13221631
Fast intrusion detection based on a non-negative matrix factorization model
In this paper, we present an efficient fast anomaly intrusion detection model incorporating a large amount of data from various data sources. A novel method based on non-negative matrix factorization (NMF) is presented to profile program and user behaviors of a computer system. A large amount of high-dimensional data is collected in our experiments and divided into smaller data blocks by a specific scheme. The system call data is divided into blocks by processes, while command data is divided into consecutive blocks with a fixed length. The frequencies of individual elements in each block of data are computed and placed column by column as data vectors to construct a matrix representation. NMF is employed to reduce the high-dimensional data vectors and anomaly detection can be realized as a very simple classifier in low dimensions. Experimental results show that the model presented in this paper is promising in terms of detection accuracy, computation efficiency and implementation for fast intrusion detection.
13632117
A Novel Intrusion Detection Method Based on Principle Component Analysis in Computer Security
Intrusion detection is an important technique in the defense-in-depth network security framework and a hot topic in computer security in recent years. In this paper, a new intrusion detection method based on Principle Component Analysis (PCA) with low overhead and high efficiency is presented. System call data and command sequences data are used as information sources to validate the proposed method. The frequencies of individual system calls in a trace and individual commands in a data block are computed and then data column vectors which represent the traces and blocks of the data are formed as data input. PCA is applied to reduce the high dimensional data vectors and distance between a vector and its projection onto the subspace reduced is used for anomaly detection. Experimental results show that the proposed method is promising in terms of detection accuracy, computational expense and implementation for real-time intrusion detection.
15381526
A general framework for adaptive and online detection of web attacks
Detection of web attacks is an important issue in current defense-in-depth security framework. In this paper, we propose a novel general framework for adaptive and online detection of web attacks. The general framework can be based on any online clustering methods. A detection model based on the framework is able to learn online and deal with "concept drift" in web audit data streams. Str-DBSCAN that we extended DBSCAN to streaming data as well as StrAP are both used to validate the framework. The detection model based on the framework automatically labels the web audit data and adapts to normal behavior changes while identifies attacks through dynamical clustering of the streaming data. A very large size of real HTTP Log data collected in our institute is used to validate the framework and the model. The preliminary testing results demonstrated its effectiveness.
19006089
Processing of massive audit data streams for real-time anomaly intrusion detection
Intrusion detection is an important technique in the defense-in-depth network security framework. Most current intrusion detection models lack the ability to process massive audit data streams for real-time anomaly detection. In this paper, we present an effective anomaly intrusion detection model based on Principal Component Analysis (PCA). The model is more suitable for high speed processing of massive data streams in real-time from various data sources by considering the frequency property of audit events than by use of the transition property or the correlation property. It can serve as a general framework that a practical Intrusion Detection Systems (IDS) can be implemented in various computing environments. In this method, a multi-pronged anomaly detection model is used to monitor various computer system and network behaviors. Three sources of data, system call data from the University of New Mexico (lpr) and from KLINNS Lab of Xi'an Jiaotong University (ftp), shell command data from AT&T Research laboratory, and network data from MIT Lincoln Lab, are used to validate the model and the method. The frequencies of individual system calls generated by one process and of individual commands embedded in one command block as well as features extracted in one network connection are transformed into an input data vector. Our method is employed to reduce the high dimensional data vectors and thus the detection is handled in a lower dimension with high efficiency and low use of system resources. The distance between a vector and its reconstruction in the reduced subspace is used for anomaly detection. Empirical results show that our model is promising in terms of detection accuracy and computational efficiency, and thus amenable for real-time intrusion detection.
2256492
Autonomic Intrusion Detection System
We propose a novel framework of autonomic intrusion detection that fulfills online and adaptive intrusion detection in unlabeled audit data streams. The framework owns ability of self-managing: self-labeling, self-updating and self-adapting. Affinity Propagation (AP) uses the framework to learn a subject's behavior through dynamical clustering of the streaming data. The testing results with a large real HTTP log stream demonstrate the effectiveness and efficiency of the method.
28996873
Distance Measures for Anomaly Intrusion Detection
Heat treatment of shaped articles, larger than films or fibers, formed from anisotropic-melt-forming polymers provides an increase of at least 25% in energy to break in flexure. In at least one direction of measurement the heat treated articles are characterized by a flexural break strength of at least 10,000 psi, maximum strain to break in flexure of at least 2% and a flexural modulus of at least 500,000 psi. In many instances the heat treated articles can be further characterized by a notched Izod impact strength of at least 2 foot-pounds per inch. Since the heat-treated shaped articles have high levels of strength, stiffness and toughness, they are useful as replacements for some metals, e.g., brass.
20468001
Adaptive backstepping control of uncertain systems with unknown input time-delay
In this paper, we establish the robustness of adaptive controllers designed using the standard backstepping technique with respect to unmodeled dynamics involving unknown input time delay. While noting that some results on robust stabilization of non-minimum phase systems using the backstepping technique are available, we realize that the standard adaptive backstepping technique has only been shown applicable to unknown minimum phase systems. Another significance of our result is to enable the class of systems stablizable by adaptive backstepping controllers to cross the boundary of minimum phase systems, since systems with input time delay belong to non-minimum phase systems. Moreover, the L"2 and L"~ norms of the system output are also established as functions of design parameters. This implies that the transient system performance can be adjusted by choosing suitable design parameters.
12735466
Position Based Unequal Error Protection for Image Transmission with Energy Constraint over Multirate XPD MIMO Sensor Networks
Multimedia delivery over Wireless Sensor Networks (WSNs) is energy critical. In this paper, we study an energy constrained cross layer optimization scheme to improve digital image quality in cross polarization discrimination (XPD) based Multiple Input Multiple Output (MIMO) WSNs. The contribution of this research can be summarized in three parts. First, link layer energy consumption and packet loss ratio in multirate XPD based MIMO WSN are modeled. Secondly, XPD based modulation optimization cross link and physical layer is proposed, achieving considerable energy efficiency. Finally, a new Position-Value (P- V) based Unequal Error Protection (UEP) scheme is studied and discussed in XPD MIMO WSNs, with more efficient resource allocation compared to traditional approaches. Simulation results show the proposed modulation optimization scheme improves energy efficiency considerably, and position based UEP achieves significant distortion-energy gain compared with traditional layer based resource allocation schemes in XPD MIMO WSNs.
7316344
CLINCH: Clustering Incomplete High-Dimensional Data for Data Mining Application
Clustering is a common technique in data mining to discover hidden patterns from massive datasets. With the development of privacy-maintaining data mining application, clustering incomplete high-dimensional data has becoming more and more useful. Motivated by these limits, we develop a novel algorithm CLINCH, which could produce fine clusters on incomplete high-dimensional data space. To handle missing attributes, CLINCH employs a prediction method that can be more precise than traditional techniques. On the other hand, we also introduce an efficient way in which dimensions are processed one by one to attack the “curse of dimensionality”. Experiments show that our algorithm not only outperforms many existing high-dimensional clustering algorithms in scalability and efficiency, but also produces precise results.
7046093
Adaptive contact probing mechanisms for delay tolerant applications
In many delay tolerant applications, information is opportunistically exchanged between mobile devices who encounter each other. In order to effect such information exchange, mobile devices must have knowledge of other devices in their vicinity. We consider scenarios in which there is no infrastructure and devices must probe their environment to discover other devices. This can be an extremely energy consuming process and highlights the need for energy conscious contact probing mechanisms. If devices probe very infrequently, they might miss many of their contacts. On the other hand, frequent contact probing might be energy inefficient. In this paper, we investigate the trade-off between the probability of missing a contact and the contact probing frequency. First, via theoretical analysis, we characterize the trade-off between the probability of a missed contact and the contact probing interval for stationary processes. Next, for time varying contact arrival rates, we provide an optimization framework to compute the optimal contact probing interval as a function of the arrival rate. We characterize real world contact patterns via Bluetooth phone contact logging experiments and show that the contact arrival process is self-similar. We design STAR, a contact probing algorithm which adapts to the contact arrival process. Via trace driven simulations on our experimental data, we show that STAR consumes three times less energy when compared to a constant contact probing interval scheme.
3069611
A General Framework for Fast Co-clustering on Large Datasets Using Matrix Decomposition
Simultaneously clustering columns and rows (co- clustering) of large data matrix is an important problem with wide applications, such as document mining, microarray analysis, and recommendation systems. Several co-clustering algorithms have been shown effective in discovering hidden clustering structures in the data matrix. For a data matrix of m rows and n columns, the time complexity of these methods is usually in the order of mtimesn (if not higher). This limits their applicability to data matrices involving a large number of columns and rows. Moreover, an implicit assumption made by existing co-clustering methods is that the whole data matrix needs to be held in the main memory. In this paper, we propose a general framework, CRD, for co-clustering large datasets utilizing recently developed sampling- based matrix decomposition methods. The time complexity of our approach is linear in m and n. And it does not require the whole data matrix be in the main memory. Experimental results show that CRD achieves competitive accuracy to existing co-clustering methods but with much less computational cost.