Question: Creating to Adjust: Utilizing Generative Adversarial Networks for Domain Alignment

This paper explores the application of generative adversarial networks (GANs) in unsupervised cross-domain image generation. The focus is on transferring a sample from one domain to an analogous sample in another domain, maintaining the essence of the original sample. Given two domains, S and T, the goal is to learn a generative function G that can transform a sample from domain S into domain T, while ensuring that the output of a representation function f, capable of processing inputs from both domains, remains consistent. The training process is unsupervised, involving sets of samples from each domain without direct mappings between them. The proposed Domain Transfer Network (DTN) utilizes a complex loss function, encompassing a multi-class GAN loss, a component that preserves the representation function f, and a regularization component that encourages G to map samples from domain T to themselves, essentially acting as an identity function. The effectiveness of this method is showcased through applications in visual domains, such as digits and face images, where it successfully generates novel images of unseen entities while preserving their identity, demonstrating the model's ability to create convincing cross-domain analogies.

Recently, image-to-image translation has seen a significant success. Among many approaches, image translation based on an exemplar image, which contains the target style information, has been popular, owing to its capability to handle multimodality as well as its suitability for practical use. However, most of the existing methods extract the style information from an entire exemplar and apply it to the entire input image, which introduces excessive image translation in irrelevant image regions. In response, this paper proposes a novel approach that jointly extracts out the local masks of the input image and the exemplar as targeted regions to be involved for image translation. In particular, the main novelty of our model lies in (1) co-segmentation networks for local mask generation and (2) the local mask-based highway adaptive instance normalization technique. We demonstrate the quantitative and the qualitative evaluation results to show the advantages of our proposed approach. Finally, the code is available at https://github.com/AnonymousIclrAuthor/ Highway-Adaptive-Instance-Normalization.

We introduce a simple semi-supervised learning approach for images based on in-painting using an adversarial loss. Images with random patches removed are presented to a generator whose task is to fill in the hole, based on the surrounding pixels. The in-painted images are then presented to a discriminator network that judges if they are real (unaltered training images) or not. This task acts as a regularizer for standard supervised training of the discriminator. Using our approach we are able to directly train large VGG-style networks in a semi-supervised fashion. We evaluate on STL-10 and PASCAL datasets, where our approach obtains performance comparable or superior to existing methods.

This paper presents a novel unsupervised domain adaptation framework, called Synergistic Image and Feature Adaptation (SIFA), to effectively tackle the problem of domain shift. Domain adaptation has become an important and hot topic in recent studies on deep learning, aiming to recover performance degradation when applying the neural networks to new testing domains. Our proposed SIFA is an elegant learning diagram which presents synergistic fusion of adaptations from both image and feature perspectives. In particular, we simultaneously transform the appearance of images across domains and enhance domain-invariance of the extracted features towards the segmentation task. The feature encoder layers are shared by both perspectives to grasp their mutual benefits during the end-to-end learning procedure. Without using any annotation from the target domain, the learning of our unified model is guided by adversarial losses, with multiple discriminators employed from various aspects. We have extensively validated our method with a challenging application of crossmodality medical image segmentation of cardiac structures. Experimental results demonstrate that our SIFA model recovers the degraded performance from 17.2% to 73.0%, and outperforms the state-of-the-art methods by a significant margin.

Generative Adversarial Nets (GANs) and Variational Auto-Encoders (VAEs) provide impressive image generations from Gaussian white noise, but the underlying mathematics are not well understood. We compute deep convolutional network generators by inverting a fixed embedding operator. Therefore, they do not require to be optimized with a discriminator or an encoder. The embedding is Lipschitz continuous to deformations so that generators transform linear interpolations between input white noise vectors into deformations between output images. This embedding is computed with a wavelet Scattering transform. Numerical experiments demonstrate that the resulting Scattering generators have similar properties as GANs or VAEs, without learning a discriminative network or an encoder.

Most existing zero-shot learning approaches exploit transfer learning via an intermediate-level semantic representation such as visual attributes or semantic word vectors. Such a semantic representation is shared between an annotated auxiliary dataset and a target dataset with no annotation. A projection from a low-level feature space to the semantic space is learned from the auxiliary dataset and is applied without adaptation to the target dataset. In this paper we identify an inherent limitation with this approach. That is, due to having disjoint and potentially unrelated classes, the projection functions learned from the auxiliary dataset/domain are biased when applied directly to the target dataset/domain. We call this problem the projection domain shift problem and propose a novel framework, transductive multi-view embedding, to solve it. It is ‘transductive’ in that unlabelled target data points are explored for projection adaptation, and ‘multi-view’ in that both lowlevel feature (view) and multiple semantic representations (views) are embedded to rectify the projection shift. We demonstrate through extensive experiments that our framework (1) rectifies the projection shift between the auxiliary and target domains, (2) exploits the complementarity of multiple semantic representations, (3) achieves state-of-the-art recognition results on image and video benchmark datasets, and (4) enables novel cross-view annotation tasks.

Generative Adversarial Networks (GAN) have achieved big success in various domains such as image generation, music generation, and natural language generation. In this paper, we propose a novel GAN-based collaborative filtering (CF) framework to provide higher accuracy in recommendation. We first identify a fundamental problem of existing GAN-based methods in CF and highlight it quantitatively via a series of experiments. Next, we suggest a new direction of vector-wise adversarial training to solve the problem and propose our GAN-based CF framework, called CFGAN, based on the direction. We identify a unique challenge that arises when vector-wise adversarial training is employed in CF. We then propose three CF methods realized on top of our CFGAN that are able to address the challenge. Finally, via extensive experiments on real-world datasets, we validate that vector-wise adversarial training employed in CFGAN is really effective to solve the problem of existing GAN-based CF methods. Furthermore, we demonstrate that our proposed CF methods on CFGAN provide recommendation accuracy consistently and universally higher than those of the state-of-the-art recommenders.

This paper describes InfoGAN, an information-theoretic extension to the Generative Adversarial Network that is able to learn disentangled representations in a completely unsupervised manner. InfoGAN is a generative adversarial network that also maximizes the mutual information between a small subset of the latent variables and the observation. We derive a lower bound of the mutual information objective that can be optimized efficiently. Specifically, InfoGAN successfully disentangles writing styles from digit shapes on the MNIST dataset, pose from lighting of 3D rendered images, and background digits from the central digit on the SVHN dataset. It also discovers visual concepts that include hair styles, presence/absence of eyeglasses, and emotions on the CelebA face dataset. Experiments show that InfoGAN learns interpretable representations that are competitive with representations learned by existing supervised methods. For an up-to-date version of this paper, please see https://arxiv.org/abs/1606.03657.

Conditional GANs are at the forefront of natural image synthesis. The main drawback of such models is the necessity for labelled data. In this work we exploit two popular unsupervised learning techniques, adversarial training and self-supervision, to close the gap between conditional and unconditional GANs. In particular, we allow the networks to collaborate on the task of representation learning, while being adversarial with respect to the classic GAN game. The role of self-supervision is to encourage the discriminator to learn meaningful feature representations which are not forgotten during training. We test empirically both the quality of the learned image representations, and the quality of the synthesized images. Under the same conditions, the self-supervised GAN attains a similar performance to stateof-the-art conditional counterparts. Finally, we show that this approach to fully unsupervised learning can be scaled to attain an FID of 33 on unconditional IMAGENET generation.

In this paper, we propose a semi-supervised kernel matching method to address domain adaptation problems where the source distribution substantially differs from the target distribution. Specifically, we learn a prediction function on the labeled source data while mapping the target data points to similar source data points by matching the target kernel matrix to a submatrix of the source kernel matrix based on a Hilbert Schmidt Independence Criterion. We formulate this simultaneous learning and mapping process as a non-convex integer optimization problem and present a local minimization procedure for its relaxed continuous form. Our empirical results show the proposed kernel matching method significantly outperforms alternative methods on the task of cross domain sentiment classification.

Despite the growing prominence of generative adversarial networks (GANs), optimization in GANs is still a poorly understood topic. In this paper, we analyze the “gradient descent” form of GAN optimization, i.e., the natural setting where we simultaneously take small gradient steps in both generator and discriminator parameters. We show that even though GAN optimization does not correspond to a convex-concave game (even for simple parameterizations), under proper conditions, equilibrium points of this optimization procedure are still locally asymptotically stable for the traditional GAN formulation. On the other hand, we show that the recently proposed Wasserstein GAN can have non-convergent limit cycles near equilibrium. Motivated by this stability analysis, we propose an additional regularization term for gradient descent GAN updates, which is able to guarantee local stability for both the WGAN and the traditional GAN, and also shows practical promise in speeding up convergence and addressing mode collapse.


Question: Visualization of intricate assaults and the condition of a network under attack.

Introducing Visual Firewall: A Real-Time Network Security Visualization Tool

Networked systems continue to face challenges due to inadequate firewall configurations and insufficient monitoring capabilities. The Visual Firewall system is designed to enhance the configuration of firewalls and improve network monitoring by offering a comprehensive visualization platform. It achieves this through four integrated views that cater to different levels of detail and time scales, accurately depicting firewall responses to individual packets. These views—real-time traffic, visual signature, statistics, and Intrusion Detection System (IDS) alarms—supply system administrators with the detailed information they require to effectively monitor their networks, whether in a passive or active capacity. Through extensive testing, we have found that Visual Firewall can effectively visualize various attacks, making it possible for users, even those with limited networking knowledge, to quickly differentiate between normal and malicious traffic patterns with just a brief introduction to the system. This makes Visual Firewall an accessible tool for enhancing network security through real-time monitoring and visualization.

We report a vulnerability to network signature-based IDS which we have tested using Snort and we call “Squealing”. This vulnerability has significant implications since it can easily be generalized to any IDS. The vulnerability of signature-based IDS to high false positive rates has been welldocumented but we go further to show (at a high level) how packets can be crafted to match attack signatures such that a alarms on a target IDS can be conditioned or disabled and then exploited. This is the first academic treatment of this vulnerability that has already been reported to the CERT Coordination Center and the National Infrastructure Protection Center. Independently, other tools based on “squealing” are poised to appear that, while validating our ideas, also gives cause for concern. keywords: squealing, false positive, intrusion detection, IDS, signature-based, misuse behavior, network intrusion detection, snort

Tor has become one of the most popular overlay networks for anonymizing TCP traffic. Its popularity is due in part to its perceived strong anonymity properties and its relatively low latency service. Low latency is achieved through Torâ s ability to balance the traffic load by optimizing Tor router selection to probabilistically favor routers with highbandwidth capabilities.
 We investigate how Torâ s routing optimizations impact its ability to provide strong anonymity. Through experiments conducted on PlanetLab, we show the extent to which routing performance optimizations have left the system vulnerable to end-to-end traffic analysis attacks from non-global adversaries with minimal resources. Further, we demonstrate that entry guards, added to mitigate path disruption attacks, are themselves vulnerable to attack. Finally, we explore solutions to improve Torâ s current routing algorithms and propose alternative routing strategies that prevent some of the routing attacks used in our experiments.

Man-At-The-End (MATE) attacks and fortifications are difficult to analyze, model, and evaluate predominantly for three reasons: firstly, the attacker is human and, therefore, utilizes motivation, creativity, and ingenuity. Secondly, the attacker has limitless and authorized access to the target. Thirdly, all major protections stand up to a determined attacker till a certain period of time. Digital assets range from business to personal use, from consumer devices to home networks, the public Internet, the cloud, and the Internet of Things – where traditional computer and network security are inadequate to address MATE attacks. MATE is fundamentally a hard problem. Much of the extant focus to deal with MATE attacks is purely technical; though security is more than just a technical issue. The main objective of the paper is to mitigate the consequences of MATE attacks through the human element of security and highlight the need for this element to form a part of a holistic security strategy alongside the necessary techniques and technologies. This paper contributes by taking software protection (SP) research to a new realm of challenges. Moreover, the paper elaborates the concept of MATE attacks, the different forms, and the analysis of MATE versus insider threats to present a thematic taxonomy of a MATE attack. The ensuing paper also highlights the fundamental concept of digital assets, and the core protection mechanisms and their qualitative comparison against MATE attacks. Finally, we present state-of-the-art trends and cutting-edge future research directions by taking into account only the human aspects for young researchers and professionals. & 2014 Elsevier Ltd. All rights reserved.

Network data is ubiquitous; e-mail traffic between persons, telecommunication, transport and financial networks are some examples. Often these networks are large and multivariate, besides the topological structure of the network, multivariate data on the nodes and links is available. Currently, exploration and analysis methods are focused on a single aspect; the network topology or the multivariate data. In addition, tools and techniques are highly domain specific and require expert knowledge. We focus on the non-expert user and propose a novel solution for multivariate network exploration and analysis that tightly couples structural and multivariate analysis. In short, we go from Detail to Overview via Selections and Aggregations (DOSA): users are enabled to gain insights through the creation of selections of interest (manually or automatically), and producing high-level, infographic-style overviews simultaneously. Finally, we present example explorations on real-world datasets that demonstrate the effectiveness of our method for the exploration and understanding of multivariate networks where presentation of findings comes for free.

Behavior of Machine Learning Algorithms in Adversarial Environments

Intrusion-detection systems aim at detecting attacks against computer systems and networks, or against information systems in general, as it is difficult to provide provably secure information systems and maintain them in such a secure state for their entire lifetime and for every utilization. Sometimes, legacy or operational constraints do not even allow a fully secure information system to be realized at all. Therefore, the task of intrusion-detection systems is to monitor the usage of such systems and to detect the apparition of insecure states. They detect attempts and active misuse by legitimate users of the information systems or external parties to abuse their privileges or exploit security vulnerabilities. In this paper, we introduce a taxonomy of intrusion-detection systems that highlights the various aspects of this area. This taxonomy defines families of intrusion-detection systems according to their properties. It is illustrated by numerous examples from past and current projects. q 1999 Elsevier Science B.V. All rights reserved.

Amplification DDoS attacks have gained popularity and become a serious threat to Internet participants. However, little is known about where these attacks originate, and revealing the attack sources is a non-trivial problem due to the spoofed nature of the traffic.
 In this paper, we present novel techniques to uncover the infrastructures behind amplification DDoS attacks. We follow a two-step approach to tackle this challenge: First, we develop a methodology to impose a fingerprint on scanners that perform the reconnaissance for amplification attacks that allows us to link subsequent attacks back to the scanner. Our methodology attributes over 58% of attacks to a scanner with a confidence of over 99.9%. Second, we use Time-to-Live-based trilateration techniques to map scanners to the actual infrastructures launching the attacks. Using this technique, we identify 34 networks as being the source for amplification attacks at 98\% certainty.

Intrusion detection is an alternative to the situation of the security violation.Security mechanism of the network is necessary against the threat to the system. There are two types of intruders: external intruders, who are unauthorized users of the machines they attack, and internal intruders, who have permission to access the system with some restrictions. This paper describes a brief overview of various intrusion detection techniques such as fuzzy logic, neural network, pattern recognition methods, genetic algorithms and related techniques is presented. Among the several soft computing paradigms, fuzzy rule-based classifiers, decision trees, support vector machines, linear genetic programming is model fast and efficient intrusion detection systems. KeywordsIntroduction, intrusion detection methods, misuse detection techniques, anomaly detection techniques, genetic algorithms.

Communication network is facilitated with different protocol .Each protocol supported to increase the network performance in a secured manner. In communication process, user’s connectivity, violations of policy on access of information are handles through intrusion. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. It focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. However, organizations use Intrusion detection and prevention system (IDPS) for other purposes, such as identifying problems with security policies, documenting existing threats, and determining individuals from violating security policies. Communication architecture is built up on IP.Internet Control Message Protocol (ICMP ) protocol is tightly integrated with IP. ICMP messages, delivered in IP packets, are used for out-of-band messages related to network operation or mis-operation.In this paper describes about HDLC , ICMP protocol sequences which is used to detect the intrusion on hybrid network and its attributes are recommend the standardized protocol for the intrusion detection process. This standardization protocol compare the previous part of the research of HDLC and ICMP protocols.

Utility networks are part of every nation's critical infrastructure, and their protection is now seen as a high priority objective. In this paper, we propose a threat awareness architecture for critical infrastructures, which we believe will raise security awareness and increase resilience in utility networks. We first describe an investigation of trends and threats that may impose security risks in utility networks. This was performed on the basis of a viewpoint approach that is capable of identifying technical and non-technical issues (e.g., behaviour of humans). The result of our analysis indicated that utility networks are affected strongly by technological trends, but that humans comprise an important threat to them. This provided evidence and confirmed that the protection of utility networks is a multi-variable problem, and thus, requires the examination of information stemming from various viewpoints of a network. In order to accomplish our objective, we propose a systematic threat awareness architecture in the context of a resilience strategy, which ultimately aims at providing and maintaining an acceptable level of security and safety in critical infrastructures. As a proof of concept, we demonstrate partially via a case study the application of the proposed threat awareness architecture, where we examine the potential impact of attacks in the context of social engineering in a European utility company.


Question: Visualization of intricate assaults and status of the compromised network.

This paper introduces IDS rainStorm, a groundbreaking visualization tool designed to help network system administrators manage and interpret the voluminous alarm data generated by intrusion detection systems. Dealing with such vast quantities of textual alarm logs can be overwhelming, often leading to the oversight of critical details and hindering the ability to obtain a comprehensive view of network activities. To tackle this issue, we have developed a unique visualization approach that consolidates alarm activity within a network into a digestible overview. This enables system administrators to quickly grasp the general network landscape and easily pinpoint anomalies. The visualization supports zooming and detailed inspection for a deeper understanding of specific incidents. The graphical layout is designed around local network IP addresses, plotted across multiple y-axes to indicate alarm locations, while the x-axis represents time, illustrating alarm patterns. Color variations are used to signify alarm severity and frequency. Our design, informed by extensive consultations with system administrators, is faster, more intuitive, and more efficient than traditional text log analysis. It employs visualization techniques to scale and display data effectively. The tool has been successfully implemented using operational alarm log data from the Georgia Tech campus network, demonstrating its practical utility. The paper discusses the design's motivation and background, complemented by illustrative examples that highlight its efficacy. CR Categories: C.2.0 [Computer-Communication Networks]: General—Security and Protection, C.2.3 [Computer-Communication Networks]: Network Operations—Network Monitoring, H.5.2 [Information Systems]: Information Interfaces and Presentation—User Interfaces.

With the rapid expansion of computer networks during the past few years, security has become a crucial issue for modern computer systems. A good way to detect illegitimate use is through monitoring unusual user activity. Methods of intrusion detection based on hand-coded rule sets or predicting commands on-line are laborous to build or not very reliable. This paper proposes a new way of applying neural networks to detect intrusions. We believe that a user leaves a ’print’ when using the system; a neural network can be used to learn this print and identify each user much like detectives use thumbprints to place people at crime scenes. If a user’s behavior does not match his/her print, the system administrator can be alerted of a possible security breech. A backpropagation neural network called NNID (Neural Network Intrusion Detector) was trained in the identification task and tested experimentally on a system of 10 users. The system was 96% accurate in detecting unusual activity, with 7% false alarm rate. These results suggest that learning user profiles is an effective way for detecting intrusions.

The tasks of IDS is to detect activities in the form of intrusion by unauthorized parties which attempt to gain access to information unlawfully in a network environment. Changes in intrusion strategies affect the behavior of networks where the representation of network traffic data changes over time. The nature of the network data has high volume and dimension and contains redundancy. This study proposes the use of ChiMIC as a method to reduce redundancy features and select the relevant features to be used in detecting anomalies on the network, where KGS is used as an anomaly detection engine. Both approach are used to build NAIDS that has capabilities to detect the emergence of new attacks over time.

A distributed detection method is proposed to detect single stage multi-point (SSMP) attacks on a Cyber Physical System (CPS). Such attacks aim at compromising two or more sensors or actuators at any one stage of a CPS and could totally compromise a controller and prevent it from detecting the attack. However, as demonstrated in this work, using the flow properties of water from one stage to the other, a neighboring controller was found effective in detecting such attacks. The method is based on physical invariants derived for each stage of the CPS from its design. The attack detection effectiveness of the method was evaluated experimentally against an operational water treatment testbed containing 42 sensors and actuators. Results from the experiments point to high effectiveness of the method in detecting a variety of SSMP attacks but also point to its limitations. Distributing the attack detection code among various controllers adds to the scalability of the proposed method.

Backdoors in software systems probably exist since the very first access control mechanisms were implemented and they are a well-known security problem. Despite a wave of public discoveries of such backdoors over the last few years, this threat has only rarely been tackled so far.
 In this paper, we present an approach to reduce the attack surface for this kind of attacks and we strive for an automated identification and elimination of backdoors in binary applications. We limit our focus on the examination of server applications within a client-server model. At the core, we apply variations of the delta debugging technique and introduce several novel heuristics for the identification of those regions in binary application that backdoors are typically installed in (i.e., authentication and command processing functions). We demonstrate the practical feasibility of our approach on several real-world backdoors found in modified versions of the popular software tools ProFTPD and OpenSSH. Furthermore, we evaluate our implementation not only on common instruction set architectures such as x86-64, but also on commercial off-the-shelf embedded devices powered by a MIPS32 processor.

Software Defined Networking (SDN) has recently emerged to become one of the promising solutions for the future Internet. With the logical centralization of controllers and a global network overview, SDN brings us a chance to strengthen our network security. However, SDN also brings us a dangerous increase in potential threats. In this paper, we apply a deep learning approach for flow-based anomaly detection in an SDN environment. We build a Deep Neural Network (DNN) model for an intrusion detection system and train the model with the NSL-KDD Dataset. In this work, we just use six basic features (that can be easily obtained in an SDN environment) taken from the forty-one features of NSL-KDD Dataset. Through experiments, we confirm that the deep learning approach shows strong potential to be used for flow-based anomaly detection in SDN environments.

Intrusion detection is a surveillance problem of practical import that is well suited to wireless sensor networks. In this paper, we study the application of sensor networks to the intrusion detection problem and the related problems of classifying and tracking targets. Our approach is based on a dense, distributed, wireless network of multi-modal resource-poor sensors combined into loosely coherent sensor arrays that perform in situ detection, estimation, compression, and exfiltration. We ground our study in the context of a security scenario called “A Line in the Sand” and accordingly define the target, system, environment, and fault models. Based on the performance requirements of the scenario and the sensing, communication, energy, and computation ability of the sensor network, we explore the design space of sensors, signal processing algorithms, communications, networking, and middleware services. We introduce the influence field, which can be estimated from a network of binary sensors, as the basis for a novel classifier. A contribution of our work is that we do not assume a reliable network; on the contrary, we quantitatively analyze the effects of network unreliability on application performance. Our work includes multiple experimental deployments of over 90 sensors nodes at MacDill Air Force Base in Tampa, Florida, as well as other field experiments of comparable scale. Based on these experiences, we identify a set of key lessons and articulate a few of the challenges facing extreme scaling to tens or hundreds of thousands of sensor nodes.

The modern automobile is controlled by networked computers. The security of these networks was historically of little concern, but researchers have in recent years demonstrated their many vulnerabilities to attack. As part of a defence against these attacks, we evaluate an anomaly detector for the automotive controller area network (CAN) bus. The majority of attacks are based on inserting extra packets onto the network. But most normal packets arrive at a strict frequency. This motivates an anomaly detector that compares current and historical packet timing. We present an algorithm that measures inter-packet timing over a sliding window. The average times are compared to historical averages to yield an anomaly signal. We evaluate this approach over a range of insertion frequencies and demonstrate the limits of its effectiveness. We also show how a similar measure of the data contents of packets is not effective for identifying anomalies. Finally we show how a one-class support vector machine can use the same information to detect anomalies with high confidence.

The explosion of interconnected devices and the Internet of Things has triggered new important challenges in the area of internet security, due to the various device vulnerabilities and increased potential for cyber-attacks. This paper touches on the areas of Cybersecurity, intrusion detection, prevention systems and artificial intelligence. Our aim is to create a system capable of understanding, detecting and preventing malicious connections using applied concepts of machine learning. We emphasize the importance of selecting and extracting features that can lead to an accurate decision of classification for malware and intrusion attacks. We propose a solution that combines features that extract correlations from the packet history for the same and different services and hosts, based on the rate of REJ, SYN and ACK flags and connection states, with HTTP features extracted from URI and RESTful methods. Our proposed solution is able to detect network intrusions and botnet communications with a precision of 98.4% on the binary classification problem.

S ensor networks hold the promise of facilitating large-scale, real-time data processing in complex environments. Their foreseeable applications will help protect and monitor critical military, environmental, safety-critical , or domestic infrastructures and resources. In these and other vital or security-sensitive deployments, keeping the network available for its intended use is essential. The stakes are high: Denial of service attacks against such networks may permit real-world damage to the health and safety of people. Without proper security mechanisms, networks will be confined to limited, controlled environments , negating much of the promise they hold. The limited ability of individual sensor nodes to thwart failure or attack makes ensuring network availability more difficult. To identify denial of service vulnerabilities, we analyze two effective sensor network protocols that did not initially consider security. These examples demonstrate that consideration of security at design time is the best way to ensure successful network deployment. Advances in miniaturization combined with an insatiable appetite for previously unrealizable information gathering have lead to the development of new kinds of networks. In many areas, static infrastruc-tures are giving way to dynamic ad-hoc networks. One manifestation of these trends is the development of highly application-dependent sensor networks. Developers build sensor networks to collect and analyze low-level data from an environment of interest. Accomplishing the network's goal often depends on local cooperation, aggregation, or data processing because individual nodes have limited capabilities. Physically small, nodes have tiny or irreplaceable power reserves, communicate wirelessly, and may not possess unique identifiers. Further, they must form ad hoc relationships in a dense network with little or no preexisting infrastructure. Protocols and algorithms operating in the network must support large-scale distribution, often with only localized interactions among nodes. The network must continue operating even after significant node failure, and it must meet real-time requirements. In addition to the limitations imposed by application-dependent deadlines, because it reflects a changing environment, the data the network gathers may intrinsically be valid for only a short time. Sensor networks may be deployed in a host of different environments, and they often figure into military scenarios. These networks may gather intelligence in battlefield conditions, track enemy troop movements, monitor a secured zone for activity , or measure damage and casualties. An airplane or artillery 1 could deploy these networks to otherwise unreachable regions. Although military applications may be the easiest to imagine, much broader opportunities await. Sensor networks could form …

This film demonstrates a tool for visualizing the development history of software projects as an interactive animation, showing developers working on the hierarchical file-directory structure of a project over the course of its development.


Question: Visualization of intricate assaults and the status of a compromised network.

This paper introduces an innovative method for managing the overwhelming volume of alarms generated by intrusion detection systems, which often inundate human operators with thousands of alerts daily. The core concept revolves around the idea that each alarm is triggered by specific underlying factors, termed root causes. Our study reveals that a limited number of persistent root causes typically account for more than 90% of all alarms. Based on this observation, we advocate for a new strategy focusing on identifying and addressing these predominant root causes to mitigate alarm frequency. To facilitate this process, we propose a novel alarm-clustering technique designed to assist analysts in pinpointing the root causes. Through experiments conducted with real-world intrusion detection alarms, we demonstrate the effectiveness of our clustering method in identifying root causes. Furthermore, we present evidence that eliminating these identified root causes significantly reduces the overall alarm load, ensuring that they no longer trigger unnecessary alerts in the future. This approach not only eases the burden on human operators but also enhances the efficiency and effectiveness of intrusion detection systems in protecting networks against complex attacks.

In these days an increasing number of public and commercial services are used through the Internet, so that security of information becomes more important issue in the society information Intrusion Detection System (IDS) used against attacks for protected to the Computer networks. On another way, some data mining techniques also contribute to intrusion detection. Some data mining techniques used for intrusion detection can be classified into two classes: misuse intrusion detection and anomaly intrusion detection. Misuse always refers to known attacks and harmful activities that exploit the known sensitivity of the system. Anomaly generally means a generally activity that is able to indicate an intrusion. In this paper, comparison made between 23 related papers of using data mining techniques for intrusion detection. Our work provide an overview on data mining and soft computing techniques such as Artificial Neural Network (ANN), Support Vector Machine (SVM) and Multivariate Adaptive Regression Spline (MARS), etc. In this paper comparison shown between IDS data mining techniques and tuples used for intrusion detection. In those 23 related papers, 7 research papers use ANN and 4 ones use SVM, because of ANN and SVM are more reliable than other models and structures. In addition, 8 researches use the DARPA1998 tuples and 13 researches use the KDDCup1999, because the standard tuples are much more credible than others. There is no best intrusion detection model in present time. However, future research directions for intrusion detection should be explored in this paper. Keywords— intrusion detection, data mining, ANN

Intrusion detection plays a vital role in maintaining the stability of any network. The major requirements for any intrusion detection system are speed, accuracy and less memory. Though various intrusion detection methods are available, they excel at some points while lack in the others. This paper presents a comprehensive survey of the technologies that are used for detecting intrusions. It analyzes the pros and cons of each technology and the literature works that utilizes these technologies. Challenges faced by the current IDS and the requirements for IDS in the current network scenario are discussed in detail. A detailed study on the datasets that can be used for effective building of an IDS is discussed. The research framework is proposed and a discussion of the various technologies that can be used for improving the efficiency of the IDS is provided.

Applications such as those for systems management and intrusion detection employ an automated real-time operation system in which sensor data are collected and processed in real time. Although such a system effectively reduces the need for operation staff, it requires constructing and maintaining correlation rules. Currently, rule construction requires experts to identify problem patterns, a process that is timeconsuming and error-prone. In this paper, we propose reducing this burden by mining historical data that are readily available. Specifically, we first present efficient algorithms to mine three types of important patterns from historical event data: event bursts, periodic patterns, and mutually dependent patterns. We then discuss a framework for efficiently mining events that have multiple attributes. Last, we present Event Correlation Constructor—a tool that validates and extends correlation knowledge.

S ensor networks hold the promise of facilitating large-scale, real-time data processing in complex environments. Their foreseeable applications will help protect and monitor critical military, environmental, safety-critical , or domestic infrastructures and resources. In these and other vital or security-sensitive deployments, keeping the network available for its intended use is essential. The stakes are high: Denial of service attacks against such networks may permit real-world damage to the health and safety of people. Without proper security mechanisms, networks will be confined to limited, controlled environments , negating much of the promise they hold. The limited ability of individual sensor nodes to thwart failure or attack makes ensuring network availability more difficult. To identify denial of service vulnerabilities, we analyze two effective sensor network protocols that did not initially consider security. These examples demonstrate that consideration of security at design time is the best way to ensure successful network deployment. Advances in miniaturization combined with an insatiable appetite for previously unrealizable information gathering have lead to the development of new kinds of networks. In many areas, static infrastruc-tures are giving way to dynamic ad-hoc networks. One manifestation of these trends is the development of highly application-dependent sensor networks. Developers build sensor networks to collect and analyze low-level data from an environment of interest. Accomplishing the network's goal often depends on local cooperation, aggregation, or data processing because individual nodes have limited capabilities. Physically small, nodes have tiny or irreplaceable power reserves, communicate wirelessly, and may not possess unique identifiers. Further, they must form ad hoc relationships in a dense network with little or no preexisting infrastructure. Protocols and algorithms operating in the network must support large-scale distribution, often with only localized interactions among nodes. The network must continue operating even after significant node failure, and it must meet real-time requirements. In addition to the limitations imposed by application-dependent deadlines, because it reflects a changing environment, the data the network gathers may intrinsically be valid for only a short time. Sensor networks may be deployed in a host of different environments, and they often figure into military scenarios. These networks may gather intelligence in battlefield conditions, track enemy troop movements, monitor a secured zone for activity , or measure damage and casualties. An airplane or artillery 1 could deploy these networks to otherwise unreachable regions. Although military applications may be the easiest to imagine, much broader opportunities await. Sensor networks could form …

Modern automobiles are pervasively computerized, and hence potentially vulnerable to attack. However, while previous research has shown that the internal networks within some modern cars are insecure, the associated threat model — requiring prior physical access — has justifiably been viewed as unrealistic. Thus, it remains an open question if automobiles can also be susceptible to remote compromise. Our work seeks to put this question to rest by systematically analyzing the external attack surface of a modern automobile. We discover that remote exploitation is feasible via a broad range of attack vectors (including mechanics tools, CD players, Bluetooth and cellular radio), and further, that wireless communications channels allow long distance vehicle control, location tracking, in-cabin audio exfiltration and theft. Finally, we discuss the structural characteristics of the automotive ecosystem that give rise to such problems and highlight the practical challenges in mitigating them.

Tactical Mobile Ad-hoc Networks (MANETs) are widely deployed in military organizations that have critical needs of communication even with the absence of fixed infrastructure. The lack of communication infrastructure and dynamic topology makes MANETs vulnerable to a wide range attacks. Tactical military operations are among the prime users of ad-hoc networks. The military holds higher standards of security requirements and thus require special intrusion detection applications. Conventional Intrusion Detection System (IDS) require central control and monitoring entities and thus cannot be applied to MANETs. Solutions to secure these networks are based on distributed and cooperative security. This paper presents a survey of IDS specifically for MANETs and also highlights the strengths and weakness of each model. We present a unique evaluation matrix for measuring the effectiveness of IDS for MANETs in an emergency response scenario.

Network forensics is basically used to detect attackers activity and to analyze their behavior. Data collection is the major task of network forensics and honeypots are used in network forensics to collect useful data. Honeypot is an exciting new technology with enormous potential for security communities. This review paper is based upon the introduction to honeypots, their importance in network security, types of honeypots, their advantages disadvantages and legal issues related with them. Research Paper also discuss about the shortcomings of intrusion detection system in a network security and how honeypots improve the security architecture of the organizational network. Furthermore, paper reveals about the different kind of honeypots their level of interaction and risks associated with them. Keywords—honeyd; honeypots; nmap; network forensics

Many large companies today face the risk of data breaches via malicious software, compromising their business. These types of attacks are usually executed using hacker assets. Researching hacker assets within underground communities can help identify the tools which may be used in a cyberattack, provide knowledge on how to implement and use such assets and assist in organizing tools in a manner conducive to ethical reuse and education. This study aims to understand the functions and characteristics of assets in hacker forums by applying classification and topic modeling techniques. This research contributes to hacker literature by gaining a deeper understanding of hacker assets in well-known forums and organizing them in a fashion conducive to educational reuse. Additionally, companies can apply our framework to forums of their choosing to extract their assets and appropriate functions.

Situation awareness depends on a reliable perception of the environment and comprehension of its semantic structures. In this respect, cyberspace presents a unique challenge to the situation awareness of users and analysts, since it is a unique combination of human and machine elements, whose complex interactions occur in a global communication network. Accordingly, we outline the underpinnings of an ontology of secure operations in cyberspace, presenting the ontology framework and providing two modeling examples. We make the case for adopting a rigorous semantic model of cyber security to overcome the current limits of the state of the art. Keywords— cyber security, ontology, situation awareness,

This paper presents a systematic solution to the persistent problem of buffer overflow attacks. Buffer overflow attacks gained notoriety in 1988 as part of the Morris Worm incident on the Internet. While it is fairly simple to fix individual buffer overflow vulnerabilities, buffer overflow attacks continue to this day. Hundreds of attacks have been discovered, and while most of the obvious vulnerabilities have now been patched, more sophisticated buffer overflow attacks continue to emerge. We describe StackGuard: a simple compiler technique that virtually eliminates buffer overflow vulnerabilities with only modest performance penalties. Privileged programs that are recompiled with the StackGuard compiler extension no longer yield control to the attacker, but rather enter a fail-safe state. These programs require no source code changes at all, and are binary-compatible with existing operating systems and libraries. We describe the compiler technique (a simple patch to gcc), as well as a set of variations on the technique that tradeoff between penetration resistance and performance. We present experimental results of both the penetration resistance and the performance impact of this technique. This research is partially supported by DARPA contracts F3060296-1-0331 and F30602-96-1-0302. Ryerson Polytechnic University


Question: Visualization of intricate assaults and the status of the targeted network.

This paper outlines an innovative aggregation and correlation methodology employed in the development of an intrusion-detection management system, seamlessly integrated with the Tivoli Enterprise Console (TEC). The core objective of this methodology is to effectively process and synthesize intrusion-detection alerts, enabling a more succinct and comprehensive perspective on the security threats identified by intrusion-detection systems. By correlating and consolidating these alerts, the system provides a clearer, more manageable overview of the network's security landscape, highlighting critical issues that require immediate attention.

Network security is a complex and challenging problem. The area of network defense mechanism design is receiving immense attention from the research community for more than two decades. However, the network security problem is far from completely solved. Researchers have been exploring the applicability of game theoretic approaches to address the network security issues and some of these approaches look promising. This paper surveys the existing game theoretic solutions which are designed to enhance network security and presents a taxonomy for classifying the proposed solutions. This taxonomy should provide the reader with a better understanding of game theoretic solutions to a variety of cyber security problems.

Security issues are becoming more and more important to acti vities of individuals, organizations and the society in our modern ne tworked computerized world. In this chapter we survey a few optimization framewor ks for problems related to security of various networked system such as the int erne or the power grid system.

A network covert channel is a mechanism that can be used to leak information across a network in violation of a security policy and in a manner that can be difficult to detect. In this paper, we describe our implementation of a covert network timing channel, discuss the subtle issues that arose in its design, and present performance data for the channel. We then use our implementation as the basis for our experiments in its detection. We show that the regularity of a timing channel can be used to differentiate it from other traffic and present two methods of doing so and measures of their efficiency. We also investigate mechanisms that attackers might use to disrupt the regularity of the timing channel, and demonstrate methods of detection that are effective against them.

Intrusion detection is a broad problem, and we need a greater range of tools than is currently available. In this article, we report a new approach. We have applied information retrieval techniques to index audit trails. These indexes can be extremely e cient at detecting attacks whose signature is an unusual combination of events, and they may consume only a very small additional amount of storage. This approach allows the intrusion detection community to adopt a wide range of techniques developed in applications ranging from library science to web search engines.

Internet and internet users are increasing day by day. Also due to rapid development of internet technology , security is becoming big issue. Intruders are monitoring comput er network continuously for attacks. A sophisticated firewall with efficient intrusion detection system (IDS) is required to pre vent computer network from attacks. A comprehensive study of litera tures proves that data mining techniques are more powerful techni que to develop IDS as a classifier. Performance of classif ier is a crucial issue in terms of its efficiency, also number of fe ature to be scanned by the IDS should also be optimized. In thi s paper two techniques C5.0 and artificial neural network (ANN) ar e utilized with feature selection. Feature selection techniques will discard some irrelevant features while C5.0 and ANN acts as a classifier to classify the data in either normal type or one of t he five types of attack.KDD99 data set is used to train and test the models ,C5.0 model with numbers of features is producing better r sults with all most 100% accuracy. Performances were also verified in terms of data partition size.

Cyber-attacks have increased in severity and complexity. That requires, that the CERT/CSIRT research and develops new security tools. Therefore, our study focuses on the design of an integral model based on Business Intelligence (BI), which provides reactive and proactive services in a CSIRT, in order to alert and reduce any suspicious or malicious activity on information systems and data networks. To achieve this purpose, a solution has been assembled, that generates information stores, being compiled from a continuous network transmission of several internal and external sources of an organization. However, it contemplates a data warehouse, which is focused like a correlator of logs, being formed by the information of feeds with diverse formats. Furthermore, it analyzed attack detection and port scanning, obtained from sensors such as Snort and Passive Vulnerability Scanner, which are stored in a database, where the logs have been generated by the systems. With such inputs, we designed and implemented BI systems using the phases of the Ralph Kimball methodology, ETL and OLAP processes. In addition, a software application has been implemented using the SCRUM methodology, which allowed to link the obtained logs to the BI system for visualization in dynamic dashboards, with the purpose of generating early alerts and constructing complex queries using the user interface through objects structures. The results demonstrate, that this solution has generated early warnings based on the level of criticality and level of sensitivity of malware and vulnerabilities as well as monitoring efficiency, increasing the level of security of member institutions.

This paper introduces the Unsupervised Neural Net based Intrusion Detector (UNNID) system, which detects network-based intrusions and attacks using unsupervised neural networks. The system has facilities for training, testing, and tunning of unsupervised nets to be used in intrusion detection. Using the system, we tested two types of unsupervised Adaptive Resonance Theory (ART) nets (ART-1 and ART-2). Based on the results, such nets can efficiently classify network traffic into normal and intrusive. The system uses a hybrid of misuse and anomaly detection approaches, so is capable of detecting known attack types as well as new attack types as anomalies.

Nowadays it is very important to maintain a high level security to ensure safe and trusted communication of information between various organizations. But secured data communication over internet and any other network is always under threat of intrusions and misuses. So Intrusion Detection Systems have become a needful component in terms of computer and network security. There are various approaches being utilized in intrusion detections, but unfortunately any of the systems so far is not completely flawless. So, the quest of betterment continues. In this progression, here we present an Intrusion Detection System (IDS), by applying genetic algorithm (GA) to efficiently detect various types of network intrusions. Parameters and evolution processes for GA are discussed in details and implemented. This approach uses evolution theory to information evolution in order to filter the traffic data and thus reduce the complexity. To implement and measure the performance of our system we used the KDD99 benchmark dataset and obtained reasonable detection rate.

Now that multiple-known attacks can affect one software product at the same time, it is necessary to rank and prioritize those attacks in order to establish a better defense. The purpose of this paper is to provide a set of security metrics to rank attacks based on vulnerability analysis. The vulnerability information is retrieved from a vulnerability management ontology, which integrates commonly used standards like CVE, CWE, CVSS, and CAPEC. Among the benefits of ranking attacks through the method proposed here are: a more effective mitigation or prevention of attack patterns against systems, a better foundation to test software products, and a better understanding of vulnerabilities and attacks.

Smartphones and tablets are now ubiquitous in many people's lives and are used throughout the day in many public places. They are often connected to a wireless local area network (IEEE 802.11 WLANs) and rely on encryption protocols to maintain their security and privacy. In this paper, we show that even in presence of encryption, an attacker without access to encryption keys is able to determine the users' behavior, in particular, their app usage. We perform this attack using packet-level traffic analysis in which we use side-channel information leaks to identify specific patterns in packets regardless of whether they are encrypted or not. We show that just by collecting and analyzing small amounts of wireless traffic, one can determine what apps each individual smartphone user in the vicinity is using. Furthermore, and more worrying, we show that by using these apps the privacy of the user is more at risk compared to using online services through browsers on mobile devices. This is due to the fact that apps generate more identifiable traffic patterns. Using random forests to classify the apps we show that we are able to identify individual apps, even in presence of noise, with great accuracy. Given that most online services now provide native apps that may be identified by this method, these attacks represent a serious threat to users' privacy.


Question: Visualization of intricate assaults and the condition of a network under attack.

This paper introduces MieLog, an innovative visual log browser designed to simplify system administration tasks by addressing the challenges associated with analyzing large volumes of textual log data. System administrators often struggle with two main issues: the cognitive burden of comprehending extensive log contents and the difficulty in identifying anomalous messages. The sheer volume of text makes reading logs a laborious, time-consuming, and error-prone process. Moreover, without the necessary expertise, distinguishing between routine and unusual messages becomes challenging. To tackle these problems, MieLog incorporates two powerful techniques: information visualization and statistical analysis. Information visualization significantly reduces the cognitive load by offering a visual interpretation of textual information, eliminating the need for detailed reading. Statistical analysis, on the other hand, facilitates the detection of unusual log messages without requiring domain-specific knowledge. The paper presents three illustrative examples demonstrating how MieLog can effectively pinpoint anomalous messages with greater ease compared to traditional methods.

Security and performance are critical goals for distributed systems. The increased design complexity, incomplete expertise of developers, and limited functionality of existing testing tools often result in bugs and vulnerabilities that prevent implementations from achieving their design goals in practice. Many of these bugs, vulnerabilities, and misconfigurations manifest after the code has already been deployed making the debugging process difficult and costly. In this paper, we present Turret, a platform for automatically finding performance attacks in unmodified implementations of distributed systems. Turret does not require the user to provide any information about vulnerabilities and runs the implementation in the same operating system setup as the deployment, with an emulated network. Turret uses a new attack finding algorithm and several optimizations that allow it to find attacks in a matter of minutes. We ran Turret on 5 different distributed system implementations specifically designed to tolerate insider attacks, and found 30 performance attacks, 24 of which were not previously reported to the best of our knowledge.

Modern vehicles are equipped with Electronic Control Units (ECUs) and external communication devices. The Controller Area Network (CAN), a widely used communication protocol for ECUs, does not have a security mechanism to detect improper packets; if attackers exploit the vulnerability of an ECU and manage to inject a malicious message, they are able to control other ECUs to cause improper operation of the vehicle. With the increasing popularity of connected cars, it has become an urgent matter to protect in-vehicle networks against security threats. In this paper, we study the applicability of statistical anomaly detection methods for identifying malicious CAN messages in invehicle networks. We focus on intrusion attacks of malicious messages. Because the occurrence of an intrusion attack certainly influences the message traffic, we focus on the number of messages observed in a fixed time window to detect intrusion attacks. We formalize features to represent a message sequence that incorporates the number of messages associated with each receiver ID. We collected CAN message data from an actual vehicle and conducted a quantitative analysis of the methods and the features in practical situations. The results of our experiments demonstrated our proposed methods provide fast and accurate detection in various cases.

We propose a characterization of distributed denial-of-s ervice (DDOS) defenses where reaction points are network-based and attack responses are active. The purpose is to provide a framework for comparing the performance and deployment of DDOS defenses. We identify the characteristics in attack detection algorithms and a ttack responses by reviewing defenses that have appeared in the literature. We expect that this char a terization will provide practitioners and academia insights into deploying DDOS defense as network services.

This paper investigates the use of Petri nets for modeling coordinated cyber-physical attacks on the smart grid. Petri nets offer more flexibility and expressiveness than traditional attack trees to represent the actions of simultaneous attackers. However, Petri net models for attacks on very large critical infrastructures such as the smart grid require a great amount of manual effort and detailed expertise in cyber-physical threats. To overcome these obstacles, we propose a novel hierarchical method to construct large Petri nets from a number of smaller Petri nets that can be created separately by different domain experts. The construction method is facilitated by a model description language that enables identical places in different Petri nets to be matched. The new modeling approach is described for an example attack on smart meters, and its efficacy is demonstrated by a proof-of-concept Python program.

A distributed detection method is proposed to detect single stage multi-point (SSMP) attacks on a Cyber Physical System (CPS). Such attacks aim at compromising two or more sensors or actuators at any one stage of a CPS and could totally compromise a controller and prevent it from detecting the attack. However, as demonstrated in this work, using the flow properties of water from one stage to the other, a neighboring controller was found effective in detecting such attacks. The method is based on physical invariants derived for each stage of the CPS from its design. The attack detection effectiveness of the method was evaluated experimentally against an operational water treatment testbed containing 42 sensors and actuators. Results from the experiments point to high effectiveness of the method in detecting a variety of SSMP attacks but also point to its limitations. Distributing the attack detection code among various controllers adds to the scalability of the proposed method.

Network intrusion detection systems are faced with the challenge of identifying diverse attacks, in extremely high speed networks. For this reason, they must operate at multi-Gigabit speeds, while performing highly-complex per-packet and per-flow data processing. In this paper, we present a multi-parallel intrusion detection architecture tailored for high speed networks. To cope with the increased processing throughput requirements, our system parallelizes network traffic processing and analysis at three levels, using multi-queue NICs, multiple CPUs, and multiple GPUs. The proposed design avoids locking, optimizes data transfers between the different processing units, and speeds up data processing by mapping different operations to the processing units where they are best suited. Our experimental evaluation shows that our prototype implementation based on commodity off-the-shelf equipment can reach processing speeds of up to 5.2 Gbit/s with zero packet loss when analyzing traffic in a real network, whereas the pattern matching engine alone reaches speeds of up to 70 Gbit/s, which is an almost four times improvement over prior solutions that use specialized hardware.

Software Defined Networks (SDN) technology can alternate the network, unlock critical intelligence, and help deliver the new services and analytics needed to run on-demand applications for today's businesses and consumers. So, SDN has been much request for adoption in mostly data centre. SDN provides network administrators to clear overview of the entire network architecture. It decouples a network's control and forwarding functions such that the physical and logical networks can be treated independently. This method allows network traffic flows to be programmatically and effectively reallocated to meet changing demands. That's what SDN does. Software defined network have too many scarcity like throughput, packet loss and network attack defense. Software defined firewalls helps to overcome lack of SDN and also reduce ratios of attack traffic. Here we analyze some SDF techniques and challenges related to software defined network.

Network traffic anomaly may indicate a possible intrusion in the network and therefore anomaly detection is important to detect and prevent the security attacks. The early research work in this area and commercially available Intrusion Detection Systems (IDS) are mostly signature-based. The problem of signature based method is that the database signature needs to be updated as new attack signatures become available and therefore it is not suitable for the real-time network anomaly detection. The recent trend in anomaly detection is based on machine learning classification techniques. We apply seven different machine learning techniques with information entropy calculation to Kyoto 2006+ data set and evaluate the performance of these techniques. Our findings show that, for this particular data set, most machine learning techniques provide higher than 90% precision, recall and accuracy. However, using area under the Receiver Operating Curve (ROC) metric, we find that Radial Basis Function (RBF) performs the best among the seven algorithms studied in this work.

Often security is seen as an add-on service for automation systems that frequently conflicts with other goals such as efficient transmission or resource limitations. This article goes for a practice-oriented approach to security in automation systems. It analysis common threats to automation systems and automation networks in particular, sets up a model to classify systems with respect to security and discusses common measures available at different system levels. The description of measures should allow to rate the effects on the overall system security

The pervasiveness of Cyber-Physical Systems (CPS) in various aspects of the modern society grows rapidly. This makes CPS to increasingly attractive targets for various kinds of attacks. We consider cyber-security as an integral part of CPS security. Additionally, the necessity exists to investigate the CPS-specific aspects which are out of scope of cyber-security. Most importantly, attacks capable to cross the cyber-physical domain boundary should be analyzed. The vulnerability of CPS to such cross-domain attacks has been practically proven by numerous examples, e.g., by the currently most famous Stuxnet attack. In this paper, we propose taxonomy for description of attacks on CPS. The proposed taxonomy is capable of representing both conventional cyber-attacks as well as cross-domain attacks on CPS. Furthermore, based on the proposed taxonomy, we define the attack categorization. Several possible application areas of the proposed taxonomy are extensively discussed. Among others, it can be used to establish a knowledge base about attacks on CPS known in the literature. Furthermore, the proposed description structure will foster the quantitative and qualitative analysis of these attacks, both of which are necessarily to improve CPS security.


Question: A suggestion for utilizing deep trench poly field plates in LDMOS technology.

This paper introduces an innovative nLDMOS structure and design methodology within the context of BCD technology, achieving superior performance metrics. The drift region's profile has been meticulously optimized, and the incorporation of multi-oxide layers enhances the RESURF limit of the on-resistance versus breakdown voltage (BVdss) characteristic. Specifically, the 36V DMOS device exhibits a specific on-resistance (Ron_sp) of 20mohm-mm2 with a BVdss of 50V, while the 45V DMOS demonstrates a Ron_sp of 28mohm-mm2 with a BVdss of 65V. Notably, these enhancements are achieved with just three additional masks in the Non-Epitaxy LV process, making this solution both high-performing and economically viable.

A capacitor charging power supply (CCPS) has been assembled. A full-bridge series resonant topology using MOSFETs as switching elements makes up the bulk of the high-power section of the CCPS. A high-voltage transformer couples the output stage to the resonant inverter, and the secondary current of this transformer is rectified to provide the charging current. The CCPS uses constant on-time control with zero current switching. The control scheme is implemented with Unitrode's UC3860 resonant mode power supply controller. The control circuitry also protects the CCPS against both overvoltage and overcurrent conditions. The CCPS has been tested in the laboratory, where it successfully charged capacitors ranging from 90 nF to 1 mu F to 2000 V.<<ETX>>

This paper proposes an Active Gate Drive (AGD) to reduce unwanted switching ringing of Silicon Carbide (SiC) MOSFET module with a rating of 120 A and 1200 V. While SiC MOSFET can be operated under high switching frequency and high temperature with very low power losses, one of the key challenges for SiC MOSFET is the electromagnetic interference (EMI) caused by steep switching transients and continuous switching ringing. Compared to Si MOSFET, the higher rate of SiC MOSFET drain current variation introduces worse EMI problems. To reduce EMI generated from the switching ringing, this paper investigates the causes of switching ringing by considering the combined impact of parasitic inductances, capacitances, and low circuit loop resistance. In addition, accurate mathematical expressions are established to explain the ringing behavior and quantitative analysis is carried out to investigate the relationship between the switching transient and gate drive voltage. Thereafter, an AGD method for mitigating SiC MOSFET switching ringing is presented. Substantially reduced switching ringing can be observed from circuit simulations. As a result, the EMI generation is mitigated.

This paper discusses the type of capacitances for Single Gate MOSFET and Double Gate MOSFET including their quantity. The effect of parasitic capacitance makes double gate MOSFET more suitable component for the designing of digital logic switches than single gate MOSFET. Here, we introducing Independent double gate MOSFET operation based on VeSFET concept. Then introducing with the total capacitance model of Independent double gate MOSFET and compared its performance parameters with double gate MOSFET and the single gate MOSFET. Double gate transistor circuit is the first choice for reduction of short channel effect in application of MOSFET. The basic advantage of double gate MOSFET is its area required. But design CMOS double gate transistor for AND functionality suffering from high leakage current; while using Independent double gate MOSFET based on VeSFET concept reduction of that leakage current is possible. So, we can easily implement logic circuits while using CMOS design based on Independent double gate MOSFET which gives high performance.

This paper presents a novel side gate HiGT (High-conductivity IGBT) that incorporates historical changes of gate structures for planar and trench gate IGBTs. Side gate HiGT has a side-wall gate, and the opposite side of channel region for side-wall gate is covered by a thick oxide layer to reduce Miller capacitance (Cres). In addition, side gate HiGT has no floating p-layer, which causes the excess Vge overshoot. The proposed side gate HiGT has 75% smaller Cres than the conventional trench gate IGBT. The excess Vge overshoot during turn-on is effectively suppressed, and Eon + Err can be reduced by 34% at the same diode's recovery dv/dt. Furthermore, side gate HiGT has sufficiently rugged RBSOA and SCSOA.

This paper presents design considerations along with measurement results pertinent to hydrogenated amorphous silicon (a-Si:H) thin film transistor (TFT) drive circuits for active matrix organic light emitting diode (AMOLED) displays. We describe both pixel architectures and TFT circuit topologies that are amenable for vertically integrated, high aperture ratio pixels. Here, the OLED layer is integrated directly above the TFT circuit layer, to provide an active pixel area that is at least 90% of the total pixel area with an aperture ratio that remains virtually independent of scaling. Both voltage-programmed and current-programmed drive circuits are considered. The latter provides compensation for shifts in device characteristics due to metastable shifts in the threshold voltage of the TFT. Various drive circuits on glass and plastic were fabricated and tested. Integration of on-panel gate drivers is also discussed where we present the architecture of an a-Si:H based gate de-multiplexer that is threshold voltage shift invariant. In addition, a programmable current mirror with good linearity and stability is presented. Programmable current sources are an essential requirement in the design of source driver output stages.

A MMIC 77-GHz two-stage power amplifier (PA) is reported in this letter. This MMIC chip demonstrated a measured small signal gain of over 10 dB from 75 GHz to 80 GHz with 18.5-dBm output power at 1 dB compression. The maximum small signal gain is above 12 dB from 77 to 78 GHz. The saturated output power is better than 21.5 dBm and the maximum power added efficiency is 10% between 75 GHz and 78 GHz. This chip is fabricated using 0.1-/spl mu/m AlGaAs/InGaAs/GaAs PHEMT MMIC process on 4-mil GaAs substrate. The output power performance is the highest among the reported 4-mil MMIC GaAs HEMT PAs at this frequency and therefore it is suitable for the 77-GHz automotive radar systems and related transmitter applications in W-band.

In order to reduce high frequency electromagnetic interference (EMI) noise for SiC devices, this paper presents a hybrid structure SiC power module with low parasitic inductance and low ground capacitance that can suppress EMI efficiently. To certify the improvement on EMI, two buck converters, using the same power loop and gate drive, are built for experiment. Two converters use the proposed power module and TO-247 packaged commercial devices respectively. The experimental results show that low parasitic inductance can increase switching speed considerably while have only slight impact on EMI. And low parasitic ground capacitance can decrease the ground current effectively. Considering soft switching can also reduce EMI, this paper further compares EMI noise of two converters under two conditions: continuous current modulation (CCM) and triangle current modulation (TCM). The result shows that the proposed power module can suppress the common mode (CM) noise effectively at both situations. Furthermore, this paper verifies the noise mode transformation from differential mode (DM) EMI to CM EMI.

An accurate computation of electrical force is significant in analyzing the performance of microelectromechanical systems and nanoelectromechanical systems. Many analytical and empirical models are available for computing the forces, especially, for a single set of parallel plates. In general, these forces are computed based on the direct electric field between the overlapping areas of the plates and the fringing field effects. Most of the models, which are based on direct electric field effect, consider only the trivial cases of the fringing field effects. In this paper, we propose different models which are obtained from the numerical simulations. It is found to be useful in computing capacitance as well force in simple and complex configurations consisting of an array of beams and electrodes. For the given configurations, the analytical models are compared with the available models and numerical results. While the percentage error of the proposed model is found to be under 6% with respect to the numerical results, the error associated with the analytical model without the fringing field effects is ~50 %. The proposed model can be applied to the devices in which the fringing field effects are dominant.

In this letter, a novel antenna-in-package (AiP) technology at W-band has been proposed. This technology is presented for solving the special case that the metallic package should be used to accommodate high mechanical strength. By taking advantages of the multilayer low temperature co-fired ceramic (LTCC) technology, the radiation efficiency of the antenna can be maintained. Meanwhile, high mechanical strength and shielding performance are achieved. A prototype of AiP has been designed. The prototype constitutes integrated LTCC antenna, low-loss feeder, and metallic package with a tapered horn aperture. This LTCC feeder is realized by laminated waveguide (LWG). An LWG cavity that is buried in LTCC is employed to broaden the antenna impedance bandwidth. Electromagnetic (EM) simulations and measurements of antenna performances agree well over the whole frequency range of interest. The proposed prototype achieves a -10-dB impedance bandwidth of 10 GHz from 88 to 98 GHz and a peak gain of 12.3 dBi at 89 GHz.

In this paper, we describe the architecture and performance of a fine pitch multiple chip heterogeneous integration solution using ceramic interconnect bridge on organic substrate package. We present the increased IO density and improvement of electrical high-speed performance on signal integrity are achievable through this novel integration scheme, where dense copper routings on small ceramic elements are served as interconnect bridges. The cost and signal attenuation of using ceramic bridge is far better than that of silicon bridge or wafer interposer on substrate.


Question: A suggestion for utilizing a deep trench poly field plate in LDMOS technology.

In this work, we introduce an innovative design for low Ron LDMOS power transistors integrated within a 0.35 μm BCD process, achieving remarkable Specific Resistance (Rsp) figures of merit. These fully isolated LDMOS devices are engineered to withstand scenarios where the source/drain terminals may be biased lower than the substrate potential, a critical requirement for high-current, high-frequency switching applications. Our new devices are perfectly suited for high-efficiency DC-DC converter products operating up to 30V, such as those found in mobile PMICs. To optimize performance across the entire voltage spectrum, two distinct extended-drain LDMOS architectures have been developed: a planar-gate structure for voltages up to 16V, and a non-planar "offset-LOCOS" gate design for voltages from 20V and above, ensuring superior performance in all operational conditions.

Leakage current reduction is of primary importance as the technology scaling trends continue towards deep sub-micrometer regime. One of the leakage mechanisms which contribute significantly to power dissipation is the Gate Induced Drain Leakage (GIDL). GIDL sets an upper limit on the VLSI MOSFET scaling and may even lead to device breakdown. Thus, in order to improve performance, static power consumption becomes a major concern in such miniaturized devices. With the CMOS technology in the nanometer regime, metal gates emerge as a powerful booster over the poly-Si gates, keeping the leakage mechanisms in control. This work presents a systematic study of the Gate Induced Drain Leakage current reduction by changing the gate workfunction. In this work, an attempt has been made to model the metal gates in the field equations in the gate-drain overlap region. The modeling has been accomplished by taking the physical property of the metals into account i.e. the workfunction. The analytical model has been used to study the impact of gate workfunction engineering on GIDL. The model includes the calculation of band bending, the resultant electric field in the gate-drain overlap region and the GIDL current. It has been observed that the electric field and the GIDL current decreases as the gate workfunction is increased continuously from 4.0~5.2 eV. Further, the results are more interesting at low applied voltages where the decrease in the current is of about 6 orders of magnitude as compared to that at higher voltages.

This work presents a Ka-band two-way 3 dB Wilkinson power divider using synthetic quasi-transverse electromagnetic (TEM) transmission lines (TLs). The synthetic quasi-TEM TL, also called complementary-conducting-strip TL (CCS TL), is theoretically analyzed. The equivalent TL model, whose production is based on the extracted results, is applied to the power divider design. The prototype is fabricated by the standard 0.18 mum 1P6M CMOS technology, showing the circuit size of 210.0 mumtimes390.0 mum without contact pads. The measurement results, which match the 50 Omega system, reveal perfect agreements with those of the simulations. The comparison reveals the following characteristics. The divider exhibits an equal power-split with the insertion losses (S21 and S31) of 3.65 dB. The return losses (S11, S22 and S33) of the prototype are higher than 10.0 dB from 30.0 to 40.0 GHz.

An eight-device Ka-band solid-state power amplifier has been designed and fabricated using a traveling-wave power-dividing/combining technique. The low-profile slotted-waveguide structure employed in this design provides not only a high power-combining efficiency over a wide bandwidth, but also efficient heat sinking for the active devices. The measured maximum small-signal gain of the eight-device power amplifier is 19.4 dB at 34 GHz with a 3-dB bandwidth of 3.2 GHz (f/sub L/=31.8 GHz, f/sub H/=35 GHz). The measured maximum output power at 1-dB compression (P/sub out/ at 1 dB) from the power amplifier is 33 dBm (/spl sim/2 W) at 32.2 GHz, with a power-combining efficiency of 80%. Furthermore, performance degradation of this power amplifier due to device failures has also been simulated and measured.

In this paper a charge pump circuit is presented: it is based on PMOS pass transistors with dynamic control of the gate and body voltages. By controlling the gate and the bulk of each PMOS pass transistor, the voltage loss due to the device threshold is removed and the charge is pumped from one stage to the other with negligible voltage drop. Furthermore, the overdrive voltage of the pass transistors grows progressively from the first to the last stage. Hence, a larger output voltage can be achieved compared to conventional charge pumps, still retaining a simple two-phase clocking scheme, along with the Dickson basic architecture. The prototype was fabricated using the STMicroelectronics T10 90nm CMOS process. Measurements results are also presented confirming the validity of the design

This paper highlights the general trend towards further monolithic integration in power applications by enabling power management and interfacing solutions in advanced CMOS nodes. The need to combine high-density digital circuits, power-management circuits, and robust interfaces in a single technology platform requires the development of additional process options on top of baseline CMOS. Examples include high-voltage devices, devices to enable area-efficient ESD protection, and integrated capacitors and inductors with high quality factors. The use of bipolar devices in these technologies for protection and control purposes in power applications is also addressed.

A new design methodology was proposed to obtain wide-bandwidth and flat-group-delay reactive-matching GaN HEMT MMIC amplifiers. Frequency dependence of the optimal source and load impedance of a GaN HEMT are derived as polynomial equations and matching circuits are designed by small signal simulation without the use of large-signal transistor model and large-signal simulation. Fabricated GaN HEMT MMIC amplifiers, which show a small deviation of Pout and PAE in the range of 8-18 GHz, prove that our methodology is suitable for the design of a wide-bandwidth MMIC amplifier.

A 45GHz Doherty power amplifier is implemented in 45nm SOI CMOS. Two-stack FET amplifiers are used as main and auxiliary amplifiers, allowing a supply voltage of 2.5V and high output power. The use of slow-wave coplanar waveguides (CPW) improves the PAE and gain by approximately 3% and 1dB, and reduces the die area by 20%. This amplifier exhibits more than 18dBm saturated output power, with peak power gain of 7dB. It occupies 0.64mm2 while achieving a peak PAE of 23%; at 6dB back-off the PAE is 17%.

We present a technology for the manufacturing of silicon-filled integrated waveguides enabling the realization of low-loss high-performance millimeter-wave passive components and high gain array antennas, thus facilitating the realization of highly integrated millimeter-wave systems. The proposed technology employs deep reactive-ion-etching (DRIE) techniques with aluminum metallization steps to integrate rectangular waveguides with high geometrical accuracy and continuous metallic side walls. Measurement results of integrated rectangular waveguides are reported exhibiting losses of 0.15 dB/ λg at 105 GHz. Moreover, ultra-wideband coplanar to waveguide transitions with 0.6 dB insertion loss at 105 GHz and return loss better than 15 dB from 80 to 110 GHz are described and characterized. The design, integration and measured performance of a frequency scanning slotted-waveguide array antenna is reported, achieving a measured beam steering capability of 82 ° within a band of 23 GHz and a half-power beam-width (HPBW) of 8.5 ° at 96 GHz. Finally, to showcase the capability of this technology to facilitate low-cost mm-wave system level integration, a frequency modulated continuous wave (FMCW) transmit-receive IC for imaging radar applications is flip-chip mounted directly on the integrated array and experimentally characterized.

Random variation of threshold voltage (Vt) in MOSFETs plays a central role in determining the minimum operating voltage of products in a given process technology. Properly characterizing Vt variation requires a large volume of measurements of minimum size devices to understand the high sigma behavior. At the same time, a rapid measurement approach is required to keep the total measurement time practical. Here we describe a new test structure and measurement approach that enables practical characterization of Vt distributions to high sigma and its application to 14nm Logic FinFET technology. We show that both NMOS and PMOS single fin devices have very low random Vt variation of 19mV and 24mV respectively, normally distributed out to +/-5σ.

A new multiple-loop design technique for high-performance low-dropout (LDO) regulator designs has been proposed and successfully implemented in many commercial products for portable smart phone and tablet PC applications. The proposed LDO is composed of five loops that allows designers to obtain a good tradeoff between quiescent current and other performances, such as undershoot, overshoot, and so on. A total of one bandgap reference and 38 LDOs (including n-type and p-type LDOs, which will be named NLDO and PLDO, respectively) were integrated in one power-management IC chip for powering an application processor inside mobile devices. The proposed LDO has been fabricated based on 0.13-<inline-formula> <tex-math notation="LaTeX">$\mu {m}$ </tex-math></inline-formula> CMOS process and supplies various current capacities from 50 to 600 mA; 38 LDOs have been designed and supply different output voltage levels from 0.7 to 3.0 V. One of the proposed NLDOs consumes <inline-formula> <tex-math notation="LaTeX">$14~\mu {A}$ </tex-math></inline-formula> of the quiescent current and features under 56/24 mV of undershoot/overshoot at VOUT =1<italic>V</italic> as the load current steps up from 0 to 300 mA with 300 mA/1 <inline-formula> <tex-math notation="LaTeX">$\mu {s}$ </tex-math></inline-formula> on a 1-<inline-formula> <tex-math notation="LaTeX">$\mu {F}$ </tex-math></inline-formula> output capacitor. The measured output load and line regulations are 1.8 and 0.4 mV, respectively. The measured integrated output noise from 10 Hz to 100 kHz at <inline-formula> <tex-math notation="LaTeX">$\text{I}_{\mathrm{ LOAD}}=10\%$ </tex-math></inline-formula> of maximum current shows 80 <inline-formula> <tex-math notation="LaTeX">$\mu {V}$ </tex-math></inline-formula> rms. The package chip size is <inline-formula> <tex-math notation="LaTeX">$6.25 \times 6.25$ </tex-math></inline-formula> mm2 with 169 balls.