A new intrusion detection method based on behavioral model

Intrusion detection based on system calls and homogeneous Markov chains

Prototype Fast Breeder Reactor (PFBR) is in the advanced stage of construction at Kalpakkam, India. Liquid sodium is used as coolant to transfer the heat produced in the reactor core to steam water circuit. Impurities present in the sodium are removed using purification circuit. Plugging indicator is a device used to measure the purity of the sodium. Versa Module Europa bus based Real Time Computer (RTC) system is used for plugging indicator control. Hot standby architecture consisting of dual redundant RTC system with switch over logic system is the configuration adopted to achieve fault tolerance. Plugging indicator can be controlled in two modes namely continuous and discontinuous mode. Software based Proportional-Integral-Derivative (PID) algorithms are developed for plugging indicator control wherein the set point changes dynamically for every scan interval of the RTC system. Set points and PID constants are kept as configurable in runtime in order to control the process in very efficient manner, which calls for reliable communication between RTC system and control station, hence TCP/IP protocol is adopted. Performance of the RTC system for plugging indicator control was thoroughly studied in the laboratory by simulating the inputs and monitored the control outputs. The control outputs were also monitored for different PID constants. Continuous and discontinuous mode plots were generated.

There many applications throughout industry and government requiring real-time computing. Any application that monitors and/or controls a process would fit into this category. Some examples are: Nuclear power plants, Steel mills, Space program, etc. General Atomics uses eight real-time computer systems for control and high speed data acquisition required to run the nuclear fusion experiments. Real-Time computing can be defined as the ability to respond to asynchronous external events in a predictable (preferably fast) time frame. Real-Time computer systems are similar to other computers in many ways and may by used for general computing requirements such as Time-Sharing. However special hardware, operating systems and software had to be developed to meet the requirement for real-time computing. Traditionally, real-time computing has been a realm of proprietary operating systems with real-time applications written in FORTRAN and assembly language. In the past, these systems adequately served the needs of the real-time world. Many of these systems that were developed 15 years ago are still being used today. However the real-time world is now changing, demanding new systems to be developed. This paper gives a description of general real-time computer systems and how they differ from other systems. However, the main purpose of this paper is to give a detailed technical description of the hardware and operating systems of an existing proprietary system and a real-time UNIX system. The two real-time computer systems described in detail are Modcomp Classic III/95 with the MAX IV operating system and Modcomp TRI-D 9750 with the REAL/IX.2 operating system.

Formant tracking linear prediction model using HMMs and Kalman filters for noisy speech processing

NetHost-sensor: Monitoring a target host's application via system calls

Intrusion and intrusive activities have become a bottleneck for both Internet and Intranet users. An intrusion detection system tries to take care of such activities by constantly monitoring the user systems. Although there are two basic approaches in intrusion detection, i.e., misuse detection system and anomaly detection system, respectively, however, recent research works emphasize on hybrid approach which tries to gather the advantage of both misuse and anomaly-based systems. The proposed research work is based on such a hybrid system which uses misuse detection system for known types of intrusions and anomaly detection system for novel attacks. Frequency episode extraction method is specifically used for misuse-based detection and chi-square test is used for anomaly-based detection. Experiments show that the hybrid intrusion detection system is able to consider the real-time traffic of a network as well as the standard available data set for detecting the efficiency of the system. The proposed system learns and trains itself by detecting known attacks from misuse detection system and novel attacks from anomaly detection system, thereby improving the true positive rates and diminishing false negative rates consequently.

Distributed real-time systems have continually being developed for many real applications. It is very important to assure the reliability of such systems. However, developing a fault-free distributed real-time system is very difficult. Duplication is one of the fault-tolerant technologies for improving the reliability of distributed real-time computer systems. In this paper, we present a dual-cluster distributed real-time system model with four states to improve the reliability of distributed real-time systems. The system employs cluster switch, output arbitration and fault detection to increase its reliability. The system's availability is evaluated according to the model. We also introduce a dynamic approach for visualizing and debugging the timing behavior of distributed real-time systems.

Intrusion detection system (IDS) is an important part of enterprise security system architecture. In particular, anomaly-based IDS has been widely applied to detect single abnormal process events that deviate from the majority. However, intrusion activity usually consists of a series of low-level heterogeneous events. The gap between low-level process events and high-level intrusion activities makes it particularly challenging to identify process events that are truly involved in a real malicious activity, and especially considering the massive 'noisy' events filling the event sequences. Hence, the existing work that focus on detecting single events can hardly achieve high detection accuracy. In this work, we formulate a novel problem in intrusion detection - suspicious event sequence discovery, and propose GID, an efficient graph-based intrusion detection technique that can identify abnormal event sequences from massive heterogeneous process traces with high accuracy. We fully implement GID and deploy it into a real-world enterprise security system, and it greatly helps detect the advanced threats and optimize the incident response. Executing GID on both static and streaming data shows that GID is efficient (processes about 2 million records per minute) and accurate for intrusion detection.

ANID-SEoKELM: Adaptive network intrusion detection based on selective ensemble of kernel ELMs with random features

The concept of distributed execution of recovery blocks is examined as an approach for uniform treatment of hardware and software faults. A useful characteristic of the approach is the relatively small time cost it requires. The approach is thus suitable for incorporation into real-time computer systems. A specific formulation of the approach that is aimed at minimizing the recovery time is presented, called the distributed recovery blocks scheme. The DRB scheme is capable of effecting forward recovery while handling both hardware and software faults in a uniform manner. An approach to incorporating the capability for distributed execution of recovery blocks into a load-sharing multiprocessing scheme is also discussed. Two experiments aimed at testing the execution efficiency of the scheme in real-time applications have been conducted on two different multimicrocomputer networks. The results clearly indicate the feasibility of achieving tolerance of hardware and software faults.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Advanced driver assistance systems have been an active research topic for decades, for which many approaches have been developed not only to reduce the number of traffic accidents but also to increase the driver’s comfort. Among the many different solutions proposed, learning-based prediction approaches have gained considerable attention in recent years. Within this scope, this work focuses on the implementation aspects of a linear learning-based regression model for detecting unintended lane-departures, where the goal is to achieve a prediction model with good predictive performance while keeping the computational complexity as low as possible. Aspects under consideration include input signal selection and down-sampling. The linear prediction model is analyzed using a real world data set, and benchmarked against a kinematic constant velocity model and a non-linear regression model. The results show that the linear regression model has a significantly higher prediction performance when compared to a kinematic model. It is also shown that the predictive performance remains comparable to the more complex nonlinear regression model, even though the computational complexity of the linear model is significantly lower.

Leveraging virtualization technology, Mobile Edge Computing (MEC) deploys multiple services with different execution time requirements running as isolated processes. For instance, both real-time (RT) and non-RT applications may be (are) running on the same infrastructure using containerized virtualization. Nevertheless, sharing resources (e.g., CPU) with collocated workloads could impact the RT performance of RT applications. This paper presents PRINCIPIA, a dynamic CPU and CPU-shares allocation mechanism that opportunistically enables non-RT applications to run on underutilized CPUs while providing RT guarantees to RT applications. By monitoring MEC’s system metrics like processor’s CPU utilization and container’s CPU usage, PRINCIPIA dynamically allocates both CPU and CPU-shares to containers running non-RT applications aiming at opportunistically exploiting underutilized CPUs by containers running RT applications. We evaluate PRINCIPIA on a small-scale MEC server which uses containerized virtualization along with Linux RT Kernel to deploy both RT and non-RT applications. Our findings show that PRINCIPIA mitigates the impact on the RT performance of RT applications providing bounded processing latency in comparison with the default host Kernel scheduler.

Purpose of research. Computing networks of a plurality of processor modules have existed for a long time, however, with the development of wireless technologies, the possibility of high-quality and inexpensive implementation of the idea of real-time reconfigurable computing networks (RRTCN) has emerged. The purpose of this work is to select a wireless data transmission network for the RRTCN and create an algorithm for the dynamic selection of the "master" processor module.Methods. The research methods of the work are based on the definitions of the theory of sets and graphs. In particular, a grapho-theoretical approach to distribution is taken as a basis, supplemented by the introduction of a system of criteria for a reconfigurable real-time computing system based on a wireless data transmission protocol.Results. In this paper, the most suitable data transfer protocol for the local RCSRV is selected, a developed mathematical model of changing a real-time computing system built on a wireless protocol is presented, and an algorithm for selecting the processor module (PM) of the RCSRV "master" is developed. The novelty of the work is the use of the distance matrix for the mathematical description of the change in the RRTCN and its use to determine the PM of the "master" in the aircraft.Conclusion. The developed algorithm for choosing the PM of the "master" RRTCN and the mathematical model of changing the position of the PM in a real-time computer system built on a wireless protocol allows organizing the optimal choice of the PM of the "master" in a reconfigurable computing system. On the basis of the presented mathematical model, in the future, it is possible to create a full-fledged mathematical model of the RRTCN and an algorithm for placing tasks in it.

Internet of things intrusion detection model and algorithm based on cloud computing and multi-feature extraction extreme learning machine

A parameter (i.e. frequency, amplitude and phase) estimation method of acoustic signals is proposed. The frequency estimation of the proposed method is basically based on the linear prediction (LP) model. The ordinary LP model assumes that the number of frequency components in the signal is given. The proposed method improves the ordinary LP model so as to be applicable for the case where the number of the frequency components is unknown. The amplitude and phase estimation of the proposed method is based on the modified least square error method. Simulation results are provided to confirm the effectiveness of the proposed method.