Physical Access Log Analysis

A study of deep convolutional auto-encoders for anomaly detection in videos

The paper considers the idea of detecting security incidents and anomalies in physical access control systems (PACS) based on combined use of different types of user identification. As an example, an implementation of PACS is considered that performs identification by RFID cards and face recognition. The architecture of such system is introduced. A BPMN diagram for RFID identification of employees by entry and exit to the organization premises is built. A basic data model is proposed for storing information about users, devices, and events. Situations that can be interpreted as anomalous in the considered system are described and classified. The theoretical contribution of the work consists in enhancing the approaches to modeling user behavior in cyber-physical systems, especially in case when this modeling is performed on the basis of heterogeneous data collected from sources of different nature.

The focus of this chapter is twofold: information dissemination from infrastructure nodes deployed along the roads, the so-called Road-Side Units (RSUs), to passing-by vehicles, and content downloading by vehicular users through nearby RSUs. In particular, in order to ensure good performance for both content dissemination and downloading, the presented study addresses the problem of RSU deployment and reviews previous work that has dealt with such an issue. The RSU deployment problem is then formulated as an optimization problem, where the number of vehicles that come in contact with any RSU is maximized, possibly considering a minimum contact time to be guaranteed. Since such optimization problems turn out to be NP-hard, heuristics are proposed to efficiently approximate the optimal solution. The RSU deployment obtained through such heuristics is then used to investigate the performance of content dissemination and downloading through ns2 simulations. Simulation tests are carried out under various real-world vehicular environments, including a realistic mobility model, and considering that the IEEE 802.11p standard is used at the physical and medium access control layers. The performance obtained in realistic conditions is discussed with respect to the results obtained under the same RSU deployment, but in ideal conditions and protocol message exchange. Based on the obtained results, some useful hints on the network system design are provided.

User Anomaly Detection, an important aspect of User Behaviour Analysis, is used to find anomalous user events from the event and network traffic log data. Traditional security mechanisms are not able to detect new/unknown types of anomalies as they do not incorporate contextual and behavioural aspects of the data for analysis. User Behaviour Anomaly Detection (UBAD) employs user behavioural patterns in context thereby achieving a higher detection rate. Log data employed for UBAD has multiple dimensions. With increase in dimensions (attributes), data gets sparse and the detection of anomalies becomes increasingly complex. For this reason, the single dimensional algorithms proposed for anomaly detection based on clustering, proximity and dimensional reduction do not work well on higher dimension data. OLAP based data analysis techniques provide efficient data slicing and aggregation operations crucial for multidimensional analytics along with multiscale visualisation for exploratory discovery. In this paper, an effective multidimensional process for UBAD is developed to detect anomalies using multi-dimensional statistical tests. An integral part of the process is the development of an OLAP Cube data model for event log data. The statistical efficiency of the UBAD process for different dimensions is investigated. On a real-life event log data, it is shown that the statistical efficiency of detection improves with the increased dimensionality of the tests: the true negative rate and the true positive rate show marked improvement. It is deduced that the computationally more expensive higher dimensional tests need to be employed in order to achieve better anomaly detection.

Anomaly Detection is an important area of research in data science. However, for big data it is challenging due to limited (or no) labeled data during training. This challenge is prevalent in the cyber-security area. There is always a lag before labels of (near) real time data become available. Hence, we would like to develop a new anomaly detection framework without any labeled data (no human intervention). For this, we utilize the density-based spatial clustering of applications with noise (DBSCAN). To address the scalability issues that arise when using DBSCAN, we exploit novel techniques based on partitions with minimum false alarm. We compare our approaches with other unsupervised approaches to demonstrate the effectiveness of our work.

Fiber-optic communication systems serve as the backbone of modern data communication networks, with increasing demands on their reliability and robustness in various emerging applications. A key challenge in ensuring reliable fiber-optic transmission lies in addressing fiber anomalies, which can cause signal degradation, service disruptions, and even system failures. However, the current anomaly detection method is too complex to be implemented in deployed networks or consumes too much time during detection. This paper proposes a simple and effective fiber anomaly detection method for C+L-band fiber-optic communication systems, leveraging the spectral tilt induced by the stimulated Raman scattering (SRS) effect. The method reconstructs the spectral tilt along an anomalous fiber link by analyzing the input and output power profile, easily obtainable from optical channel monitors (OCMs), enabling anomaly localization and loss quantification through forward and backward spectral tilt comparison. The performance and robustness of the proposed method are studied and discussed in actual scenarios such as erbium-doped fiber amplifier gain fluctuations, OCM measurement errors, parameter inaccuracies, and modeling inaccuracies. In addition to being able to detect a single anomaly, the process of using the proposed method to achieve multiple anomaly detection links is also discussed according to the chronological order of anomalies. Experimental validation on a multi-span C+L-band transmission system achieves a maximum localization error of 2.06 km and a maximum loss estimation error of 0.14 dB within 2 s. This work underscores the potential of exploiting inherent physical phenomena like SRS for fast anomaly detection in deployed optical networks.

Transit user behavioural response under disrupted service conditions, specifically how transit riders choose among available mode options to complete their trips, is not well understood. This study aimed to investigate transit user mode choice in response to rapid transit service disruption in the City of Toronto, incorporating such factors as the type of disruption, stage of the passenger’s trip (pre-trip or en-route), weather conditions, and uncertainty of delay duration. A joint revealed preference (RP) and stated preference (SP) survey was designed where the RP part gathered information on the respondent’s actual response to the most recent service disruption while the SP part solicited the respondent’s travel choices under a set of hypothetical service disruption scenarios. A transit trip planner tool was developed to generate alternative transit mode and path options to avoid the disrupted segment. An empirical model using RP data is presented to verify the survey design technique.

Human action detection and recognition has become a significant topic in computer vision research over the last two decades. Intelligent techniques (such as machine learning and deep learning) have grown in popularity as a result of technological advancements in visual data. Due to the exponential growth of video data generated by surveillance cameras, intelligent systems are in great demand for detecting specific human activities. In this work, we critically examine the state-of-the-art (SOA) methodologies for human activity detection (HAD) approaches. The study illustrates a generic classification for HAD methods anda paradigm shift is observed from traditional to modern deep learning-based techniques. We also provide an analysis of publicly available datasets for the classification of human activities. The paper outlines various open research issues as well as future directions for HAD methods. Due to problems such as a dynamic and complex background, camera motion, occlusion, and bad weather, it is evident that detecting human behaviors in surveillance videos is a challenging task. Convolution neural networks (CNNs) are used in the bulk of HAD techniques, prompting researchers to look at sequence learning models like Recurrent Neural Networks (RNNs) and Long-Short-Term Neural Networks (LSTM). Furthermore, our analysis indicates that only a few research articles on the detection of anomalous behavior have been published, with the majority of the work focusing on human action detection. Furthermore, existing HAD deep learning models could be improved by including the notion of transfer learning, which saves training time and enhances accuracy.

Anomaly detection has been extensively studied in the last two decades. Features are usually selected or created at first for characterizing behaviours of networks, users or systems, and then anomaly detection algorithms are developed and applied. However, such traditional network anomaly detection systems detect a limited number of attack types and report a huge number of false alarms due to lack of proper features and inherent weakness of anomaly detection algorithms. In order to minimize the number of false alerts and maximize the detection accuracy, we propose in this chapter an enhanced CUSUM algorithm for network anomaly detection, modelling various features from different sources and reporting alerts according to some decision strategies. The experimental evaluation with the 1999 DARPA intrusion detection evaluation dataset shows an empirical study of applying the proposed enhanced CUSUM algorithm for detecting successfully some network attacks.

Social engineering (SE) attacks are a serious threat to online users and might subject people to different kinds of harm. Despite increased concern with this risk, there has been little research activity focused upon social engineering in the potentially rich hunting ground of social networks. The number of victims of social engineering attacks will be decreased if the users' detection ability has improved. Yet, this improvement of the user's detection behaviour can't be occurred without investigating the users' weakness points. The present study develops a conceptual model to test the factors that influence social networks users' judgment of social engineering-based attacks in order to identify the weakest points of users' detection behaviour which also help to predict vulnerable individuals.

Abstract—The rapid expansion of digital communication plat- forms, cloud computing, online banking, and social networking services has significantly increased the scale and complexity of cyber threats. Modern attackers no longer depend on simple malware or static phishing emails; instead, they use advanced techniques such as social engineering, deepfake media, and malicious QR codes to deceive users and bypass conventional security mechanisms. These attacks are often carefully crafted and multi-vector in nature, making traditional rule-based and signature-based cybersecurity solutions increasingly ineffective. Furthermore, most existing security systems are designed to detect only a single type of threat, which limits their ability to provide comprehensive protection in real-world environments. This paper presents an AI-based multi cyber threat detection framework that integrates machine learning, deep learning, and natural language processing to provide real-time and in- telligent security. The proposed system analyzes textual data from emails and messages, visual content from images and videos, and encoded information extracted from QR codes in order to detect phishing attempts, identify manipulated deepfake media, and recognize malicious QR-based exploits. Experimental evaluation shows that the proposed approach achieves improved accuracy, precision, and recall compared to traditional single- threat detection systems, while maintaining low computational latency, making it suitable for deployment in modern digital infrastructures. Index Terms—Cyber security, phishing detection, deepfake de- tection, QR code attacks, social engineering, artificial intelligence, deep learning, natural language processing

Template-Protection-Techniken stellen eine wichtige Ergänzung zu biometrischen Systemen, um das gewünschte Sicherheitsniveau zu erreichen und die Anforderungen an den Schutz der Privatsphäre zu erfüllen. Diese Techniken ermöglichen Erneuerung und Widerruf der Referenzendaten in biometrischen Systemen. In dieser Arbeit wird ein systematisches Evaluierungsframework entwickelt, das sich an die wesentlichen Kriterien und Anforderungen an biometrische Template-Protection-Verfahren festhält. Seine Anwendbarkeit wird durch die Analyse der verschiedenen Algorithmen demonstriert. Die in dieser Arbeit präsentierte Evaluierung ist grundlegend für eine vollständige Analyse. Darüber hinaus ermöglicht es einen Nachweis der Sicherheit und Einhaltung der Privatsphäre. Es schafft eine Basis für Zertifizierung und Benchmark der Template-Protection-Verfahren.

This paper presents a number of key radio resource management strategies across physical (PHY) and medium access control (MAC) layers for reducing base station energy consumption including power efficient link adaptation (LA), exploitation of multi-user diversity and trading bandwidth for energy efficiency. By collectively taking advantage of these radio resource management strategies, a multi-user adaptive power and resource allocation algorithm is proposed to ease the power requirements of a base station, whilst maintaining the same levels of service. The scheduling algorithm is evaluated within a LTE downlink simulator for various traffic load conditions. The results show that the proposed algorithm achieves a significant energy saving over a conventional non-energy aware resource allocation scheme.

Besides avoiding inter-symbol interference and leading to high capacity, wireless orthogonal frequency division multiplexing (OFDM) provide fine granularity for resource allocation since they are capable of dynamically assigning sub-carriers to multiple users and adaptively allocating transmit power. The current dominate layered networking architecture, in which each layer is designed and operated independently, results in inefficient and inflexible resource use in wireless networks due to the nature of the wireless medium, such as time-varying channel fading. Thus, we need an integrated adaptive design across different layers. In this paper, we focus on resource allocation and scheduling in wireless multiuser OFDM networks based on joint physical and medium access control (MAC) layer optimization. An adaptive cross-layer design for the downlink multiuser OFDM systems, to maximize the weighted sum capacity of all users, where each user has multiple heterogeneous traffic queues simultaneously is proposed. A packet dependent (PD) scheduling scheme is employed at the MAC layer, which determines the packet transmission order by assigning different weights to different packets, and is shown by simulations more efficient than the previous methods where all packets in a queue have the same weight. The weight design in PD scheduling considers the delay, size and quality of service (QoS) priority level of packets. Each user weight employed in resource allocation at the physical (PHY) layer is obtained by summing up the weights of selected packets for the user. We also deeply investigate the various resource scheduling schemes for comparisons.

In this paper, we derive an algorithm for estimating the location of events which cause burst errors, such as packet collisions and multipath fades in wireless packets. Effective localization algorithms have a range of applications, and could lead to network performance improvements through techniques such as error control coding and cross-layer design between the physical and medium access control layers. Given that a collision or fade occurs in a packet, the algorithm finds the maximum-likelihood estimate of the start time and duration of the collision or fade. Due to the computational complexity of this optimal estimate, we also derive an efficient sub-optimal algorithm which decouples the estimation of the collision or fade duration from the estimation of its starting position within the packet of interest. Both algorithms are able to isolate collision locations within the packet when the signal-to-noise ratio is high enough for the link to operate at a BER of ~10?6 in the absence of collision. An extension to M-QAM demonstrates similar effectiveness for constellation sizes up to 128.