent sonar domes that are used to protect arrays of transducers – scatter waves that are incident on it and cause an error in the estimated direction of arrival of the wave. In the third problem, a high-frequency ray-acoustics method is presented and used to determine the interior pressure field when a plane wave is normally incident on a fluid cylinder embedded in another infinite fluid. The pressure field is determined by using geometrical and physical acoustics. The interior pressure is expressed as the sum of the pressures due to all rays that pass through a point. Numerical results are presented for ka = 20 to 100 where k is the acoustic wavenumber of the exterior fluid and a is the radius of the cylinder. The results are in good agreement with those obtained using field theory. The directional responses, to the plane wave, of sectors of a circular array of uniformly distributed hydrophones in the embedded cylinder are then computed. The sectors are used to simulate linear arrays with uniformly distributed normals by using delays. The directional responses are compared with the output from an array in an infinite homogenous fluid. These outputs are of interest as they are used to determine the direction of arrival of the plane wave. Numerical results are presented for a circular array with 32 hydrophones and 12 hydrophones in each sector. The problem is of interest because arrays of hydrophones are housed inside sonar domes and acoustic plane waves from distant sources are scattered by the dome filled with fresh water and cause deterioration in the performance of the array.

Laser Spectroscopy: TDLAS instrumentation and NIR analysis of some organic materials

Near-infrared spectroscopy can be a workhorse technique for materials analysis in industries such as agriculture, pharmaceuticals, chemicals and polymers. A near-infrared spectrum represents combination bands and overtone bands that are harmonics of absorption frequencies in the mid-infrared. Near-infrared absorption includes a combination-band region immediately adjacent to the mid-infrared and three overtone regions. All four near-infrared regions contain "echoes" of the fundamental mid-infrared absorptions. For example, vibrations in the mid-infrared due to the C-H stretches will produce four distinct bands in each of the overtone and combination regions. As the bands become more removed from the fundamental frequencies they become more widely separated from their neighbors, more broadened and are dramatically reduced in intensity. Because near-infrared bands are much less intense, more of the sample can be used to produce a spectra and with near-infrared, sample preparation activities are greatly reduced or eliminated so more of the sample can be utilized. In addition, long path lengths and the ability to sample through glass in the near-infrared allows samples to be measured in common media such as culture tubes, cuvettes and reaction bottles. This is unlike mid-infrared where very small amounts of a sample produce a strong spectrum; thus sample preparation techniques must be employed to limit the amount of the sample that interacts with the beam. In the present work we describe the successful the fabrication and calibration of a linear high resolution linear spectrometer using tunable diode laser and a 36 m path length cell and meuurement of a highly resolved structure of OH group in methanol in the transition region A v =3. We then analyse the NIR spectrum of certain aromatic molecules and study the substituent effects using local mode theory

Studies on pulp propogation in single mode optical fibres

Studies on pulse propagation in single mode optical fibers have attracted interest from a wide area of science and technology as they have laid down the foundation for an in-depth understanding of the underlying physical principles, especially in the field of optical telecommunications. The foremost among them is discovery of the optical soliton which is considered to be one of the most significant events of the twentieth century owing to its fantastic ability to propagate undistorted over long distances and to remain unaflected after collision with each other. To exploit the important propertia of optical solitons, innovative mathematical models which take into account proper physical properties of the single mode optical fibers demand special attention. This thesis contains a theoretical analysis of the studies on soliton pulse propagation in single mode optical fibers.

Spectral clustering independent component analysis for tissue classification from brain MRI

A spectral angle based feature extraction method, Spectral Clustering Independent Component Analysis (SC-ICA), is proposed in this work to improve the brain tissue classification from Magnetic Resonance Images (MRI). SC-ICA provides equal priority to global and local features; thereby it tries to resolve the inefficiency of conventional approaches in abnormal tissue extraction. First, input multispectral MRI is divided into different clusters by a spectral distance based clustering. Then, Independent Component Analysis (ICA) is applied on the clustered data, in conjunction with Support Vector Machines (SVM) for brain tissue analysis. Normal and abnormal datasets, consisting of real and synthetic T1-weighted, T2-weighted and proton density/fluid-attenuated inversion recovery images, were used to evaluate the performance of the new method. Comparative analysis with ICA based SVM and other conventional classifiers established the stability and efficiency of SC-ICA based classification, especially in reproduction of small abnormalities. Clinical abnormal case analysis demonstrated it through the highest Tanimoto Index/accuracy values, 0.75/98.8%, observed against ICA based SVM results, 0.17/96.1%, for reproduced lesions. Experimental results recommend the proposed method as a promising approach in clinical and pathological studies of brain diseases

Flexure-shear Analysis of Concrete Beam Reinforced with GFRP bars

This paper gives the details of flexure-shear analysis of concrete beams reinforced with GFRP rebars. The influence of vertical reinforcement ratio, longitudinal reinforcement ratio and compressive strength of concrete on shear strength of GFRP reinforced concrete beam is studied. The critical value of shear span to depth ratio (a/d) at which the mode of failure changes from flexure to shear is studied. The fail-ure load of the beam is predicted for various values of a/d ratio. The prediction show that the longitudinally FRP reinforced concrete beams having no stirrups fail in shear for a/d ratio less than 9.0. It is expected that the predicted data is useful for structural engineers to design the FRP reinforced concrete members.

Raman and infrared spectral analysis of thallium niobyl phosphates: Tl2NbO2PO4, Tl3NaNb4O9(PO4)2 and TlNbOP2O7

Raman and infrared spectra of Tl2NbO2PO4, Tl3NaNb4O9(PO4)2 and TlNbOP2O7 are reported. The observed bands are assigned in terms of vibrations of NbO6 octahedra and PO4 tetrahedra in the first two compounds and in terms of NbO6 octahedra and P2O7 4− anion in the third compound. The NbO6 octahedra in all the title compounds are found to be corner-shared and distorted. The higher wavenumber values of the ν1 (NbO6) mode and other stretching modes indicate that the NbO6 octahedra in them are distorted in the order TlNbOP2O7 > Tl2NbO2PO4 > Tl3NaNb4O9(PO4)2. The splitting of the ν3 (PO4) mode indicates that PO4 tetrahedra is distorted more in Tl2NbO2PO4 than in Tl3NaNb4O9(PO4)2. The symmetry of P2O7 4− anion in TlNbOP2O7 is lowered. Bands indicate that the P–O–P bridge in the above compound has a bent P–O–P bridge configuration

Analysis of Stochastic Volatility Sequences Generated by Product Autoregressive Models

The classical methods of analysing time series by Box-Jenkins approach assume that the observed series uctuates around changing levels with constant variance. That is, the time series is assumed to be of homoscedastic nature. However, the nancial time series exhibits the presence of heteroscedasticity in the sense that, it possesses non-constant conditional variance given the past observations. So, the analysis of nancial time series, requires the modelling of such variances, which may depend on some time dependent factors or its own past values. This lead to introduction of several classes of models to study the behaviour of nancial time series. See Taylor (1986), Tsay (2005), Rachev et al. (2007). The class of models, used to describe the evolution of conditional variances is referred to as stochastic volatility modelsThe stochastic models available to analyse the conditional variances, are based on either normal or log-normal distributions. One of the objectives of the present study is to explore the possibility of employing some non-Gaussian distributions to model the volatility sequences and then study the behaviour of the resulting return series. This lead us to work on the related problem of statistical inference, which is the main contribution of the thesis

Femtosecond imaging-mode laser-induced breakdown spectroscopy

Many nonlinear optical microscopy techniques based on the high-intensity nonlinear phenomena were developed recent years. A new technique based on the minimal-invasive in-situ analysis of the specific bound elements in biological samples is described in the present work. The imaging-mode Laser-Induced Breakdown Spectroscopy (LIBS) is proposed as a combination of LIBS, femtosecond laser material processing and microscopy. The Calcium distribution in the peripheral cell wall of the sunflower seedling (Helianthus Annuus L.) stem is studied as a first application of the imaging-mode LIBS. At first, several nonlinear optical microscopy techniques are overviewed. The spatial resolution of the imaging-mode LIBS microscope is discussed basing on the Point-Spread Function (PSF) concept. The primary processes of the Laser-Induced Breakdown (LIB) are overviewed. We consider ionization, breakdown, plasma formation and ablation processes. Water with defined Calcium salt concentration is used as a model of the biological object in the preliminary experiments. The transient LIB spectra are measured and analysed for both nanosecond and femtosecond laser excitation. The experiment on the local Calcium concentration measurements in the peripheral cell wall of the sunflower seedling stem employing nanosecond LIBS shows, that nanosecond laser is not a suitable excitation source for the biological applications. In case of the nanosecond laser the ablation craters have random shape and depth over 20 µm. The analysis of the femtosecond laser ablation craters shows the reproducible circle form. At 3.5 µJ laser pulse energy the diameter of the crater is 4 µm and depth 140 nm for single laser pulse, which results in 1 femtoliter analytical volume. The experimental result of the 2 dimensional and surface sectioning of the bound Calcium concentrations is presented in the work.

CD-Systems of Restarting Automata

Die vorliegende Arbeit behandelt Restartautomaten und Erweiterungen von Restartautomaten. Restartautomaten sind ein Werkzeug zum Erkennen formaler Sprachen. Sie sind motiviert durch die linguistische Methode der Analyse durch Reduktion und wurden 1995 von Jancar, Mráz, Plátek und Vogel eingeführt. Restartautomaten bestehen aus einer endlichen Kontrolle, einem Lese/Schreibfenster fester Größe und einem flexiblen Band. Anfänglich enthält dieses sowohl die Eingabe als auch Bandbegrenzungssymbole. Die Berechnung eines Restartautomaten läuft in so genannten Zyklen ab. Diese beginnen am linken Rand im Startzustand, in ihnen wird eine lokale Ersetzung auf dem Band durchgeführt und sie enden mit einem Neustart, bei dem das Lese/Schreibfenster wieder an den linken Rand bewegt wird und der Startzustand wieder eingenommen wird. Die vorliegende Arbeit beschäftigt sich hauptsächlich mit zwei Erweiterungen der Restartautomaten: CD-Systeme von Restartautomaten und nichtvergessende Restartautomaten. Nichtvergessende Restartautomaten können einen Zyklus in einem beliebigen Zustand beenden und CD-Systeme von Restartautomaten bestehen aus einer Menge von Restartautomaten, die zusammen die Eingabe verarbeiten. Dabei wird ihre Zusammenarbeit durch einen Operationsmodus, ähnlich wie bei CD-Grammatik Systemen, geregelt. Für beide Erweiterungen zeigt sich, dass die deterministischen Modelle mächtiger sind als deterministische Standardrestartautomaten. Es wird gezeigt, dass CD-Systeme von Restartautomaten in vielen Fällen durch nichtvergessende Restartautomaten simuliert werden können und andererseits lassen sich auch nichtvergessende Restartautomaten durch CD-Systeme von Restartautomaten simulieren. Des Weiteren werden Restartautomaten und nichtvergessende Restartautomaten untersucht, die nichtdeterministisch sind, aber keine Fehler machen. Es zeigt sich, dass diese Automaten durch deterministische (nichtvergessende) Restartautomaten simuliert werden können, wenn sie direkt nach der Ersetzung einen neuen Zyklus beginnen, oder ihr Fenster nach links und rechts bewegen können. Außerdem gilt, dass alle (nichtvergessenden) Restartautomaten, die zwar Fehler machen dürfen, diese aber nach endlich vielen Zyklen erkennen, durch (nichtvergessende) Restartautomaten simuliert werden können, die keine Fehler machen. Ein weiteres wichtiges Resultat besagt, dass die deterministischen monotonen nichtvergessenden Restartautomaten mit Hilfssymbolen, die direkt nach dem Ersetzungsschritt den Zyklus beenden, genau die deterministischen kontextfreien Sprachen erkennen, wohingegen die deterministischen monotonen nichtvergessenden Restartautomaten mit Hilfssymbolen ohne diese Einschränkung echt mehr, nämlich die links-rechts regulären Sprachen, erkennen. Damit werden zum ersten Mal Restartautomaten mit Hilfssymbolen, die direkt nach dem Ersetzungsschritt ihren Zyklus beenden, von Restartautomaten desselben Typs ohne diese Einschränkung getrennt. Besonders erwähnenswert ist hierbei, dass beide Automatentypen wohlbekannte Sprachklassen beschreiben.

Statistical Analysis of Diabetes Mellitus

Diabetes mellitus is a disease where the glucosis-content of the blood does not automatically decrease to a ”normal” value between 70 mg/dl and 120 mg/dl (3,89 mmol/l and 6,67 mmol/l) between perhaps one hour (or two hours) after eating. Several instruments can be used to arrive at a relative low increase of the glucosis-content. Besides drugs (oral antidiabetica, insulin) the blood-sugar content can mainly be influenced by (i) eating, i.e., consumption of the right amount of food at the right time (ii) physical training (walking, cycling, swimming). In a recent paper the author has performed a regression analysis on the influence of eating during the night. The result was that one ”bread-unit” (12g carbon-hydrats) increases the blood-sugar by about 50 mg/dl, while one hour after eating the blood-sugar decreases by about 10 mg/dl per hour. By applying this result-assuming its correctness - it is easy to eat the right amount during the night and to arrive at a fastening blood-sugar (glucosis-content) in the morning of about 100 mg/dl (5,56 mmol/l). In this paper we try to incorporate some physical exercise into the model.

Characterization of DnmA, the Dnmt2 homolog in Dictyostelium discoideum

Eukaryotic DNA m5C methyltransferases (MTases) play a major role in many epigenetic regulatory processes like genomic imprinting, X-chromosome inactivation, silencing of transposons and gene expression. Members of the two DNA m5C MTase families, Dnmt1 and Dnmt3, are relatively well studied and many details of their biological functions, biochemical properties as well as interaction partners are known. In contrast, the biological functions of the highly conserved Dnmt2 family, which appear to have non-canonical dual substrate specificity, remain enigmatic despite the efforts of many researchers. The genome of the social amoeba Dictyostelium encodes Dnmt2-homolog, the DnmA, as the only DNA m5C MTase which allowed us to study Dnmt2 function in this organism without interference by the other enzymes. The dnmA gene can be easily disrupted but the knock-out clones did not show obvious phenotypes under normal lab conditions, suggesting that the function of DnmA is not vital for the organism. It appears that the dnmA gene has a low expression profile during vegetative growth and is only 5-fold upregulated during development. Fluorescence microscopy indicated that DnmA-GFP fusions were distributed between both the nucleus and cytoplasm with some enrichment in nuclei. Interestingly, the experiments showed specific dynamics of DnmA-GFP distribution during the cell cycle. The proteins colocalized with DNA in the interphase and were mainly removed from nuclei during mitosis. DnmA functions as an active DNA m5C MTase in vivo and is responsible for weak but detectable DNA methylation of several regions in the Dictyostelium genome. Nevertheless, gel retardation assays showed only slightly higher affinity of the enzyme to dsDNA compared to ssDNA and no specificity towards various sequence contexts, although weak but detectable specificity towards AT-rich sequences was observed. This could be due to intrinsic curvature of such sequences. Furthermore, DnmA did not show denaturant-resistant covalent complexes with dsDNA in vitro, although it could form covalent adducts with ssDNA. Low binding and methyltransfer activity in vitro suggest the necessity of additional factor in DnmA function. Nevertheless, no candidates could be identified in affinity purification experiments with different tagged DnmA fusions. In this respect, it should be noted that tagged DnmA fusion preparations from Dictyostelium showed somewhat higher activity in both covalent adduct formation and methylation assays than DnmA expressed in E.coli. Thus, the presence of co-purified factors cannot be excluded. The low efficiency of complex formation by the recombinant enzyme and the failure to define interacting proteins that could be required for DNA methylation in vivo, brought up the assumption that post-translational modifications could influence target recognition and enzymatic activity. Indeed, sites of phosphorylation, methylation and acetylation were identified within the target recognition domain (TRD) of DnmA by mass spectrometry. For phosphorylation, the combination of MS data and bioinformatic analysis revealed that some of the sites could well be targets for specific kinases in vivo. Preliminary 3D modeling of DnmA protein based on homology with hDNMT2 allowed us to show that several identified phosphorylation sites located on the surface of the molecule, where they would be available for kinases. The presence of modifications almost solely within the TRD domain of DnmA could potentially modulate the mode of its interaction with the target nucleic acids. DnmA was able to form denaturant-resistant covalent intermediates with several Dictyostelium tRNAs, using as a target C38 in the anticodon loop. The formation of complexes not always correlated with the data from methylation assays, and seemed to be dependent on both sequence and structure of the tRNA substrate. The pattern, previously suggested by the Helm group for optimal methyltransferase activity of hDNMT2, appeared to contribute significantly in the formation of covalent adducts but was not the only feature of the substrate required for DnmA and hDNMT2 functions. Both enzymes required Mg2+ to form covalent complexes, which indicated that the specific structure of the target tRNA was indispensable. The dynamics of covalent adduct accumulation was different for DnmA and different tRNAs. Interestingly, the profiles of covalent adduct accumulation for different tRNAs were somewhat similar for DnmA and hDNMT2 enzymes. According to the proposed catalytic mechanism for DNA m5C MTases, the observed denaturant-resistant complexes corresponded to covalent enamine intermediates. The apparent discrepancies in the data from covalent complex formation and methylation assays may be interpreted by the possibility of alternative pathways of the catalytic mechanism, leading not to methylation but to exchange or demethylation reactions. The reversibility of enamine intermediate formation should also be considered. Curiously, native gel retardation assays showed no or little difference in binding affinities of DnmA to different RNA substrates and thus the absence of specificity in the initial enzyme binding. The meaning of the tRNA methylation as well as identification of novel RNA substrates in vivo should be the aim of further experiments.

Parameter identification of structural dynamic models by inverse statistical analysis

Auf dem Gebiet der Strukturdynamik sind computergestützte Modellvalidierungstechniken inzwischen weit verbreitet. Dabei werden experimentelle Modaldaten, um ein numerisches Modell für weitere Analysen zu korrigieren. Gleichwohl repräsentiert das validierte Modell nur das dynamische Verhalten der getesteten Struktur. In der Realität gibt es wiederum viele Faktoren, die zwangsläufig zu variierenden Ergebnissen von Modaltests führen werden: Sich verändernde Umgebungsbedingungen während eines Tests, leicht unterschiedliche Testaufbauten, ein Test an einer nominell gleichen aber anderen Struktur (z.B. aus der Serienfertigung), etc. Damit eine stochastische Simulation durchgeführt werden kann, muss eine Reihe von Annahmen für die verwendeten Zufallsvariablengetroffen werden. Folglich bedarf es einer inversen Methode, die es ermöglicht ein stochastisches Modell aus experimentellen Modaldaten zu identifizieren. Die Arbeit beschreibt die Entwicklung eines parameter-basierten Ansatzes, um stochastische Simulationsmodelle auf dem Gebiet der Strukturdynamik zu identifizieren. Die entwickelte Methode beruht auf Sensitivitäten erster Ordnung, mit denen Parametermittelwerte und Kovarianzen des numerischen Modells aus stochastischen experimentellen Modaldaten bestimmt werden können.

Possible solution of some essential zero problems in compositional data analysis

One of the tantalising remaining problems in compositional data analysis lies in how to deal with data sets in which there are components which are essential zeros. By an essential zero we mean a component which is truly zero, not something recorded as zero simply because the experimental design or the measuring instrument has not been sufficiently sensitive to detect a trace of the part. Such essential zeros occur in many compositional situations, such as household budget patterns, time budgets, palaeontological zonation studies, ecological abundance studies. Devices such as nonzero replacement and amalgamation are almost invariably ad hoc and unsuccessful in such situations. From consideration of such examples it seems sensible to build up a model in two stages, the first determining where the zeros will occur and the second how the unit available is distributed among the non-zero parts. In this paper we suggest two such models, an independent binomial conditional logistic normal model and a hierarchical dependent binomial conditional logistic normal model. The compositional data in such modelling consist of an incidence matrix and a conditional compositional matrix. Interesting statistical problems arise, such as the question of estimability of parameters, the nature of the computational process for the estimation of both the incidence and compositional parameters caused by the complexity of the subcompositional structure, the formation of meaningful hypotheses, and the devising of suitable testing methodology within a lattice of such essential zero-compositional hypotheses. The methodology is illustrated by application to both simulated and real compositional data

Meaning of the λ parameter of skew–normal and log–skew normal distributions in fluid geochemistry

The literature related to skew–normal distributions has grown rapidly in recent years but at the moment few applications concern the description of natural phenomena with this type of probability models, as well as the interpretation of their parameters. The skew–normal distributions family represents an extension of the normal family to which a parameter (λ) has been added to regulate the skewness. The development of this theoretical field has followed the general tendency in Statistics towards more flexible methods to represent features of the data, as adequately as possible, and to reduce unrealistic assumptions as the normality that underlies most methods of univariate and multivariate analysis. In this paper an investigation on the shape of the frequency distribution of the logratio ln(Cl−/Na+) whose components are related to waters composition for 26 wells, has been performed. Samples have been collected around the active center of Vulcano island (Aeolian archipelago, southern Italy) from 1977 up to now at time intervals of about six months. Data of the logratio have been tentatively modeled by evaluating the performance of the skew–normal model for each well. Values of the λ parameter have been compared by considering temperature and spatial position of the sampling points. Preliminary results indicate that changes in λ values can be related to the nature of environmental processes affecting the data