No description available.

Yes / Cyber security has become a matter of a global interest, and several attacks target industrial companies and governmental organizations. The advanced persistent threats (APTs) have emerged as a new and complex version of multi-stage attacks (MSAs), targeting selected companies and organizations. Current APT detection systems focus on raising the detection alerts rather than predicting APTs. Forecasting the APT stages not only reveals the APT life cycle in its early stages but also helps to understand the attacker's strategies and aims. This paper proposes a novel intrusion detection system for APT detection and prediction. This system undergoes two main phases; the first one achieves the attack scenario reconstruction. This phase has a correlation framework to link the elementary alerts that belong to the same APT campaign. The correlation is based on matching the attributes of the elementary alerts that are generated over a configurable time window. The second phase of the proposed system is the attack decoding. This phase utilizes the hidden Markov model (HMM) to determine the most likely sequence of APT stages for a given sequence of correlated alerts. Moreover, a prediction algorithm is developed to predict the next step of the APT campaign after computing the probability of each APT stage to be the next step of the attacker. The proposed approach estimates the sequence of APT stages with a prediction accuracy of at least 91.80%. In addition, it predicts the next step of the APT campaign with an accuracy of 66.50%, 92.70%, and 100% based on two, three, and four correlated alerts, respectively. / The Gulf Science, Innovation and Knowledge Economy Programme of the U.K. Government under UK-Gulf Institutional Link Grant IL 279339985 and in part by the Engineering and Physical Sciences Research Council (EPSRC), U.K., under Grant EP/R006385/1.

Yes / As one of the most serious types of cyber attack, Advanced Persistent Threats (APT) have caused major concerns on a global scale. APT refers to a persistent, multi-stage attack with the intention to compromise the system and gain information from the targeted system, which has the potential to cause significant damage and substantial financial loss. The accurate detection and prediction of APT is an ongoing challenge. This work proposes a novel machine learning-based system entitled MLAPT, which can accurately and rapidly detect and predict APT attacks in a systematic way. The MLAPT runs through three main phases: (1) Threat detection, in which eight methods have been developed to detect different techniques used during the various APT steps. The implementation and validation of these methods with real traffic is a significant contribution to the current body of research; (2) Alert correlation, in which a correlation framework is designed to link the outputs of the detection methods, aims to identify alerts that could be related and belong to a single APT scenario; and (3) Attack prediction, in which a machine learning-based prediction module is proposed based on the correlation framework output, to be used by the network security team to determine the probability of the early alerts to develop a complete APT attack. MLAPT is experimentally evaluated and the presented system is able to predict APT in its early steps with a prediction accuracy of 84.8%.

Yes / Over the past decade, the digitization of services transformed the healthcare sector leading to a sharp rise in cybersecurity threats. Poor cybersecurity in the healthcare sector, coupled with high value of patient records attracted the attention of hackers. Sophisticated advanced persistent threats and malware have significantly contributed to increasing risks to the health sector. Many recent attacks are attributed to the spread of malicious software, e.g., ransomware or bot malware. Machines infected with bot malware can be used as tools for remote attack or even cryptomining. This paper presents a novel approach, called BotDet, for botnet Command and Control (C&C) traffic detection to defend against malware attacks in critical ultrastructure systems. There are two stages in the development of the proposed system: 1) we have developed four detection modules to detect different possible techniques used in botnet C&C communications and 2) we have designed a correlation framework to reduce the rate of false alarms raised by individual detection modules. Evaluation results show that BotDet balances the true positive rate and the false positive rate with 82.3% and 13.6%, respectively. Furthermore, it proves BotDet capability of real time detection.

In der vorliegenden Arbeit wurden neue Untersuchungsmöglichkeiten mit dem BacT/Alert 3D Mykobakterien-Testsystem erprobt. Erstens wurden Untersuchungen durchgeführt, um die Testkonzentrationen für Protionamid (PTH) und Linezolid (LIZ) für die standardmäßige Empfindlichkeitstestung von M. tuberculosis (Mtb) mit dem BacT/Alert 3D-System festzulegen. Dazu wurden die MHK-Werte für 32 Mtb-Stämme bestimmt: Referenzstamm Mtb H37Rv, sensible Patientenstämme, Patientenstämme mit verschiedenen Resistenzen (u. a. PTH-Resistenz) sowie eigens für die Arbeit isolierte LIZ-resistente Mutanten. Die PTH-MHK betrug für 20 von 21 sensiblen Mtb-Stämmen einschließlich des Referenzstammes Mtb H37Rv 0,125 - 1 mg/l (0,25 mg/l bei 11 von 21 Stämmen). Lediglich ein Stamm mit Resistenz gegenüber Isoniazid, Ethambutol und Streptomycin fiel mit einer etwas erhöhten PTH-MHK von 2 mg/l auf. Sechs PTH-resistente Stämme (z. T. mit anderen Resistenzen gegenüber Erstrang-Antituberkulotika) zeigten PTH-MHK von 4 - 16 mg/l. Die Gruppen der PTH-sensiblen und resistenten Stämme zeigten ein bimodales Verteilungsmuster, das mit einem Schwellenwert von 2 mg PTH/l gut zu differenzieren ist. Für die standardmäßige Durchführung der Empfindlichkeitstestung gegenüber PTH mit dem BacT/Alert 3D-System empfehlen wir deshalb eine PTH-Testkonzentration von 2 mg/l. Die LIZ-MHK betrug für 20 sensible Mtb-Stämme (inklusive Referenzstamm Mtb H37Rv) und sieben Stämme mit verschiedenen Resistenzen gegenüber Erstrang-Antituberkulotika 0,25 - 2 mg/l (0,5 mg/l bei 17 von 27 Stämmen). Für die vier isolierten LIZ-resistenten Mutanten betrug die LIZ-MHK 8 - 16 mg/l. Es zeigt sich auch bei der Verteilung der LIZ-MHK ein bimodales Verteilungsmuster; die Gruppen der sensiblen und resistenten Stämme sind gut zu differenzieren. Wir empfehlen für die standardmäßige Durchführung der Empfindlichkeitstestung gegenüber LIZ mit dem BacT/Alert 3D-System eine LIZ-Testkonzentration von 4 mg/l. Die festgestellten MHK-Werte von PTH und LIZ und die vorgeschlagenen Testkonzentrationen entsprechen Ergebnissen aus der Literatur, die mit ähnlichen Methoden erhoben wurden. Zweitens wurden mit dem BacT/Alert 3D-System Untersuchungen zur Kombinationstestung von Antituberkulotika bei Mtb und Stämmen des MAC-Komplexes durchgeführt, bisher liegen keine Publikationen für Untersuchungen von Wirkstoff-Kombinationen bei Mykobakterien mit diesem System vor. Es wurde geprüft, ob die MHK eines Antituberkulotikums durch die Zugabe einer subinhibitorischen Menge eines anderen Antituberkulotikums verändert wird. Bei Mtb wurden dazu folgende Kombinationen geprüft: Rifampicin (RMP) + LIZ, Moxifloxacin + LIZ, Isoniazid + PTH, RMP + PTH, PTH + LIZ. In keinem Fall konnten signifikante Effekte beobachtet werden. Ein tendenziell synergistischer Effekt der PTH-RMP-Kombination beim Stamm Mtb H37Rv (Reduktion der RMP-MHK um eine Stufe) wurde durch die Analyse der Wachstumskinetik des Stammes unterstützt. Bei zufällig ausgewählten Stämmen des MAC-Komplexes wurde die Kombination Ciprofloxacin (CIP) + Ethambutol (EMB) geprüft. Es zeigte sich bei sieben von zehn Stämmen eine Reduzierung der CIP-MHK um mindestens drei Stufen bei Zugabe einer subinhibitorischen Konzentration von EMB. Dieser synergistische Effekt wurde bereits in den 1990er Jahren mit einer ähnlichen Methode festgestellt, allerdings ohne die Stämme des MAC-Komplexes zu differenzieren (Arbeitsgruppe von S. Hoffner). Interessanterweise handelte es sich bei den von uns untersuchten Stämmen, bei denen dieser synergistische Effekt nachgewiesen wurde, um M. avium-Stämme. Diese Problematik sollte weiter verfolgt werden, da sich daraus Konsequenzen für die Therapieempfehlung ergeben könnten.

En cas d’alerte aux inondations, l'information en temps réel et sa diffusion à un large public sont des éléments cruciaux pour limiter les comportements à risque, détecter les premiers dégâts ou préparer les acteurs locaux à gérer la crise. Face à ces enjeux, les technologies smartphones apparaissent, deplus en plus, comme des solutions logicielles et matérielles qui pourraient compléter de façon positiveles dispositifs d’alerte institutionnels, notamment grâce à la dynamique des contenus partagés et auxnombreuses interactions dont ils sont le support. Alors que plusieurs pays (États-Unis, Norvège, Pays-Bas, Suède, Philippines) utilisent déjà de tels outils, et même si le Ministère de l'Intérieur a lancé uneapplication urgentiste (SAIP) le 8 juin 2016, la population et les services de l’État semblent beaucoupplus réticents en France. La défense de la propriété individuelle, le manque de crédit attribué auxmessages postés et les verrous technologiques sont les principaux facteurs de blocage avancés. Aprèsavoir mené une enquête dans plusieurs communes rurales des départements du Var et du Vaucluse(qui confirme la méconnaissance des applications déjà existantes alors que les besoins sont bien réelsface aux crues rapides), une nouvelle application a été développée (Al’in). Le prototype créé vise àréduire les écarts entre une approche étatique descendante (top-down), qui positionne et impose l’Étatcomme le seul lanceur d’alerte, et une initiative citoyenne (approche « Bottom-Up »), qui érigel’individu au rang de « citoyen capteur », à la fois capable de remonter ou de diffuser une alerte àtravers l’usage de son smartphone. Répondre à ce défi ne s’avère toutefois pas si simple au regard descontraintes juridiques et techniques préexistantes en France. / The information given on flash floods in real time should undoubtedly answers to the citizens needs aswell as to the politic and the safety services. Face to such objective, Smartphone could positivelycomplete the official institutional systems, especially thanks to the dynamic and nature of postedmessages, and to the social interactions they support. This study questions the opportunity ofdeveloping a proactive and innovative alert system using the Smartphone technologies to face therisks due to flash flood hazards. A first study focuses on several alert systems existing actually inFrance but we quickly aim at identifying limits (legal rules, technologies and scientific problems) andchallenges usefulness and opportunities in the numeric sphere) of our objective in general manner.Finally, a local study in Var and Vaucluse permits us to see if population and local stakeholdersshould be interested (or not) by a smartphone application. The proposed solution tries to achieve amajor challenge: reducing the gap between a state approach (top-down), which positions and imposedthe state as the main official alert source, and the citizen action (bottom-up) which establishes theindividual as “Citizen sensor” (both in go up or disseminate information) through the use of issmartphone. Meeting this challenge is indispensable if we hope effectively minimizing material andhuman damages especially when high temporal acuity phenomena such as flash floods happen.

No description available.

Non-Player Character (NPC) behaviors in todays computer games are mostly generated from manually written scripts. The high cost of manually creating complex behaviors for each NPC to exhibit intelligence in response to every situation in the game results in NPCs with repetitive and artificial looking behaviors. The goal of this research is to enable NPCs in computer games to exhibit natural and human-like behaviors in non-combat situations. The quality of these behaviors affects the game experience especially in story-based games, which rely heavily on player-NPC interactions. Reinforcement Learning has been used in this research for BioWare Corp.s Neverwinter Nights to learn natural-looking behaviors for companion NPCs. The proposed method enables NPCs to rapidly learn reasonable behaviors and adapt to the changes in the game environment. This research also provides a learning architecture to divide the NPC behavior into sub-behaviors and sub-tasks called decision domains.

Η αποφυγή συγκρούσεων με αναγνώριση της θέσης και της σχετικής ταχύτητας προπορευόμενων οχημάτων είναι μια άκρως ενδιαφέρουσα εφαρμογή που βρίσκεται σε πειραματικό στάδιο. Η ύπαρξη πολλαπλών αντικειμένων στο οπτικό πεδίο της κάμερας δημιουργεί προβλήματα στον ακριβή εντοπισμό του προπορευόμενου οχήματος, ενώ η έλλειψη βάσεων δεδομένων με κατηγοριοποιημένα παραδείγματα είναι ένα επιπλέον εμπόδιο για την ανάπτυξη της εφαρμογής αυτής. Στην εργασία αυτή περιγράφονται οι υπάρχουσες εφαρμογές όσον αφορά στο πρόβλημα της μηχανικής όρασης στην αυτοκίνηση, τα προβλήματα που λύνουν αλλά και οι δυσκολίες που συνεχίζουν να υπάρχουν. Αναφέρονται οι αιτίες της έλλειψης βάσεων δεδομένων με κατηγοριοποιημένα παραδείγματα και αναλύεται η ημιαυτόματη μέθοδος (Random Walker) στην οποία καταφεύγουμε για τον λόγο αυτό. Εν συνεχεία θα παρουσιαστούν τα αποτελέσματα της ανάπτυξης σε Matlab που πραγματοποιήθηκε, τα συμπεράσματα που προέκυψαν, αλλά και οι μελλοντικές προκλήσεις. / In this diplom work, the ways followed to deal with the issue of mechanical vision in car driving are described. The reasons why there there are not any specific data sets are decribed and the focus of this work is on the Random Walker algorithm.

Made available in DSpace on 2016-08-03T12:30:05Z (GMT). No. of bitstreams: 1 FernandoMoreira2.pdf: 2322081 bytes, checksum: 8edb32a01dcfa850bd9598f07804470b (MD5) Previous issue date: 2015-03-16 / Early Emergency Warning are important elements in disaster risk reduction, avoiding the loss of life and reducing its economic impact and material. Among the most effective means of communication for the generation of early warnings, the digital television issue with capacity from one to many and with their ability to generate reactive information with data sent by the same TV signal is at the moment, the state of Art to help the population at risk, proven through comparative studies between existing emergency alert systems today around the world. This work compares the Japanese and US systems, and the theoretical framework presented focus on the communication process of an emergency information from several theories that underlie the process of communication in crisis situations, with which was reached to the conclusion that the Brazilian Digital TV technology, along with the essential infrastructure for risk detection and reliability for the generation of existing early warning, has all the necessary tools for the creation of a national system. Finally presents the initial indications for creating a model for efficient and effective communication of emergency information for the Brazilian population. / Alertas Antecipados de Emergência são elementos importantes na redução de riscos de desastres, evitando a perda de vidas e reduzindo seu impacto econômico e material. Dentre os meios de comunicação mais eficazes para geração de alertas antecipados, a televisão digital com sua capacidade de emissão de um para muitos e ainda com suas possibilidades de gerar informações reativas com dados enviados pelo mesmo sinal de TV é, no momento, o estado da arte para ajudar a população em situações de risco, comprovado através de estudos comparativos entre os sistemas de alerta de emergência existentes hoje em todo o mundo. Neste trabalho são comparados os sistemas japonês e norte-americano, sendo que os referenciais teóricos apresentados focalizam o processo comunicacional de uma informação de emergência, a partir de diversas teorias que fundamentam o processo de comunicação em situações de crise, com os quais chegou-se à conclusão de que a tecnologia de televisão Digital Brasileira, juntamente com a infraestrutura essencial para detecção de riscos e confiabilidade para a geração de alertas antecipados já existente, dispõe de todo o ferramental necessário para a criação de um sistema nacional. Por fim são apresentadas as indicações iniciais para a criação de um modelo para uma comunicação eficaz e efetiva de informações de emergência destinado à população brasileira.