The deficiencies of traditional dendrometry mean improvements in methods of tree mensuration are necessary in order to obtain accurate tree metrics for applications such as resource appraisal, and biophysical and ecological modelling. This thesis tests the potential of SfM-MVS (Structure-fromMotion with Multi-View Stereo-photogrammetry) using the software package PhotoScan Professional, for accurately determining linear (2D) and volumetric (3D) tree metrics. SfM is a remote sensing technique, in which the 3D position of objects is calculated from a series of photographs, resulting in a 3D point cloud model. Unlike other photogrammetric techniques, SfM requires no control points or camera calibration. The MVS component of model reconstruction generates a mesh surface based on the structure of the SfM point cloud. The study was divided into two research components, for which two different groups of study trees were used: 1) 30 small, potted ‘nursery’ trees (mean height 2.98 m), for which exact measurements could be made and field settings could be modified, and; 2) 35 mature ‘landscape’ trees (mean height 8.6 m) located in parks and reserves in urban areas around the South Island, New Zealand, for which field settings could not be modified. The first component of research tested the ability of SfM-MVS to reconstruct spatially-accurate 3D models from which 2D (height, crown spread, crown depth, stem diameter) and 3D (volume) tree metrics could be estimated. Each of the 30 nursery trees was photographed and measured with traditional dendrometry to obtain ground truth values with which to evaluate against SfM-MVS estimates. The trees were destructively sampled by way of xylometry, in order to obtain true volume values. The RMSE for SfM-MVS estimates of linear tree metrics ranged between 2.6% and 20.7%, and between 12.3% and 47.5% for volumetric tree metrics. Tree stems were reconstructed very well though slender stems and branches were reconstructed poorly. The second component of research tested the ability of SfM-MVS to reconstruct spatially-accurate 3D models from which height and DBH could be estimated. Each of the 35 landscape trees, which varied in height and species, were photographed, and ground truth values were obtained to evaluate against SfM-MVS estimates. As well as this, each photoset was thinned to find the minimum number of images required to achieve total image alignment in PhotoScan and produce an SfM point cloud (minimum photoset), from which 2D metrics could be estimated. The height and DBH were estimated by SfM-MVS from the complete photosets with RMSE of 6.2% and 5.6% respectively. The height and DBH were estimated from the minimum photosets with RMSE of 9.3% and 7.4% respectively. The minimum number of images required to achieve total alignment was between 20 and 50. There does not appear to be a correlation between the minimum number of images required for alignment and the error in the estimates of height or DBH (R2 =0.001 and 0.09 respectively). Tree height does not appear to affect the minimum number of images required for image alignment (R 2 =0.08).

En este trabajo se presenta el estudio de un caso de integración de una MANET, desplegada en una zona remota, a una red de infraestructura. La finalidad principal es la de proporcionar, a los nodos de la red ad hoc, acceso “seguro” a un servidor de la red de infraestructura, sin comprometer recursos como ancho de banda y energía que son limitados en la zona de despliegue. Para ello, se implemento un escenario de pruebas que comprende el despliegue de una MANET en zona remota y la integración de la misma a una red de infraestructura a través de la red celular. Sobre el escenario propuesto se establecieron canales de comunicación extremo a extremo, entre un nodo de la MANET y un servidor de infraestructura. Inicialmente, se realizaron pruebas inyectando tráfico de datos sobre un canal “no seguro” para obtener valores de referencia para latencia, throughput y consumo de energía. Luego, se efectuaron las mismas pruebas utilizando canales de comunicación “seguros” configurados sobre protocolos IPSEC y SSL/TLS. Los resultados obtenidos utilizando canales “seguros” fueron comparados con los valores de referencia para determinar las diferencias de consumo de recursos. Las desviaciones que surgieron de estas comparaciones, permitieron: - Establecer el consumo adicional de recursos generado por el uso de protocolos seguros. - Realizar un estudio comparativo de rendimiento, entre diferentes configuraciones de protocolos de seguridad. - Determinar que protocolo seguro se adapta mejor a este tipo de entornos.

The importance of knowing what type of traffic is flowing through a network is paramount to its success. Traffic shaping, Quality of Service, identifying critical business applications, Intrusion Detection Systems, as well as network administra- tion activities all require the base knowledge of what traffic is flowing over a network before any further steps can be taken. With SSL traffic on the rise due to applica- tions securing or concealing their traffic, the ability to determine what applications are running within a network is getting more and more difficult. Traditional methods of traffic classification through port numbers or deep packet inspection have been deemed inadequate by researchers thus making way for new methods. The purpose of this thesis is to investigate if a machine learning approach can be used with flow features to identify SSL in a given network trace. To this end, different machine learning methods are investigated without the use of port numbers, Internet Protocol addresses, or payload information. Various machine learning models are investigated including AdaBoost, Naive Bayes, RIPPER, and C4.5. The robustness of the results are tested against unseen datasets during training. Moreover, the proposed approach is compared to the Wireshark traffic analysis tool. Results show that the proposed ap- proach is very promising in identifying SSL traffic from a given network trace without using port numbers, Internet protocol addresses, or payload information.

L'évolution des réseaux informatiques, et notamment d'Internet, s'ancre dans l'émergence de paradigmes prépondérants tels que la mobilité et les réseaux sociaux. Cette évolution amène à considérer une réorganisation de la gestion des données circulant au cœur des réseaux. L'accès à des services offrant de la vidéo ou de la voix à la demande depuis des appareils aussi bien fixes que mobiles, tels que les Smartphones, ou encore la perméabilité des informations fournies à des réseaux sociaux conduisent à s'interroger sur la notion d'identité numérique et, de manière sous-jacente, à reconsidérer les concepts de sécurité et de confiance. La contribution réalisée dans ce travail de thèse consiste, dans une première partie, à analyser les différents modèles d'identité numérique existants ainsi que les architectures de fédération d'identité, mais également les protocoles déployés pour l'authentification et les problèmes de confiance engendrés par l'absence d'élément sécurisé tel qu'une carte à puce. Dans une deuxième partie, nous proposons, en réponse aux éléments dégagés dans la partie précédente, un modèle d'identité fortement attaché au protocole d'authentification TLS embarqué dans un composant sécurisé, permettant ainsi de fournir les avantages sécuritaires exigibles au cœur des réseaux actuels tout en s'insérant naturellement dans les différents terminaux, qu'ils soient fixes ou mobiles. Enfin, dans une dernière partie, nous expliciterons plusieurs applications concrètes, testées et validées, de ce modèle d'identité, afin d'en souligner la pertinence dans des cadres d'utilisation pratique extrêmement variés.

A current challenge in the Internet of Things is the seeking after conceptual structures to connect the presumably billions of devices of innumerable forms and capabilities. An emerging architectural concept, the fog cloud computing, moves the seemingly unlimited computational power of the distant cloud to the edge of the network, closer to the potentially computationally limited things, effectively diminishing the experienced latency. To allow computationally-constrained devices partaking in the network they have to be relieved from the burden of constant availability and extensive computational execution. Establishing a publish/subscribe communication pattern with the utilization of the popular Internet of Things application layer protocol Constrained Application Protocol is depicted one approach of overcoming this issue. In this project, a Java based library to establish a publish/subscribe communication pattern for the Constrained Application Protocol was develop. Furthermore, efforts to build and assess prototypes of several publish/subscribe application layer protocols executed over varying common as well as secured versions of the standard and non-standard transport layer protocols were made to take advantage, evaluate, and compare the developed library. The results indicate that the standard protocol stacks represent solid candidates yet one non-standard protocol stack is the considered prime candidate which still maintains a low response time while not adding a significant amount of communication overhead.

IoT is a rapidly growing area with products in the consumer, commercial and industrial market. Collecting data with multiple small and often battery-powered devices sets new challenges for both security and communication. There has been a distinct lack of a IoT specific communication protocols. The industry has had to use bulky interfaces not suitable for resource-constrained devices. MQTT is a standardised communication protocol made for the IoT industry. MQTT does however not have built-in security and it is up to the developers to implement a suitable security countermeasure. To evaluate how different security countermeasures impact MQTT in complexity, current consumption and security the following research questions are answered. How do you derive a measurement from the SEF that can be compared with a current consumption measurement? Which level of security, according to the SEF, will RSA, AES and TLS provide to MQTT when publishing a message to a broker? What level of complexity is added to MQTT when using chosen security countermeasure? Which of the analysed security countermeasure upholds an adequate security level while also having a low current consumption? To answer the above research questions an experiment approach has been used. Implementations of TLS, RSA and AES have been evaluated to measure how they affect the security level and current consumption of an MQTT publication, compared to no security countermeasures at all.Both RSA and AES had the same security level, but the current consumption for RSA was four times higher. The experiment showed that the security level is significantly higher for TLS, while it also has the highest current consumption. The security countermeasure evaluated differs greatly. TLS provides complete protections, while RSA and AES lacks authentication and does not ensure integrity and non-repudiation.Even if the current consumption for TLS is higher, the security it provides make it unreasonable to recommend any of the other security countermeasure implementations.

This thesis is focused on the topic of digital certificates for secure communication. First of all, methods of authentication and cryptography are analyzed as a starting point. Furthermore, the thesis describes communication protocols for secure connection HTTPS and SSL/TLS, the importance of certification authorities and their characteristics. It devotes the biggest part of attention to digital certificates as such. Practical part introduces available certification authorities, including practical creation of the new certification authority and certificate. This untrusted certificate has become the key element of the questionnaire survey, which aim is to analyze knowledge level of users about secure connection through trusted certificates. After the analysis, interpretation of obtained data and verification of selected hypothesis, recommendations for domain owners, who are planning to use HTTPS, were proposed.

Abstract. Security and privacy in digital communications is the need of the hour. SSL/TLS has become widely adopted to provide the same. Multiple application layer protocols can be layered on top of it. However protection is this form results in all the data being encrypted causing problems for an intrusion detection system which relies on a sniffer that analyses packets on a network. We thus hypothesise that a host based intrusion detection system that analyses packets after decryption would be able to detect attacks against security protocols. To this effect we conduct two experiments where we attack a web server and a mail server, collect data, analyse it and conclude with methods to detect such attacks. These methods are in the form of peudocode.

Security on the Internet is essential to ensure the privacy of an individual. Today, Trans- port Layer Security (TLS) and certificates are used to ensure this. But certificates are not enough in order to maintain confidentiality and therefore a new concept, Certificate Trans- parency (CT), has been introduced. CT improves security by allowing the analysis of sus- picious certificates. Validation by CT uses public logs that can return Signed Certificate Timestamp (SCT), which is a promise returned by the log indicating that the certificate will be added to the log. A server may then deliver the SCT to a client in three different ways: X.509v3 extension, Online Certificate Status Protocol (OSCP) stapling and TLS extension. For further analysis, we have created a tool to collect data during TLS handshakes and data transfer, including byte information, the certificates themselves, SCT delivery method and especially timing information. From our dataset we see that most websites do not use CT and the ones that use CT almost only use X.509 extension to send their SCTs.

The company Roxen Internet Software have an implementation of the secure network protocol SSL (Secure Sockets Layer) which is used in their web server product. This report describes the upgrading of that implementation to the TLS1.0 (Transport Layer Security) standard. It also describes a performance investigation of the SSL/TLS support in the Roxen WebServer and compares it with other common web servers. The initial setup time for the secure SSL/TLS connection was found to be very long in the Roxen Webserver compared to its competitors. The main bottleneck, in the Roxen implementation, was found to be the modular exponentiation that is the core of the RSA decryption algorithm. One suggested improvement is to upgrade the bignumber numerical package used in Roxen WebServer, GMP (The GNU Multiple Precision arithmetic library) from version 2.0 to version 4.0. The newer version of the bignumber package have been measured to have considerably better performance in its modular exponentation operation.