No / In recent years, the Internet has enabled access to widespread remote services in the distributed computing environment; however, integrity of data transmission in the distributed computing platform is hindered by a number of security issues. For instance, the botnet phenomenon is a prominent threat to Internet security, including the threat of malicious codes. The botnet phenomenon supports a wide range of criminal activities, including distributed denial of service (DDoS) attacks, click fraud, phishing, malware distribution, spam emails, and building machines for illegitimate exchange of information/materials. Therefore, it is imperative to design and develop a robust mechanism for improving the botnet detection, analysis, and removal process. Currently, botnet detection techniques have been reviewed in different ways; however, such studies are limited in scope and lack discussions on the latest botnet detection techniques. This paper presents a comprehensive review of the latest state-of-the-art techniques for botnet detection and figures out the trends of previous and current research. It provides a thematic taxonomy for the classification of botnet detection techniques and highlights the implications and critical aspects by qualitatively analyzing such techniques. Related to our comprehensive review, we highlight future directions for improving the schemes that broadly span the entire botnet detection research field and identify the persistent and prominent research challenges that remain open. / University of Malaya, Malaysia (No. FP034-2012A)

International Telemetering Conference Proceedings / October 27-30, 1997 / Riviera Hotel and Convention Center, Las Vegas, Nevada / Stanford’s Space Systems Development Laboratory is developing methods for automated spacecraft health operations. Such operations greatly reduce the need for ground-space communication links and full-time operators. However, new questions emerge about how to supply operators with the spacecraft information that is no longer available. One solution is to introduce a low-bandwidth health beacon and to develop new approaches in on-board summarization of health data for telemetering. This paper reviews the development of beacon operations and data summary, describes the implementation of beacon-based health management on board SAPPHIRE, and explains the mission operations response to health emergencies. Additional information is provided on the role of SSDL’s academic partners in developing a worldwide network of beacon receiving stations.

International Telemetering Conference Proceedings / October 28-31, 1996 / Town and Country Hotel and Convention Center, San Diego, California / This paper discusses the design and development of the EUVE Virtual Environment (EVE) system. The EVE system is being developed as an interactive virtual reality (VR) viewing tool for NASA's Extreme Ultraviolet Explorer (EUVE) satellite. EVE will serve as a predictive tool for forecasting spacecraft constraint violations and will provide a capability for spacecraft problem analysis and resolution in realtime through visualization of the problem components in the spacecraft. EVE will animate, in three-dimensional realtime, the spacecraft dynamics and thermal characteristics of the EUVE spacecraft. EVE will also display the field of view for the science instrument detectors, star trackers, sun sensors, and both the omni and high-gain antennas for NASA's Tracking and Data Relay Satellite System (TDRSS) and for possible ground station contact. EVE will display other vital spacecraft information to support the routine operations of the EUVE spacecraft. The EVE system will provide three quick-look visualization functions: (1) to model in-orbit data for realtime spacecraft problem analysis and resolution, (2) to playback data for post-pass data analysis, and training exercises, and (3) to simulate data in the science planning process for optimum attitude determination and to predict spacecraft and thermal constraint violations. We present our preliminary design for a telemetry server, providing both realtime and post pass data, that uses standard Unix utilities. We also present possibilities for future integration of the EVE system with other software to automate the science planning and command generation functions of the satellite operations.

Darbe pristatoma žinojimo augimo problema mokslo filosofijoje, pasirinkus Lakatoso ir Kuhno diskusiją šiuo klausimu. Lakatosas yra vienas iš žymiausių falsifikacionistų, labai prisidėjęs prie Popperio teorijų falsifikavimo metodologijos tobulinimo. Žinojimo augimas yra pagrindinė falsifikacionizmo koncepcija. Falsifikacija Kuhnui yra nepriimtina. Įvykus mokslo revoliucijai, senas žinojimas atmetamas. Nauja paradigma kaupia naują žinojimą. / The discussion between Lakatos and Kuhn is chosen to represent the growth of knowledge in philosophy of science. Lakatos is one of the best-known falsificationists, he improved Popper's methodology of falsification. The growth of knowledge is a key concept in falsificationism. Kuhn did not reject the growth of knowledge, but he had different approach to it. During scientific revolution old knowledge is abolished. There is no continuity from the old paradigm to the new one.

Although the primary purpose of the signal received by amobile handset or smartphone is to enable wireless communication, the information extracted can be reused to provide a number of additional services. Two such services discussed in this thesis are: mobile speed estimation and signal anomaly detection. The proposed algorithms exploit the propagation environment specific information that is already imprinted on the received signal and therefore do not incur any additional signalling overhead. Speed estimation is useful for providing navigation and location based services in areas where global navigation satellite systems (GNSS) based devices are unusable while the proposed anomaly detection algorithms can be used to locate signal faults and aid spectrum sensing in cognitive radio systems. The speed estimation algorithms described within this thesis require a receiver with at least two antenna elements and a wideband radio frequency (RF) signal source. The channel transfer function observed at the antenna elements are compared to yield an estimate of the device speed. The basic algorithm is a one-dimensional and unidirectional two-antenna solution. The speed of the mobile receiver is estimated from a knowledge of the fixed inter-antenna distance and the time it takes for the trailing antenna to sense similar channel conditions previously observed at the leading antenna. A by-product of the algorithm is an environment specific spatial correlation function which may be combined with theoretical models of spatial correlation to extend and improve the accuracy of the algorithm. Results obtained via computer simulations are provided. The anomaly detection algorithms proposed in this thesis highlight unusual signal features while ignoring events that are nominal. When the test signal possesses a periodic frame structure, Kullback-Leibler divergence (KLD) analysis is employed to statistically compare successive signal frames. A method of automatically extracting the required frame period information from the signal is also provided. When the signal under test lacks a periodic frame structure, information content analysis of signal events can be used instead. Clean training data is required by this algorithm to initialise the reference event probabilities. In addition to the results obtained from extensive computer simulations, an architecture for field-programmable gate array (FPGA) based hardware implementations of the KLD based algorithm is provided. Results showing the performance of the algorithms against real test signals captured over the air are also presented. Both sets of algorithms are simple, effective and have low computational complexity – implying that real-time implementations on platforms with limited processing power and energy are feasible. This is an important quality since location based services are expected to be an integral part of next generation cognitive radio handsets.

There are two main approaches for intrusion detection: signature-based and anomaly-based. Signature-based detection employs pattern matching to match attack signatures with observed data making it ideal for detecting known attacks. However, it cannot detect unknown attacks for which there is no signature available. Anomaly-based detection builds a profile of normal system behavior to detect known and unknown attacks as behavioral deviations. However, it has a drawback of a high false alarm rate. In this thesis, we describe our anomaly-based IDS designed for detecting intrusions in cryptographic and application-level protocols. Our system has several unique characteristics, such as the ability to monitor cryptographic protocols and application-level protocols embedded in encrypted sessions, a very lightweight monitoring process, and the ability to react to protocol misuse by modifying protocol response directly.

The twenty approved members of the eudialyte group are complex zirconosilicates, primarily with general formula N15M(1)6M(2)3M(3)M(4)Z3[Si24O72]O4X2. An algorithm was created to address the inherent recalculation difficulties in the absence of single-crystal X-ray data and was an overall improvement over previous schemes. Eudialyte group minerals were analyzed from the East Hill Suite of the Mont Saint-Hilaire alkaline complex. Recalculations revealed previously undocumented eudialyte-group compositions and degrees of chemical zonation. These data suggest that late-stage melt heterogeneity in alkaline systems is far more pronounced than previously thought. All analyses exhibited a negative neodymium anomaly in chondrite-normalized data. This supports data from other investigators that point to a preintrusion fractionation event in the underlying mantle. Potassium content of the eudialyte group minerals from the East Hill Suite was restricted to a narrow range, as was that of analyses from numerous other localities, suggesting some internal control on potassium content in eudialyte group minerals.

Digital forensics is the practice of trained investigators gathering and analyzing evidence from digital devices such as computers and smart phones. On these digital devices, it is possible to change the time on the device for a purpose other than what is intended. Currently there are no documented techniques to determine when this occurs. This research seeks to prove out a technique for determining when the time has been changed on forensic disk image by analyzing the log files found on the image. Out of this research a tool is created to perform this analysis in automated fashion. This tool is TADpole, a command line program that analyzes the log files on a disk image and determines if a timeline anomaly has occurred.

<p>Considerable attention has been given to the vulnerability of machine learning to adversarial samples. This is particularly critical in anomaly detection; uses such as detecting fraud, intrusion, and malware must assume a malicious adversary. We specifically address poisoning attacks, where the adversary injects carefully crafted benign samples into the data, leading to concept drift that causes the anomaly detection to misclassify the actual attack as benign. Our goal is to estimate the vulnerability of an anomaly detection method to an unknown attack, in particular the expected</p> <p>minimum number of poison samples the adversary would need to succeed. Such an estimate is a necessary step in risk analysis: do we expect the anomaly detection to be sufficiently robust to be useful in the face of attacks? We analyze DBSCAN, LOF,</p> <p>one-class SVM as an anomaly detection method, and derive estimates for robustness to poisoning attacks. The analytical estimates are validated against the number of poison samples needed for the actual anomalies in standard anomaly detection test</p> <p>datasets. We then develop defense mechanism, based on the concept drift caused by the poisonous points, to identify that an attack is underway. We show that while it is possible to detect the attacks, it leads to a degradation in the performance of the</p> <p>anomaly detection method. Finally, we investigate whether the generated adversarial samples for one anomaly detection method transfer to another anomaly detection method.</p>

Este trabalho tem por objetivo descrever a Anomalia Magnética do Atlântico Sul (SAMA) utilizando os modelos para o período histórico (1600–1890) e também os modelos para o último século (DGRF e IGRF). Como a SAMA apresenta características de baixa intensidade do campo total e coincide com a região de intenso fluxo de partículas cósmicas, muitos problemas com objetos que orbitam a Terra (por exemplo, satélites) são detectados nessa região. São descritos os efeitos provocados pela SAMA em fenômenos espaciais. Através da análise dos modelos na forma de mapas, foram extraídos os dados de mínima intensidade para o centro da SAMA e a posição destes pontos, possibilitando conhecer a trajetória e as taxas de deriva. Os modelos foram testados na interface manto-núcleo através da componente vertical, para encontrar correlação com anomalias em superfície. Os resultados mostraram deriva para Oeste constante e variações em latitude. Foi observado que as intensidades acompanham a diminuição de todo o campo, embora a SAMA apresente caráter predominantemente não-dipolar, evidenciada pela razão entre o campo não-dipolar e o campo total no Atlântico Sul. A comparação de intensidades da SAMA com as medidas de intensidade realizadas pelos observatórios mostrou que a influência da SAMA aparece na forma de sobreposição ou amplificação de fenômenos com menor comprimento de onda, como os impulsos de variação secular (jerks geomagnéticos). A continuação para baixo dos modelos se mostrou satisfatória quando comparada com o método de inversão estocástica. A comparação da SAMA com outras anomalias em superfície mostrou independência na trajetória, porém, quando comparadas com os lóbulos principais na interface manto-núcleo, indicam que estas anomalias possam estar interligadas. Os lóbulos do núcleo foram interpretados com base nos mecanismos de geração, sugerindo que a SAMA possa ser originada através de movimentos combinados entre duas colunas de convecção e regiões de fluxo reverso no núcleo externo. / The object of this dissertation is to describe the South Atlantic Magnetic Anomaly (SAMA) using geomagnetic models for the historical period from 1600 to 1890 and also the IGRF and DGRF models for the past century. Since the SAMA presents low intensities of the total geomagnetic field that correspond to a region of intense cosmic ray particle flux, many problems with objects that orbit along this region (eg. Satelites) have been detected. The SAMA effects on space vehicles are described. The field models led to the definition of the SAMA center as the locus of minimum total field intensity and how the anomaly drifted and varied in intensity for the past four centuries. The vertical component at the Core Mantle Boundary (CMB) was used to find correlations with anomalies at the surface the Earth surface. Results have shown a rather constant westward drift and also latitude variations. It was observed that intensities follow the general decrease of the total field although the SAMA displays a predominantly non-dipolar character that is evident in the non-dipolar/total field ratios for the South Atlantic. The comparison of geomagnetic measurements by nearby Southamerican Observatories show that the SAMA influence appears as a superposition or amplification of lower wavelength phenomena such as the secular variation impulses (jerks). A downward continuation of the models was found satisfactory when compared to the stochastic inversion method. The comparison of the SAMA with other surface anomalies showed a rather independent behavior however, a comparison with the main radial component lobes at the CMB showed that all these anomalies may be interconnected. The nucleus lobes have been interpreted under the light of field generation processes, suggesting that the SAMA may originate from the combined motion of two convection columns and reverse flux regions in the outer core.