Cyber attacks against companies and organizations can result in high impact losses that include damaged credibility, exposed vulnerability, and financial losses. Until the 21st century, insiders were often overlooked as suspects for these attacks. The 2010 CERT Cyber Security Watch Survey attributes 26 percent of cyber crimes to insiders. Numerous real insider attack scenarios suggest that during, or directly before the attack, the insider begins to behave abnormally. We introduce a method to detect abnormal behavior by profiling users. We utilize the k-means and kernel density estimation algorithms to learn a user’s normal behavior and establish normal user profiles based on behavioral data. We then compare user behavior against the normal profiles to identify abnormal patterns of behavior.

Digital communication systems invariably employ an underlying analog communication channel. At the transmitter, data is modulated to obtain an analog waveform which is input to the channel. At the receiver, the output of the channel needs to be mapped back into the discrete domain. To this effect, the continuous-time received waveform is sampled at instants chosen by the timing recovery block. Therefore, timing recovery is an essential component of digital communication systems. A widely used timing recovery method is based on a phase-locked loop (PLL), which updates its timing estimates based on a decision-directed device. Timing recovery performance is a strong function of the reliability of decisions, and hence, of the channel signal-to-noise ratio (SNR). Iteratively decodable error-control codes (ECCs) like turbo codes and LDPC codes allow operation at SNRs lower than ever before, thus exacerbating timing recovery. We propose iterative timing recovery, where the timing recovery block, the equalizer and the ECC decoder exchange information, giving the timing recovery block access to decisions that are much more reliable than the instantaneous ones. This provides significant SNR gains at a marginal complexity penalty over a conventional turbo equalizer where the equalizer and the ECC decoder exchange information. We also derive the Cramer-Rao bound, which is a lower bound on the estimation error variance of any timing estimator, and propose timing recovery methods that outperform the conventional PLL and achieve the Cramer-Rao bound in some cases. At low SNR, timing recovery suffers from cycle slips, where the receiver drops or adds one or more symbols, and consequently, almost always the ECC decoder fails to decode. Iterative timing recovery has the ability to corrects cycle slips. To reduce the number of iterations, we propose cycle slip detection and correction methods. With iterative timing recovery, the PLL with cycle slip detection and correction recovers most of the SNR loss of the conventional receiver that separates timing recovery and turbo equalization.

This thesis presents methods for developing FPGA-based test solutions that solve the challenges of evaluating source-synchronous and protocol-laden systems and devices at multi-gigabit per second signaling rates. These interfaces are becoming more prevalent in emerging designs and are difficult to test using traditional automated test equipment (ATE) and test instrumentation which were designed for testing designs utilizing synchronous and deterministic signaling. The main motivation of this research was to develop solutions that address these challenges. The methods shown in this thesis are used to design a test architecture consisting of custom hardware components, reprogrammable digital logic for hardware integration, and a software interface for external data transport and configuration. The hardware components consist of a multi-GHz field programmable gate array (FPGA) based interface board providing processing, control, and data capabilities to the system and enhanced by one or more application modules which can be tailored for specific test functionality compatible with source-synchronous and protocol interfaces. Software controls from a host computer provide high and low level access to the internal tester data and configuration memory space. The architecture described in this thesis is demonstrated through a specific test solution for a high-speed optical packet switched network called the Data Vortex. Reprogrammable firmware and software controls allow for a high degree of adaptability and application options. The modularized implementation of the hardware elements introduces additional adaptability and future upgradability, capable of incorporating new materials and design techniques for the test platform and application modules.

Cyber attacks against companies and organizations can result in high impact losses that include damaged credibility, exposed vulnerability, and financial losses. Until the 21st century, insiders were often overlooked as suspects for these attacks. The 2010 CERT Cyber Security Watch Survey attributes 26 percent of cyber crimes to insiders. Numerous real insider attack scenarios suggest that during, or directly before the attack, the insider begins to behave abnormally. We introduce a method to detect abnormal behavior by profiling users. We utilize the k-means and kernel density estimation algorithms to learn a user’s normal behavior and establish normal user profiles based on behavioral data. We then compare user behavior against the normal profiles to identify abnormal patterns of behavior.

Not available / text

I present RAACD, a software suite that detects misbehaving computers in large computing systems and presents information about those machines to the system administrator. I build this system using preexisting anomaly detection techniques. I evaluate my methods using simple synthesized data, real data containing coerced abnormal behavior, and real data containing naturally occurring abnormal behavior. I find that the system adequately detects abnormal behavior and significantly reduces the amount of uninteresting computer health data presented to a system administrator.

Thesis (M.App.Sc.) - Carleton University, 2002. / Includes bibliographical references (p. 124-127). Also available in electronic format on the Internet.

A comunicação de Voz sobre IP (VoIP) vem aumentando com o decorrer do tempo e as redes de comunicação estão se tornando cada vez mais congestionadas, ocasionando perda de pacotes e latência nas redes, prejudicando diretamente a qualidade das comunicações de voz. Neste trabalho, foi estudado em detalhe como a qualidade do sinal de voz transmitido em uma comunicação VoIP é afetada por parâmetros da rede e pelo tipo de codificador utilizado na comunicação. Uma contribuição importante deste trabalho é a apresentação de uma metodologia que serve para predizer o comportamento de um codificador de voz em diferentes cenários de redes. O estabelecimento de um mecanismo de controle que otimize a utilização da rede e ao mesmo tempo garanta a melhor qualidade possível do sinal de voz transmitido vem sendo motivo de pesquisa. O emprego de codificadores multitaxa nas comunicações de voz possibilita a implementação de algoritmos que controlem a comutação destas taxas de codificação baseados em diferentes fatores de decisão como as características do sinal de voz a ser transmitido ou empregando a informação dos parâmetros de rede. Este trabalho apresenta um algoritmo de determinação de taxa de codificação com fator de decisão baseado na qualidade do sinal avaliada no ponto da recepção ou em algum ponto intermediário. Para realização dos testes montou-se um cenário de emulação de rede IP para o estabelecimento de uma chamada VoIP, onde são utilizados codificadores multitaxa (ITU-T G.726 e Speex). Para avaliação da qualidade do sinal de voz foi utilizada a recomendação ITU-T P.563, sendo que o índice MOS obtido no ponto de recepção é transmitido utilizando um laço de transmissão, que forma parte da estrutura do mecanismo de controle apresentado neste trabalho. Este laço de transmissão é implementado via socket sobre uma comunicação UDP. Como as ferramentas utilizadas são todas freeware, o cenário de emulação pode ser facilmente implementado por demais pesquisadores. Os resultados obtidos são confiáveis, já que para cenários onde se mesclam diferentes taxas de codificação, o índice MOS obtido é um valor que está na faixa dos valores obtidos nos cenários onde se utilizou taxa de codificação única. O correto desempenho do mecanismo do RDA também foi verificado, sendo que a qualidade do sinal de voz decresce, o mecanismo de controle no RDA comuta a uma taxa de codificação menor, garantindo o melhor uso do canal de transmissão. Quando os parâmetros da rede passam a melhores condições, o índice MOS do sinal aumenta e o RDA comuta a uma taxa de codificação maior obtendo uma qualidade mais alta na comunicação. / Voice over IP (VoIP) communications are becoming increasingly popular so that data communication networks are ever more prone to degradations like packet losses and rising latency. In this work, it was studied in detail how the quality of the speech signal transmitted in a VoIP communication is affected by parameters of the network and the type of codec used in the communication. An important contribution of this work is to predict the behavior of a speech codec in different network scenarios. The main goal of this research has been the development of an algorithm that constrains rate allocation to a speech communication for best quality according to current network resource availability. The use of multirate codecs in speech communications makes it possible to implement control algorithms for coding rate switching. They are based on speech signal features or network trafic parameters. This work presents an algorithm for the determination of coding rate with decision factor based on speech quality evaluated at the point of reception or intermediate points. For accomplishment of the tests, a scenario of emulation of an IP network for the establishment of a VoIP call was built, where multi-rate codecs are used (ITU-T G.726 and Speex). For evaluation of the quality of the speech signal the Recommendation ITU-T P.563 was used, where the MOS index obtained in the reception is transmitted using a transmission loop, as a part in the control mechanism in the proposed algorithm. This transmission loop consists of a UDP message sent on a socket. As the tools used are all freeware, the simulation scenarios can easily be implemented by other researchers. The results are trustworthy, because for multirate scenarios, the MOS index obtained is a value that is between the ones obtained in the single-rate scenarios. The correct performance of the mechanism of the RDA was also verified, so that when the quality of the signal decreases, the control mechanism in the RDA switches to a lower coding rate, ensuring the best use of the transmission canal. When the parameters of the network drive to best conditions, the MOS index of the signal increases and the RDA decides to switch to a higher coding rate achieving a higher communication quality.

Dans le contexte des Réseaux Optiques Passifs (PON), les opérateurs recherchent des solutions innovantes pour augmenter le débit agrégé, nombre d'utilisateurs et portée de la transmission. En plus, des solutions émetteurs-récepteurs à bas coût sont nécessaires. La technique de transmission Orthogonal Frequency Division Multiplexing (OFDM) peut améliorer les performances de la communication en termes de débit agrégé et portée comparé à la modulation classique On-Off Keying (OOK) mono-porteuse. Au même temps, la technologie Photonique sur Silicium permet de réduire le coût par unité des émetteurs-récepteurs, en raison de sa capacité de production en masse et intégration électro-optique. L'OFDM optique a déjà démontré son potentiel avec des composants optiques sur étagère. Par contre, son utilisation avec des émetteurs compatibles avec la technologie Photonique sur Silicium est plus difficile. L'objectif de ce travail est d'étudier les performances d'un lien basé sur des composants Photoniques sur Silicium utilisant la technique de modulation OFDM. Pour atteindre cet objectif, une plateforme de simulation dédiée est développée. Le modulateur-démodulateur OFDM est mise en place, ainsi que des modèles d'émetteurs Photoniques sur Silicium développés pendant la thèse. Ces modèles sont validés expérimentalement avec la caractérisation des composants disponibles au laboratoire. En parallèle, un banc expérimental est construit. Les émetteurs Photoniques sur Silicium sont comparés avec des composants à l'état-de-l' art sur étagère dans un lien OFDM optique. Dans les systèmes en modulation d'intensité et détection directe (IM/DD), une technique d'allocation quasi-optimale de bits et puissance avec de l'OFDM optique est proposée pour maximiser l'efficacité spectrale. Deux types d'émetteurs Photoniques sur Silicium sont considérés : des lasers hybrides III/V-sur-Silicium en modulation directe (expérimentation) et des modulateurs externes comme le Mach-Zehnder (MZM) (simulation) et en anneau-résonant (expérimentation et simulation). Les résultats expérimentaux montrent qu'un débit agrégé de 10Gbps peut être attendu jusqu'à 50km de fibre monomode, compatible avec les exigences de futures générations de PONs. La portée de la transmission (>10Gbps) avec le modulateur en anneau est limitée à 20km, en raison des pertes de couplage élevé en entrée/sortie de la puce. Les simulations montrent que la portée peut atteindre 100km si les pertes sont réduites. Une technique de modulation appelée Single-Side Band (SSB)-OFDM est connu pour améliorer le produit bande-passante-portée de la transmission, en comparaison avec des systèmes IM/DD (Dual-Side Band (DSB)). Par contre, l'émetteur SSB exige plusieurs composants électriques et optiques discrets, augmentant sa complexité. La technologie Photonique sur Silicium permet de un haut niveau d'intégration électro-optique. Pour cette raison, une implémentation spécifique d'un modulateur optique IQ sur Silicium permettant une génération efficace d'un signal SSB-OFDM est étudiée. Les résultats de simulation d'un cas d'étude montrent que l'émetteur Silicium permet d'atteindre une pénalité dans le budget optique relativement faible (de l'ordre de 3dB) comparé à un modulateur LiNbO3. Les solutions présentées dans cette thèse répondent aux besoins de future générations de PON en termes de débit avec des bandes-passantes relativement faibles (<6.25GHz). Ceci est un atout pour l'application considérée. Les tensions de modulations pour les liens IM/DD sont proches des celles fournies par l'électronique CMOS (about 2Vpp). Le développement récent de processeurs numériques et de convertisseurs numériques-analogiques à haut débit en CMOS font de l'OFDM une solution très attractive pour les futures générations de PONs, puisque des transmetteurs tout-Silicium peuvent désormais être envisagés. / In the context of Passive Optical Networks (PON), operators are looking for innovative solutions to increase aggregated data-rate, split-ratio and reach. Another requirement is that transceivers should be as low-cost as possible. The optical Orthogonal Frequency Division Multiplexing (OFDM) technique can improve performance of the transmission in terms of data-rate and reach as compared to classical single-carrier On-Off Keying (OOK) modulation. At the same time, the silicon photonics technology can lower the cost per unit of the transceiver, due to its mass production and E/O integration capabilities. Optical OFDM has already shown its potential using commercially available optical components. However, its use with silicon photonics Directly-Modulated Lasers (DML) and modulators is more challenging. The objective of this work is to study the performance of OFDM -based solutions for future PON, using silicon photonics transmitters. For that purpose, a dedicated simulation platform is developed. The OFDM modem is implemented, as well as models of silicon photonic devices built during this thesis. These models are validated by characterizing physical components available for test. In parallel, an experimental test-bed is developed. The silicon photonics transmitters are benchmarked with commercial-available transmitters for OFDM-based optical systems. For Intensity-Modulated/Directly-Detected (IM/DD) links, the use of optical OFDM with adaptive bit and power loading is proposed to maximize spectral efficiency. Two types of silicon photonics transmitters are considered: directly modulated III/V-on-silicon lasers (experiment) and external optical modulators such as Mach-Zehnder Modulator (MZM) (simulation) and ring-resonator (simulation and experiment). Experimental results show that the hybrid DML can provide more than 10Gbps aggregated data-rate over at least 50km, which is a requirement for future uplink PON (from the subscriber to the central office). For the silicon ring modulator, because of the high coupling loss in and out of the photonic chip, reach was limited to 20km for a data-rate higher than 10Gbps. These are the first experimental demonstrations of OFDM modulation with hybrid III/V-on-silicon lasers and silicon ring-resonator modulator. Besides, simulation results show that reach can be indeed improved up to 100km if the optical signal is amplified or the coupling loss reduced. A modulation technique called Single-Side Band (SSB)-OFDM is known to improve the [bandwidth x reach] product of the link, as compared to IM/DD (Dual-Side Band (DSB)) systems. However, it requires expensive transmitters with several discrete optical components. As silicon photonics technology allows a very high level of integration between different optical components and between electrical and optical devices, a silicon optical IQ modulator enabling ac{SSB}-ac{OFDM} technique is investigated. Simulation results of a study-case reveal that a relatively low optical budget penalty (up to 3dB) of the silicon photonics transmitters as compared to the LiNbO3 modulator is achieved. The solutions presented in this thesis are demonstrated to be compliant with future PON in terms of data-rate, with relatively low bandwidth (<6.25GHz) electronics. This is a great asset for the considered application. The driving voltages required for typical IM/DD systems showed to be closer to what CMOS driving circuitry can provide (about 2Vpp). Recent developments on high-speed digital signal processors and D/A-A/D converters, using CMOS technologies, make optical-OFDM an attractive solution for future PONs as full-Silicon-transmitters could be used.

Orientador: Eleri Cardozo / Tese (doutorado) - Universidade Estadual de Campinas, Faculdade de Engenharia Elétrica e de Computação / Made available in DSpace on 2018-08-16T06:51:09Z (GMT). No. of bitstreams: 1 Badan_TomasAntonioCosta_D.pdf: 1510212 bytes, checksum: 73618c2b1cfc1df892bb1bd071694ef9 (MD5) Previous issue date: 2010 / Resumo: A próxima geração da telefonia celular, 4G, será totalmente baseada no protocolo IP. Para o usuário final, a expectativa é estar constantemente conectado à esta rede, no qual a característica fundamental será a mobilidade transparente do dispositivo móvel, entre as várias subredes que compõem um domínio administrativo. Esta tese tem por objetivo propor uma solução para o problema da mobilidade transparente do dispositivo móvel em redes IP. Como consequência, duas contribuições são alcançadas. A primeira é a especificação de uma arquitetura que permita localizar e rastrear o dispositivo móvel em um domínio administrativo, que seja independente da tecnologia de túneis utilizada na camada de rede. A segunda é a proposição de um método de rastreamento do dispositivo móvel em redes MPLS, preservando as especificações do protocolo MPLS. É mostrado também como este método foi integrado com a arquitetura previamente definida. Por fim, é descrita como essa proposta de rastreamento em redes MPLS foi implementada sobre o sistema operacional Linux e os testes realizados para avaliar, tanto a implementação desta proposta, quanto a sua integração com essa arquitetura / Abstract: The next generation of cellular telephony, 4G, is going to be totally based on the IP protocol. The end user expects to be constantly connected to this network, in which the key feature Will be the seamless mobility of the mobile device among the various subnets within an administrative domain. This thesis has as objective to propose a solution to the problem of seamless mobility of the mobile device in IP networks. As such, two contributions are achieved. The first one is the specification of an architecture able to locate and track the mobile device inside an administrative domain, being independent of the tunnel technology used in the network layer. The second one is the proposition of a method to track the mobile device inside a MPLS networks, keeping intact the specifications of the MPLS protocol. It is also shown how this method was integrated with the previously defined architecture. Finally, it is described how the proposed method to track mobile devices inside a MPLS network was implemented on the Linux operating system, and the tests performed in order to assess both the implementation of this proposal and its integration with this architecture / Doutorado / Engenharia de Computação / Doutor em Engenharia Elétrica