Ana Georgina Flesia

Multiscale stepping-stone detection: detecting pairs of jittered interactive streams by exploiting maximum tolerable delay

Computer attackers frequently relay their attacks through a compromised host at an innocent site, thereby obscuring the true origin of the attack. There is a growing literature on ways to detect that an interactive connection into a site and another outbound from the site give evidence of such a stepping stone. This has been done based on monitoring the access link connecting the site to the Internet (Eg. [7,11, 8]). The earliest work was based on connection content comparisons but more recent work has relied on timing information in order to compare encrypted connections. Past work on this problem has not yet attempted to cope with the ways in which intruders might attempt to modify their traffic to defeat stepping stone detection. In this paper we give the first consideration to constraining such intruder evasion. We present some unexpected results that show there are theoretical limits on the ability of attackers to disguise their traffic in this way for sufficiently long connections. We consider evasions that consist of local jittering of packet arrival times (without addition and subtraction of packets), and also the addition of superfluous packets which will be removed later in the connection chain (chaff). To counter such evasion, we assume that the intruder has a maximum delay tolerance. By using wavelets and similar multiscale methods, we show that we can separate the short-term behavior of the streams - where the jittering or chaff indeed masks the correlation - from the long-term behavior of the streams - where the correlation remains. It therefore appears, at least in principle, that there is an effective countermeasure to this particular evasion tactic, at least for sufficiently long-lived interactive connections.

Digital Ridgelet Transform Based on True Ridge Functions

Abstract We study a notion of ridgelet transform for arrays of digital data in which the analysis operator uses true ridge functions, as does the synthesis operator. There are fast algorithms for analysis, for synthesis, and for partial reconstruction. Associated with this is a transform which is a digital analog of the orthonormal ridgelet transform (but not orthonormal for finite n). In either approach, we get an overcomplete frame; the result of ridgelet transforming an n × n array is a 2n × 2n array. The analysis operator is invertible on its range; the appropriately preconditioned operator has a tightly controlled spread of singular values. There is a near-parseval relationship. Our construction exploits the recent development by Averbuch et al. (2001) of the Fast Slant Stack, a Radon transform for digital image data; it may be viewed as following a Fast Slant Stack with fast 2-d wavelet transform. A consequence of this construction is that it offers discrete objects (discrete ridgelets, discrete Radon transform, discrete Pseudopolar Fourier domain) which obey inter-relationships paralleling those in the continuum ridgelet theory (between ridgelets, Radon transform, and polar Fourier domain). We make comparisons with other notions of ridgelet transform, and we investigate what we view as the key issue: the summability of the kernel underlying the constructed frame. The sparsity observed in our current implementation is not nearly as good as the sparsity of the underlying continuum theory, so there is room for substantial progress in future implementations.

Digital Implementation of Ridgelet Packets

Abstract The Ridgelet Packets library provides a large family of orthonormal bases for functions f ( x,y ) in L 2 ( dxdy ) which includes orthonormal ridgelets as well as bases deriving from tilings reminiscent from the theory of wavelets and the study of oscillatory Fourier integrals. An intuitively appealing feature: many of these bases have elements whose envelope is strongly aligned along specified ‘ridges’ while displaying oscillatory components across the main ‘ridge’. There are two approaches to constructing ridgelet packets; the most direct is a frequency-domain viewpoint. We take a recursive dyadic partition of the polar Fourier domain into a collection of rectangular tiles of various widths and lengths. Focusing attention on each tile in turn, we take a tensor basis, using windowed sinusoids in θ times windowed sinusoids in r. There is also a Radon-domain approach to constructing ridgelet packets, which involves applying the Radon isometry and then, in the Radon plane, using wavelets in θ times wavelet packets in t, with the scales of the wavelets in the two directions carefully related. We discuss digital implementations of the two continuum approaches, yielding many new frames for representation of digital images I ( i,j ). These rely on two tools: the pseudopolar Fast Fourier Transform, and a pseudo Radon isometry called the normalized Slant Stack; these are described in Averbuch et al. (2001). In the Fourier approach, we mimic the continuum Fourier approach by partitioning the pseudopolar Fourier domain, building an orthonormal basis in the image space subordinate to each tile of the partition. On each rectangle of the partition, we use windowed sinusoids in θ times windowed sinusoids in r. In the Radon approach, we operate on the pseudo-Radon plane, and mimic the construction of orthonormal ridgelets, but with different scaling relationships between angular wavelets and ridge wavelets. Using wavelet packets in the ridge direction would also be possible. Because of the wide range of possible ridgelet packet frames, the question arises: what is the best frame for a given dataset? Because of the Cartesian format of our 2-D pseudopolar domain, it is possible to apply best-basis algorithms for best anisotropic cosine packets bases; this will rapidly search among all such frames for the best possible frame according to a sparsity criterion – compare N. Bennetts 1997 Yale Thesis. This automatically finds the best ridgelet packet frame for a given dataset.

Testing statistical hypothesis on random trees and applications to the protein classification problem

Efficient automatic protein classification is of central importance in genomic annotation. As an independent way to check the reliability of the classification, we propose a statistical approach to test if two sets of protein domain sequences coming from two families of the Pfam database are significantly different. We model protein sequences as realizations of Variable Length Markov Chains (VLMC) and we use the context trees as a signature of each protein family. Our approach is based on a Kolmogorov―Smirnov-type goodness-of-fit test proposed by Balding et al. [Limit theorems for sequences of random trees (2008), DOI: 10.1007/s11749-008-0092-z]. The test statistic is a supremum over the space of trees of a function of the two samples; its computation grows, in principle, exponentially fast with the maximal number of nodes of the potential trees. We show how to transform this problem into a max-flow over a related graph which can be solved using a Ford―Fulkerson algorithm in polynomial time on that number. We apply the test to 10 randomly chosen protein domain families from the seed of Pfam-A database (high quality, manually curated families). The test shows that the distributions of context trees coming from different families are significantly different. We emphasize that this is a novel mathematical approach to validate the automatic clustering of sequences in any context. We also study the performance of the test via simulations on Galton―Watson related processes.

Network dynamics: quantitative analysis of complex behavior in metabolism, organelles, and cells, from experiments to models and back

Advancing from two core traits of biological systems: multilevel network organization and nonlinearity, we review a host of novel and readily available techniques to explore and analyze their complex dynamic behavior within the framework of experimental–computational synergy. In the context of concrete biological examples, analytical methods such as wavelet, power spectra, and metabolomics–fluxomics analyses, are presented, discussed, and their strengths and limitations highlighted. Further shown is how time series from stationary and nonstationary biological variables and signals, such as membrane potential, high‐throughput metabolomics, O2 and CO2 levels, bird locomotion, at the molecular, (sub)cellular, tissue, and whole organ and animal levels, can reveal important information on the properties of the underlying biological networks. Systems biology‐inspired computational methods start to pave the way for addressing the integrated functional dynamics of metabolic, organelle and organ networks. As our capacity to unravel the control and regulatory properties of these networks and their dynamics under normal or pathological conditions broadens, so is our ability to address endogenous rhythms and clocks to improve health‐span in human aging, and to manage complex metabolic disorders, neurodegeneration, and cancer. WIREs Syst Biol Med 2017, 9:e1352. doi: 10.1002/wsbm.1352

Generalized method for sampling spatially correlated heterogeneous speckeled imagery

This paper presents a general result for the simulation of correlated heterogeneous targets, which are present in images corrupted by speckle noise. This technique is based on the use of a correlation mask and Gaussian random variables, in order to obtain spatially dependent Gamma deviates. These Gamma random variables, in turn, allow the obtainment of correlated deviates with specified correlation structure. The theoretical properties of the procedure are presented, along with the corresponding algorithm.

Unsupervised edge map scoring: A statistical complexity approach ☆

We propose a new Statistical Complexity Measure (SCM) to qualify edge maps without Ground Truth (GT) knowledge. The measure is the product of two indices, an \emph{Equilibrium} index

Inference strategies for the smoothness parameter in the Potts model

\mathcal{E}

Assessment of long-range correlation in animal behavior time series: The temporal pattern of locomotor activity of Japanese quail (Coturnix coturnix) and mosquito larva (Culex quinquefasciatus)

obtained by projecting the edge map into a family of edge patterns, and an \emph{Entropy} index

External visual interface for a Nikon 6D autocollimator

\mathcal{H}