Probabilistic analysis of security attacks in cloud environment using hidden Markov models

Distributed Denial of Service (DDoS) attacks in the cloud environment are not as simple as the same attacks which occur in the traditional physical network environment. Not only one single attack is affecting the cloud environment, where as there are multiple sources to affect the environment. DDoS attacks can be detected using the existing machine learning techniques such as neural classifiers. This paper discusses on the survey carried out on DDoS attacks in the cloud environment. Using Machine learning techniques results to detection of higher false positive rates. Some of the widely used methods are ANN, SVM, kNN, J48, Feature rank and Feature selection methods to detect DDoS attacks in the cloud environment. This paper reviews various studies related to detection of network attacks in network and cloud environments.

Cloud Computing is emerging out as the future of next generation architecture for information technology enterprises. But due to its popularity, it is vulnerable to various unwanted attacks. One of the solutions is intrusion detection system. The Existing architectures of IDS in cloud environment are deployed on the network periphery of each guest OS that offers high attack resistance at the cost of visibility. In this paper, we propose hybrid architecture for deployment of intrusion detection system which takes into account security at both the front end and the clusters. This Paper also includes a critical review of previously proposed architectures on deployment of Intrusion Detection Systems in Cloud Environment and a detailed description of the research Gaps identified. Our approach leverages VMware virtualization techniques using open nebula as a test bed for deploying our proposed system.

Sleep quantity affects an individual's personal health. The gold standard of measuring sleep and diagnosing sleep disorders is Polysomnography (PSG). Although PSG is accurate, it is expensive and it lacks portability. A number of wearable devices with embedded sensors have emerged in the recent past as an alternative to PSG for regular sleep monitoring directly by the user. These devices are intrusive and cause discomfort besides being expensive. In this work, we present an algorithm to detect sleep using a smartphone with the help of its inbuilt accelerometer sensor. We present three different approaches to classify raw acceleration data into two states - Sleep and Wake. In the first approach, we take an equation from Kushida's algorithm to process accelerometer data. Henceforth, we call it Kushida's equation. While the second is based on statistical functions, the third is based on Hidden Markov Model (HMM) training. Although all the three approaches are suitable for a phone's resources, each approach demands different amount of resources. While Kushida's equation-based approach demands the least, the HMM training-based approach demands the maximum. We collected data from mobile phone's accelerometer for four subjects for twelve days each. We compare accuracy of sleep detection using each of the three approaches with that of Zeo sensor, which is based on Electroencephalogram (EEG) sensor to detect sleep. EEG is an important modality in PSG. We find that HMM training-based approach is as much as 84% accurate. It is 15% more accurate as compared to Kushida's equation-based approach and 10% more accurate as compared to statistical method-based approach. In order to concisely represent the sleep quality of people, we model their sleep data using HMM. We present an analysis to find out a tradeoff between the amount of training data and the accuracy provided in the modeling of sleep. We find that six days of sleep data is sufficient for accurate modeling. We compare accuracy of our HMM training-based algorithm with a representative third party app SleepTime available from Google Play Store for Android. We find that the detection done using HMM approach is closer to that done by Zeo by 13% as compared to the third party Android application SleepTime. We show that our HMM training-based approach is efficient as it takes less than ten seconds to get executed on Moto G Android phone.

The complexity of the Internet and the volume of network traffic have dramatically increased in the last few years, making it more challenging to design scalable Network Traffic Monitoring and Analysis (NTMA) systems. Critical NTMA applications such as the detection of network attacks and anomalies require fast mechanisms for on-line analysis of thousands of events per second, as well as efficient techniques for off-line analysis of massive historical data. The high-dimensionality of network data provided by current network monitoring systems opens the door to the massive application of machine learning approaches to improve the detection and classification of network attacks and anomalies, but this higher dimensionality comes with an extra data processing overhead. In this paper we present Big-DAMA, a big data analytics framework (BDAF) for NTMA applications. Big-DAMA is a flexible BDAF, capable to analyze and store big amounts of both structured and unstructured heterogeneous data sources, with both stream and batch processing capabilities. Big-DAMA uses off-the-shelf big data storage and processing engines to offer both stream data processing and batch processing capabilities, decomposing separate engines for stream, batch and query, following a Data Stream Warehouse (DSW) paradigm. Big-DAMA implements several algorithms for anomaly detection and network security using supervised and unsupervised machine learning (ML) models, using off-the-shelf ML libraries. We apply Big-DAMA to the detection of different types of network attacks and anomalies, benchmarking multiple supervised ML models. Evaluations are conducted on top of real network measurements collected at the WIDE backbone network, using the well-known MAWILab dataset for attacks labeling. Big-DAMA can speed up computations by a factor of 10 when compared to a standard Apache Spark cluster, and can be easily deployed in cloud environments, using hardware virtualization technology.

Cloud computing is an inventive innovation that has acquired a progressive changes in computing administrations. It has empowered to drive the concentration from neighborhood/individual calculation to datacenter-driven algorithm by giving resources powerfully in a virtualized way by means of Internet. The aim of load adjusting is to clearly comprehend the client prerequisites, the information and data which can be sent and obtained without taking additional time. In this paper, we have focused on cloud computing, load balancing techniques, cloud resource scheduling process. Review on load balancing techniques and resource scheduling, sidechannel attack is also presented in this paper.KeywordsCloud computingLoad balancingSidechannel attacksResource scheduling

With the growing use of crowdsourced location data from smartphones for transportation applications, the task of map-matching raw location sequence data to travel paths in the road network becomes more important. High-frequency sampling of smartphone locations using accurate but power-hungry positioning technologies is not practically feasible as it consumes an undue amount of the smartphone’s bandwidth and battery power. Hence, there exists a need to develop robust algorithms for map-matching inaccurate and sparse location data in an accurate and timely manner. This paper addresses the above-mentioned need by presenting a novel map-matching solution that combines the widely used approach based on a hidden Markov model (HMM) with the concept of drivers’ route choice. Our algorithm uses an HMM tailored for noisy and sparse data to generate partial map-matched paths in an online manner. We use a route choice model, estimated from real drive data, to reassess each HMM-generated partial path along with a set of feasible alternative paths. We evaluated the proposed algorithm with real world as well as synthetic location data under varying levels of measurement noise and temporal sparsity. The results show that the map-matching accuracy of our algorithm is significantly higher than that of the state of the art, especially at high levels of noise.

Computational cancer phylogenetics can play an important role in delineating possible tumor progression pathways and identifying molecular subtypes and mechanisms of action. We previously developed a pipeline for constructing tumor phylogenies from recurring cell types computationally inferred from whole genome copy number data. The accuracy and detail of these tumor phylogenies, however, depends on the identification of accurate and high-resolution molecular markers of progression, i.e., reproducible regions of copy number variation that can be used to robustly differentiate different subtypes and stages of progression. Here we present a new method for the problem using hidden Markov models (HMMs) to derive robust, high resolution progression markers from sets of tumor samples. We demonstrate our method on a publicly available array comparative genome hybridization (aCGH) dataset (NCBI GEO GSE16672, Navin et al., 2010) from sectioned primary ductal breast tumors. Our method uses an HMM, a class of probabilistic models, to classify sets of aCGH data into a partitioning of samples into normal (diploid) or amplified at each copy number probe. It differs from other similar HMM methods primarily in seeking a parsimonious set of combinations of amplification states able to explain all aCGH profiles simultaneously in order to identify robust markers of progression across samples. The model learns frequencies with which different combinations of amplifications are observed across the samples by modeling individual probes as Gaussian random variables with either normal or tetraploid means, with data more consistent with tetraploid being classified as amplified and those more consistent with diploid classified as normal. To handle a combinatorial explosion in combinations of amplification states with increasing numbers of samples, the method introduces a Gibbs sampling algorithm to learn a parsimonious model of the most frequently occurring combinations of amplification states. We applied our methods to a previously constructed set of inferred cell types derived from the Navin et al. data (Tolliver et al., 2010) and to a comparison set of 9 random samples from the raw aCGH data. We validated our model relative to manual labeling of amplicons on the same data. In both experiments, the HMM method was able to pick up significantly larger numbers of robustly amplified segments per chromosome than did prior methods or manual analysis. The resulting segments can be directly fed into downstream analysis routines for phylogeny inference or other predictions. In future work, the HMM method may be improved by fine-tuning the underlying model for copy number variation. Citation Format: {Authors}. {Abstract title} [abstract]. In: Proceedings of the 103rd Annual Meeting of the American Association for Cancer Research; 2012 Mar 31-Apr 4; Chicago, IL. Philadelphia (PA): AACR; Cancer Res 2012;72(8 Suppl):Abstract nr 3964. doi:1538-7445.AM2012-3964

Automatic Analysis of Large-scale Nanopore Data Using Hidden Markov Models

<abstract><p>Due to the complexities of systems thinking and the communication between independent Cyber-Physical Systems (CPSs) areas through accumulative expansion, several security threats are posed, such as deception of channels for information sharing, hardware aspects and virtual machines. CPSs have become increasingly complex, sophisticated, knowledgeable and fully independent. Because of their complex interactions between heterogeneous virtual and objective components, CPSs are subject to significant disturbances from intended and unintended events, making it extremely difficult for scientists to predict their behavior. This paper proposes a framework for Cyber-Physical Business Systems based on Artificial Intelligence (CPBS-AI). It summarizes several safety risks in distinct CPS levels, their threat modeling and the scientific challenges they face in building effective security solutions. This research provides a thorough overview of current state-of-the-art static capable of adapting detection and tracking approaches and their methodological limitations, namely, the difficulty of identifying runtime security attacks caused by hibernation or uncertainty. The way of identifying the threat and the security attacks in networks reduce the complexities in the communication in CPS. The negligible threats exhibit an inability to be identified, avoided and blocked by Intrusion Prevention Security Systems (IPSSs), and misbehavior in the database of the safety measures is analyzed. Neural Networks (NN) and Variable Structure Control (VSC) are designed to estimate attacks and prevent the risk of threats in tracking applications using a nonlinear monitoring system based on VSC. NN and the VSC evaluate the different attacks based on the nonlinear monitoring system. The evaluation of the proposed CPBS-AI is based on the request time analysis, accuracy, loss and reliability analysis. The overall effectiveness of the system is about 96.01%.</p></abstract>

Objectives: This study investigated the visual search behaviour of optometrists and fellowship-trained ophthalmologists when screening for diabetic retinopathy in retinal photographs. Methods: Participants assessed and graded retinal photographs on a computer screen while a Gazepoint GP3 HD eye tracker recorded their eye movements. Areas of interest were derived from the raw data using Hidden Markov modelling. Fixation strings were extracted by matching raw fixation data to areas of interest and resolving ambiguities with graph search algorithms. Fixation strings were clustered using Affinity Propagation to determine search behaviours characteristic of the correct and incorrect response groups. Results: A total of 23 participants (15 optometrists and 8 ophthalmologists) completed the grading task, with each assessing 20 images. Visual search behaviour differed between correct and incorrect responses, with data suggesting correct responses followed a visual search strategy incorporating the optic disc, macula, superior arcade, and inferior arcade as areas of interest. Data from incorrect responses suggest search behaviour driven by saliency or a search pattern unrelated to anatomical landmarks. Referable diabetic retinopathy was correctly identified in 86% of cases. Grader accuracy was 64.8% with good inter-grader agreement (α = 0.818). Conclusions: Our study suggests that a structured visual search strategy is correlated with higher accuracy when assessing retinal photographs for diabetic retinopathy. Referable diabetic retinopathy is detected at high rates; however, there is disagreement between clinicians when determining a precise severity grade.

The central nervous system (CNS) plays an important role in regulation of human gait. Parkinson's disease (PD) is a common neurodegenerative disease that may cause neurophysiologic change in the CNS and as a result change the gait cycle duration (stride interval). This article used the Hidden Markov Model (HMM) with Gaussian Mixtures to separate the patients with PD from healthy subjects. The results showed that the performance of the HMM classifier in classifying the gait data corresponding to 16 healthy and 15 PD subjects is comparable to the results obtained from the least squares support vector machine (LS-SVM) classifier. In this study, the leave-one-out cross-validation method was used to evaluate the performance of each classifier. The HMM method could effectively separate the gait data in terms of stride interval obtained from healthy subjects and PD patients with an accuracy rate of 90.3 % . All in all, the results showed that the proposed method can be used for distinguishing PD patients from healthy subjects based on the gait data classification.

In view of all kinds of network attacks which may affect the network security of the smart grid system, an attack detection algorithm is proposed, feature extraction and training to the data such as server logs is carried out based on Hidden Markov model (HMM) to achieve the network attack detection in smart grid system. By the proposed algorithm, analysis on real data of the smart grid system in one power company is carried out, which can effectively identify common types and numbers of network attack types. Through the proposed smart grid network attack detection algorithm, network security risks in the smart grid system can be found, and the level of network security is improved.

This doctoral thesis presents a framework for machine based interpretation of Malaysian Sign Language (MSL). The goal is to explore and develop necessary core algorithms that are capable of recognizing hand signs, based on the monocular/2D visual input of a low-cost hardware (Digital Webcam), without the assistance of visual-markers on hands. Successful hand sign interpretation with the aforementioned constrained visual system is challenging. Economical hardware devices often provide noisy/cluttered raw data with limited useful information. Non-involvement of visual markers imposes the requirement of additional strategies to disambiguate occlusions and background complexities. Natural variations in hand posture/gesture performances further convolute the recognition task. Addressing these challenges require computationally heavy algorithms in image processing, machine learning and pattern recognition. Thus vision-based sign language translator frameworks have to be multifaceted and versatile, in order to address innumerable practical concerns. In this research, hand postures interpretation is achieved by statistical projection methods. Analysis of high dimensional hand shape data is a complex task. Thus reducing dimensions via known projection methods aids in alleviating some of these complexities. Locality Preserving Projection (LPP) has been employed to accomplish this goal, while Principal Component Analysis (PCA) has been used as the benchmark method. Both methods were extensively tested against a hand posture database of 24 alphabet signs from MSL. As for the hand gesture interpretation, parameter-less Gaussian process based machine learning methods are proposed, as an alternative to current status quo. A variation of the Gaussian latent variable model – Gaussian Process Dynamic Model (GPDM) – has been employed for hand gesture interpretation. This has been comparatively studied against the established Hidden Markov Model (HMM). These machine learning methods were thoroughly tested against a hand gesture database of 64 signs from MSL. Grammatical sentence construction offers both intelligible sentences, and a mean of identifying erroneous sign classifications. In this thesis, a proof-of-concept on: use of Context Free Grammar (CFG) in successful parsing of meaningful sentences based on recognised gesture words, and how it can be extended in identifying (and correcting) erroneous sign classifications, is demonstrated with 92 sentences and the output of GPDM gesture classification. The novelty and contribution of this research: this is the first undertaking of markerless vision-based translation for MSL. Both LPP and GPDM are introduced to the sign language research field as an outcome of this investigation. The preliminary study and demonstration of grammatical sentence construction for translated gesture signs, is the first of its kind to the best of author's knowledge.

Cloud computing has emerged as a fast-growing technology in the past few years. It provides a great flexibility for storing, sharing and delivering data over the Internet without investing on new technology or resources. In spite of the development and wide array of cloud usage, security perspective of cloud computing still remains its infancy. Security challenges faced by cloud environment becomes more complicated when we include various stakeholders' perspectives. In a cloud environment, security perspectives and requirements are usually designed by software engineers or security experts. Sometimes clients' requirements are either ignored or given a very high importance. In order to implement cloud security by providing equal importance to client organizations, software engineers and security experts, we propose a new methodology in this paper. We use Microsoft's STRIDE-DREAD model to assess threats existing in the cloud environment and also to measure its consequences. Our aim is to rank the threats based on the nature of its severity, and also giving a significant importance for clients' requirements on security perspective. Our methodology would act as a guiding tool for security experts and software engineers to proceed with securing process especially for a private or a hybrid cloud. Once threats are ranked, we provide a link to a well-known security pattern classification. Although we have some security pattern classification schemes in the literature, we need a methodology to select a particular category of patterns. In this paper, we provide a novel methodology to select a set of security patterns for securing a cloud software. This methodology could aid a security expert or a software professional to assess the current vulnerability condition and prioritize by also including client's security requirements in a cloud environment.

Cloud security is under threats of anomalies, which indicate cyber threats. The centralized methods of the traditional system have been struggling with scalability and privacy. This paper presents a hybrid framework combining decentralized federated learning (DFL), secure multi-party computation (SMPC), and hidden Markov models (HMM) for improved anomaly detection. The proposed framework integrates DFL, SMPC, and HMM to achieve enhanced privacy, scalability, and detection accuracy. Real-time anomaly detection with better privacy and accuracy that adapts to the evolving threats. It has achieved 92.8% probability, higher precision, and lower latency than traditional methods. Hybrid model with HMM, SMPC, and DFL is used for secure, scalable, real-time anomaly detection.