Emin Anarim

An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks

In this paper, we propose a novel Intrusion Detection System (IDS) architecture utilizing both anomaly and misuse detection approaches. This hybrid Intrusion Detection System architecture consists of an anomaly detection module, a misuse detection module and a decision support system combining the results of these two detection modules. The proposed anomaly detection module uses a Self-Organizing Map (SOM) structure to model normal behavior. Deviation from the normal behavior is classified as an attack. The proposed misuse detection module uses J.48 decision tree algorithm to classify various types of attacks. The principle interest of this work is to benchmark the performance of the proposed hybrid IDS architecture by using KDD Cup 99 Data Set, the benchmark dataset used by IDS researchers. A rule-based Decision Support System (DSS) is also developed for interpreting the results of both anomaly and misuse detection modules. Simulation results of both anomaly and misuse detection modules based on the KDD 99 Data Set are given. It is observed that the proposed hybrid approach gives better performance over individual approaches.

Multidirectional and multiscale edge detection via M-band wavelet transform

In this correspondence, the problem of directional and multiscale edge detection is considered. Orthogonal and linear-phase M-band wavelet transform is used to decompose the image into MxM channels. These channels are then combined such that each combination, which we refer to as decomposition filter, results in zero-crossings at the locations of edges corresponding to different directions and resolutions, and inherently performs regularization against noise. By applying a zero-crossing detector on the outputs of the decomposition filters, edge maps of desired resolution and direction are obtained. In addition, with the application of the Teagers energy operator at the analysis stage, it is possible to obtain a reduction in unwanted zero-crossings. Final edge maps of images are obtained through simple combinations of directional edge maps.

Perceptual audio hashing functions

Perceptual hash functions provide a tool for fast and reliable identification of content. We present new audio hash functions based on summarization of the time-frequency spectral characteristics of an audio document. The proposed hash functions are based on the periodicity series of the fundamental frequency and on singular-value description of the cepstral frequencies. They are found, on one hand, to perform very satisfactorily in identification and verification tests, and on the other hand, to be very resilient to a large variety of attacks. Moreover, we address the issue of security of hashes and propose a keying technique, and thereby a key-dependent hash function.

Image Error Concealment Using Watermarking with Subbands for Wireless Channels

Transmission of block-coded images through error-prone wireless channels often results in lost blocks. In this study, we investigate a novel error concealment method for covering up these high packet losses and reconstructing a close approximation. Our scheme is a modified discrete wavelet transform (DWT) technique (namely, subbands based image error concealment (SIEC)) for embedding downsized replicas of original image into itself. We propose that this technique can be implemented for wireless channels to combat degradations in a backward-compatible scheme. We show that the proposed error concealment technique is promising, especially for the erroneous channels causing a wider range of packet losses, at the expense of computational burden

Scalability and Security Conflict for RFID Authentication Protocols

RFID technology continues to flourish as an inherent part of virtually every ubiquitous environment. However, it became clear that the public—implying the industry—seriously needs mechanisms emerging the security and privacy issues for increasing RFID applications. As the nodes of RFID systems mostly suffer from low computational power and small memory size, various attempts which propose to implement the existing security primitives and protocols, have ignored the realm of the cost limitations and failed. In this study, two recently proposed protocols—SSM and LRMAP—claiming to meet the standard privacy and security requirements are analyzed. The design of both protocols based on defining states where the server authenticates the tag in constant time in a more frequent normal state and needs a linear search in a rare abnormal states. Although both protocols claim to provide untraceability criteria in their design objectives, we outline a generic attack that both protocols failed to fulfill this claim. Moreover, we showed that the SSM protocol is vulnerable to a desynchronization attack which prevents a server from authenticating a legitimate tag. Resultantly, we conclude that defining computationally unbalanced tag states yields to a security/scalability conflict for RFID authentication protocols.

Network-based anomaly intrusion detection system using SOMs

Network-based anomaly intrusion detection systems using artificial neural networks are investigated. From knowledge of only normal traffic data, a mathematical model describing normal traffic is constructed and a test is conducted based on the deviations from the mathematical model. A self-organizing map (SOM) structure is used for constructing the mathematical model describing normal traffic and anomaly detection. The SOM structure preserves topological mappings between representations. A feature which is desired when classifying normal or intrusive behavior for network data, our hypothesis is that normal traffic representing normal behavior would be clustered around one or more cluster centers and any irregular traffic representing abnormal, and possibly suspicious, behavior would be clustered outside of the normal clustering or inside with high quantization error. The SOM is trained with normal traffic data and by considering the best matching unit or clustering region and the quantization error, the type of traffic is determined.

Location estimation using RSS measurements with unknown path loss exponents

The location of a mobile station (MS) in a cellular network can be estimated using received signal strength (RSS) measurements that are available from control channels of nearby base stations. Most of the recent RSS-based location estimation methods that are available in the literature rely on the rather unrealistic assumption that signal propagation characteristics are known and independent of time variations and the environment. In this paper, we propose an RSS-based location estimation technique, so-called multiple path loss exponent algorithm (RSS-MPLE), which jointly estimates the propagation parameters and the MS position. The RSS-MPLE method incorporates antenna radiation pattern information into the signal model and determines the maximum likelihood estimate of unknown parameters by employing the Levenberg-Marquardt method. The accuracy of the proposed method is further examined by deriving the Cramer-Rao bound. The performance of the RSS-MPLE algorithm is evaluated for various scenarios via simulation results which confirm that the proposed scheme provides a practical position estimator that is not only accurate but also robust against the variations in the signal propagation characteristics.

Motion estimation in the frequency domain using fuzzy c-planes clustering

A recent work explicitly models the discontinuous motion estimation problem in the frequency domain where the motion parameters are estimated using a harmonic retrieval approach. The vertical and horizontal components of the motion are independently estimated from the locations of the peaks of respective periodogram analyses and they are paired to obtain the motion vectors using a procedure proposed. In this paper, we present a more efficient method that replaces the motion component pairing task and hence eliminates the problems of the pairing method described. The method described in this paper uses the fuzzy c-planes (FCP) clustering approach to fit planes to three-dimensional (3-D) frequency domain data obtained from the peaks of the periodograms. Experimental results are provided to demonstrate the effectiveness of the proposed method.

Subspace-based frequency estimation of sinusoidal signals in alpha-stable noise

In the frequency estimation of sinusoidal signals observed in impulsive noise environments, techniques based on Gaussian noise assumption are unsuccessful. One possible way to find better estimates is to model the noise as an alpha-stable process and to use the fractional lower order statistics (FLOS) of the data to estimate the signal parameters. In this work, we propose a FLOS-based statistical average, the generalized covariation coefficient (GCC). The GCCs of multiple sinusoids for unity moment order in SαS noise attain the same form as the covariance expressions of multiple sinusoids in white Gaussian noise. The subspace-based frequency estimators FLOS-multiple signal classification (MUSIC) and FLOS-Bartlett are applied to the GCC matrix of the data. On the other hand, we show that the multiple sinusoids in SαS noise can also be modeled as a stable autoregressive moving average process approximated by a higher order stable autoregressive (AR) process. Using the GCCs of the data, we obtain FLOS versions of Tufts-Kumaresan (TK) and minimum norm (MN) estimators, which are based on the AR model. The simulation results show that techniques employing lower order statistics are superior to their second-order statistics (SOS)-based counterparts, especially when the noise exhibits a strong impulsive attitude. Among the estimators, FLOS-MUSIC shows a robust performance. It behaves comparably to MUSIC in non-impulsive noise environments, and both in impulsive and non-impulsive high-resolution scenarios. Furthermore, it offers a significant advantage at relatively high levels of impulsive noise contamination for distantly located sinusoidal frequencies.

A comparative study of moment invariants and Fourier descriptors in planar shape recognition

Recent developments in the area of pattern recognition have brought up various methodologies to the problem of planar shape recognition. In this study, two popular feature sets, namely moment invariants and Fourier descriptors are applied to the problem of classification of 2-D images of airplanes, and their performance is compared vis-a-vis computational load and accuracy. An alternative form of the moment invariant technique, Zernike moments, is also compared with ordinary moment invariants.<<ETX>>