As the trend of successful network attacks continue to rise, better forms of intrusion, detection and prevention are needed. This thesis addresses network traffic visualization techniques that aid administrators in recognizing attacks. A view of port statistics and Intrusion Detection System (IDS) alerts has been developed. Each help to address issues with analyzing large datasets involving networks. Due to the amount of traffic as well as the range of possible port numbers and IP addresses, scaling techniques are necessary. A port-based overview of network activity produces an improved representation for detecting and responding to malicious activity. We have found that presenting an overview using stacked histograms of aggregate port activity, combined with the ability to drill-down for finer details allows small, yet important details to be noticed and investigated without being obscured by large, usual traffic. Another problem administrators face is the cumbersome amount of alarm data generated from IDS sensors. As a result, important details are often overlooked, and it is difficult to get an overall picture of what is occurring in the network by manually traversing textual alarm logs. We have designed a novel visualization to address this problem by showing alarm activity within a network. Alarm data is presented in an overview from which system administrators can get a general sense of network activity and easily detect anomalies. They additionally have the option of then zooming and drilling down for details. Based on our system administrator requirements study, this graphical layout addresses what system administrators need to see, is faster and easier than analyzing text logs, and uses visualization techniques to effectively scale and display the data. With this design, we have built a tool that effectively uses operational alarm log data generated on the Georgia Tech campus network. For both of these systems, we describe the input data, the system design, and examples. Finally, we summarize potential future work.

Power system protection is important for service reliability and quality assurance. Various faults may occur due to natural and artificial calamity. To reduce the outage duration and promptly restore power services, fault section estimate has to be done effectively and accurately with fault alarms. Dispatchers study the changed statuses of protection devices from the Supervisory Control and Data Acquisition (SCADA) system to identify the fault. Single and multiple faults could coexist with the failed operation of relays and circuit breakers, or with the erroneous data communication. It needs a long time to process a large number of alarms under various conditions involving multiple faults and many uncertainties. To cope with the problem, an effective tool is helpful for the fault section estimation and alarm processing. Besides, power transformer plays a major role in a power system. For a better service quality, it is important to be routinely examined for detecting incipient faults inside transformers. Preventive techniques for early detection can find out the incipient faults and avoid outages. Power quality is another issue to considerable attentions from utilities and customers due to the popular uses of many sensitive electronic equipment. Harmonics, voltage swell, voltage sag, and, power interruption could downgrade the service quality. To ensure the power quality, detecting harmonic and voltage disturbances becomes important. A detection method with classification capability will be helpful for detecting disturbances. This dissertation developed various algorithm for detection including fault section detection, alarm processing, transformer fault diagnosis, and power quality detection. For a well-dispatched power system, the adaptive detection idea will be used, and the existing SCADA/EMS will be integrated without extra devices.

Finding an efficient method to detect counterfeit banknotes is imperative. In this study, we propose multiple kernel weighted support vector machine for counterfeit banknote recognition. A variation of SVM in optimizing false alarm rate, called FARSVM, is proposed which provide minimized false negative rate and false positive rate. Each banknote is divided into m ¡Ñ n partitions, and each partition comes with its own kernels. The optimal weight with each kernel matrix in the combination is obtained through the semidefinite programming (SDP) learning method. The amount of time and space required by the original SDP is very demanding. We focus on this framework and adopt two strategies to reduce the time and space requirements. The first strategy is to assume the non-negativity of kernel weights, and the second strategy is to set the sum of weights equal to 1. Experimental results show that regions with zero kernel weights are easy to imitate with today¡¦s digital imaging technology, and regions with nonzero kernel weights are difficult to imitate. In addition, these results show that the proposed approach outperforms single kernel SVM and standard SVM with SDP on Taiwanese banknotes.

No description available.

Hatchery supplementation of declining fish populations is used for increasing year-class strength, particularly when fish are released with knowledge of local predators. The ability of young-of-the-year lake sturgeon (Acipenser fulvescens) to avoid predation, as well as their vulnerability to predation, remains undocumented. The objective of my thesis was to determine: 1) whether hatchery-reared, predator-naive juvenile sturgeon would respond to alarm cues from injured conspecific cues, a reliable indicator of predation risk in other fishes; and 2) if sturgeon would learn to identify unknown predators through a Pavlovian-like conditioning with conspecific alarm cues. Releaser-induced recognition learning is a variant of Pavlovian learning in which recognition of a previously neutral stimulus is acquired through the experience of pairing a behaviourally active releasing stimulus and a novel stimulus. Sturgeon were initially conditioned using a behaviourally active stimulus of sturgeon alarm cue, paired with a behaviourally neutral stimulus of novel northern pike (Esox lucius) odour, or were pseudo-conditioned with distilled water paired with pike odour. Following conditioning, sturgeon were tested for recognition of the predator odour 24 hours later. The first population of fish (Rainy River) showed a dramatic antipredator response to alarm cues from the skin of conspecifics, but failed to exhibit learning of a novel predator through conditioning with alarm cues obtained from the skin of conspecifics. However, when Rainy River fish were conditioned with alarm cues from the whole body of conspecifics, they showed strong learning of the predator. Conditioning Wolf River fish to recognize predators with whole body extract had no effect on response to predator odours. However, when the fish were conditioned multiple times there was evidence of predator learning. These results highlight potential opportunities and limitation to life-skill training of artificially reared sturgeon for future conservation initiatives.

Cerebral lateralization was once thought to be unique to humans, but is now known to be widespread among the vertebrates. Lateralization appears to confer cognitive advantages upon those that possess it. Despite the taxonomic ubiquity and described advantages of lateralization, substantial individual variation exists in all species. Individual variation in cerebral lateralization may be tied to individual variation in behaviour and the selective forces that act to maintain variation in behaviour may also act to maintain variation in lateralization. Sex differences may also be an important source of variation in lateralization, as differences between males and females are often observed. Here, I present three papers that collectively deal with the interrelationships between sex, behaviour and cerebral lateralization in the convict cichlid. My results illustrate that lateralization is related to personality-like characteristics in the convict cichlid, and that there are important differences between the sexes in their pattern of lateralization.

Smart computer algorithms and signal processing techniques have led to rapid development in the field of patient monitoring. Accelerated growth in the field of medical science has made data analysis more demanding and thus the complexity of decision-making procedures. Anaesthetists working in the operating theatre are responsible for carrying out a multitude of tasks which requires constant vigilance and thus a need for a smart decision support system has arisen. It is anticipated that such an automated decision support tool, capable of detecting pathological events can enhance the anaesthetist’s performance by providing the diagnostic information to the anaesthetist in an interactive and ergonomic display format. The main goal of this research was to develop a clinically useful diagnostic alarm system prototype for monitoring pathological events during anaesthesia. Several intelligent techniques, fuzzy logic, artificial neural networks, a probabilistic alarms and logistic regression were explored for developing the optimum diagnostic modules in detecting these events. New real-time diagnostic algorithms were developed and implemented in the form of a prototype system called real time – smart alarms for anaesthesia monitoring (RT-SAAM). Three diagnostic modules based on, fuzzy logic (Fuzzy Module), probabilistic alarms (Probabilistic Module) and respiration induced systolic pressure variations (SPV Module) were developed using MATLABTM and LabVIEWTM. In addition, a new data collection protocol was developed for acquiring data from the existing S/5 Datex-Ohmeda anaesthesia monitor in the operating theatre without disturbing the original setup. The raw physiological patient data acquired from the S/5 monitor were filtered, pre-processed and analysed for detecting anaesthesia related events like absolute hypovolemia (AHV) and fall in cardiac output (FCO) using SAAM. The accuracy of diagnoses generated by SAAM was validated by comparing its diagnostic information with the one provided by the anaesthetist for each patient. Kappa-analysis was used for measuring the level of agreement between the anaesthetist’s and RT-SAAM’s diagnoses. In retrospective (offline) analysis, RT-SAAM that was tested with data from 18 patients gave an overall agreement level of 81% (which implies substantial agreement between SAAM and anaesthetist). RT-SAAM was further tested in real-time with 6-patients giving an agreement level of 71% (which implies fair level of agreement). More real-time tests are required to complete the real-time validation and development of RT-SAAM. This diagnostic alarm system prototype (RT-SAAM) has shown that evidence based expert diagnostic systems can accurately diagnose AHV and FCO events in anaesthetized patients and can be useful in providing decision support to the anaesthetists.

Made available in DSpace on 2014-12-17T14:08:44Z (GMT). No. of bitstreams: 1 AndreLA_DISSERT.pdf: 1426214 bytes, checksum: 62fdf46525d28318b6138490219276ba (MD5) Previous issue date: 2010-12-21 / In the operational context of industrial processes, alarm, by definition, is a warning to the operator that an action with limited time to run is required, while the event is a change of state information, which does not require action by the operator, therefore should not be advertised, and only stored for analysis of maintenance, incidents and used for signaling / monitoring (EEMUA, 2007). However, alarms and events are often confused and improperly configured similarly by developers of automation systems. This practice results in a high amount of pseudo-alarms during the operation of industrial processes. The high number of alarms is a major obstacle to improving operational efficiency, making it difficult to identify problems and increasing the time to respond to abnormalities. The main consequences of this scenario are the increased risk to personal safety, facilities, environment deterioration and loss of production. The aim of this paper is to present a philosophy for setting up a system of supervision and control, developed with the aim of reducing the amount of pseudo-alarms and increase reliability of the information that the system provides. A real case study was conducted in the automation system of the offshore production of hydrocarbons from Petrobras in Rio Grande do Norte, in order to validate the application of this new methodology. The work followed the premises of the tool presented in ISA SP18.2. 2009, called "life cycle alarm . After the implementation of methodology there was a significant reduction in the number of alarms / No contexto de opera??o de processos industriais, alarme, por defini??o, ? um aviso ao T?cnico de Opera??o que uma a??o com tempo restrito para ser executada ? necess?ria, enquanto que evento ? uma informa??o de mudan?a de estado e n?o demanda a??o por parte do T?cnico de Opera??o, consequentemente n?o deve ser anunciada, sendo apenas armazenada para fins de an?lise de manuten??o, incidentes e utilizadas para sinaliza??o/monitora??o (EEMUA, 2007). Por?m, alarmes e eventos s?o frequentemente confundidos e configurados inadequadamente de forma semelhante por programadores de sistemas de automa??o. Esta pr?tica resulta em uma elevada quantidade de pseudo-alarmes durante a opera??o de processos industriais. O elevado n?mero de alarmes configurados ? um dos principais entraves para a melhoria da efici?ncia operacional, dificultando a identifica??o de problemas e aumentando o tempo de resposta ?s anormalidades. As principais conseq??ncias desse quadro s?o o aumento do risco ? seguran?a das pessoas, instala??es, meio ambiente e o agravamento das perdas de produ??o. O objetivo principal deste trabalho ? apresentar uma filosofia de configura??o de um sistema de supervis?o e controle, desenvolvida com o intuito de diminuir a quantidade de pseudo-alarmes configurados e aumentar a confiabilidade das informa??es que o sistema fornece. Um estudo de caso foi realizado no sistema de automa??o das plataformas mar?timas de produ??o de Hidrocarbonetos da Petrobras no Rio Grande do Norte, de forma a validar a aplica??o dessa nova metodologia. O trabalho seguiu as premissas da ferramenta apresentada na norma ISA SP18.2. 2009, denominado ciclo de vida de alarme . Ap?s a implanta??o da metodologia verificou-se uma redu??o significativa no n?mero de alarmes

Alarm calls are one of the essential components of antipredator behaviour in birds. In this study I recorded and analysed alarm responses of the barred warbler (Sylvia nisoria) to different mounts of avian predators and nonpredators. The information about danger is encoded through graded structure in its unspecific alarm call type.

Au CERN (Organisation européenne pour la recherche nucléaire), le contrôle et la supervision du plus grand accélérateur du monde, le LHC (Large Hadron Collider), sont basés sur des solutions industrielles (SCADA). Le LHC est composé de sous-systèmes disposant d’un grand nombre de capteurs et d’actionneurs qui rendent la surveillance de ces équipements un véritable défi pour les opérateurs. Même avec les solutions SCADA actuelles, l’occurrence d’un défaut déclenche de véritables avalanches d’alarmes, rendant le diagnostic de ces systèmes très difficile. Cette thèse propose une méthodologie d’aide au diagnostic à partir de données historiques du système. Les signatures des défauts déjà rencontrés et représentés par les listes d’alarmes qu’ils ont déclenchés sont comparées à la liste d’alarmes du défaut à diagnostiquer. Deux approches sont considérées. Dans la première, l’ordre d’apparition des alarmes n’est pas pris en compte et les listes d’alarmes sont représentées par un vecteur binaire. La comparaison se fait à l’aide d’une distance pondérée. Le poids de chaque alarme est évalué en fonction de son aptitude à caractériser chaque défaut. La seconde approche prend en compte l’ordre d’apparition des alarmes, les listes d’alarmes sont alors représentées sous forme de séquences symboliques. La comparaison entre ces deux séquences se fait à l’aide d’un algorithme dérivé de l’algorithme de Needleman et Wunsch utilisé dans le domaine de la Bio-Informatique. Les deux approches sont testées sur des données artificielles ainsi que sur des données extraites d’un simulateur très réaliste d’un des systèmes du LHC et montrent de bons résultats. / In the context of the CERN Large Hadron Collider (LHC), a large number of control systems have been built based on industrial control and SCADA solutions. Beyond the complexity of these systems, a large number of sensors and actuators are controlled which make the monitoring and diagnostic of these equipment a continuous and real challenge for human operators. Even with the existing SCADA monitoring tools, critical situations prompt alarms avalanches in the supervision that makes diagnostic more difficult. This thesis proposes a decision support methodology based on the use of historical data. Past faults signatures represented by alarm lists are compared with the alarm list of the fault to diagnose using pattern matching methods. Two approaches are considered. In the first one, the order of appearance is not taken into account, the alarm lists are then represented by a binary vector and compared to each other thanks to an original weighted distance. Every alarm is weighted according to its ability to represent correctly every past faults. The second approach takes into account the alarms order and uses a symbolic sequence to represent the faults. The comparison between the sequences is then made by an adapted version of the Needleman and Wunsch algorithm widely used in Bio-Informatic. The two methods are tested on artificial data and on simulated data extracted from a very realistic simulator of one of the CERN system. Both methods show good results.