Decentralized detector generation in cooperative intrusion detection system

We consider Cooperative Intrusion Detection System (CIDS) which is a distributed AIS-based (Artificial Immune System) IDS where nodes collaborate over a peer-to-peer overlay network. The AIS uses the negative selection algorithm for the selection of detectors (e.g., vectors of features such as CPU utilization, memory usage and network activity). For better detection performance, selection of all possible detectors for a node is desirable but it may not be feasible due to storage and computational overheads. Limiting the number of detectors on the other hand comes with the danger of missing attacks. We present a scheme for the controlled and decentralized division of detector sets where each IDS is assigned to a region of the feature space. We investigate the trade-off between scalability and robustness of detector sets. We address the problem of self-organization in CIDS so that each node generates a distinct set of the detectors to maximize the coverage of the feature space while pairs of nodes exchange their detector sets to provide a controlled level of redundancy. Our contribution is twofold. First, we use Symmetric Balanced Incomplete Block Design, Generalized Quadrangles and Ramanujan Expander Graph based deterministic techniques from combinatorial design theory and graph theory to decide how many and which detectors are exchanged between which pair of IDS nodes. Second, we use a classical epidemic model (SIR model) to show how properties from deterministic techniques can help us to reduce the attack spread rate.

A formal method for attack modelling and detection

This paper presents a formal methodology for attack modeling and detection for networks. Our approach has three phases. First, we extend the basic attack tree approach 1 to capture (i) the temporal dependencies between components, and (ii) the expiration of an attack. Second, using the enhanced attack trees (EAT) we build a tree automaton that accepts a sequence of actions from input stream if there is a traverse of an attack tree from leaves to the root node. Finally, we show how to construct an enhanced parallel automaton (EPA) that has each tree automaton as a subroutine and can process the input stream by considering multiple trees simultaneously. As a case study, we show how to represent the attacks in IEEE 802.11 and construct an EPA for it.

Damage identification and condition assessment of building structures using frequency response functions and neural networks

This thesis investigated the viability of using Frequency Response Functions in combination with Artificial Neural Network technique in damage assessment of building structures. The proposed approach can help overcome some of limitations associated with previously developed vibration based methods and assist in delivering more accurate and robust damage identification results. Excellent results are obtained for damage identification of the case studies proving that the proposed approach has been developed successfully.

Practical Modbus flooding attack and detection

The Modicon Communication Bus (Modbus) protocol is one of the most commonly used protocols in industrial control systems. Modbus was not designed to provide security. This paper confirms that the Modbus protocol is vulnerable to flooding attacks. These attacks involve injection of commands that result in disrupting the normal operation of the control system. This paper describes a set of experiments that shows that an anomaly-based change detection algorithm and signature-based Snort threshold module are capable of detecting Modbus flooding attacks. In comparing these intrusion detection techniques, we find that the signature-based detection requires a carefully selected threshold value, and that the anomaly-based change detection algorithm may have a short delay before detecting the attacks depending on the parameters used. In addition, we also generate a network traffic dataset of flooding attacks on the Modbus control system protocol.

Identification and estimation of equivalent area parameters using synchronised phasor measurements

A new approach is proposed for obtaining a non-linear area-based equivalent model of power systems to express the inter-area oscillations using synchronised phasor measurements. The generators that remain coherent for inter-area disturbances over a wide range of operating conditions define the areas, and the reduced model is obtained by representing each area by an equivalent machine. The parameters of the reduced system are identified by processing the obtained measurements, and a non-linear Kalman estimator is then designed for the estimation of equivalent area angles and frequencies. The simulation of the approach on a two-area system shows substantial reduction of non-inter-area modes in the estimated angles. The proposed methods are also applied to a ten-machine system to illustrate the feasibility of the approach on larger and meshed networks.

A gray-box neural network-based model identification and fault estimation scheme for nonlinear dynamic systems

A novel gray-box neural network model (GBNNM), including multi-layer perception (MLP) neural network (NN) and integrators, is proposed for a model identification and fault estimation (MIFE) scheme. With the GBNNM, both the nonlinearity and dynamics of a class of nonlinear dynamic systems can be approximated. Unlike previous NN-based model identification methods, the GBNNM directly inherits system dynamics and separately models system nonlinearities. This model corresponds well with the object system and is easy to build. The GBNNM is embedded online as a normal model reference to obtain the quantitative residual between the object system output and the GBNNM output. This residual can accurately indicate the fault offset value, so it is suitable for differing fault severities. To further estimate the fault parameters (FPs), an improved extended state observer (ESO) using the same NNs (IESONN) from the GBNNM is proposed to avoid requiring the knowledge of ESO nonlinearity. Then, the proposed MIFE scheme is applied for reaction wheels (RW) in a satellite attitude control system (SACS). The scheme using the GBNNM is compared with other NNs in the same fault scenario, and several partial loss of effect (LOE) faults with different severities are considered to validate the effectiveness of the FP estimation and its superiority.

Phage library screening for the rapid identification and in vivo testing of candidate genes for a DNA vaccine against Mycoplasma mycoides subsp. mycoides small colony biotype

A new strategy for rapidly selecting and testing genetic vaccines has been developed, in which a whole genome library is cloned into a bacteriophage λ ZAP Express vector which contains both prokaryotic (Plac) and eukaryotic (PCMV) promoters upstream of the insertion site. The phage library is plated on Escherichia coli cells, immunoblotted, and probed with hyperimmune and/or convalescent-phase antiserum to rapidly identify vaccine candidates. These are then plaque purified and grown as liquid lysates, and whole bacteriophage particles are then used directly to immunize the host, following which PCMV-driven expression of the candidate vaccine gene occurs. In the example given here, a semirandom genome library of the bovine pathogen Mycoplasma mycoides subsp. mycoides small colony (SC) biotype was cloned into λ ZAP Express, and two strongly immunodominant clones, λ-A8 and λ-B1, were identified and subsequently tested for vaccine potential against M. mycoides subsp. mycoides SC biotype-induced mycoplasmemia. Sequencing and immunoblotting indicated that clone λ-A8 expressed an isopropyl-β-d-thiogalactopyranoside (IPTG)-inducible M. mycoides subsp. mycoides SC biotype protein with a 28-kDa apparent molecular mass, identified as a previously uncharacterized putative lipoprotein (MSC_0397). Clone λ-B1 contained several full-length genes from the M. mycoides subsp. mycoides SC biotype pyruvate dehydrogenase region, and two IPTG-independent polypeptides, of 29 kDa and 57 kDa, were identified on immunoblots. Following vaccination, significant anti-M. mycoides subsp. mycoides SC biotype responses were observed in mice vaccinated with clones λ-A8 and λ-B1. A significant stimulation index was observed following incubation of splenocytes from mice vaccinated with clone λ-A8 with whole live M. mycoides subsp. mycoides SC biotype cells, indicating cellular proliferation. After challenge, mice vaccinated with clone λ-A8 also exhibited a reduced level of mycoplasmemia compared to controls, suggesting that the MSC_0397 lipoprotein has a protective effect in the mouse model when delivered as a bacteriophage DNA vaccine. Bacteriophage-mediated immunoscreening using an appropriate vector system offers a rapid and simple technique for the identification and immediate testing of putative candidate vaccines from a variety of pathogens.

Transport and health in China : recent collaborative research relating to vehicle factors and pollution

The nature of the transport system contributes to public health outcomes in a range of ways. The clearest contribution to public health is in the area of traffic crashes, because of their direct impact on individual death and disability and their direct costs to the health system. Other papers in this conference address these issues. This paper outlines some collaborative research between the Centre for Accident Research and Road Safety - Queensland (CARRS-Q) at QUT and Chinese researchers in areas that have indirect health impacts. Heavy vehicle dynamics: The integrity of the road surface influences crash risk, with ruts, pot-holes and other forms of road damage contributing to increased crash risks. The great majority of damage to the road surface from vehicles is caused by heavy trucks and buses, rather than cars or smaller vehicles. In some cases this damage is due to deliberate overloading, but in other cases it is due to vehicle suspension characteristics that lead to occasional high loads on particular wheels. Together with a visiting researcher and his colleagues, we have used both Queensland and Chinese data to model vehicle suspension systems that reduce the level of load, and hence the level of road damage and resulting crash risk(1-5). Toll worker exposure to vehicle emissions: The increasing construction of highways in China has also involved construction of a large number of toll roads. Tollbooth workers are potentially exposed to high levels of pollutants from vehicles, however the extent of this exposure and how it relates to standards for exposure are not well known. In a study led by a visiting researcher, we conducted a study to model these levels of exposure for a tollbooth in China(6). Noise pollution: The increasing presence of high speed roads in China has contributed to an increase in noise levels. In this collaborative study we modelled noise levels associated with a freeway widening near a university campus, and measures to reduce the noise(7). Along with these areas of research, there are many other areas of transport with health implications that are worthy of exploration. Traffic, noise and pollution contribute to a difficult environment for pedestrians, especially in an ageing society where there are health benefits to increasing physical activity. By building on collaborations such as those outlined, there is potential for a contribution to improved public health by addressing transport issues such as vehicle factors and pollution, and extending the research to other areas of travel activity. 1. Chen, Y., He, J., King, M., Chen, W. and Zhang, W. (2014). Stiffness-damping matching method of an ECAS system based on LQG control. Journal of Central South University, 21:439-446. DOI: 10.1007/s1177101419579 2. Chen, Y., He, J., King, M., Feng, Z. and Chang, W. (2013). Comparison of two suspension control strategies for multi-axle heavy truck. Journal of Central South University, 20(2): 550-562. 3. Chen, Y., He, J., King, M., Chen, W. and Zhang, W. (2013). Effect of driving conditions and suspension parameters on dynamic load-sharing of longitudinal-connected air suspensions. Science China Technological Sciences, 56(3): 666-676. DOI: 10.1007/s11431-012-5091-3 4. Chen, Y., He., J., King, M., Chen, W. and Zhang, W. (2013). Model development and dynamic load-sharing analysis of longitudinal-connected air suspensions. Strojniški Vestnik - Journal of Mechanical Engineering, 59(1):14-24. 5. Chen, Y., He, J., King, M., Liu, H. and Zhang, W. (2013). Dynamic load-sharing of longitudinal-connected air suspensions of a tri-axle semi-trailer. Proceedings of Transportation Research Board Annual Conference, Washington DC, 13-17 January 2013, paper no. 13-1117. 6. He, J., Qi, Z., Hang, W., King, M., and Zhao, C. (2011). Numerical evaluation of pollutant dispersion at a toll plaza based on system dynamics and Computational Fluid Dynamics models. Transportation Research Part C, 19(2011):510-520. 7. Zhang, C., He, J., Wang, Z., Yin, R. and King, M. (2013). Assessment of traffic noise level before and after freeway widening using traffic microsimulation and a refined classic noise prediction method. Proceedings of Transportation Research Board Annual Conference, Washington DC, 13-17 January 2013, paper no. 13-2016.

The koala immunological toolkit: Sequence identification and comparison of key markers of the koala (Phascolarctos cinereus) immune response

The koala (Phascolarctos cinereus) is an Australian marsupial that continues to experience significant population declines. Infectious diseases caused by pathogens such as Chlamydia are proposed to have a major role. Very few species-specific immunological reagents are available, severely hindering our ability to respond to the threat of infectious diseases in the koala. In this study, we utilise data from the sequencing of the koala transcriptome to identify key immunological markers of the koala adaptive immune response and cytokines known to be important in the host response to chlamydial infection in other species. This report describes the identification and preliminary sequence analysis of (1) T lymphocyte glycoprotein markers (CD4, CD8); (2) IL-4, a marker for the Th2 response; (3) cytokines such as IL-6, IL-12 and IL-1β, that have been shown to have a role in chlamydial clearance and pathology in other hosts; and (4) the sequences for the koala immunoglobulins, IgA, IgG, IgE and IgM. These sequences will enable the development of a range of immunological reagents for understanding the koala’s innate and adaptive immune responses, while also providing a resource that will enable continued investigations into the origin and evolution of the marsupial immune system.

Comparison of sampling sites and detection methods for Haemophilus parasuis

Objective To improve the isolation rate and identification procedures for Haemophilus parasuis from pig tissues. Design Thirteen sampling sites and up to three methods were used to confirm the presence of H. parasuis in pigs after experimental challenge. Procedure Colostrum-deprived, naturally farrowed pigs were challenged intratracheally with H parasuis serovar 12 or 4. Samples taken during necropsy were either inoculated onto culture plates, processed directly for PCR or enriched prior to being processed for PCR. The recovery of H parasuis from different sampling sites and using different sampling methods was compared for each serovar. Results H parasuis was recovered from several sample sites for all serovar 12 challenged pigs, while the trachea was the only positive site for all pigs following serovar 4 challenge. The method of solid medium culture of swabs, and confirmation of the identity of cultured bacteria by PCR, resulted in 38% and 14% more positive results on a site basis for serovars 12 and 4, retrospectively, than direct PCR on the swabs. This difference was significant in the serovar 12 challenge. Conclusion Conventional culture proved to be more effective in detecting H parasuis than direct PCR or PCR on enrichment broths. For subacute (serovar 4) infections, the most successful sites for culture or direct PCR were pleural fluid, peritoneal fibrin and fluid, lung and pericardial fluid. For acute (serovar 12) infections, the best sites were lung, heart blood, affected joints and brain. The methodologies and key sampling sites identified in this study will enable improved isolation of H parasuis and aid the diagnosis of Glässer's disease.

Rapid isolation and detection of erythropoietin in blood plasma by magnetic core gold nanoparticles and portable Raman spectroscopy

Isolating, purifying, and identifying proteins in complex biological matrices is often difficult, time consuming, and unreliable. Herein we describe a rapid screening technique for proteins in biological matrices that combines selective protein isolation with direct surface enhanced Raman spectroscopy (SERS) detection. Magnetic core gold nanoparticles were synthesised, characterised, and subsequently functionalized with recombinant human erythropoietin (rHuEPO)-specific antibody. The functionalized nanoparticles were used to capture rHuEPO from horse blood plasma within 15 minutes. The selective binding between the protein and the functionalized nanoparticles was monitored by SERS. The purified protein was then released from the nanoparticles’ surface and directly spectroscopically identified on a commercial nanopillar SERS substrate. ELISA independently confirmed the SERS identification and quantified the released rHuEPO. Finally, the direct SERS detection of the extracted protein was successfully demonstrated for in-field screening by a handheld Raman spectrometer within 1 minute sample measurement time.

Foodborne Yersinia : Identification and Molecular Epidemiology of Isolates from Human Infections

Yersinia enterocolitica and Yersinia pseudotuberculosis are among the major enteropathogenic bacteria causing infections in humans in many industrialized countries. In Finland, Y. pseudotuberculosis has caused 10 outbreaks among humans during 1997-2008. Some of these outbreaks have been very extensive involving over 400 cases; mainly children attending schools and day-care. Y. enterocolitica, on the contrary, has caused mainly a large number of sporadic human infections in Finland. Y. pseudotuberculosis is widespread in nature, causing infections in a variety of domestic and wild animals. Foodborne transmission of human infections has long been suspected, however, attempts to trace the pathogen have been unsuccessful before this study that epidemiologically linked Y. pseudotuberculosis to a specific food item. Furthermore, due to modern food distribution systems, foodborne outbreaks usually involve many geographically separate infection clusters difficult to identify as part of the same outbreak. Among pathogenic Y. enterocolitica, the global predominance of one genetically homogeneous type (bioserotype 4/O:3) is a challenge to the development of genetic typing methods discriminatory enough for epidemiological purposes, for example, for tracing back to the sources of infections. Furthermore, the diagnostics of Y. enterocolitica infections is hampered because clinical laboratories easily misidentify some other members of the Yersinia species (Y. enterocolitica–like species) as Y. enterocolitica. This results in misleading information on the prevalence and clinical significance of various Yersinia isolates. The aim of this study was to develop and optimize molecular typing methods to be used in epidemiological investigations of Y. enterocolitica and Y. pseudotuberculosis, particularly in active surveillance and outbreak investigations of Y. pseudotuberculosis isolates. The aim was also to develop a simplified set of phenotypic tests that could be used in routine diagnostic laboratories for the correct identification of Y. enterocolitica and Y. enterocolitica –like species. A PFGE method designed here for typing of Y. pseudotuberculosis was efficient in linking the geographically dispersed and apparently unrelated Y. pseudotuberculosis infections as parts of the same outbreak. It proved to be useful in active laboratory-based surveillance of Y. pseudotuberculosis outbreaks. Throughout the study period, information about the diversity of genotypes among outbreak and non-outbreak related strains of human origin was obtained. Also, to our knowledge, this was the first study to epidemiologically link a Y. pseudotuberculosis outbreak of human illnesses to a specific food item, iceberg lettuce. A novel epidemiological typing method based on the use of a repeated genomic region (YeO:3RS) as a probe was developed for the detection and differentiation between strains of Y. enterocolitica subspecies palearctica. This method was able to increase the discrimination in a set of 106 previously PFGE typed Finnish Y. enterocolitica bioserotype 4/O:3 strains among which two main PFGE genotypes had prevailed. The developed simplified method was a more reliable tool than the commercially available biochemical test kits for differentiation between Y. enterocolitica and Y. enterocolitica –like species. In Finland, the methods developed for Y. enterocolitica and Y. pseudotuberculosis have been used to improve the identification protocols and in subsequent outbreak investigations.

Status, challenges and tools for identification and diagnosis of Peronosclerospora and Sclerophthora of regulatory concern for graminicolous crops

Graminicolous Downy Mildew (GDM) diseases caused by the genera Peronosclerospora (13 spp.) and Sclerophthora (6 spp. and 1 variety) are poorly studied but destructive diseases of major crops such as corn, sorghum, sugarcane and other graminoids. Eight of the 13 described Peronosclerospora spp. are able to infect corn. In particular, P. philippinensis (= P. sacchari), P. maydis, P. heteropogonis, and S. rayssiae var. zeae cause major losses in corn yields in tropical Asia. In 2012 a new species, P. australiensis, was described based on isolates previously identified as P. maydis in Australia; this species is now a pathogen of major concern. Despite the strong impact of GDM diseases, there are presently no reliable molecular methods available for their detection. GDM pathogens are among the most difficult Oomycetes to identify using molecular tools, as their taxonomy is very challenging, and little genetic sequence data are available for development of molecular tools to detect GDM pathogens to species level. For example, from over 15 genes used in identification, diagnostics or phylogeny of Phytophthora, only ITS1 and cox2 show promise for use with GDM pathogens. Multiplex/multigene conventional and qPCR assays are currently under evaluation for the detection of economically important GDM spp. Scientists from the USA, Germany, Canada, Australia, and the Philippines are collaborating on the development and testing of diagnostic tools for these pathogens of concern.

Identification and functional characterization of a cis-acting positive DNA element regulating CYP 2B1/B2 gene transcription in rat liver

A positive cis-acting DNA element in the near 5'-upstream region of the CYP2B1/B2 genes in rat liver was found to play an important role in the transcription of these genes. An oligonucleotide covering -69 to -98 nt mimicked the gel mobility shift pattern given by the fragment -179 to +29 nt, which was earlier found adequate to confer the regulatory features of this gene. Two major complexes were seen, of which the slower and faster moving complexes became intense under uninduced and Phenobarbitone-induced conditions respectively. Minigene cloned DNA plasmid covering -179 to +181 nt in pUC 19 and Bal 31 mutants derived from this parent were transcribed in whole nuclei and cell free transcription extracts and mutants containing only upto -75 nt of the upstream were poorly transcribed. Transcription extracts from phenobarbitone-injected rat liver nuclei were significantly more active than extracts from uninduced rats in transcribing the minigene constructs. Addition of the oligonucleotide (-69 to -98nt) specifically inhibited the transcription of the minigene construct (-179 to +181 nt) in the cell free transcription system. It is therefore, concluded that the region -69 to -98 nt acts as a positive cis-acting element in the transcription of the CYP2B1/B2 genes and in mediating the inductive effects of phenobarbitone.

Usefulness of DARPA dataset for intrusion detection system evaluation

The MIT Lincoln Laboratory IDS evaluation methodology is a practical solution in terms of evaluating the performance of Intrusion Detection Systems, which has contributed tremendously to the research progress in that field. The DARPA IDS evaluation dataset has been criticized and considered by many as a very outdated dataset, unable to accommodate the latest trend in attacks. Then naturally the question arises as to whether the detection systems have improved beyond detecting these old level of attacks. If not, is it worth thinking of this dataset as obsolete? The paper presented here tries to provide supporting facts for the use of the DARPA IDS evaluation dataset. The two commonly used signature-based IDSs, Snort and Cisco IDS, and two anomaly detectors, the PHAD and the ALAD, are made use of for this evaluation purpose and the results support the usefulness of DARPA dataset for IDS evaluation.