Christof Störmann

Cyber-critical infrastructure protection using real-time payload-based anomaly detection

With an increasing demand of inter-connectivity and protocol standardization modern cyber-critical infrastructures are exposed to a multitude of serious threats that may give rise to severe damage for life and assets without the implementation of proper safeguards. Thus, we propose a method that is capable to reliably detect unknown, exploit-based attacks on cyber-critical infrastructures carried out over the network. We illustrate the effectiveness of the proposed method by conducting experiments on network traffic that can be found in modern industrial control systems. Moreover, we provide results of a throughput measuring which demonstrate the real-time capabilities of our system.

Improving the accuracy of network intrusion detectors by input-dependent stacking

Network intrusion detectors analyze network traffic for detecting attacks in computer networks. Achieving a high detection accuracy and in particular a low number of false alarms is crucial for their practical use. In this paper a new stacking approach is suggested for improving the detection accuracy of anomaly and misuse detectors in network intrusion detection systems. Each detector gets a stacked module as a corrective element that is learned on training data. The stacked module shall raise the detector score in case of a true attack and lower the score in case of a normal connection. This is achieved by combining the detector score with context information (statistical features) about the respective connection, making it possible for example to learn in which context a certain detector is reliable and where it is not. The approach is empirically evaluated using real HTTP and FTP network traffic. The results show that the detectors enhanced by stacking typically are significantly better than the original detectors.

Methods for Exploitation of Fine-Grained Parallelism

Fine-grained parallelism is offered by an increasing number of processors. This kind of parallelism increases performance for all kinds of applications, including general-purpose code; most promising is the combination with coarse-grained parallelism. Unlike coarse-grained parallelism it can be exploited by automatic parallelization. This paper presents program analysis and transformation methods for exploitation of fine-grained parallelism, based on global instruction scheduling.