The number of significant security incidents tends to increase day by day in recent years. The distributed denial of service attacks and worm attacks extensively influence the network and cause serious damages. In the thesis, we analyze these two critical distributed attacks. We propose an intrusion detection approach against this kind of attacks and implement an attack detection system based on the approach. We use anomaly detection of intrusion detecting techniques and observed the anomalous distribution of packet fields to perform the detection. The proposed approach records the characteristics of normal traffic volumes so that to make detections more flexible and more precise. Finally, we evaluated our approach by experiments.

No description available.

<p> 101 samples of Thorold sandstone were collected from 12 geographically distinct regions along the Niagara Escarpment. The average number of vertical worm tubes in each region was determined as was clay content, organic matter, burrow diameter, interburrow distance, mean grain size, sorting, quartz proportion, distance from shore, porosity, and the sandstone/shale ratio. Stepwise linear regression and principal component analysis were used to investigate relationships between the variables. The number of worm tubes can be predicted by clay content, organic matter, distance from the shore, and porosity, a model which explains 62% of the observed variation. All 11 variables accounted for 99. 9% of the variation. Distance from shore can be predicted by organic matter, burrow diameter, mean grain size, and the sandstone/shale ratio, a model which explains 94% of the variation. All 11 variables accounted for 99.9% of the variation. Organisms living in the Thorold evidently reacted to environmental parameters in a similar fashion to modern tidal flat organisms.</p> / Thesis / Bachelor of Science (BSc)

Stylaria is a genus of globally distributed clitellates consisting of two recognized species with a difficult taxonomic history: Stylaria lacustris and Stylaria fossularis. The current species-level taxonomy of this genus is unclear due to variation in several morphological characters. To assess the amount of species-level diversity in Stylaria, an integrative approach using morphological investigations and genetic information was employed. I investigated the phylogenetics of this genus using three loci, two mitochondrial (cox1, and rrnL), and one nuclear (ITS) gene regions. Using several species delimitation tools, I was able to estimate the number of species in this group. Automatic barcode gap discovery, assemble species by automatic partitioning (ASAP), and the Geneious Prime Species delimitation package all delimited at least five species within Stylaria, Bayesian Poisson Tree Processes(bPTP) recovered at least six, and DELINEATE proposed only three species, all within S. fossularis. Morphologically, there seems to be no clear, consistent distinction between members of S. lacustris from Europe and S. lacustris from North America. Based on my morphological investigations and disagreement among species delimitation methods, I conservatively propose that the subclades discovered via phylogenetic analysis of mitochondrial and nuclear sequence data within S. lacustris represent population-level rather than species-level variation. However, there appear to be at least two previously unknown species in need of proper descriptions within the S. fossularis species complex. Within Stylaria, morphological criteria might be useless at the species level as there is a high level of intraspecific morphological variation. Analyses of sexual characteristics of this group could help further document any differences between populations of S. lacustris.

No abstract provided. / Thesis / Bachelor of Science (BSc)

The purpose of this study has been to determine the identity and the life history of certain larvae attacking dewberry fruits and foliage in a few sections of Utah. The dewberry fruit worm as it was called until it was definitely identified the oblique-banded leaf-roller, was first observed by farmers at Granite and Butlerville in 1932. Since 1934 it has been found affecting dewberries in other parts of northern Utah. This investigation was begun in the spring of 1935 and continued until the fall of 1936, being made possible through the Utah Agricultural Experiment Station, Department of Entomology, and with the cooperation of various farmers in the vicinity of Granite, Utah. Field studies were made at Granite, Butlerville and southeast Pleasant Grove during the course of the investigation. Overwintering studies were carried on at Logan during the winter of 1935-36. Since this insect is one of the most important pests of dewberries in Utah a careful study of its life history and habits was considered necessary before control methods were undertaken.

Bluetooth is one of the most popular technologies in the world in the new century. Meanwhile it attracts attackers to develop new worm and malicious code attacking Bluetooth wireless network. So far the growth of mobile malicious code is very fast and they have become a great potential threat to our society. In this thesis, we study Bluetooth worm in Mobile Wireless Network. Firstly we investigate the Bluetooth technology and several previously appeared Bluetooth worms, e.g. "Caribe","Comwar", and we find the infection cycle of a Bluetooth worm. Next, we develop a new simulator, Bluetooth Worm simulator (BTWS), which simulates Bluetooth worm' behaviors in Mobile wireless networks. Through analyzing the result, we find i) In ideal environment the mobility of Bluetooth device can improve the worm's propagation speed, but combining mobility and inquiry time issue would cause a Bluetooth worm to slow down its propagation under certain situation. ii) The number of initially infected Bluetooth devices mostly affects the beginning propagation speed of a worm, and energy issue can be ignored because the new technology can let Bluetooth device keeping work for a long time. iii) Co-channel interference and setting up monitoring system in public place can improve the security of Bluetooth wireless network.

Since the Morris worm was released in 1988, Internet worms continue to be one of top security threats. For example, the Conficker worm infected 9 to 15 million machines in early 2009 and shut down the service of some critical government and medical networks. Moreover, it constructed a massive peer-to-peer (P2P) botnet. Botnets are zombie networks controlled by attackers setting out coordinated attacks. In recent years, botnets have become the number one threat to the Internet. The objective of this research is to characterize spatial-temporal infection structures of Internet worms, and apply the observations to study P2P-based botnets formed by worm infection. First, we infer temporal characteristics of the Internet worm infection structure, i.e., the host infection time and the worm infection sequence, and thus pinpoint patient zero or initially infected hosts. Specifically, we apply statistical estimation techniques on Darknet observations. We show analytically and empirically that our proposed estimators can significantly improve the inference accuracy. Second, we reveal two key spatial characteristics of the Internet worm infection structure, i.e., the number of children and the generation of the underlying tree topology formed by worm infection. Specifically, we apply probabilistic modeling methods and a sequential growth model. We show analytically and empirically that the number of children has asymptotically a geometric distribution with parameter 0.5, and the generation follows closely a Poisson distribution. Finally, we evaluate bot detection strategies and effects of user defenses in P2P-based botnets formed by worm infection. Specifically, we apply the observations of the number of children and demonstrate analytically and empirically that targeted detection that focuses on the nodes with the largest number of children is an efficient way to expose bots. However, we also point out that future botnets may self-stop scanning to weaken targeted detection, without greatly slowing down the speed of worm infection. We then extend the worm spatial infection structure and show empirically that user defenses, e.g., patching or cleaning, can significantly mitigate the robustness and the effectiveness of P2P-based botnets. To counterattack, we evaluate a simple measure by future botnets that enhances topology robustness through worm re-infection.

Worms have been improved and a range of sophisticated techniques have been integrated, which make the detection and response processes much harder and longer than in the past. Therefore, in this thesis, a STAKCERT (Starter Kit for Computer Emergency Response Team) model is built to detect worms attack in order to respond to worms more efficiently. The novelty and the strengths of the STAKCERT model lies in the method implemented which consists of STAKCERT KDD processes and the development of STAKCERT worm classification, STAKCERT relational model and STAKCERT worm apoptosis algorithm. The new concept introduced in this model which is named apoptosis, is borrowed from the human immunology system has been mapped in terms of a security perspective. Furthermore, the encouraging results achieved by this research are validated by applying the security metrics for assigning the weight and severity values to trigger the apoptosis. In order to optimise the performance result, the standard operating procedures (SOP) for worm incident response which involve static and dynamic analyses, the knowledge discovery techniques (KDD) in modeling the STAKCERT model and the data mining algorithms were used. This STAKCERT model has produced encouraging results and outperformed comparative existing work for worm detection. It produces an overall accuracy rate of 98.75% with 0.2% for false positive rate and 1.45% is false negative rate. Worm response has resulted in an accuracy rate of 98.08% which later can be used by other researchers as a comparison with their works in future.

No description available.