Cyber-Physical Systems (CPS) are complex systems where physical operations are supported and coordinated by Information and Communication Technology (ICT). From the point of view of security, ICT technology offers new opportunities to increase vigilance and real-time responsiveness to physical security faults. On the other hand, the cyber domain carries all the security vulnerabilities typical to information systems, making security a new big challenge in critical systems. This thesis addresses anomaly detection as security measure in CPS. Anomaly detection consists of modelling the good behaviour of a system using machine learning and data mining algorithms, detecting anomalies when deviations from the normality model occur at runtime. Its main feature is the ability to discover the kinds of attack not seen before, making it suitable as a second line of defence. The first contribution of this thesis addresses the application of anomaly detection as early warning system in water management systems. We describe the evaluation of an anomaly detection software when integrated in a Supervisory Control and Data Acquisition (SCADA) system where water quality sensors provide data for real-time analysis and detection of contaminants. Then, we focus our attention to smart metering infrastructures. We study a smart metering device that uses a trusted platform for storage and communication of electricity metering data, and show that despite the hard core security, there is still room for deployment of a second level of defence as an embedded real-time anomaly detector that can cover both the cyber and physical domains. In both scenarios, we show that anomaly detection algorithms can efficiently discover attacks in the form of contamination events in the first case and cyber attacks for electricity theft in the second. The second contribution focuses on online adaptation of the parameters of anomaly detection applied to a Mobile Ad hoc Network (MANET) for disaster response. Since survivability of the communication to network attacks is as crucial as the lifetime of the network itself, we devised a component that is in charge of adjusting the parameters based on the current energy level, using the trade-off between the node's response to attacks and the energy consumption induced by the intrusion detection system. Adaption increases the network lifetime without significantly deteriorating the detection performance.

Probabilistic graphical models are today one of the most well used architectures for modelling and reasoning about knowledge with uncertainty. The most widely used subclass of these models is Bayesian networks that has found a wide range of applications both in industry and research. Bayesian networks do however have a major limitation which is that only asymmetric relationships, namely cause and eect relationships, can be modelled between its variables. A class of probabilistic graphical models that has tried to solve this shortcoming is chain graphs. It is achieved by including two types of edges in the models, representing both symmetric and asymmetric relationships between the connected variables. This allows for a wider range of independence models to be modelled. Depending on how the second edge is interpreted this has also given rise to dierent chain graph interpretations. Although chain graphs were first presented in the late eighties the field has been relatively dormant and most research has been focused on Bayesian networks. This was until recently when chain graphs got renewed interest. The research on chain graphs has thereafter extended many of the ideas from Bayesian networks and in this thesis we study what this new surge of research has been focused on and what results have been achieved. Moreover we do also discuss what areas that we think are most important to focus on in further research.

No description available.

Physiological markers have long been used to monitor physiological state in individual athletes. More recently, heart rate variability (HRV) has become a popular metric to monitor athletes' physiological state over longer periods of time to guide training and detect fatigue. HRV measured immediately prior to shooting has been shown to be a predictor of shooting performance. However, there is a lack of research on how physiological state as measured by HRV in resting states impacts sports shooting performance over longer periods of time. This thesis explored if there was a relationship between HRV and rifle shooting performance through a six-week-long experiment. Ten participants wore wrist sensors that measured HRV during slow wave sleep and performed simulator rifle shooting tasks twice a week to measure shooting performance. The relationship between HRV and shooting performance was analyzed through Pearson’s correlation coefficient, linear regression, and k-means clustering. The results indicated that there was no relationship between HRV and shooting performance in the participants collectively, except for two participants. The thesis contributed to the current knowledge about physiological state and HRV in relation to sports shooting performance. It also gave new insight into how experiments can be designed to study variability of physiological state in relation to shooting performance over longer periods of time.

The current population age grows increasingly in industrialized societies and calls for more intelligent tools to monitor human activities.  The aims of these intelligent tools are often to support senior people in their homes, to keep track of their daily activities, and to early detect potential health problems to facilitate a long and independent life.  The recent advancements of smart environments using miniaturized sensors and wireless communications have facilitated unobtrusively human activity recognition.   Human activity recognition has been an active field of research due to its broad applications in different areas such as healthcare and smart home monitoring. This thesis project develops work on machine learning systems to improve the understanding of human activity patterns in smart home environments. One of the contributions of this research is to process and share information across multiple smart homes to reduce the learning time, reduce the need and effort to recollect the training data, as well as increase the accuracy for applications such as activity recognition. To achieve that, several contributions are presented to pave the way to transfer knowledge among smart homes that includes the following studies. Firstly, a method to align manifolds is proposed to facilitate transfer learning. Secondly, we propose a method to further improve the performance of activity recognition over the existing methods. Moreover, we explore imbalanced class problems in human activity recognition and propose a method to handle imbalanced human activities. The summary of these studies are provided below.  In our work, it is hypothesized that aligning learned low-dimensional  manifolds from disparate datasets could be used to transfer knowledge between different but related datasets. The t-distributed Stochastic Neighbor Embedding(t-SNE) is used to project the high-dimensional input dataset into low-dimensional manifolds. However, since t-SNE is a stochastic algorithm and  there is a large variance of t-SNE maps, a thorough analysis of the stability is required before applying  Transfer learning.  In response to this, an extension to Local Procrustes Analysis called Normalized Local Procrustes Analysis (NLPA) is proposed to non-linearly align manifolds by using locally linear mappings to test the stability of t-SNE low-dimensional manifolds. Experiments show that the disparity from using NLPA to align low-dimensional manifolds decreases by order of magnitude compared to the disparity obtained by Procrustes Analysis (PA). NLPA outperforms PA and provides much better alignments for the low-dimensional manifolds. This indicates that t-SNE low-dimensional manifolds are locally stable, which is the part of the contribution in this thesis. Human activity recognition in smart homes shows satisfying recognition results using existing methods. Often these methods process sensor readings that precede the evaluation time (where the decision is made) to evaluate and deliver real-time human activity recognition. However, there are several critical situations, such as diagnosing people with dementia where "preceding sensor activations" are not always sufficient to accurately recognize the resident's daily activities in each evaluated time. To improve performance, we propose a method that delays the recognition process to include some sensor activations that occur after the point in time where the decision needs to be made. For this, the proposed method uses multiple incremental fuzzy temporal windows to extract features from both preceding and some oncoming sensor activations. The proposed method is evaluated with two temporal deep learning models: one-dimensional convolutional neural network (1D CNN) and long short-term memory (LSTM) on a binary sensor dataset of real daily living activities.  The experimental evaluation shows that the proposed method achieves significantly better results than the previous state-of-the-art.  Further, one of the main problems of activity recognition in a smart home setting is that the frequency and duration of human activities are intrinsically imbalanced. The huge difference in the number of observations for the categories means that many machine learning algorithms focus on the classification of the majority examples due to their increased prior probability while ignoring or misclassifying minority examples. This thesis explores well-known class imbalance approaches (synthetic minority over-sampling technique, cost-sensitive learning and ensemble learning) applied to activity recognition data with two temporal data pre-processing for the deep learning models LSTM and 1D CNN. This thesis proposes a data level perspective combined with a temporal window technique to handle imbalanced human activities from smart homes in order to make the learning algorithms more sensitive to the minority class. The experimental results indicate that handling imbalanced human activities from the data-level outperforms algorithm level and improved the classification performance.

This thesis aims to predict energy (fossil fuel and electric) consumption of internal combustion and hybrid vehicles. This thesis is in association with Wireless cars. Accurate prediction of energy consumption in vehicles is vital, as it can pave the way for a more sustainable future. Despite its criticality, accurate predictions of energy consumption are a challenging task. Several factors which impact energy consumption, i.e., average speed, trip duration, etc. , are not available at the beginning of the trip. To use such kinds of features to the full extent, we will be using multitask learning methods. The dataset provided by the company covers different aspects, including GPS information, energy consumption, time, and vehicle configurations which suggests multitask learning as an intriguing technique to approach it. Multitask learning uses a shared feature space wherein information is shared between multiple relevant tasks, helping to predict energy consumption accurately.  Multitask learning (MTL) is susceptible to two crucial issues, namely task dominance and conflicting gradients between different tasks. Previous studies have addressed these issues separately , but we propose a unified framework to tackle these problems simultaneously in this thesis. In the proposed framework we are addressing the issue of task dominance model using Gradient Normalization (GradNorm)  while the issue of conflicting gradients is solved using the Projecting conflicting gradient (PCGrad) technique. Experimental results have shown the success of this method in comparison with other state-of-the-art methods. Apart from creating unified architecture, we are also analyzing the behavioral pattern of the MTL model. This experiment was performed to check which tasks provide the maximum contribution to help improve the overall performance. Apart from the two contributions, we have also performed an additional experiment of task dominance analysis where we have given an equal budget to the main task and also to the auxiliary tasks. The motivation to perform this experiment is to create a main task dominant MTL model, which can take advantage of multitask learning, and improve the performance of the main task simultaneously.  All the novelties presented in this thesis indicate the potential of multitask learning techniques and their future applicability in the vehicular domain.

This report is the result of a thesis project performed in cooperation with a local company inSkellefteå named Sherpas. They help other companies and organizations with businessand system-development and project management, etc.As an IT-company today it is important to have an overview of the company's network toavoid outside intrusion or unnecessary bandwidth-thieves from within. With a good programfor network monitoring these two problems, and much more, can be fixed. In this report threevarious programs are tested and evaluated. One program is free of charge, one costs andthe last program is open source. All three of these programs are based on NetFlow as acollector of network traffic.The test is performed on a server which is reached via remote desktop. On the server threehyper-V machines are installed for performing the tests on. Much of the work is also basedon reading into and understanding the programs and what their strengths are.The programs that will be tested are Solarwinds real-time netflow analyzer FREE-tool,solarwinds NetFlow traffic analyzer which costs after 30-days evaluation and the opensource program ntopng with nProbe.The results show that all three programs work well for the purpose. The free program is, asexpected, very simple in both installation and ease of use. There is a lack of functions thatthe other programs have and the 1 hour time-limit on captures is a big minus, but it is still agood program. The other two programs were somewhat more complex in both installationand ease to use with ntopng being a little bit easier to understand if you just compare thosetwo.Some unexpected problems with the open source program ntopng occured. The mainprogram ntopng is open source as expected, but not nProbe which is a big part of the testsince it is the NetFlow collector. But I could still evaluate the program's interface, ease to useand installation process.The time limit that I had to make this work played a major role in the outcome, but is still abeginning to see what is important in a program for the specific purpose.

Denna rapport presenterar ett projekt som syftar till att skapa en applikation med tillhörande hårdvara för att styra en vakuumpump i ett analyslaboratorie som ligger i anslutning till Bolidenägda Aitikgruvan i Gällivare. Vakuumpumpen används för att generera sugkraft till dragskåp, slangar och robotutrustning där giftiga ångor sugs bort när analyseringen av gråberg inträffar. Innan implementeringen av applikationen var pumphaverier ett faktum på grund av för lång tomgångskörning och Boliden beslutade därför att starta pump efter behov istället. Först skrevs en funktionsbeskrivning som vidare applicerades programmeringsmässigt i styrsystemet 800xA tillsammans med nödvändig hårdvara som exempelvis PAC, FRO och I/O-enheter. När applikationen innehöll samtliga funktioner testades den med en simulationscontroller som även kopplade samman applikation och konstruerad processbild. Efter felfri testkörning implementerades den essentiella hårdvaran för att genomföra ett slutgiltigt test på site med alla komponenter inkopplade. Detta test var framgångsrikt och en applikation enligt funktionsbeskrivning hade således konstruerats. Slutsatsen av arbetet är att det går att bygga en applikation för att styra en vakuumpump enligt kravspecifikationen med de applikationskomponenter som använts.

The extensive development of cyberspace and the increasing potential for cybersecu-rity vulnerabilities demand the constant production of improved methods for detect-ing and mitigating vulnerabilities in software. In a perfect world, there would be atool that detects and mitigates all types of vulnerabilities in all types of software, butunfortunately, that is not the reality. Most methods need to be specific to have goodperformance. The tool we use in our paper specializes in detecting vulnerabilities inexecutable programs, specifically heap buffer overflow vulnerabilities.In this master thesis, we focus on the problem of detecting heap buffer overflowvulnerabilities in executable programs. We conducted two experiments to answertwo research questions related to this problem. The first research question aims toevaluate the performance of a unit-based symbolic execution method for detectingsuch vulnerabilities in terms of accuracy and execution time. The second researchquestion investigates whether the performance of the method from the first questioncan be improved through the use of the machine learning method Q-learning.In the first experiment, we used the 90 included test programs to evaluate theoriginal version of the tool. For our second experiment, we used 100 other testprograms that we selected from the NIST database, together with the original versionof the tool and our modified version with integrated Q-learning functionality. Thefindings from our experiments show that unit-based symbolic execution tools arecomplex, and the accuracy of these tools can be improved through the use of machinelearning algorithms. However, the use of these algorithms comes at the cost ofexecution time.Overall, this thesis contributes to the field of software security by providing in-sights into the performance and potential improvements of symbolic execution meth-ods for detecting heap buffer overflow vulnerabilities. Our findings suggest that theuse of machine learning algorithms can enhance the accuracy of unit-based symbolicexecution tools, which can be useful for detecting security vulnerabilities in software.

No description available.