Selection of intrusion detection system threshold bounds for effective sensor fusion

The motivation behind the fusion of Intrusion Detection Systems was the realization that with the increasing traffic and increasing complexity of attacks, none of the present day stand-alone Intrusion Detection Systems can meet the high demand for a very high detection rate and an extremely low false positive rate. Multi-sensor fusion can be used to meet these requirements by a refinement of the combined response of different Intrusion Detection Systems. In this paper, we show the design technique of sensor fusion to best utilize the useful response from multiple sensors by an appropriate adjustment of the fusion threshold. The threshold is generally chosen according to the past experiences or by an expert system. In this paper, we show that the choice of the threshold bounds according to the Chebyshev inequality principle performs better. This approach also helps to solve the problem of scalability and has the advantage of failsafe capability. This paper theoretically models the fusion of Intrusion Detection Systems for the purpose of proving the improvement in performance, supplemented with the empirical evaluation. The combination of complementary sensors is shown to detect more attacks than the individual components. Since the individual sensors chosen detect sufficiently different attacks, their result can be merged for improved performance. The combination is done in different ways like (i) taking all the alarms from each system and avoiding duplications, (ii) taking alarms from each system by fixing threshold bounds, and (iii) rule-based fusion with a priori knowledge of the individual sensor performance. A number of evaluation metrics are used, and the results indicate that there is an overall enhancement in the performance of the combined detector using sensor fusion incorporating the threshold bounds and significantly better performance using simple rule-based fusion.

Pressure sensor based tsunami detection system: A laboratory study

In this paper, we present the study and implementation of a low-cost system to detect the occurrences of tsunamis at significantly smaller laboratory scale. The implementation is easily scalable for real-time deployment. Information reported in this paper includes the experimentally recorded response from the pressure sensor giving an indication as well as an alarm at remote place for the detection of water turbulence similar to the case of tsunami. It has been found that the system developed works very well in the laboratory scale.

Identification and expression of the 20 kd structural protein gene of colitis bacteriophage

The 2.3 kb BamHI fragment from the colitis bacteriophage DNA was transcribed and translated into a 20 kd structural protein P6, in a coupled transcription-translation system derived from Escherichia coli. This protein was expressed in vivo by the 2.3 kb DNA cloned in pBR322. The gene with the regulatory elements for this protein was located on the 680 bp AvaII fragment of the insert DNA. It hybridized with two RNAs of sizes 520 and 1630 nucleotides indicating that both are messengers for the 20 kd protein. Dot-blot hybridization showed that the transcripts for P6 reached a maximum level at 12 min after phage infection.

Identification and Epidemiological Typing of Campylobacter strains isolated from Patients in Finland

C. jejuni constitutes the majority of Campylobacter strains isolated from patients in Finland, and C. coli strains are also reported. To improve the species identification, a combination of phenotype- and genotype-based methods was applied. Standardising the cell suspension turbidity in the hippurate hydrolysis test enabled the reliable identification of hippurate-positive Campylobacter strains as C. jejuni. The detection of species-specific genes by PCR showed that about 30% of the hippurate-negative strains were C. jejuni. Three typing methods, serotyping, PCR-RFLP analysis of LOS biosynthesis genes and pulsed-field gel electrophoresis (PFGE) were evaluated as epidemiological typing tools for C. jejuni. The high number of non-typeable strains lowered the discriminatory ability of serotyping. PCR-RFLP typing offered high discrimination for both serotypeable and non-typeable strains, but the correlation between serotypes and RFLP-types was not high enough to enable its use for molecular serotyping of non-typeable strains. PFGE was a highly discriminative typing method. Although the use of two restriction enzymes generally increases the discriminatory ability, KpnI alone offered almost as high discrimination as the use of SmaI and KpnI. The characteristic seasonal distribution of Campylobacter infections with a peak in summer and low incidence in winter was mainly due to domestically acquired infections. Of the C. jejuni strains, 41% were of domestic origin compared to only 17% of the C. coli strains. Serotypes Pen 12, Pen 6,7 and Pen 27 were significantly associated with domestic C. jejuni infections, Pen 1,44, Pen 3 and Pen 37 with travel-related infections. Pen 2 and Pen 4-complex were common both in domestic and travel-related infections. Serotype Pen 2 was less common among patients 60 years or older than in younger patients, more prevalent in Western Finland than in other parts of the country and more prevalent than other serotypes in winter. The source of Pen 2 infections may be related to cattle, since Pen 2 is the most common serotype in isolates from Finnish cattle. PFGE subtypes among isolates from patients and chickens during the summer 2003 and from cattle during the whole year were compared. The analysis of indistinguishable SmaI/KpnI subtypes suggested that up to 31% of the human infections may have been mediated by chickens and 19% by cattle. Human strains isolated during two one-year sampling periods were studied by PFGE. Of the domestic strains, 69% belonged to SmaI subtypes found during both sampling periods. Four SmaI subtypes accounted for 45% of the domestic strains, further typing of these subtypes by KpnI revealed six temporally persistent SmaI/KpnI subtypes. They were only occasionally identified in travel-related strains, and therefore, can be considered to be national subtypes. Each subtype was associated with a serotype: Pen 2, Pen 12, Pen 27, Pen 4-complex, Pen 41, and Pen 57. Five of these subtypes were identified in cattle (S5/K27, S7/K1, S7/K2, S7/K5 and S64/K19), and two in chickens (S7/K1 and S64/K19) with a temporal association with human infections in 2003. Cattle are more likely potential sources of these persistent subtypes, since long-term excretion of Campylobacter strains by cattle has been reported.

Microbial identification by detection of ligation probes on DNA microarray

Microbes in natural and artificial environments as well as in the human body are a key part of the functional properties of these complex systems. The presence or absence of certain microbial taxa is a correlate of functional status like risk of disease or course of metabolic processes of a microbial community. As microbes are highly diverse and mostly notcultivable, molecular markers like gene sequences are a potential basis for detection and identification of key types. The goal of this thesis was to study molecular methods for identification of microbial DNA in order to develop a tool for analysis of environmental and clinical DNA samples. Particular emphasis was placed on specificity of detection which is a major challenge when analyzing complex microbial communities. The approach taken in this study was the application and optimization of enzymatic ligation of DNA probes coupled with microarray read-out for high-throughput microbial profiling. The results show that fungal phylotypes and human papillomavirus genotypes could be accurately identified from pools of PCR amplicons generated from purified sample DNA. Approximately 1 ng/μl of sample DNA was needed for representative PCR amplification as measured by comparisons between clone sequencing and microarray. A minimum of 0,25 amol/μl of PCR amplicons was detectable from amongst 5 ng/μl of background DNA, suggesting that the detection limit of the test comprising of ligation reaction followed by microarray read-out was approximately 0,04%. Detection from sample DNA directly was shown to be feasible with probes forming a circular molecule upon ligation followed by PCR amplification of the probe. In this approach, the minimum detectable relative amount of target genome was found to be 1% of all genomes in the sample as estimated from 454 deep sequencing results. Signal-to-noise of contact printed microarrays could be improved by using an internal microarray hybridization control oligonucleotide probe together with a computational algorithm. The algorithm was based on identification of a bias in the microarray data and correction of the bias as shown by simulated and real data. The results further suggest semiquantitative detection to be possible by ligation detection, allowing estimation of target abundance in a sample. However, in practise, comprehensive sequence information of full length rRNA genes is needed to support probe design with complex samples. This study shows that DNA microarray has the potential for an accurate microbial diagnostic platform to take advantage of increasing sequence data and to replace traditional, less efficient methods that still dominate routine testing in laboratories. The data suggests that ligation reaction based microarray assay can be optimized to a degree that allows good signal-tonoise and semiquantitative detection.

Data rectification and detection of trend shifts in jet engine path measurements using median filters and fuzzy logic

Filtering methods are explored for removing noise from data while preserving sharp edges that many indicate a trend shift in gas turbine measurements. Linear filters are found to be have problems with removing noise while preserving features in the signal. The nonlinear hybrid median filter is found to accurately reproduce the root signal from noisy data. Simulated faulty data and fault-free gas path measurement data are passed through median filters and health residuals for the data set are created. The health residual is a scalar norm of the gas path measurement deltas and is used to partition the faulty engine from the healthy engine using fuzzy sets. The fuzzy detection system is developed and tested with noisy data and with filtered data. It is found from tests with simulated fault-free and faulty data that fuzzy trend shift detection based on filtered data is very accurate with no false alarms and negligible missed alarms.

A scalable network port scan detection system on FPGA

With ever increasing network speed, scalable and reliable detection of network port scans has become a major challenge. In this paper, we present a scalable and flexible architecture and a novel algorithm, to detect and block port scans in real time. The proposed architecture detects fast scanners as well as stealth scanners having large inter-probe periods. FPGA implementation of the proposed system gives an average throughput of 2 Gbps with a system clock frequency of 100 MHz on Xilinx Virtex-II Pro FPGA. Experimental results on real network trace show the effectiveness of the proposed system in detecting and blocking network scans with very low false positives and false negatives.

Selective excitation and detection of maximum quantum coherence of a group of scalar coupled protons in chiral molecules: an NMR experiment for enantiodiscrimination

The H-1 NMR spectroscopic discrimination of enantiomers in the solution state and the measurement of enantiomeric composition is most often hindered due to either very small chemical shift differences between the discriminated peaks or severe overlap of transitions from other chemically non-equivalent protons. In addition the use of chiral auxiliaries such as, crown ether and chiral lanthanide shift reagent may often cause enormous line broadening or give little degree of discrimination beyond the crown ether substrate ratio, hampering the discrimination. In circumventing such problems we are proposing the utilization of the difference in the additive values of all the chemical shifts of a scalar coupled spin system. The excitation and detection of appropriate highest quantum coherence yields the measurable difference in the frequencies between two transitions, one pertaining to each enantiomer in the maximum quantum dimension permitting their discrimination and the F-2 cross section at each of these frequencies yields an enantiopure spectrum. The advantage of the utility of the proposed method is demonstrated on several chiral compounds where the conventional one dimensional H-1 NMR spectra fail to differentiate the enantiomers.

Joint Self-Iterating Equalization and Detection for Two-Dimensional Intersymbol-Interference Channels

We develop several novel signal detection algorithms for two-dimensional intersymbol-interference channels. The contribution of the paper is two-fold: (1) We extend the one-dimensional maximum a-posteriori (MAP) detection algorithm to operate over multiple rows and columns in an iterative manner. We study the performance vs. complexity trade-offs for various algorithmic options ranging from single row/column non-iterative detection to a multi-row/column iterative scheme and analyze the performance of the algorithm. (2) We develop a self-iterating 2-D linear minimum mean-squared based equalizer by extending the 1-D linear equalizer framework, and present an analysis of the algorithm. The iterative multi-row/column detector and the self-iterating equalizer are further connected together within a turbo framework. We analyze the combined 2-D iterative equalization and detection engine through analysis and simulations. The performance of the overall equalizer and detector is near MAP estimate with tractable complexity, and beats the Marrow Wolf detector by about at least 0.8 dB over certain 2-D ISI channels. The coded performance indicates about 8 dB of significant SNR gain over the uncoded 2-D equalizer-detector system.

Radio over fibre enabled sensing and communications system for in building

This paper describes work on radio over fiber distributed antenna systems for improving the quality of radio coverage for in-building applications. The DAS network has also been shown to provide improved detection for Gen 2 UHF RFID tags. Using pre-distortion to reduce the problem of the RFID second harmonic, a simple heterogeneous sensing and communications system is demonstrated. © 2011 NOrthumbria University.

Micro-measurement and monitoring system for ageing underground infrastructure (Underground M3)

Advances in the development of computer vision, miniature Micro-Electro-Mechanical Systems (MEMS) and Wireless Sensor Network (WSN) offer intriguing possibilities that can radically alter the paradigms underlying existing methods of condition assessment and monitoring of ageing civil engineering infrastructure. This paper describes some of the outcomes of the European Science Foundation project "Micro-Measurement and Monitoring System for Ageing Underground Infrastructures (Underground M3)". The main aim of the project was to develop a system that uses a tiered approach to monitor the degree and rate of tunnel deterioration. The system comprises of (1) Tier 1: Micro-detection using advances in computer vision and (2) Tier 2: Micro-monitoring and communication using advances in MEMS and WSN. These potentially low-cost technologies will be able to reduce costs associated with end-of-life structures, which is essential to the viability of rehabilitation, repair and reuse. The paper describes the actual deployment and testing of these innovative monitoring tools in tunnels of London Underground, Prague Metro and Barcelona Metro. © 2012 Taylor & Francis Group.

Genome-wide identification and characterization of cytochrome P450 monooxygenase genes in the ciliate Tetrahymena thermophila

Background: Cytochrome P450 monooxygenases play key roles in the metabolism of a wide variety of substrates and they are closely associated with endocellular physiological processes or detoxification metabolism under environmental exposure. To date, however, none has been systematically characterized in the phylum Ciliophora. T. thermophila possess many advantages as a eukaryotic model organism and it exhibits rapid and sensitive responses to xenobiotics, making it an ideal model system to study the evolutionary and functional diversity of the P450 monooxygenase gene family. Results: A total of 44 putative functional cytochrome P450 genes were identified and could be classified into 13 families and 21 sub-families according to standard nomenclature. The characteristics of both the conserved intron-exon organization and scaffold localization of tandem repeats within each P450 family clade suggested that the enlargement of T. thermophila P450 families probably resulted from recent separate small duplication events. Gene expression patterns of all T. thermophila P450s during three important cell physiological stages (vegetative growth, starvation and conjugation) were analyzed based on EST and microarray data, and three main categories of expression patterns were postulated. Evolutionary analysis including codon usage preference, sit-especific selection and gene-expression evolution patterns were investigated and the results indicated remarkable divergences among the T. thermophila P450 genes. Conclusion: The characterization, expression and evolutionary analysis of T. thermophila P450 monooxygenase genes in the current study provides useful information for understanding the characteristics and diversities of the P450 genes in the Ciliophora, and provides the baseline for functional analyses of individual P450 isoforms in this model ciliate species.

Identification and characterization of a novel envelope protein in Rana grylio virus

Viral envelope proteins have been proposed to play significant roles in virus infection and assembly. In this study, an envelope protein gene, 53R, was cloned and characterized from Rana grylio virus (RGV), a member of the family Iridoviridae. Database searches found its homologues in all sequenced iricloviruses, and sequence alignment revealed several conserved structural features shared by virus capsid or envelope proteins: a myristoylation site, two predicted transmembrane domains and two invariant cysteine residues. Subsequently, RT-PCR and Western blot detection revealed that the transcripts encoding RGV 53R and the protein itself appeared late during infection of fathead minnow cells and that their appearance was blocked by viral DNA replication inhibitor, indicating that RGV 53R is a late expression gene. Moreover, immunofluorescence localization found an association of 53R with virus factories in RGV-infected cells, and this association was further confirmed by expressing a 53R-GFP fusion protein in pEGFP-N3/53R-transfected cells. Furthermore, detergent extraction and Western blot detection confirmed that RGV 53R was associated with virion membrane. Therefore, the current data suggest that RGV 53R is a novel viral envelope protein and that it may play an important role in virus assembly. This is thought to be the first report on a viral envelope protein that is conserved in all sequenced iridoviruses.

Identification and characterization of a cathepsin L-like cysteine protease from Taenia solium metacestode

Taenia solium metacestode, a larval pork tapeworm, is a causative agent of neurocysticercosis, one of the most common parasitic diseases in the human central nervous system. In this study, we identified a cDNA encoding for a cathepsin L-like cysteine protease from the T solium metacestode (TsCL-1) and characterized the biochemical properties of the recombinant enzyme. The cloned cDNA of 1216 bp encoded 339 amino acids with an approximate molecular weight of 37.6 kDa which containing a typical signal peptide sequence (17 amino acids), a pro-domain (106 amino acids), and a mature domain (216 amino acids). Sequence alignments of TsCL-1 showed low sequence similarity of 27.3-44.6 to cathepsin L-like cysteine proteases from other helminth parasites, but the similarity was increased to 35.9-55.0 when compared to mature domains. The bacterially expressed recombinant protein (rTsCL-1) did not show enzyme activity; however, the rTsCL-1 expressed in Pichia pastoris showed typical biochemical characteristics of cysteine proteases. It degraded human immunoglobulin G (IgG) and bovine serum albumin (BSA), but not collagen. Western blot analysis of the rTsCL-1 showed antigenicity against the sera from patients with cysticercosis, sparganosis or fascioliasis, but weak or no antigenicity against the sera from patients with paragonimiasis or clonorchiasis. (c) 2006 Published by Elsevier B.V.