O mundo moderno está cada dia mais conectado por todos os meios tecnológicos que existem hoje. Isto permite que mais e mais pessoas possam se comunicar, tornando a estrada da comunicação virtual obrigatória para a sobrevivência das pequenas, médias e grandes empresas públicas e privadas. O grande avanço tecnológico do século 20 foi à utilização em grande escala do PC (personal computer) comumente chamados de microcomputadores. Este avanço também chegou aos sistemas elétricos de potência, tornando as subestações digitalizadas. Estas subestações sendo digitais correm riscos de invasão cibernética interna ou mesmo externa. Embora a possibilidade de invasão cibernética externa seja pequena, ela existe. Diante dessa situação este trabalho propõe a aplicação de um sistema de segurança, aplicado em um sistema elétrico de potência. O trabalho concentra-se especificamente no estudo dos sistemas de detecção de intruso (SDI), nos seus dois modos básicos: o SDI por abuso e SDI por anomalia utilizando redes neurais artificiais. Estes conceitos serão testados em um sistema elétrico de potência simulado, com uma rede de comunicação baseada em microcomputadores e/ou equipamentos microprocessados, com relés digitais reais. Os Softwares, denominados SNORT e Carcará, foram utilizados e extensivamente testados com resultados altamente encorajadores para a função descrita. / Modern world is more connected each day by all technological means available. This allows more people to communicate, turning the virtual communication road obligatory to the survival of small, medium and large companies, whether public or private. The great technological advance of the 20th century was the large use of the PCs (personal computer), usually called microcomputers. This advance also reached the power electric systems with the digitalization of the substations. These digitalized substations, run the risk of cybernetic invasion, internal or even external. Although the possibility of external cybernetic invasion is small, it exists. In that context, the present thesis proposes the application of a security system for an electric power system. The focus will be the study of intruder detection systems (IDS), on its two basic forms: the IDS by abuse and the IDS by anomaly, using artificial neural networks. These concepts will be tested in a simulated electric power system, with a communication network based on microcomputers, with actual digital relays with the digitalization of the substations.

Les travaux de recherche de cette thèse consistent à mettre en place des solutions performantes et légères permettant de répondre aux problèmes de sécurisation de produits sensibles. Motivé par une collaboration avec différents acteurs au sein du projet Nuc-Track,le développement d'un système de sécurité biométrique, possiblement multimodal, mènera à une étude sur différentes caractéristiques biométriques telles que le visage, les empreintes digitales et le réseau vasculaire. Cette thèse sera axée sur une adéquation algorithme et architecture, dans le but de minimiser la taille de stockage des modèles d'apprentissages tout en garantissant des performances optimales. Cela permettra leur stockage sur un support personnel, respectant ainsi les normes de vie privée. / Research of this thesis consists in setting up efficient and light solutions to answer the problems of securing sensitive products. Motivated by a collaboration with various stakeholders within the Nuc-Track project, the development of a biometric security system, possibly multimodal, will lead to a study on various biometric features such as the face, fingerprints and the vascular network. This thesis will focus on an algorithm and architecture matching, with the aim of minimizing the storage size of the learning models while guaranteeing optimal performances. This will allow it to be stored on a personal support, thus respecting privacy standards.

A extração de regras de associação (ARM - Association Rule Mining) de dados quantitativos tem sido pesquisa de grande interesse na área de mineração de dados. Com o crescente aumento das bases de dados, há um grande investimento na área de pesquisa na criação de algoritmos para melhorar o desempenho relacionado a quantidade de regras, sua relevância e a performance computacional. O algoritmo APRIORI, tradicionalmente usado na extração de regras de associação, foi criado originalmente para trabalhar com atributos categóricos. Geralmente, para usá-lo com atributos contínuos, ou quantitativos, é necessário transformar os atributos contínuos, discretizando-os e, portanto, criando categorias a partir dos intervalos discretos. Os métodos mais tradicionais de discretização produzem intervalos com fronteiras sharp, que podem subestimar ou superestimar elementos próximos dos limites das partições, e portanto levar a uma representação imprecisa de semântica. Uma maneira de tratar este problema é criar partições soft, com limites suavizados. Neste trabalho é utilizada uma partição fuzzy das variáveis contínuas, que baseia-se na teoria dos conjuntos fuzzy e transforma os atributos quantitativos em partições de termos linguísticos. Os algoritmos de mineração de regras de associação fuzzy (FARM - Fuzzy Association Rule Mining) trabalham com este princípio e, neste trabalho, o algoritmo FUZZYAPRIORI, que pertence a esta categoria, é utilizado. As regras extraídas são expressas em termos linguísticos, o que é mais natural e interpretável pelo raciocício humano. Os algoritmos APRIORI tradicional e FUZZYAPRIORI são comparado, através de classificadores associativos, baseados em regras extraídas por estes algoritmos. Estes classificadores foram aplicados em uma base de dados relativa a registros de conexões TCP/IP que destina-se à criação de um Sistema de Detecção de Intrusos. / The mining of association rules of quantitative data has been of great research interest in the area of data mining. With the increasing size of databases, there is a large investment in research in creating algorithms to improve performance related to the amount of rules, its relevance and computational performance. The APRIORI algorithm, traditionally used in the extraction of association rules, was originally created to work with categorical attributes. In order to use continuous attributes, it is necessary to transform the continuous attributes, through discretization, into categorical attributes, where each categorie corresponds to a discrete interval. The more traditional discretization methods produce intervals with sharp boundaries, which may underestimate or overestimate elements near the boundaries of the partitions, therefore inducing an inaccurate semantical representation. One way to address this problem is to create soft partitions with smoothed boundaries. In this work, a fuzzy partition of continuous variables, which is based on fuzzy set theory is used. The algorithms for mining fuzzy association rules (FARM - Fuzzy Association Rule Mining) work with this principle, and, in this work, the FUZZYAPRIORI algorithm is used. In this dissertation, we compare the traditional APRIORI and the FUZZYAPRIORI, through classification results of associative classifiers based on rules extracted by these algorithms. These classifiers were applied to a database of records relating to TCP / IP connections that aims to create an Intrusion Detection System.

A extração de regras de associação (ARM - Association Rule Mining) de dados quantitativos tem sido pesquisa de grande interesse na área de mineração de dados. Com o crescente aumento das bases de dados, há um grande investimento na área de pesquisa na criação de algoritmos para melhorar o desempenho relacionado a quantidade de regras, sua relevância e a performance computacional. O algoritmo APRIORI, tradicionalmente usado na extração de regras de associação, foi criado originalmente para trabalhar com atributos categóricos. Geralmente, para usá-lo com atributos contínuos, ou quantitativos, é necessário transformar os atributos contínuos, discretizando-os e, portanto, criando categorias a partir dos intervalos discretos. Os métodos mais tradicionais de discretização produzem intervalos com fronteiras sharp, que podem subestimar ou superestimar elementos próximos dos limites das partições, e portanto levar a uma representação imprecisa de semântica. Uma maneira de tratar este problema é criar partições soft, com limites suavizados. Neste trabalho é utilizada uma partição fuzzy das variáveis contínuas, que baseia-se na teoria dos conjuntos fuzzy e transforma os atributos quantitativos em partições de termos linguísticos. Os algoritmos de mineração de regras de associação fuzzy (FARM - Fuzzy Association Rule Mining) trabalham com este princípio e, neste trabalho, o algoritmo FUZZYAPRIORI, que pertence a esta categoria, é utilizado. As regras extraídas são expressas em termos linguísticos, o que é mais natural e interpretável pelo raciocício humano. Os algoritmos APRIORI tradicional e FUZZYAPRIORI são comparado, através de classificadores associativos, baseados em regras extraídas por estes algoritmos. Estes classificadores foram aplicados em uma base de dados relativa a registros de conexões TCP/IP que destina-se à criação de um Sistema de Detecção de Intrusos. / The mining of association rules of quantitative data has been of great research interest in the area of data mining. With the increasing size of databases, there is a large investment in research in creating algorithms to improve performance related to the amount of rules, its relevance and computational performance. The APRIORI algorithm, traditionally used in the extraction of association rules, was originally created to work with categorical attributes. In order to use continuous attributes, it is necessary to transform the continuous attributes, through discretization, into categorical attributes, where each categorie corresponds to a discrete interval. The more traditional discretization methods produce intervals with sharp boundaries, which may underestimate or overestimate elements near the boundaries of the partitions, therefore inducing an inaccurate semantical representation. One way to address this problem is to create soft partitions with smoothed boundaries. In this work, a fuzzy partition of continuous variables, which is based on fuzzy set theory is used. The algorithms for mining fuzzy association rules (FARM - Fuzzy Association Rule Mining) work with this principle, and, in this work, the FUZZYAPRIORI algorithm is used. In this dissertation, we compare the traditional APRIORI and the FUZZYAPRIORI, through classification results of associative classifiers based on rules extracted by these algorithms. These classifiers were applied to a database of records relating to TCP / IP connections that aims to create an Intrusion Detection System.

O mundo moderno está cada dia mais conectado por todos os meios tecnológicos que existem hoje. Isto permite que mais e mais pessoas possam se comunicar, tornando a estrada da comunicação virtual obrigatória para a sobrevivência das pequenas, médias e grandes empresas públicas e privadas. O grande avanço tecnológico do século 20 foi à utilização em grande escala do PC (personal computer) comumente chamados de microcomputadores. Este avanço também chegou aos sistemas elétricos de potência, tornando as subestações digitalizadas. Estas subestações sendo digitais correm riscos de invasão cibernética interna ou mesmo externa. Embora a possibilidade de invasão cibernética externa seja pequena, ela existe. Diante dessa situação este trabalho propõe a aplicação de um sistema de segurança, aplicado em um sistema elétrico de potência. O trabalho concentra-se especificamente no estudo dos sistemas de detecção de intruso (SDI), nos seus dois modos básicos: o SDI por abuso e SDI por anomalia utilizando redes neurais artificiais. Estes conceitos serão testados em um sistema elétrico de potência simulado, com uma rede de comunicação baseada em microcomputadores e/ou equipamentos microprocessados, com relés digitais reais. Os Softwares, denominados SNORT e Carcará, foram utilizados e extensivamente testados com resultados altamente encorajadores para a função descrita. / Modern world is more connected each day by all technological means available. This allows more people to communicate, turning the virtual communication road obligatory to the survival of small, medium and large companies, whether public or private. The great technological advance of the 20th century was the large use of the PCs (personal computer), usually called microcomputers. This advance also reached the power electric systems with the digitalization of the substations. These digitalized substations, run the risk of cybernetic invasion, internal or even external. Although the possibility of external cybernetic invasion is small, it exists. In that context, the present thesis proposes the application of a security system for an electric power system. The focus will be the study of intruder detection systems (IDS), on its two basic forms: the IDS by abuse and the IDS by anomaly, using artificial neural networks. These concepts will be tested in a simulated electric power system, with a communication network based on microcomputers, with actual digital relays with the digitalization of the substations.

This thesis investigates the problem of detecting an intruder in the presence of clutter in a Passive Infra-Red (PIR) based Wireless Sensor Network (WSN). As one of the major objectives in a WSN is to maximize battery life, data transmission and local computations must be kept to a minimum as they are expensive in terms of energy. But, as intrusion being a rare event and cannot be missed, local computations expend more energy than data transmission. Hence, the need for a low-complexity algorithm for intrusion detection is inevitable. A low-complexity algorithm for intrusion detection in the presence of clutter arising from wind-blown vegetation, using PIR sensors is presented. The algorithm is based on a combination of Haar Transform (HT) and Support Vector Machine (SVM) based training. The amplitude and frequency of the intruder signature is used to differentiate it from the clutter signal. The HT was preferred to Discrete Fourier Transform (DFT) in computing the spectral signature because of its computational simplicity -just additions and subtractions suffice (scaling coefficients taken care appropriately). Intruder data collected in a laboratory and clutter data collected from various types of vegetation were fed into SVM for training. The optimal decision rule returned by SVM was then used to separate intruder from clutter. Simulation results along with some representative samples in which intrusions were detected and the clutter being rejected by the algorithm is presented. The implementation of the proposed intruder-detection algorithm in a network setting comprising of 20 sensing nodes is discussed. The field testing performance of the algorithm is then discussed. The limitations of the algorithm is also discussed. A closed-form analytical expression for the signature generated by a human moving along a straight line in the vicinity of the PIR sensor at constant velocity is provided. It is shown to be a good approximation by showing a close match with the real intruder waveforms. It is then shown how this expression can be exploited to track the intruder from the signatures of three well-positioned sensing nodes.

This thesis presents the development of a Sensor Tower Platform (STP) comprised of an array of Passive Infra-Red (PIR) sensors along with a classification algorithm that enables the STP to distinguish between human intrusion, animal intrusion and clutter arising from wind-blown vegetative movement in an outdoor environment. The research was motivated by the aim of exploring the potential use of wireless sensor networks (WSNs) as an early-warning system to help mitigate human-wildlife conflicts occurring at the edge of a forest. While PIR sensors are in commonplace use in indoor settings, their use in an outdoor environment is hampered by the fact that they are prone to false alarms arising from wind-blown vegetation. Every PIR sensor is made up of one or more pairs of pyroelectric pixels arranged in a plane, and the orientation of interest in this thesis is one in which this plane is a vertical plane, i.e., a plane perpendicular to the ground plane. The intersection of the Field Of View (FOV) of the PIR sensor with a second vertical plane that lies within the FOV of the PIR sensor, is called the virtual pixel array (VPA). The structure of the VPA corresponding to the plane along which intruder motion takes place determines the form of the signal generated by the PIR sensor. The STP developed in this thesis employs an array of PIR sensors designed so as to result in a VPA that makes it easier to discriminate between human and animal intrusion while keeping to a small level false alarms arising from vegetative motion. The design was carried out in iterative fashion, with each successive iteration separated by a lengthy testing phase. There were a total of 5 design iterations spanning a total period of 14 months. Given the inherent challenges involved in gathering data corresponding to animal intrusion, the testing of the SP was carried out both using real-world data and through simulation. Simulation was carried out by developing a tool that employed animation software to simulate intruder and animal motion as well as some limited models of wind-blown vegetation. More specifically, the simulation tool employed 3-dimensional models of intruder and shrub motion that were developed using the popular animation software Blender. The simulated output signal of the PIR sensor was then generated by calculating the area of the 3-dimensional intruder when projected onto the VPA of the STP. An algorithm for efficiently calculating this to a good degree of approximation was implemented in Open Graphics Library (OpenGL). The simulation tool was useful both for evaluating various competing design alternatives as well as for developing an intuition for the kind of signals the SP would generate without the need for time-consuming and challenging animal-motion data collection. Real-world data corresponding to human motion was gathered on the campus of the Indian Institute of Science (IISc), while animal data was recorded at a dog-trainer facility in Kengeri as well as the Bannerghatta Biological Park, both located in the outskirts of Bengaluru. The array of PIR sensors was designed so as to result in a VPA that had good spatial resolution. The spatial resolution capabilities of the STP permitted distinguishing between human and animal motion with good accuracy based on low-complexity, signal-energy computations. Rejecting false alarms arising from vegetative movement proved to be more challenging. While the inherent spatial resolution of the STP was very helpful, an alternative approach turned out to have much higher accuracy, although it is computationally more intensive. Under this approach, the intruder signal, either human or animal, was modelled as a chirp waveform. When the intruder moves along a circular arc surrounding the STP, the resulting signal is periodic with constant frequency. However, when the intruder moves along a more likely straight-line path, the resultant signal has a strong chirp component. Clutter signals arising from vegetative motion does not exhibit this chirp behavior and an algorithm that exploited this difference turned in a classification accuracy in excess of 97%.