Question: A broadband millimetre-wave passive spatial combiner utilizing coaxial waveguide technology.

This paper presents the design and implementation of a high-efficiency Ka-band solid-state power amplifier, utilizing a traveling-wave power-dividing/combining technique. The innovative use of a low-profile slotted-waveguide structure in this amplifier not only ensures a high power-combining efficiency across a broad bandwidth but also facilitates effective heat dissipation for the active components. Experimental results reveal a peak small-signal gain of 19.4 dB at 34 GHz, with a 3-dB bandwidth spanning from 31.8 GHz to 35 GHz. At 32.2 GHz, the amplifier achieves a maximum output power of 33 dBm (approximately 2 W) at 1 dB compression, demonstrating an impressive power-combining efficiency of 80%. Additionally, the paper explores the impact of device failures on the amplifier's performance, both through simulations and practical measurements, showcasing its robustness and reliability under less than ideal conditions.

We describe the design, simulation, fabrication, and performance of a 96-GHz ortho-mode transducer (OMT) to be used for the Polatron—a bolometric receiver with polarization capability. The OMT has low loss, good isolation, and moderately broad bandwidth, and its performance closely resembles simulation results.

An FET-sized 1-18 GHz monolithic active magic T (1 W hybrid) is proposed. It unifies two different dividers, electrically isolated from each other, in a novel GaAs FET electrode configuration, viz. the LUFET concept. Its characteristics and experiment results are presented. Applications of the magic T to miniature wide-band RF signal processing. . .

This paper describes the analysis and design of saturated silicon-germanium (SiGe) heterojunction bipolar transistor (HBT) switches for millimeter-wave applications. A switch optimization procedure is developed based on detailed theoretical analysis and is then used to design multiple switch variants. The switches utilize IBM's 90-nm 9HP technology, which features SiGe HBTs with peak f T/ fmax of 300/350 GHz. Using a reverse-saturated configuration, a single-pole double-throw switch with a measured insertion loss of 1.05 dB and isolation of 22 dB is achieved at 94 GHz after de-embedding pad losses. The switch draws 5.2 mA from a 1.1-V supply, limiting power consumption to less than 6 mW. The switching speed is analyzed and the simulated turn-on and turn-off times are found to be less than 200 ps. A technique is also introduced to significantly increase the power-handling capabilities of saturated SiGe switches up to an input-referred 1-dB compression point of 22 dBm. Finally, the impact of RF stress on this novel configuration is investigated and initial measurements over a 48-h period show little performance degradation. These results demonstrate that SiGe-based switches may provide significant benefits to millimeter-wave systems.

The X-band pulsed 1kW SSPA for XFEL has been designed and manufactured. Amplifier modules were combined by a 20-way Hybrid Radial combiner in order to reduce output loss. The manufactured 20-Way Hybrid Radial Combiner is capable of high output with a combining efficiency of 95%. The entire system is driven by Pulse and results in a Power Gain of 60dB with an Output Power of 1kW.

Next-generation mobile technology (5G) aims to provide an improved experience through higher data-rates, lower latency, and improved link robustness. Millimeter-wave phased arrays offer a path to support multiple users at high data-rates using high-bandwidth directional links between the base station and mobile devices. To realize this vision, a phased-array-based pico-cell must support a large number of precisely controlled beams, yet be compact and power efficient. These system goals have significant mm-wave radio interface implications, including scalability of the RFIC+antenna-array solution, increase in the number of concurrent beams by supporting dual polarization, precise beam steering, and high output power without sacrificing TX power efficiency. Packaged Si-based phased arrays [1–3] with nonconcurrent dual-polarized TX and RX operation [2,3], concurrent dual-polarized RX operation [3] and multi-IC scaling [3,4] have been demonstrated. However, support for concurrent dual-polarized operation in both RX and TX remains unaddressed, and high output power comes at the cost of power consumption, cooling complexity and increased size. The RFIC reported here addresses these challenges. It supports concurrent and independent dual-polarized operation in TX and RX modes, and is compatible with a volume-efficient, scaled, antenna-in-package array. A new TX/RX switch at the shared antenna interface enables high output power without sacrificing TX efficiency, and a t-line-based phase shifter achieves <1° RMS error and <5° phase steps for precise beam control.

A W-band SIW horn antenna is designed and fabricated using PCB process. Measured S11 reaches -15 dB at 84 GHz with bandwidth of 1 GHz and the maximum simulated gain is 9 dBi. The antenna is loaded with dielectric to increase gain and the effect of different loading lengths on gain is studied. The antenna is fed using a WR10 standard waveguide through a coupling slot in the SIW. The effect of changing the slot width on the return loss is studied. Good agreement is achieved between measured and simulated results. The proposed antenna is suitable for medical imaging and air traffic radar.

The general issue of this letter deals with the design of a phased array antenna for high-data-rate SATCOM. A final demonstrator antenna could be installed on an unmanned aerial vehicle (UAV) to communicate with a satellite in Ka-band. First, a compact reflection-type phase shifter is designed and realized. Second, the conception of a phased array antenna prototype is detailed. Third, a new calibration method is involved that can provide the bias voltage to be applied to each phase shifter in order to scan the beam in the desired direction.

A broadband design of substrate integrated waveguide (SIW) to stripline interconnects is presented for the first time. The transition shows a wideband performance and, contrary to microstrip and coplanar waveguide circuitry, interconnects two planar transmission-line media that are both capable of medium-level power handling capabilities. Over a bandwidth of 18 GHz to 28 GHz (43.4 percent), the single interconnect shows a worst-case return loss of 24 dB and maximum insertion losses of 0.44 dB. For a back-to-back connection, the return loss reduces to 19 dB and insertion loss increases to 0.87 dB. All dimensional parameters are specified, and the design is validated by two commercially available field-solver packages. Moreover, field plots are presented that highlight the step-by-step mode conversion from SIW to stripline.

The increasing interest in bi-directional mobile high data rate satellite communications in Ka-band necessitates the development of dedicated antenna tracking systems and feeds. In this paper we describe a compact feed structure based on printed circuit boards for a mobile satellite communications ground terminal with a Cassegrain reflector antenna. The novel structure provides a dual circular polarisation communication mode as well as the TM01 mode for multimode monopulse tracking. This coupler, based on carefully matched transitions from grounded coplanar lines to circular waveguides, is operational at 20GHz and 30 GHz, to cover the downlink and the uplink frequency ranges in Ka-band. This work contributes to the development of a satellite terminal for land-mobile communications in disaster scenarios.

In this paper, a two element antipodal Vivaldi antenna array in combination with an ultra-wideband (UWB) Wilkinson power divider feeding network is presented. The antennas are placed in a stacked configuration to provide more gain and to limit cross talk between transmit and receive antennas in radar applications. Each part can be realized with standard planar technology. For a single antenna element, a comparison in performance is done between standard FR4 and a Rogers® RO3003 substrate. The antenna spacing is obtained using the parametric optimizer of CST MWS®. The performance of the power divider and the antenna array is analyzed by means of simulations and measurements.


Question: A broadband millimetre-wave passive spatial combiner utilizing coaxial waveguide technology.

This paper presents a high-power, broad-bandwidth amplifier design that employs a spatial power-combining technique, addressing critical requirements such as high power output, wide bandwidth, high linearity, and low noise. The technique achieves these objectives by aggregating the output power from multiple microwave monolithic integrated circuit (MMIC) amplifiers within a coaxial waveguide environment, which ensures good linearity and enhances the phase noise characteristics of the MMIC amplifiers. A coaxial waveguide is utilized as the primary medium for combining circuits due to its capability to distribute input power equally among the elements, thus ensuring a broader bandwidth and improved uniformity. An innovative compact coaxial combiner design is explored, significantly reducing the size of the system. To enhance compatibility with commercial MMIC amplifiers, a broad-band slotline to microstrip-line transition is integrated. Thermal simulations are conducted, leading to the implementation of an enhanced thermal management strategy that surpasses previous designs, crucial for high-power applications. A prototype high-power amplifier incorporating the compact combiner design is constructed and tested, demonstrating a bandwidth of 6 to 17 GHz with a maximum output power of 44 watts. Linearity measurements reveal a high third-order intercept point at 52 dBm. Further analysis indicates the amplifier's potential to expand the spurious-free dynamic range by 2 to 3 times. Additionally, the amplifier exhibits a residual phase floor near 140 dBc at a 10-kHz offset from the carrier, representing a 5 to 6 dB improvement over a single MMIC amplifier.

In this paper, a new single element broad band cavity backed multi-layer microstrip patch antenna is presented. This antenna is designed to be used in 79 GHz MIMO radar applications, and is fabricated with advanced high resolution multi-layer PCB technology. It has a wide bandwidth of 11.43 GHz, which is 14.5% of the center frequency. The beam widths in both E and H-planes are very wide, and are 144 degrees and 80 degrees respectively. Also, the antenna gain and efficiency are respectively 4.7 dB and 87%. Furthermore, measurements have been done, and show a good agreement with simulations.

This paper presents a T-shaped antenna at millimetre-wave (MMW) frequency ranges to offer a number of advantages including simple structure, high operating bandwidth, and high gain. Defected ground structures (DGS) have been symmetrically added in ground in order to produce multiple resonating bands, accompanied by partial ground plane to achieve continuous operating bandwidth. The antenna consists of T-shaped radiating patch with a coplanar waveguide (CPW) feed. The bottom part has a partial ground plane loaded with five symmetrical split-ring slots. Measured results of antenna prototype show a wide bandwidth of 25.1-37.5 GHz. Moreover, simulation evaluation of peak gain of the antenna is 9.86 dBi at 36.8 GHz, and efficiency is higher than 80% in complete range of operation. The proposed antenna is considered as a potential candidate for the 5G wireless networks and applications.

A W-band SIW horn antenna is designed and fabricated using PCB process. Measured S11 reaches -15 dB at 84 GHz with bandwidth of 1 GHz and the maximum simulated gain is 9 dBi. The antenna is loaded with dielectric to increase gain and the effect of different loading lengths on gain is studied. The antenna is fed using a WR10 standard waveguide through a coupling slot in the SIW. The effect of changing the slot width on the return loss is studied. Good agreement is achieved between measured and simulated results. The proposed antenna is suitable for medical imaging and air traffic radar.

Planar antennas are common components in sensing applications due to their low cost, low profile and simple integration with systems. They can be used commonly at frequencies as high as 77 GHz and above, for example in automotive sensing. Also, new ultra-wideband communication systems operating around 60 GHz will heavily rely on planar antennas due to their unique properties. One special advantage of planar elements is that they can easily form array structures combining very simple elements, like microstrip patches. Also phased and conformal arrays can be built. Due to all these characteristics, planar antennas are very good candidates for building front ends for mm-wave applications in radar, sensing or communications. For some applications, which are either established today or which will become commercial in a few years, general requirements can be given. In addition to automotive radar, this mainly applies to 60 GHz ultra-broadband wireless indoor communications. Microwave imaging at 94 GHz and above is still much under research, as well as other sensing applications in the millimeter-wave region above 100 GHz. Prominent frequency bands are in the 122 and 140 GHz range1. Typical antenna requirements are multi-beam or scanning capability, high gain up to 30..36 dBi and moderate to low sidelobes. In monopulse radar systems, the sidelobes may be included in the angle determination scheme, then the sidelobe level requirements are rather relaxed. Loss is generally an important issue. Comparing a planar approach to a commercially available dielectric lens, the planar antenna exhibits significantly higher losses, especially if the beamforming device is included. The antenna efficiency of 77 GHz planar array columns is roughly 50%. These losses are caused by dielectric losses and conductor losses. To attain reliable predictions of the losses in full-wave simulations, care has to be taken in the

In this paper, the design procedure of the 2-18 GHz and the 18-40 GHz cavity-backed spiral antenna is described. By varying the antenna parameters the VSWR and the axial ratio characteristics of the antenna are investigated. For the 2-18 GHz spiral antenna, the solid absorber and the Marchand balun are applied. The measured results of the fabricated antenna are compared with the simulated ones. For the 18-40 GHz antenna, the honeycomb absorber having variable loss tangent is considered in simulation to investigate for improvement of the VSWR and the axial ratio characteristics.

A new generation of compact microwave bandpass filters (BPF) is proposed. The filters are based on multilayer ring resonators (MRR) technique which is applicable to both narrow band and ultra-wideband (UWB) bandpass filters. This class of filters has very compact circuit size and simple structure for fabrication. Multiple attenuation poles exist and can be simply placed to the left or right of the passband. The dimensions of the filters can be designed to around 2 mm × 2 mm × 1 mm. Out of the five filters presented, two of them are fabricated and measured. Good agreement between the simulation and measurements confirmed the design approach.

A circularly polarized slot radiator in millimetre band is presented. Low reflection and good polarization performance is obtained in comparison with state of art slot elements. A high gain array prototype has been implemented in substrate integrated waveguides (SIW) technology, in order to check the new element performance. A cosecant amplitude coverage in the elevation plane, as well as a 6° tilted monopulse pattern in the azimuth plane are obtained. A gain peak value of 28.6 dBi and 79% of efficiency at 36.7 GHz have been obtained in the specified operation band (36.7 – 37 GHz) for a manufactured antenna prototype. Likewise, the top measured axial ratio is 1.95 dB at 36.85 GHz.

A substrate integrated waveguide (SIW) H-plane sectoral horn antenna, with significantly improved bandwidth, is presented. A tapered ridge, consisting of a simple arrangement of vias on the side flared wall within the multilayer substrate, is introduced to enlarge the operational bandwidth. A simple feed configuration is suggested to provide the propagating wave for the antenna structure. The proposed antenna is simulated by two well-known full-wave packages, Ansoft HFSS and CST Microwave Studio, based on segregate numerical methods. Close agreement between simulation results is reached. The designed antenna shows good radiation characteristics and low VSWR, lower than 2.5, for the whole frequency range of 18-40 GHz.

This communication presents a 60-GHz wideband circularly polarized (CP) U-slot patch antenna array of 4 × 4 elements on low temperature cofired ceramic (LTCC). A CP U-slot patch antenna is used as the array element to enhance the impedance bandwidth and a stripline sequential rotation feeding scheme is applied to achieve wide axial ratio (AR) bandwidth. Meanwhile, a grounded coplanar waveguide (GCPW) to stripline transition is designed for probe station measurement. The fabricated antenna array has a dimension of 14 ×16 × 1.1 mm3 . The simulated and measured impedance bandwidths, AR bandwidths, and radiation patterns are investigated and compared. Measured results show that the proposed antenna array has a wide impedance bandwidth from 50.5 GHz to 67 GHz for |S11| <; -10 dB, and a wide AR bandwidth from 54 GHz to 65.5 GHz for AR <; 3 dB. In addition, it exhibits a peak gain of 16 dBi and a beam-shaped pattern with 3-dB beam width of 20°. Moreover, its AR keeps below 3 dB within the 3-dB beam width.

The paper presents several feasible millimeter wave on-chip antenna designs suitable to be fabricated in CMOS technology without any additional process. The results are listed and compared with state-of-the-art designs in the literature. The difficulties in designing high efficiency antenna on CMOS chip are discussed.


Question: An immune system inspired approach for developing an intrusion detection system.

This paper explores the concept of self versus nonself in computer systems, drawing parallels with the immune system's mechanism for distinguishing between self and foreign entities. Inspired by the immune system's T cell generation process, we present a novel approach to detecting changes in computer environments that could indicate the presence of malicious software, akin to computer viruses. Through rigorous mathematical analysis, we uncover the computational expenses associated with implementing this system. Initial experimental results highlight the potential of this method in effectively identifying computer viruses by emulating the immune system's sophisticated self-nonself discrimination capabilities. This approach not only enhances the detection of known threats but also holds promise in identifying previously unseen or evolving malware, thereby offering a robust defense mechanism for computer systems.

Robust statistics is a branch of statistics which includes statistical methods capable of dealing adequately with the presence of outliers. In this paper, we propose an anomaly detection method that combines a feature selection algorithm and an outlier detection method, which makes extensive use of robust statistics. Feature selection is based on a mutual information metric for which we have developed a robust estimator; it also includes a novel and automatic procedure for determining the number of relevant features. Outlier detection is based on robust Principal Component Analysis (PCA) which, opposite to classical PCA, is not sensitive to outliers and precludes the necessity of training using a reliably labeled dataset, a strong advantage from the operational point of view. To evaluate our method we designed a network scenario capable of producing a perfect ground-truth under real (but controlled) traffic conditions. Results show the significant improvements of our method over the corresponding classical ones. Moreover, despite being a largely overlooked issue in the context of anomaly detection, feature selection is found to be an important preprocessing step, allowing adaption to different network conditions and inducing significant performance gains.

Network forensics is the science that deals with capture, recording, and analysis of network traffic for detecting intrusions and investigating them. This paper makes an exhaustive survey of various network forensic frameworks proposed till date. A generic process model for network forensics is proposed which is built on various existing models of digital forensics. Definition, categorization and motivation for network forensics are clearly stated. The functionality of various Network Forensic Analysis Tools (NFATs) and network security monitoring tools, available for forensics examiners is discussed. The specific research gaps existing in implementation frameworks, process models and analysis tools are identified and major challenges are highlighted. The significance of this work is that it presents an overview on network forensics covering tools, process models and framework implementations, which will be very much useful for security practitioners and researchers in exploring this upcoming and young discipline. a 2010 Elsevier Ltd. All rights reserved.

In some domains of application, like software development and health care processes, a normative business process system (e.g. workflow management system) is not appropriate because a flexible support is needed to the participants. On the other hand, while it is important to support flexibility of execution in these domains, security requirements can not be met whether these systems do not offer extra control, which characterizes a trade off between flexibility and security in such domains. This work presents and assesses a set of anomaly detection algorithms in logs of Process Aware Systems (PAS). The detection of an anomalous instance is based on the “noise” which an instance makes in a process model discovered by a process mining algorithm. As a result, a trace that is an anomaly for a discovered model will require more structural changes for this model fit it than a trace that is not an anomaly. Hence, when aggregated to PAS, these methods can support the coexistence of security and flexibility.

Traditional intrusion detection systems (IDSs) focus on low-level attacks or anomalies, and raise alerts independently, though there may be logical connections between them. In situations where there are intensive intrusions, not only will actual alerts be mixed with false alerts, but the amount of alerts will also become unmanageable. As a result, it is difficult for human users or intrusion response systems to understand the alerts and take appropriate actions. This paper presents a practical technique to address this issue. The proposed approach constructs attack scenarios by correlating alerts on the basis of  prerequisites and consequences of intrusions. Intuitively, the prerequisite of an intrusion is the necessary condition for the intrusion to be successful, while the consequence of an intrusion is the possible outcome of the intrusion. Based on the prerequisites and consequences of different types of attacks, the proposed approach correlates alerts by (partially) matching the consequence of some previous alerts and the prerequisite of some later ones. The contribution of this paper includes a formal framework for alert correlation, the implementation of an off-line alert correlator based on the framework, and the evaluation of our method with the 2000 DARPA intrusion detection scenario specific datasets. Our experience and experimental results have demonstrated the potential of the proposed method and its advantage over alternative methods.

As Supervisory Control and Data Acquisition (SCADA) systems control several critical infrastructures, they have connected to the internet. Consequently, SCADA systems face different sophisticated types of cyber adversaries. This paper suggests a Probability Risk Identification based Intrusion Detection System (PRI-IDS) technique based on analysing network traffic of Modbus TCP/IP for identifying replay attacks. It is acknowledged that Modbus TCP is usually vulnerable due to its unauthenticated and unencrypted nature. Our technique is evaluated using a simulation environment by configuring a testbed, which is a custom SCADA network that is cheap, accurate and scalable. The testbed is exploited when testing the IDS by sending individual packets from an attacker located on the same LAN as the Modbus master and slave. The experimental results demonstrated that the proposed technique can effectively and efficiently recognise replay attacks.

Biomimetic, or biologically inspired, design uses analogous biological phenomena to develop solutions for engineering problems. Several instances of biomimetic design result from personal observations of biological phenomena. However, many engineers’ knowledge of biology may be limited, thus reducing the potential of biologically inspired solutions. Our approach to biomimetic design takes advantage of the large amount of biological knowledge already available in books, journals, and so forth, by performing keyword searches on these existing natural-language sources. Because of the ambiguity and imprecision of natural language, challenges inherent to natural language processing were encountered. One challenge of retrieving relevant cross-domain information involves differences in domain vocabularies, or lexicons. A keyword meaningful to biologists may not occur to engineers. For an example problem that involved cleaning, that is, removing dirt, a biochemist suggested the keyword “defend.” Defend is not an obvious keyword to most engineers for this problem, nor are the words defend and “clean0remove” directly related within lexical references. However, previous work showed that biological phenomena retrieved by the keyword defend provided useful stimuli and produced successful concepts for the clean0remove problem. In this paper, we describe a method to systematically bridge the disparate biology and engineering domains using natural language analysis. For the clean0remove example, we were able to algorithmically generate several biologically meaningful keywords, including defend, that are not obviously related to the engineering problem. We developed a method to organize and rank the set of biologically meaningful keywords identified, and confirmed that we could achieve similar results for two other examples in encapsulation and microassembly. Although we specifically address cross-domain information retrieval from biology, the bridging process presented in this paper is not limited to biology, and can be used for any other domain given the availability of appropriate domain-specific knowledge sources and references.

Critical Infrastructures (CIs) use Supervisory Control And Data Acquisition (SCADA) systems for remote control and monitoring. Sophisticated security measures are needed to address malicious intrusions, which are steadily increasing in number and variety due to the massive spread of connectivity and standardisation of open SCADA protocols. Traditional Intrusion Detection Systems (IDSs) cannot detect attacks that are not already present in their databases. Therefore, in this paper, we assess Machine Learning (ML) for intrusion detection in SCADA systems using a real data set collected from a gas pipeline system and provided by the Mississippi State University (MSU). The contribution of this paper is two-fold: 1) The evaluation of four techniques for missing data estimation and two techniques for data normalization, 2) The performances of Support Vector Machine (SVM), and Random Forest (RF) are assessed in terms of accuracy, precision, recall and F 1 score for intrusion detection. Two cases are differentiated: binary and categorical classifications. Our experiments reveal that RF detect intrusions effectively, with an F_1 score of respectively > 99%.

Intrusion Detection Systems (IDS) have been in existence for many years now, but they fall short in efficiently detecting zero-day attacks. This paper presents an organic combination of Semantic Link Networks (SLN) and dynamic semantic graph generation for the on the fly discovery of zero-day attacks using the Spark Streaming platform for parallel detection. In addition, a minimum redundancy maximum relevance (MRMR) feature selection algorithm is deployed to determine the most discriminating features of the dataset. Compared to previous studies on zero-day attack identification, the described method yields better results due to the semantic learning and reasoning on top of the training data and due to the use of collaborative classification methods. We also verified the scalability of our method in a distributed environment.

Port scanning is the usual precursor to malicious attacks on today's Internet. Although many algorithms have been proposed for different aspects of the scan detection problem, their focused designed space is enterprise gateway level Intrusion Detection. Furthermore, we find few studies that track scanner behaviors over an extended period of time. Operating from a unique vantage point, the IP backbone, we put all the pieces together in designing and implementing a fast and accurate online port scan detection and tracking system. We introduce our flexible architecture, discuss trade-offs and design choices. Specifically, we go in depth to two design choices: the distinct counter data structure and the buffer size tuning. Our choice of a probabilistic counter is proved to have a low average error of 3.5%. The buffer size is derived using Lyapunov drift techniques on an equivalent queuing model. Our initial scanner tracking results show that the scanners' timing behavior follows a 90-10 curve. That is, 90% of scanners are active for a short time, with low scanning rates, while 10% are long term and fast scanners, with a few super-scanners lasting the entire duration of monitoring.

Security issues are becoming more and more important to acti vities of individuals, organizations and the society in our modern ne tworked computerized world. In this chapter we survey a few optimization framewor ks for problems related to security of various networked system such as the int erne or the power grid system.


Question: An immune system-inspired method for intrusion detection systems.

This paper presents a comprehensive categorization framework for intrusion-detection systems, which are essential for identifying assaults on computer systems, networks, and information systems at large. Given the inherent difficulty in ensuring absolute security across all systems, especially considering their long-term usage and operational constraints, intrusion-detection systems play a critical role. Their primary function is to continuously monitor system activity and promptly identify any deviations from secure operations. These systems are vigilant against both attempted intrusions and active exploitation of vulnerabilities by both authorized users and external entities. We propose a taxonomy that encapsulates the multifaceted nature of intrusion-detection systems, classifying them into distinct families based on their specific characteristics. This taxonomy is substantiated with a wide array of examples drawn from both historical and contemporary projects, offering a detailed understanding of the field. Copyright 1999 Elsevier Science B.V. All rights reserved. This structured approach not only provides a clearer picture of existing systems but also aids in the development of new, more effective intrusion-detection mechanisms.

We present a method for detecting exploitations of vulnerabilities in privileged programs by monitoring their execution using audit trials, where the monitoring is with respect to specifications of the security-relevant behavior of the programs. Our work is motivated by the intrusion detection paradigm, but is a n attempt to avoid a d hoc approaches to codifying misuse behavior. Our approach as based on the observation that although privileged programs can be exploited (due to errors) to cause security compromise in systems because of the privileges accorded to them, the intended behavior of privileged programs is, of course, limited a n d benign. The key, then i s to specify the intended behavior (Le., the program policy) and to detect any action by privileged program that is outside the intended behavior a n d that imperils security. We describe a program policy specification language, which is based on simple predicate logic and regular expressions. I n addition, we present specifications of privileged programs in Unix, and Q prototype execution monitor for analyzing audit trails with respect to these specifications. The program policies are surprisingly concise and clear, a n d an addition, capable of detecting exploitations of known vulnerabilities in these programs. Although our work has been motivated by the known vulnerabilities in Unix, we believe that by tightly restricting the behavior of all privileged programs, exploitations of unknown vulnerabilities can be detected. A s Q check on the specifications, work is in progress on verifying them with respect to a n abstract security policy. *This work is funded in part by the National Security Agency University Research Program under Contract No. DOD-MDA904-93-C4083 and by ARPA under Contract No. USNN00014-94-1-0065.

The scale and complexity of Advanced Metering Infrastructure (AMI) networks requires careful planning for the deployment of security solutions. In particular, the large number of AMI devices and the volume and diversity of communication expected to take place on the various AMI networks make the role of intrusion detection systems (IDSes) critical. Understanding the trade-offs for a scalable and comprehensive IDS is key to investing in the right technology and deploying sensors at optimal locations. This paper reviews the benefits and costs associated with different IDS deployment options, including either centralized or distributed solution. A general cost-model framework is proposed to help utilities (AMI asset owners) make more informed decisions when selecting IDS deployment architectures and managing their security investments. We illustrate how the framework can be applied through case studies, and highlight the interesting cost/benefit trade-offs that emerge.

Robust statistics is a branch of statistics which includes statistical methods capable of dealing adequately with the presence of outliers. In this paper, we propose an anomaly detection method that combines a feature selection algorithm and an outlier detection method, which makes extensive use of robust statistics. Feature selection is based on a mutual information metric for which we have developed a robust estimator; it also includes a novel and automatic procedure for determining the number of relevant features. Outlier detection is based on robust Principal Component Analysis (PCA) which, opposite to classical PCA, is not sensitive to outliers and precludes the necessity of training using a reliably labeled dataset, a strong advantage from the operational point of view. To evaluate our method we designed a network scenario capable of producing a perfect ground-truth under real (but controlled) traffic conditions. Results show the significant improvements of our method over the corresponding classical ones. Moreover, despite being a largely overlooked issue in the context of anomaly detection, feature selection is found to be an important preprocessing step, allowing adaption to different network conditions and inducing significant performance gains.

With the capability of infecting hundreds of thousands of hosts, worms represent a major threat to the Internet. The defense against Internet worms is largely an open problem. This paper investigates two important problems. Can a localized defense system detect new worms that were not seen before and moreover, capture the attack packets? How to identify polymorphic worms from the normal background traffic? We have two major contributions here. The first contribution is the design of a novel double-honeypot system, which is able to automatically detect new worms and isolate the attack traffic. The second contribution is the proposal of a new type of position-aware distribution signatures (PADS), which fit in the gap between the traditional signatures and the anomaly-based systems. We propose two algorithms based on expectation-maximization (EM) and Gibbs sampling for efficient computation of PADS from polymorphic worm samples. The new signature is capable of handling certain polymorphic worms. Our experiments show that the algorithms accurately separate new variants of the MSBlaster worm from the normal-traffic background.

Data and network system security is the most important roles. An organization should find the methods to protect their data and network system to reduce the risk from attacks. Snort Intrusion Detection System (Snort-IDS) is a security tool of network security. It has been widely used for protecting the network of the organizations. The Snort-IDS utilize the rules to matching data packets traffic. If some packet matches the rules, Snort-IDS will generate the alert messages. However, Snort-IDS contain many rules and it also generates a lot of false alerts. In this paper, we present the procedure to improve the Snort-IDS rules for the network probe attack detection. In order to test the performance evaluation, we utilized the data set from the MIT-DAPRA 1999, which includes the normal and abnormal traffics. Firstly, we analyzed and explored the existing the Snort-IDS rules to improve the proposed Snort-IDS rules. Secondly, we applied the WireShark software to analyze data packets form of attack in data set. Finally, the Snort-IDS was improved, and it can detect the network probe attack. This paper, we had classified the attacks into several groups based on the nature of network probe attack. In addition, we also compared the efficacy of detection attacks between Snort-IDS rules to be updated with the Detection Scoring Truth. As the experimental results, the proposed Snort-IDS efficiently detected the network probe attacks compared to the Detection Scoring Truth. It can achieve higher accuracy. However, there were some detecting alert that occur over the attack in Detection Scoring Truth, because some attack occur in several time but the Detection Scoring Truth indentify as one time.

As more software modules and external interfaces are getting added on vehicles, new attacks and vulnerabilities are emerging. Researchers have demonstrated how to compromise in-vehicle Electronic Control Units (ECUs) and control the vehicle maneuver. To counter these vulnerabilities, various types of defense mechanisms have been proposed, but they have not been able to meet the need of strong protection for safety-critical ECUs against in-vehicle network attacks. To mitigate this deficiency, we propose an anomaly-based intrusion detection system (IDS), called Clock-based IDS (CIDS). It measures and then exploits the intervals of periodic in-vehicle messages for fingerprinting ECUs. The thusderived fingerprints are then used for constructing a baseline of ECUs’ clock behaviors with the Recursive Least Squares (RLS) algorithm. Based on this baseline, CIDS uses Cumulative Sum (CUSUM) to detect any abnormal shifts in the identification errors — a clear sign of intrusion. This allows quick identification of in-vehicle network intrusions with a low false-positive rate of 0.055%. Unlike state-of-the-art IDSs, if an attack is detected, CIDS’s fingerprinting of ECUs also facilitates a rootcause analysis; identifying which ECU mounted the attack. Our experiments on a CAN bus prototype and on real vehicles have shown CIDS to be able to detect a wide range of in-vehicle network attacks.

Nowadays, network is one of the essential parts of life, and lots of primary activities are performed by using the network. Also, network security plays an important role in the administrator and monitors the operation of the system. The intrusion detection system (IDS) is a crucial module to detect and defend against the malicious traffics before the system is affected. This system can extract the information from the network system and quickly indicate the reaction which provides real-time protection for the protected system. However, detecting malicious traffics is very complicating because of their large quantity and variants. Also, the accuracy of detection and execution time are the challenges of some detection methods. In this paper, we propose an IDS platform based on convolutional neural network (CNN) called IDS-CNN to detect DoS attack. Experimental results show that our CNN based DoS detection obtains high accuracy at most 99.87%. Moreover, comparisons with other machine learning techniques including KNN, SVM, and Naïve Bayes demonstrate that our proposed method outperforms traditional ones.

Network security is a complex and challenging problem. The area of network defense mechanism design is receiving immense attention from the research community for more than two decades. However, the network security problem is far from completely solved. Researchers have been exploring the applicability of game theoretic approaches to address the network security issues and some of these approaches look promising. This paper surveys the existing game theoretic solutions which are designed to enhance network security and presents a taxonomy for classifying the proposed solutions. This taxonomy should provide the reader with a better understanding of game theoretic solutions to a variety of cyber security problems.

We present a scalable system for high-throughput real-time analysis of heterogeneous data streams. Our architecture enables incremental development of models for predictive analytics and anomaly detection as data arrives into the system. In contrast with batch data-processing systems, such as Hadoop, that can have high latency, our architecture allows for ingest and analysis of data on the fly, thereby detecting and responding to anomalous behavior in near real time. This timeliness is important for applications such as insider threat, financial fraud, and network intrusions. We demonstrate an application of this system to the problem of detecting insider threats, namely, the misuse of an organization's resources by users of the system and present results of our experiments on a publicly available insider threat dataset.

Ideally, a measure of the security of a system should capture quantitatively the intuitive notion of ‘the ability of the system to resist attack’. That is, it should be operational, reflecting the degree to which the system can be expected to remain free of security breaches under particular conditions of operation (including attack). Instead, current security levels at best merely reflect the extensiveness of safeguards introduced during the design and development of a system. Whilst we might expect a system developed to a higher level than another to exhibit ‘more secure behaviour’ in operation, this cannot be guaranteed; more particularly, we cannot infer what the actual security behaviour will be from knowledge of such a level. In the paper we discuss similarities between reliability and security with the intention of working towards measures of ‘operational security’ similar to those that we have for reliability of systems. Very informally, these measures could involve expressions such as the rate of occurrence of security breaches (cf rate of occurrence of failures in reliability), or the probability that a specified ‘mission’ can be accomplished without a security breach (cf reliability function). This new approach is based on the analogy between system failure and security breach. A number of other analogies to support this view are introduced. We examine this duality critically, and have identified a number of important open questions that need to be answered before this quantitative approach can be taken further. The work described here is therefore somewhat tentative, and one of our major intentions is to invite discussion about the plausibility and feasibility of this new approach. Towards Operational Measures of Computer Security 2 _____________________________________________________________________


Question: An immunity-based approach for intrusion detection systems.

Exploring Artificial Immune Systems: A Novel Approach in Computational Intelligence

In just a few moments, we'll introduce you to a transformative concept that will redefine your perspective on computational intelligence. This is the essence of Artificial Immune Systems (AIS), a groundbreaking paradigm that has the potential to revolutionize the way we approach complex problems. Rather than spending countless hours searching for the right resource, consider this your definitive guide to understanding the power of AIS.

AIS, inspired by the intricate workings of the human immune system, presents a fresh and innovative framework for computational intelligence. By modeling the immune system's ability to identify and respond to threats, AIS offers a sophisticated mechanism for detecting and mitigating intrusions in computer systems. This approach is not only intuitive but also highly effective, as it mimics the natural processes that have evolved over millions of years.

The beauty of AIS lies in its adaptability and efficiency. Just as the immune system evolves and adapts to new pathogens, AIS can be trained to recognize and counteract novel security threats. This dynamic capability sets it apart from traditional intrusion detection systems, which often struggle to keep pace with rapidly evolving cyber threats.

Moreover, AIS offers a scalable solution that can be tailored to the specific needs of different systems. Whether you're dealing with large-scale networks or smaller, more specialized systems, AIS can be adapted to fit the unique requirements of your environment. This flexibility ensures that AIS remains a relevant and powerful tool in the ever-changing landscape of computational intelligence.

In essence, AIS represents a significant leap forward in the field of intrusion detection. By harnessing the power of the immune system, we can create more resilient and responsive systems that are better equipped to handle the challenges of the digital age. So, whether you're a seasoned expert or a curious newcomer, the world of Artificial Immune Systems is waiting to be explored. Dive in, and discover the potential of this revolutionary paradigm.

With the rapid expansion of computer networks during the past few years, security has become a crucial issue for modern computer systems. A good way to detect illegitimate use is through monitoring unusual user activity. Methods of intrusion detection based on hand-coded rule sets or predicting commands on-line are laborous to build or not very reliable. This paper proposes a new way of applying neural networks to detect intrusions. We believe that a user leaves a ’print’ when using the system; a neural network can be used to learn this print and identify each user much like detectives use thumbprints to place people at crime scenes. If a user’s behavior does not match his/her print, the system administrator can be alerted of a possible security breech. A backpropagation neural network called NNID (Neural Network Intrusion Detector) was trained in the identification task and tested experimentally on a system of 10 users. The system was 96% accurate in detecting unusual activity, with 7% false alarm rate. These results suggest that learning user profiles is an effective way for detecting intrusions.

Network intrusion detection systems are faced with the challenge of identifying diverse attacks, in extremely high speed networks. For this reason, they must operate at multi-Gigabit speeds, while performing highly-complex per-packet and per-flow data processing. In this paper, we present a multi-parallel intrusion detection architecture tailored for high speed networks. To cope with the increased processing throughput requirements, our system parallelizes network traffic processing and analysis at three levels, using multi-queue NICs, multiple CPUs, and multiple GPUs. The proposed design avoids locking, optimizes data transfers between the different processing units, and speeds up data processing by mapping different operations to the processing units where they are best suited. Our experimental evaluation shows that our prototype implementation based on commodity off-the-shelf equipment can reach processing speeds of up to 5.2 Gbit/s with zero packet loss when analyzing traffic in a real network, whereas the pattern matching engine alone reaches speeds of up to 70 Gbit/s, which is an almost four times improvement over prior solutions that use specialized hardware.

A popular approach in current commercial anti-malware software detects malicious programs by searching in the code of programs for scan strings that are byte sequences indicative of malicious code. The scan strings, also known as the signatures of existing malware, are extracted by malware analysts from known malware samples, and stored in a database often referred to as a virus dictionary. This process often involves a significant amount of human efforts. In addition, there are two major limitations in this technique. First, not all malicious programs have bit patterns that are evidence of their malicious nature. Therefore, some malware is not recorded in the virus dictionary and can not be detected through signature matching. Second, searching for specific bit patterns will not work on malware that can take many forms--obfuscated malware. Signature matching has been shown to be incapable of identifying new malware patterns and fails to recognize obfuscated malware. This paper presents a malware detection technique that discovers malware by means of a learning engine trained on a set of malware instances and a set of benign code instances. The learning engine uses an adaptive data compression model--prediction by partial matching (PPM)--to build two compression models, one from the malware instances and the other from the benign code instances. A code instance is classified, either as "malware" or "benign", by minimizing its estimated cross entropy. Our preliminary results are very promising. We achieved about 0.94 true positive rate with as low as 0.016 false positive rate. Our experiments also demonstrate that this technique can effectively detect unknown and obfuscated malware.

In this paper, a new learning algorithm for adaptive network intrusion detection using naive Bayesian classifier and decision tree is presented, which performs balance detections and keeps false positives at acceptable level for different types of network attacks, and eliminates redundant attributes as well as contradictory examples from training data that make the detection model complex. The proposed algorithm also addresses some difficulties of data mining such as handling continuous attribute, dealing with missing attribute values, and reducing noise in training data. Due to the large volumes of security audit data as well as the complex and dynamic properties of intrusion behaviours, several data miningbased intrusion detection techniques have been applied to network-based traffic data and host-based data in the last decades. However, there remain various issues needed to be examined towards current intrusion detection systems (IDS). We tested the performance of our proposed algorithm with existing learning algorithms by employing on the KDD99 benchmark intrusion detection dataset. The experimental results prove that the proposed algorithm achieved high detection rates (DR) and significant reduce false positives (FP) for different types of network intrusions using limited computational resources.

We propose a characterization of distributed denial-of-s ervice (DDOS) defenses where reaction points are network-based and attack responses are active. The purpose is to provide a framework for comparing the performance and deployment of DDOS defenses. We identify the characteristics in attack detection algorithms and a ttack responses by reviewing defenses that have appeared in the literature. We expect that this char a terization will provide practitioners and academia insights into deploying DDOS defense as network services.

We describe an approach to building security services for context-aware environments. Specifically, we focus on the design of security services that incorporate the use of security-relevant “context” to provide flexible access control and policy enforcement. We previously presented a generalized access control model that makes significant use of contextual information in policy definition. This document provides a concrete realization of such a model by presenting a system-level service architecture, as well as early implementation experience with the framework. Through our context-aware security services, our system architecture offers enhanced authentication services, more flexible access control and a security subsystem that can adapt itself based on current conditions in the environment. We discuss our architecture and implementation and show how it can be used to secure several sample applications.

A decision tree is a outstanding method for the data mining. In intrusion detection systems (IDSs), the data mining techniques are useful to detect the attack especially in anomaly detection. For the decision tree, we use the DARPA 98 Lincoln Laboratory Evaluation Data Set (DARPA Set) as the training data set and the testing data set. KDD 99 Intrusion Detection data set is also based on the DARPA Set. These three entities are widely used in IDSs. Hence, we describe the total process to generate the decision tree learned from the DARPA Sets. In this paper, we also evaluate the effective value of the decision tree as the data mining method for the IDSs, and the DARPA Set as the learning data set for the decision trees.

Host compromise is a serious computer security problem today. To better protect hosts, several Mandatory Access Control systems, such as Security Enhanced Linux (SELinux) and AppArmor, have been introduced. In this paper we propose an approach to analyze and compare the quality of protection offered by these different MAC systems. We introduce the notion of vulnerability surfaces under attack scenarios as the measurement of protection quality, and implement a tool called VulSAN for computing such vulnerability surfaces. In VulSAN, we encode security policies, system states, and system rules using logic programs. Given an attack scenario, VulSAN computes a host attack graph and the vulnerability surface. We apply our approach to compare SELinux and AppArmor policies in several Linux distributions and discuss the results. Our tool can also be used by Linux system administrators as a system hardening tool. Because of its ability to analyze SELinux as well as AppArmor policies, it can be used for most enterprise Linux distributions and home user distributions.

Intrusion detection systems aim to detect malicious viruses from computer and network traffic, which is not possible using common firewall. Most intrusion detection systems are developed based on machine learning techniques. Since datasets which used in intrusion detection are imbalanced, in the previous methods, the accuracy of detecting two attack classes, R2L and U2R, is lower than that of the normal and other attack classes. In order to overcome this issue, this study employs a hybrid approach. This hybrid approach is a combination of synthetic minority oversampling technique (SMOTE) and cluster center and nearest neighbor (CANN). Important features are selected using leave one out method (LOO). Moreover, this study employs NSL KDD dataset. Results indicate that the proposed method improves the accuracy of detecting U2R and R2L attacks in comparison to the baseline paper by 94% and 50%, respectively. Keywords—intrusion detection system; feature selection; imbalanced dataset; SMOTE; NSL KDD

The modern requirements and the best practices in the field of Information Security (IS) Incident Management Process (ISIMP) are analyzed. "IS event" and "IS incident" terms, being used for ISIMP, have been defined. An approach to ISIMP development has been created. According to this approach ISIMP processes are described. As an example the «Vulnerabilities, IS events and incidents detection and notification» joint process is examined in detail.


Question: An immunity-based approach for intrusion detection systems.

In recent years, numerous publications have vividly highlighted an extensive array of security issues specific to the UNIX environment. These issues have been recurrently discussed, focusing on the vulnerabilities associated with set user ID (setuid) programs, inappropriate file permissions, and weak passwords, among others. Two consistent traits are observable in these security flaws: they are generally straightforward to rectify once identified, and they are relatively easy to pinpoint. Given that the majority of systems share similar susceptibilities, the development of a tool designed to identify potential security vulnerabilities appears to be a logical step to assist system administrators. This paper introduces such a utility: the COPS Security Checker System (Computerized Oracle and Password System). COPS is a freely accessible tool that systematically scans for common security weaknesses, thereby providing system administrators with a valuable resource to enhance the security of their systems. By automating the detection of these recurrent problems, COPS not only facilitates the identification of vulnerabilities but also supports the timely implementation of corrective measures, contributing to a more secure computing environment.

Machine learning based network anomaly detection methods, which are already effective defense mechanisms against known network intrusion attacks, have also proven themselves to be more successful on the detection of zero-day attacks compared to other types of detection methods. Therefore, research on network anomaly detection using deep learning is getting more attention constantly. In this study we created an anomaly detection model based on a deterministic autoencoder, which discriminates normal and abnormal data by using our proposed stochastic threshold determination approach. We tested our proposed anomaly detection model on the NSL-KDD's test dataset KDDTest+ and obtained an accuracy of 88.28%. The experimental results show that our proposed anomaly detection model can perform almost the same as the most successful and up-to-date machine learning based anomaly detection models in the literature.

T There are plenty of security software in market; each claiming the best, still we daily face problem of viruses and other malicious activities. If we know the basic working principal of such malware then we can very easily prevent most of them even without security software. Hackers and crackers are experts in psychology to manipulate people into giving them access or the information necessary to get access. This paper discusses the inner working of such attacks. Case study of Spyware is provided. In this case study, we got 100% success using social engineering techniques for deception on Linux operating system, which is considered as the most secure operating system. Few basic principal of defend, for the individual as well as for the organization, are discussed here, which will prevent most of such attack if followed.

Vehicular ad hoc networking (VANET) have become a significant technology in the current years because of the emerging generation of self-driving cars such as Google driverless cars. VANET have more vulnerabilities compared to other networks such as wired networks, because these networks are an autonomous collection of mobile vehicles and there is no fixed security infrastructure, no high dynamic topology and the open wireless medium makes them more vulnerable to attacks. It is important to design new approaches and mechanisms to rise the security these networks and protect them from attacks. In this paper, we design an intrusion detection mechanism for the VANETs using Artificial Neural Networks (ANNs) to detect Denial of Service (DoS) attacks. The main role of IDS is to detect the attack using a data generated from the network behavior such as a trace file. The IDSs use the features extracted from the trace file as auditable data. In this paper, we propose anomaly and misuse detection to detect the malicious attack.

The continued growth and diversification of the Internet has been accompanied by an increasing prevalence of attacks and intrusions [40]. It can be argued, however, that a significant change in motivation for malicious activi ty has taken place over the past several years: from vandalism and recognition in th e hacker community, to attacks and intrusions for financial gain. This shift has bee n marked by a growing sophistication in the tools and methods used to conduct atta cks, thereby escalating the network security arms race. Our thesis is that the reactivemethods for network security that are predominant today are ultimately insufficient and that more proactivemethods are required. One such approach is to develop a foundational understanding of the mechanisms employed by malicious software (malware) which is often readi ly available in source form on the Internet. While it is well known that large IT secu rity companies maintain detailed databases of this information, these are not o penly available and we are not aware of any such open repository. In this paper we begin t he process of codifying the capabilities of malware by dissecting four widely-u sed Internet Relay Chat (IRC) botnet codebases. Each codebase is classified along se ven k y dimensions including botnet control mechanisms, host control mechani sms, propagation mechanisms, exploits, delivery mechanisms, obfuscation and de ception mechanisms. Our study reveals the complexity of botnet software, and we disc us es implications for defense strategies based on our analysis.

| This paper presents a new approach to representing and detecting computer penetrations in real-time. The approach, called state transition analysis, models penetrations as a series of state changes that lead from an initial secure state to a target compromised state. State transition diagrams, the graphical representation of penetrations, identify precisely the requirements for and the compromise of a penetration and present only the critical events that must occur for the successful completion of the penetration. State transition diagrams are written to correspond to the states of an actual computer system, and these diagrams form the basis of a rule-based expert system for detecting penetrations, called the State Transition Analysis Tool (STAT). The design and implementation of a UNIX-speci c prototype of this expert system, called USTAT, is also presented. This prototype provides a further illustration of the overall design and functionality of this intrusion detection approach. Lastly, STAT is compared to the functionality of comparable intrusion detection tools. Keywords|Security, Intrusion Detection, Expert Systems

Organizations are facing an increasing number of criminal threats ranging from opportunistic malware to more advanced targeted attacks. While various security technologies are available to protect organizations’ perimeters, still many breaches lead to undesired consequences such as loss of proprietary information, financial burden, and reputation defacing. Recently, endpoint monitoring agents that inspect system-level activities on user machines started to gain traction and be deployed in the industry as an additional defense layer. Their application, though, in most cases is only for forensic investigation to determine the root cause of an incident. In this paper, we demonstrate how endpoint monitoring can be proactively used for detecting and prioritizing suspicious software modules overlooked by other defenses. Compared to other environments in which host-based detection proved successful, our setting of a large enterprise introduces unique challenges, including the heterogeneous environment (users installing software of their choice), limited ground truth (small number of malicious software available for training), and coarse-grained data collection (strict requirements are imposed on agents’ performance overhead). Through applications of clustering and outlier detection algorithms, we develop techniques to identify modules with known malicious behavior, as well as modules impersonating popular benign applications. We leverage a large number of static, behavioral and contextual features in our algorithms, and new feature weighting methods that are resilient against missing attributes. The large majority of our findings are confirmed as malicious by anti-virus tools and manual investigation by experienced security analysts.

Network intrusion detection systems are faced with the challenge of identifying diverse attacks, in extremely high speed networks. For this reason, they must operate at multi-Gigabit speeds, while performing highly-complex per-packet and per-flow data processing. In this paper, we present a multi-parallel intrusion detection architecture tailored for high speed networks. To cope with the increased processing throughput requirements, our system parallelizes network traffic processing and analysis at three levels, using multi-queue NICs, multiple CPUs, and multiple GPUs. The proposed design avoids locking, optimizes data transfers between the different processing units, and speeds up data processing by mapping different operations to the processing units where they are best suited. Our experimental evaluation shows that our prototype implementation based on commodity off-the-shelf equipment can reach processing speeds of up to 5.2 Gbit/s with zero packet loss when analyzing traffic in a real network, whereas the pattern matching engine alone reaches speeds of up to 70 Gbit/s, which is an almost four times improvement over prior solutions that use specialized hardware.

The prolifeation of Internet technologies, services and devices, have made the current networked system designs, and management tools incapable of designing reliable, secure networked systems and services. In fact, we have reached a level of complexity, heterogeneity, and a rapid change rate that our information infiastructure is becoming unmanageable and insecure. This had led researchers to consider alternative designs and management techniques that are based on strategies used by biological systems to deal with complexity, heterogeneity and uncertainty. The approach is referred to as autonomic computing. An autonomic computing system is the system that has the capabilities of being sevdefining, self-healing, self-configwing, self-optimizing, etc. In this paper, we present our approach to implement an autonomic computing infastructure, Autonomia that provides dynamically programmable control and management services to support the development and deployment of smart (intelligent) applications. The A UTONOMIA environment provides the application developers with all the tools required to specifj, the appropriate control and management schemes to maintain any quality of service requirement or application attribute/firnctionality (e.g., perjormance, fault, security, etc.) and the core autonomic middleware services to maintain the autonomic requirements of a wide range of network applications and services. We have successfully implemented a proof-of-concept prototype system that can support the self-configuring, self-deploying and selfhealing of any networked application.

Modern security mechanisms such as Unified Threat Management (UTM), Next-Generation Firewalls and Security Information and Event Management (SIEM) have become more sophisticated over recent years, promising advanced security features and immediate mitigation of the most advanced threats. While this appears promising, in practice even this cutting-edge technology often fails to protect modern organisations as they are being targeted by attacks that were previously unknown to the security industry. Most security mechanisms are based on a database of previously known attack artefacts (signatures) and they will fail on slightly modified or new attacks. The need for threat intelligence is in complete contrast with the way current security solutions are responding to the threats they identify, as they immediately block them without attempting to acquire any further information. In this report, we present and evaluate a security mechanism that operates as an intrusion prevention system which uses honeypots to deceive an attacker, prevent a security breach and which allows the potential acquisition of intelligence on each intrusion attempt. a aThis article is published online by Computer Weekly as part of the 2017 Royal Holloway information security thesis series http://www.computerweekly.com/ehandbook/Active-defence-through-deceptive-IPS. It is based on an MSc dissertation written as part of the MSc in Information Security at the ISG, Royal Holloway, University of London. The full thesis is published on the ISG’s website at https://www.royalholloway.ac.uk/isg/.

Most computers today are insecure because security is costly in terms of user inconvenience and foregone features, and people are unwilling to pay the price. Real-world security depends more on punishment than on locks, but it's hard to even find network attackers, much less punish them. The basic elements of security are authentication, authorization, and auditing: the gold standard. The idea of one principal speaking for another is the key to doing these uniformly across the Internet.


Question: An immune system-inspired method for intrusion detection systems.

Introducing NetVIGIL: An Advanced Network-centric Intrusion Detection Mechanism
As network-based attacks grow in frequency and complexity, traditional intrusion detection systems are evolving to prioritize network-centric monitoring over host-based systems. The sheer volume of network audit data and the dispersed visibility of intrusion-related events across various network segments pose significant challenges. This paper introduces NetVIGIL, an innovative network intrusion detection framework. By employing a formalized model encompassing both the network infrastructure and attack patterns, NetVIGIL identifies the critical network events requiring surveillance and determines the optimal locations for monitoring. This approach not only enhances the efficiency of intrusion detection but also streamlines the analysis of network traffic, making NetVIGIL a promising solution for tackling modern network security threats.

The security event correlation scalability has become a major concern for security analysts and IT administrators when considering complex IT infrastructures that need to handle gargantuan amounts of events or wide correlation window spans. The current correlation capabilities of Security Information and Event Management (SIEM), based on a single node in centralized servers, have proved to be insufficient to process large event streams. This paper introduces a step forward in the current state of the art to address the aforementioned problems. The proposed model takes into account the two main aspects of this field: distributed correlation and query parallelization. We present a case study of a multiple-step attack on the Olympic Games IT infrastructure to illustrate the applicability of our approach.

Network Function Virtualization (NFV) promises the benefits of reduced infrastructure, personnel, and management costs by outsourcing network middleboxes to the public or private cloud. Unfortunately, running network functions in the cloud entails security challenges, especially for complex stateful services. In this paper, we describe our experiences with hardening the king of middleboxes - Intrusion Detection Systems (IDS) - using Intel Software Guard Extensions (Intel SGX) technology. Our IDS secured using Intel SGX, called SEC-IDS, is an unmodified Snort 3 with a DPDK network layer that achieves 10Gbps line rate. SEC-IDS guarantees computational integrity by running all Snort code inside an Intel SGX enclave. At the same time, SEC-IDS achieves near-native performance, with throughput close to 100 percent of vanilla Snort 3, by retaining network I/O outside of the enclave. Our experiments indicate that performance is only constrained by the modest Enclave Page Cache size available on current Intel SGX Skylake based E3 Xeon platforms. Finally, we kept the porting effort minimal by using the Graphene-SGX library OS. Only 27 Lines of Code (LoC) were modified in Snort and 178 LoC in Graphene-SGX itself.

Counterfeiting of goods in general and of electronic goods in particular is a growing concern with a huge impact on the global economy, the society, and the security of its critical infrastructure. Various examples are known where companies suffer from economic and brand damage due to competition with counterfeit goods. In some cases the use of counterfeit components has even led to tragic accidents in which lives were lost. It has also recently become clear that counterfeit products can penetrate the critical and security infrastructure of our modern societies and hence cause a threat to national security. One of the difficulties to deal with this problem stems from the fact that counterfeit goods can originate from sources that are able to make copies that are very hard to distinguish from their legitimate counterpart. A first well-known aspect of counterfeiting is product cloning. A second much less known but increasingly dangerous aspect consists of overproduction of goods. A special, but modern, case of counterfeiting is theft of Intellectual Property such as software and designs. The attractive part from the attackers’ point of view is that it is relatively easy to steal and has a high value without having to do huge investments in research and development. From a high-level point of view one can state that the attack can be thwarted by using encryption and authentication techniques. Device configuration data or embedded software can, for example, be encrypted such that it will only run on the device possessing the correct cryptographic key. Since encrypted data is still easy to copy, it now becomes essential that the secret key is well protected against copying or cloning. In order to deal with these two aspects of counterfeiting, a secret unclonable identifier is required together with strong cryptographic protocols. In this chapter we focus on a new way to address these problems: Hardware Intrinsic Security. It is based on the implementation and generation of secret physically unclonable identifiers used in conjunction with cryptographic techniques such as encryption and

Rogue devices are an increasingly dangerous reality in the insider threat problem domain. Industry, government, and academia need to be aware of this problem and promote state-of-the-art detection methods.

Several studies have been conducted where authors compared the performance of open source Intrusion detection systems, namely Snort and Suricata. However, most studies were limited to either security indicators or performance measurements under the same operating system. The objective of this study is to give a comprehensive analysis of both products in terms of several security related and performance related indicators. In addition, we tested the products under two different operating systems. Several experiments were run to evaluate the effects of open source intrusion detection and prevention systems Snort and Suricata, operating systems Windows, Linux and various attack types on system resource usage, dropped packets rate and ability to detect intrusions. The results show that Suricata has a higher CPU and RAM utilization than Snort in all cases on both operating systems, but lower percentage of dropped packets when evaluated during five of six simulated attacks. Both products had the same number of correctly identified intrusions. The results show that Linux-based solutions consume more system resources, but Windows-based systems had a higher rate of dropped packets. This indicates that these two intrusion detection and prevention systems should be run on Linux. However, both systems are inappropriate for high volumes of traffic in single-server setting.

The prolifeation of Internet technologies, services and devices, have made the current networked system designs, and management tools incapable of designing reliable, secure networked systems and services. In fact, we have reached a level of complexity, heterogeneity, and a rapid change rate that our information infiastructure is becoming unmanageable and insecure. This had led researchers to consider alternative designs and management techniques that are based on strategies used by biological systems to deal with complexity, heterogeneity and uncertainty. The approach is referred to as autonomic computing. An autonomic computing system is the system that has the capabilities of being sevdefining, self-healing, self-configwing, self-optimizing, etc. In this paper, we present our approach to implement an autonomic computing infastructure, Autonomia that provides dynamically programmable control and management services to support the development and deployment of smart (intelligent) applications. The A UTONOMIA environment provides the application developers with all the tools required to specifj, the appropriate control and management schemes to maintain any quality of service requirement or application attribute/firnctionality (e.g., perjormance, fault, security, etc.) and the core autonomic middleware services to maintain the autonomic requirements of a wide range of network applications and services. We have successfully implemented a proof-of-concept prototype system that can support the self-configuring, self-deploying and selfhealing of any networked application.

We introduce a problem class which we term activity monitoring. Such problems involve monitoring the behavior of a large population of entities for interesting events requiring action. We present a framework within which each of the individual problems has a natural expression, as well as a methodology for evaluating performance of activity monitoring techniques. We show that two superficially different tasks, news story monitoring and intrusion detection, can be expressed naturally within the framework, and show that key differences in solution methods can be compared.

Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.

Most current network intrusion detection systems employ signature-based methods or data mining-based methods which rely on labelled training data. This training data is typically expensive to produce. Moreover, these methods have difficulty in detecting new types of attack. Using unsupervised anomaly detection techniques, however, the system can be trained with unlabelled data and is capable of detecting previously “unseen” attacks. In this paper, we present a new density-based and grid-based clustering algorithm that is suitable for unsupervised anomaly detection. We evaluated our methods using the 1999 KDD Cup data set. Our evaluation shows that the accuracy of our approach is close to that of existing techniques reported in the literature, and has several advantages in terms of computational complexity.

Cyber frauds are a major security threat to the banking industry worldwide. Malware is one of the manifestations of cyber frauds. Malware authors use Application Programming Interface (API) calls to perpetrate these crimes. In this paper, we propose a static analysis method to detect Malware based on API call sequences using text and data mining in tandem. We analyzed the dataset available at CSMINING group. First, we employed text mining to extract features from the dataset consisting a series of API calls. Further, mutual information is invoked for feature selection. Then, we resorted to over-sampling to balance the data set. Finally, we employed various data mining techniques such as Decision Tree (DT), Multi Layer Perceptron (MLP), Support Vector Machine (SVM), Probabilistic Neural Network (PNN) and Group Method for Data Handling (GMDH). We also applied One Class SVM (OCSVM). Throughout the paper, we used 10-fold cross validation technique for testing the techniques. We observed that SVM and OCSVM achieved 100% sensitivity after balancing the dataset.


Question: Speed regulation for DC motor drives powered by buck converters.

This paper employs the principles of active disturbance rejection control and flatness-based control to manage the performance of a dc-to-dc buck power converter, particularly when confronted with unpredictable, exogenous, and time-varying load current demands. The generalized proportional integral observer serves a critical role in estimating and mitigating these time-varying disturbance signals. A noteworthy aspect of the proposed control strategy for the buck converter-dc motor combination is its resilience to inaccuracies in the control input gain, ensuring effective regulation and tracking. This robustness is further illustrated in the context of a dual buck topology powering two distinct dc motors, each experiencing unique load torque disturbances. The efficacy of this approach is substantiated through simulation outcomes.

This paper presents a LED driver circuit based on single-stage Flyback converter with power factor correction. Voltage following control and Nonlinear carrier control are applied to constant current mode Flyback converter which is combined with constant current driver technique. By designing the outer loop to stabilize the output voltage and the inner loop to shape input current waveform, that makes the system achieve unity power factor. The circuit doesn't need an expensive multiplier as classical multiplier control. To verify the performance, the proposed circuit was confirmed by simulation and experiment. From the results, the proposed system shows high power factor with 0.96 and constant current output.

DC-bus voltage control is an important task in the operation of a dc or a hybrid ac/dc microgrid system. To improve the dc-bus voltage control dynamics, traditional approaches attempt to measure and feedforward the load or source power in the dc-bus control scheme. However, in a microgrid system with distributed dc sources and loads, the traditional feedforward-based methods need remote measurement with communications. In this paper, a nonlinear disturbance observer (NDO) based dc-bus voltage control is proposed, which does not need the remote measurement and enables the important “plug-and-play” feature. Based on this observer, a novel dc-bus voltage control scheme is developed to suppress the transient fluctuations of dc-bus voltage and improve the power quality in such a microgrid system. Details on the design of the observer, the dc-bus controller and the pulsewidth-modulation (PWM) dead-time compensation are provided in this paper. The effects of possible dc-bus capacitance variation are also considered. The performance of the proposed control strategy has been successfully verified in a 30 kVA hybrid microgrid including ac/dc buses, battery energy storage system, and photovoltaic (PV) power generation system.

This paper proposes new step-up DC-DC converters with high ratio capability. The proposed DC-DC converters are derived using combination of boost converters and buck-boost converters. A high ratio capability is achieved by parallel input and series output combination so that the efficiency is better than the one that is achieved by using a conventional boost converter. A method to reduce the input and output ripples are also proposed in this paper. Simulated and experimental results are included to show the validity of the proposed converters.

In this paper, a weighted tuning methods of a PID speed controller for separately excited Direct current motor is presented, based on Empirical Ziegler-Nichols tuning formula and modified Ziegler-Nichol PID tuning formula. Both these methods are compared on the basis of output response, minimum settling time, and minimum overshoot for speed demand application of DC motor. Computer simulation shows that the performance of PID controller using Modified Ziegler-Nichols technique is better than that of traditional Ziegler-Nichols technique.

With the die area of modern processors growing larger and larger, the IR drop across the power supply rail due to its parasitic resistance becomes considerable. There is an urgent demand for local power regulation to reduce the IR drop and to enhance transient response. A distributed power-delivery grid (DPDG) is an attractive solution for large area power-supply applications. The dual-loop distributed micro-regulator in [1] achieves a tight regulation and fast response, but suffers from large ripple and high power consumption due to the comparator-based regulator. Digital low-dropout regulators (DLDOs) [2] can be used as local micro-regulators to implement a DPDG, due to their low-voltage operation and process scalability. Adaptive control [3], asynchronous 3D pipeline control [4], analog-assisted tri-loop control [5], and event-driven PI control [6] are proposed to enhance the transient response speed. However, digital LDOs suffer from the intrinsic limitations of large output ripple and narrow current range. This paper presents an on-chip DPDg with cooperative regulation based on an analog-assisted digital LDO (AADLDO), which inherits the merits of low output ripple and sub-LSB current supply ability from the analog control, and the advantage of low supply voltage operation and adaptive fast response from the digital control.

The fundamental properties, such as passivity or incremental passivity, of the network elements making up a switched power converter are examined. The nominal open-loop operation of a broad class of such converters is shown to be stable in the large via a Lyapunov argument. The obtained Lyapunov function is then shown to be useful for designing globally stabilizing controls that include adaptive schemes for handling uncertain nominal parameters. Numerical simulations illustrate the application of this control approach in DC-DC converters.<<ETX>>

Due to exponential (Moores law) scaling of advanced CMOS technologies, the challenges associated with delivering power to performance and mobile computing systems are outpacing the capabilities of conventional voltage regulator (VR) topologies. To continue to scale throughput at constant power density, the level of parallelism in microprocessor architectures is expected to increase substantially. In this paper, we present a power conversion topology to provide independent multicore regulation in the 0.8-1.4 V range from a 12-V dc bus. The topology uses a multistage ladder converter to manage power delivery to digital circuits stacked in vertical voltage domains. This approach has several advantages with regard to systems efficiency as it allows a more moderate conversion ratio of the main dc-dc converter. Moreover, the parallel converter only needs to process a fraction of the power of each core as the current can be “recycled” by adjacent cores in the stack. We develop a dynamical model for a multiple-input, multiple-output control scheme that uses a simple integral-control law, augmented with fast voltage- and current-mode feedforward. Measurement results of a discrete prototype verify the control scheme and demonstrate the potential advantages in system efficiency but also emphasize the remaining challenges in meeting stringent VR dynamic response requirements.

This paper presents a comprehensive study on reducing commutation torque ripples generated in brushless DC motor drives with only a single DC-link current sensor provided. In such drives, commutation torque ripple suppression techniques that are practically effective in low speed as well as high speed regions are scarcely found. The commutation compensation technique proposed here is based on a strategy that the current slopes of the incoming and the outgoing phases during the commutation interval can be equalized by a proper duty-ratio control. Being directly linked with deadbeat current control scheme, the proposed control method accomplishes suppression of the spikes and dips superimposed on the current and torque responses during the commutation intervals of the inverter. Effectiveness of the proposed control method is verified through simulations and experiments.

Theoretical performance limits of twophase switched-capacitor (SC) dc-dc converters are discussed in this paper. For a given number of capacitors k, the complete set of attainable dc conversion ratios is found. The maximum step-up or stepdown ratio is given by the k t h Fibonacci number, while the bound on the number of switches required in any SC circuit is 3k 2. Practical implications, illustrated by several SC converter examples, include savings in the number of components required for a given application, and the ability to construct SC converters that can maintain the output voltage regulation and high conversion efficiency over a wide range of input voltage variations. Limits found for the output resistance and efflciency can be used for selection and comparison of SC converters.

In order to improve the speed measurement performance of low speed PMSM drives equipped with absolute optical encoders, this paper proposes a speed measurement method based on overlapped measurement regions. The proposed method replaces the long measurement region of the conventional backward differentiation method with several short ones which are overlapped at most regions. In one speed measurement process, the results obtained from the short regions are averaged to improve precision. Then the relationship between precision, time delay and region length, overlap times, are analyzed using expectation and variance as performance index. Based on the analysis, an optimal design method of the measurement region is derived. Experimental researches are carried out on a low speed permanent magnet synchronous motor equipped with a 13 bit absolute encoder. The results prove the validity and effectiveness of the proposed method.