Botnets are becoming the predominant threat on the Internet today and is the primary vector for carrying out attacks against organizations and individuals. Botnets have been used in a variety of cybercrime, from click-fraud to DDOS attacks to the generation of spam. In this thesis we propose an approach to detect botnet activity using two different strategies both based on machine learning techniques. In one, we examine the network flow based metrics of potential botnet traffic and show that we are able to detect botnets with only data from a small time interval of operation. For our second technique, we use a similar strategy to identify botnets based on their potential fast flux behavior. For both techniques, we show experimentally that the presence of botnets may be detected with a high accuracy and identify their potential limitations. / Graduate

This report, will show by demonstration with Network Penetration, how to reveal security holes by using the same methods as an outside attack and carry out attacks against wired and wireless networks when it comes to sniffing user traffic, abuse VLAN, cracking password, WEP, WPA/WPA2, hacking WPS and analysing traffic. The tests was performed at the Halmstad University with lab equipment and at home with own equipment. Using Backtrack 5 R3 which is compatible with Linux, performance of the tests could be done by making use of various tools that comes with Backtrack.The goal of the project was to demonstrate how to reveal security holes by using the same methods as an outside attack. By testing, demonstrate and report the security of wired and wireless network, the achievement of these goals could be done and a greater insight into network security was gained, which gives more experience and knowledge that can be taken to a future professional life. The results show how simple it can be to abuse a network or sniff a password if there is no attention to the safety and the security configurations that can be implemented.In other words, during this project, both learning and demonstration has been done to show how vulnerable individuals, civilians and entrepreneurs are. It is easier than someone can imagine to obtaining unauthorized information that nobody wants to share out.

Comparative analysis of genomic data investigates the relationship of genome structure and function across different biological species to shed light on their similarities and differences. In this dissertation, we study two important problems in comparative genomics, namely comparative sequence analysis and comparative network analysis. In the comparative sequence analysis, we study the multiple sequence alignment of protein and DNA sequences as well as the structural alignment of multiple RNA sequences. For closely related sequences, multiple sequence alignment can be efficiently performed through progressive techniques. However, for divergent sequences it is very challenging to predict an accurate alignment. Here, we introduce PicXAA, an efficient non-progressive technique for multiple protein and DNA sequence alignment. We also further extend PicXAA to PicXAA-R for structural alignment of RNA sequences. PicXAA and PicXAA-R greedily build up the alignment from sequence regions with high local similarity, thereby yielding an accurate global alignment that effectively captures local similarities among sequences. As another important research area in comparative genomics, we also investigate the comparative network analysis problem. Translation of increasing number of large-scale biological networks into meaningful biological insights requires efficient computational techniques. One such example is network querying, which aims to identify subnetwork regions in a large target network that are similar to a given query network. Here, we introduce an efficient algorithm for querying large-scale biological networks, called RESQUE. RESQUE adopts a semi-Markov random walk model to probabilistically estimate the correspondence scores between nodes that belong to different networks. The target network is iteratively reduced based on the estimated correspondence scores until the best matching subnetwork emerges. The proposed network querying scheme is computationally efficient, can handle any network query with an arbitrary topology, and yields accurate querying results. We also extend the idea used in RESQUE to develop an efficient algorithm for alignment of multiple large-scale biological networks, called SMETANA. SMETANA outperforms state-of- the-art network alignment techniques, in terms of both computational efficiency and alignment accuracy. The accomplished studies have enabled us to provide a coherent framework for probabilistic approach to comparative analysis of biological sequences and networks. Such a probabilistic framework helps us employ rigorous mathematical schemes to find accurate and efficient solutions to these problems.

Oil/gas and petrochemical plants are complicated and dynamic in nature. Dynamic characteristics include ageing of equipment/components, season changes, stochastic processes, operator response times, inspection and testing time intervals, sequential dependencies of equipment/components and timing of safety system operations, all of which are time dependent criteria that can influence dynamic processes. The conventional risk assessment methodologies can quantify dynamic changes in processes with limited capacity. Therefore, it is important to develop method that can address time-dependent effects. The primary objective of this study is to propose a risk assessment methodology for dynamic systems. In this study, a new technique for dynamic operational risk assessment is developed based on the Bayesian networks, a structure optimal suitable to organize cause-effect relations. The Bayesian network graphically describes the dependencies of variables and the dynamic Bayesian network capture change of variables over time. This study proposes to develop dynamic fault tree for a chemical process system/sub-system and then to map it in Bayesian network so that the developed method can capture dynamic operational changes in process due to sequential dependency of one equipment/component on others. The developed Bayesian network is then extended to the dynamic Bayesian network to demonstrate dynamic operational risk assessment. A case study on a holdup tank problem is provided to illustrate the application of the method. A dryout scenario in the tank is quantified. It has been observed that the developed method is able to provide updated probability different equipment/component failure with time incorporating the sequential dependencies of event occurrence. Another objective of this study is to show parallelism of Bayesian network with other available risk assessment methods such as event tree, HAZOP, FMEA. In this research, an event tree mapping procedure in Bayesian network is described. A case study on a chemical reactor system is provided to illustrate the mapping procedure and to identify factors that have significant influence on an event occurrence. Therefore, this study provides a method for dynamic operational risk assessment capable of providing updated probability of event occurrences considering sequential dependencies with time and a model for mapping event tree in Bayesian network.

This thesis contributes toward the design of a reliable and energy-efficient transport system for Wireless Sensor Networks. Wireless Sensor Networks have emerged as a vital new area in networking research. In many Wireless Sensor Network systems, a common task of sensor nodes is to sense the environment and send the sensed data to a sink node. Thus, the effectiveness of a Wireless Sensor Network depends on how reliably the sensor nodes can deliver their sensed data to the sink. However, the sensor nodes are susceptible to loss for various reasons when there are dynamics in wireless transmission medium, environmental interference, battery depletion, or accidentally damage, etc. Therefore, assuring reliable data delivery between the sensor nodes and the sink in Wireless Sensor Networks is a challenging task. The primary contributions of this thesis include four parts. First, we design, implement, and evaluate a cross-layer communication protocol for reliable data transfer for data streaming applications in Wireless Sensor Networks. We employ reliable algorithms in each layer of the communication stack. At the MAC layer, a CSMA MAC protocol with an explicit hop-by-hop Acknowledgment loss recovery is employed. To ensure the end-to-end reliability, the maximum number of retransmissions are estimated and used at each sensor node. At the transport layer, an end-to-end Negative Acknowledgment with an aggregated positive Acknowledgment mechanism is used. By inspecting the sequence numbers on the packets, the sink can detect which packets were lost. In addition, to increase the robustness of the system, a watchdog process is implemented at both base station and sensor nodes, which enable them to power cycle when an unexpected fault occurs. We present extensive evaluations, including theoretical analysis, simulations, and experiments in the field based on Fleck-3 platform and the TinyOS operating system. The designed network system has been working in the field for over a year. The results show that our system is a promising solution to a sustainable irrigation system. Second, we present the design of a policy-based Sensor Reliability Management framework for Wireless Sensor Networks called SRM. SRM is based on hierarchical management architecture and on the policy-based network management paradigm. SRM allows the network administrators to interact with the Wireless Sensor Network via the management policies. SRM also provides a self-control capability to the network. This thesis restricts SRM to reliability management, but the same framework is also applicable for other management services by providing the management policies. Our experimental results show that SRM can offer sufficient reliability to the application users while reducing energy consumption by more than 50% compared to other approaches. Third, we propose an Energy-efficient and Reliable Transport Protocol called ERTP, which is designed for data streaming applications in Wireless Sensor Networks. ERTP is an adaptive transport protocol based on statistical reliability that ensures the number of data packets delivered to the sink exceeds the defined threshold while reducing the energy consumption. Using a statistical reliability metric when designing a reliable transport protocol guarantees the delivery of adequate information to the users, and reduces energy consumption when compared to the absolute reliability. ERTP uses hop-by-hop Implicit Acknowledgment with a dynamically updated retransmission timeout for packet loss recovery. In multihop wireless networks, the transmitter can overhear a forwarding transmission and interpret it as an Implicit Acknowledgment. By combining the statistical reliability and the hop-by-hop Implicit Acknowledgment loss recovery, ERTP can offer sufficient reliability to the application users with minimal energy expense. Our extensive simulations and experimental evaluations show that ERTP can reduce energy consumption by more than 45% when compared to the state-of- the-art protocol. Consequently, sensor nodes are more energy-efficient and the lifespan of the unattended Wireless Sensor Network is increased. In Wireless Sensor Networks, sensor node failures can create network partitions or coverage loss which can not be solved by providing reliability at higher layers of the protocol stack. In the final part of this thesis, we investigate the problem of maintaining the network connectivity and coverage when the sensor nodes are failed. We consider a hybrid Wireless Sensor Network where a subset of the nodes has the ability to move at a high energy expense. When a node has low remaining energy (dying node) but it is a critical node which constitutes the network such as a cluster head, it will seek a replacement. If a redundant node is located in the transmission range of the dying node and can fulfill the network connectivity and coverage requirement, it can be used for substitution. Otherwise, a protocol should be in place to relocate the redundant sensor node for replacement. We propose a distributed protocol for Mobile Sensor Relocation problem called Moser. Moser works in three phases. In the first phase, the dying node determines if network partition occurs, finds an available mobile node, and asks for replacement by using flooding algorithm. The dying node also decides the movement schedule of the available mobile node based on certain criteria. The second phase of the Moser protocol involves the actual movement of the mobile nodes to approach the location of the dying node. Finally, when the mobile node has reached the transmission of the dying node, it communicates to the dying nodes and moves to a desired location, where the network connectivity and coverage to the neighbors of the dying nodes are preserved.

Information measures may be used to estimate the amount of information emitted by discrete information sources. Network streams are an example for such discrete information sources. This thesis investigates the use of information measures for the detection of events in network streams. Starting with the fundamental entropy and complexity measures proposed by Shannon and Kolmogorov, it reviews a range of candidate information measures for network event detection, including algorithms from the Lempel-Ziv family and a relative newcomer, the T-entropy. Using network trace data from the University of Auckland, the thesis demonstrates experimentally that these measures are in principle suitable for the detection of a wide range of network events. Several key parameters influence the detectability of network events with information measures. These include the amount of data considered in each traffic sample and the choice of observables. Among others, a study of the entropy behaviour of individual observables in event and non-event scenarios investigates the optimisation of these parameters. The thesis also examines the impact of some of the detected events on different information measures. This motivates a discussion on the sensitivity of various measures. A set of experiments demonstrating multi-dimensional network event classification with multiple observables and multiple information measures concludes the thesis.

Information measures may be used to estimate the amount of information emitted by discrete information sources. Network streams are an example for such discrete information sources. This thesis investigates the use of information measures for the detection of events in network streams. Starting with the fundamental entropy and complexity measures proposed by Shannon and Kolmogorov, it reviews a range of candidate information measures for network event detection, including algorithms from the Lempel-Ziv family and a relative newcomer, the T-entropy. Using network trace data from the University of Auckland, the thesis demonstrates experimentally that these measures are in principle suitable for the detection of a wide range of network events. Several key parameters influence the detectability of network events with information measures. These include the amount of data considered in each traffic sample and the choice of observables. Among others, a study of the entropy behaviour of individual observables in event and non-event scenarios investigates the optimisation of these parameters. The thesis also examines the impact of some of the detected events on different information measures. This motivates a discussion on the sensitivity of various measures. A set of experiments demonstrating multi-dimensional network event classification with multiple observables and multiple information measures concludes the thesis.

Information measures may be used to estimate the amount of information emitted by discrete information sources. Network streams are an example for such discrete information sources. This thesis investigates the use of information measures for the detection of events in network streams. Starting with the fundamental entropy and complexity measures proposed by Shannon and Kolmogorov, it reviews a range of candidate information measures for network event detection, including algorithms from the Lempel-Ziv family and a relative newcomer, the T-entropy. Using network trace data from the University of Auckland, the thesis demonstrates experimentally that these measures are in principle suitable for the detection of a wide range of network events. Several key parameters influence the detectability of network events with information measures. These include the amount of data considered in each traffic sample and the choice of observables. Among others, a study of the entropy behaviour of individual observables in event and non-event scenarios investigates the optimisation of these parameters. The thesis also examines the impact of some of the detected events on different information measures. This motivates a discussion on the sensitivity of various measures. A set of experiments demonstrating multi-dimensional network event classification with multiple observables and multiple information measures concludes the thesis.

Information measures may be used to estimate the amount of information emitted by discrete information sources. Network streams are an example for such discrete information sources. This thesis investigates the use of information measures for the detection of events in network streams. Starting with the fundamental entropy and complexity measures proposed by Shannon and Kolmogorov, it reviews a range of candidate information measures for network event detection, including algorithms from the Lempel-Ziv family and a relative newcomer, the T-entropy. Using network trace data from the University of Auckland, the thesis demonstrates experimentally that these measures are in principle suitable for the detection of a wide range of network events. Several key parameters influence the detectability of network events with information measures. These include the amount of data considered in each traffic sample and the choice of observables. Among others, a study of the entropy behaviour of individual observables in event and non-event scenarios investigates the optimisation of these parameters. The thesis also examines the impact of some of the detected events on different information measures. This motivates a discussion on the sensitivity of various measures. A set of experiments demonstrating multi-dimensional network event classification with multiple observables and multiple information measures concludes the thesis.

Thesis (Ph.D)--University of Wollongong, 2005. / Typescript. Includes bibliographical references: leaf 172-181.