As the complexity of cyber-attacks keeps increasing, new and more robust detection mechanisms need to be developed. The next generation of Intrusion Detection Systems (IDSs) should be able to adapt their detection characteristics based not only on the measureable network traffic, but also on the available highlevel information related to the protected network to improve their detection results. We make use of the Pattern-of-Life (PoL) of a network as the main source of high-level information, which is correlated with the time of the day and the usage of the network resources. We propose the use of a Fuzzy Cognitive Map (FCM) to incorporate the PoL into the detection process. The main aim of this work is to evidence the improved the detection performance of an IDS using an FCM to leverage on network related contextual information. The results that we present verify that the proposed method improves the effectiveness of our IDS by reducing the total number of false alarms; providing an improvement of 9.68% when all the considered metrics are combined and a peak improvement of up to 35.64%, depending on particular metric combination.

Abuse attacks on wireless networks are becoming increasingly sophisticated. Most of the recent research on intrusion detection systems for wireless attacks either focuses on just one layer of observation or uses a limited number of metrics without proper data fusion techniques. However, the true status of a network is rarely accurately detectable by examining only one network layer. The goal of this study is to detect injection types of attacks in wireless networks by fusing multi‐metrics using the Dempster–Shafer (D–S) belief theory. When combining beliefs, an important step to consider is the automatic and self‐adaptive process of basic probability assignment (BPA). This study presents a comparison between manual and automatic BPA methods using the D–S technique. Custom tailoring BPAs in an optimum manner under specific network conditions could be extremely time consuming and difficult. In contrast, automatic methods have the advantage of not requiring any prior training or calibration from an administrator. The results show that multi‐layer techniques perform more efficiently when compared with conventional methods. In addition, the automatic assignment of beliefs makes the use of such a system easier to deploy while providing a similar performance to that of a manual system.

Facial expression recognition forms a critical capability desired by human-interacting systems that aim to be responsive to variations in the human's emotional state. Recent trends toward cloud computing and outsourcing has led to the requirement for facial expression recognition to be performed remotely by potentially untrusted servers. This paper presents a system that addresses the challenge of performing facial expression recognition when the test image is in the encrypted domain. More specifically, to the best of our knowledge, this is the first known result that performs facial expression recognition in the encrypted domain. Such a system solves the problem of needing to trust servers since the test image for facial expression recognition can remain in encrypted form at all times without needing any decryption, even during the expression recognition process. Our experimental results on popular JAFFE and MUG facial expression databases demonstrate that recognition rate of up to 95.24 percent can be achieved even in the encrypted domain.

Monitoring and measuring various metrics of high-speed networks produces a vast amount of information over a long period of time making the storage of the metrics a serious issue. Previous work has suggested stream aware compression algorithms, among others, that is, methodologies that try to organise the network packets in a compact way in order to occupy less storage. However, these methods do not reduce the redundancy in the stream information. Lossy compression becomes an attractive solution, as higher compression ratios can be achieved. However, the important and significant elements of the original data need to be preserved. This study proposes the use of a lossy wavelet compression mechanism that preserves crucial statistical and visual characteristics of the examined computer network measurements and provides significant compression against the original file sizes. To the best of authors' knowledge, this is the first study to suggest and implement a wavelet analysis technique for compressing computer network measurements. Here, wavelet analysis is used and compared against the Gzip and Bzip2 tools for data rate and delay measurements. In addition, this study also provides a comparison of eight different wavelets with respect to the compression ratio, the preservation of the scaling behaviour, of the long-range dependence (LRD), of the mean and standard deviation and of the general reconstruction quality. The results show that the Haar wavelet provides higher peak signal-to-noise ratio (PSNR) values and better overall results, than other wavelets with more vanishing moments. Our proposed methodology has been implemented on an on-line-based measurement platform and compressed data traffic generated from a live network.

The production of a large-scale monitoring system for a high-speed network leads to a number of challenges. These challenges are not purely technical but also socio-political and legal. The number of stakeholders in such monitoring activity is large including the network operators, the users, the equipment manufacturers and, of course, the monitoring researchers. The MASTS project (measurement at all scales in time and space) was created to instrument the high-speed JANET Lightpath network and has been extended to incorporate other paths supported by JANET(UK). Challenges the project has faced included: simple access to the network; legal issues involved in the storage and dissemination of the captured information, which may be personal; the volume of data captured and the rate at which these data appear at store. To this end, the MASTS system will have established four monitoring points each capturing packets on a high-speed link. Traffic header data will be continuously collected, anonymised, indexed, stored and made available to the research community. A legal framework for the capture and storage of network measurement data has been developed which allows the anonymised IP traces to be used for research purposes.

Monitoring and measuring various metrics of high speed and high capacity networks produces a vast amount of information over a long period of time. For the collected monitoring data to be useful to administrators, these measurements need to be analyzed and processed in order to detect interesting characteristics such as sudden changes. In this paper wavelet analysis is used along with the universal threshold proposed by Donoho-Johnstone in order to detect abrupt changes in computer network measurements. Experimental results are obtained to compare the behaviour of the algorithm on delay and data rate signals. Both type of signals are measurements from real networks and not produced from a simulation tool. Results show that detection of anomalies is achievable in a variety of signals.

Honeypots are a useful tool for discovering the distribution of malicious traffic on the Internet and how that traffic evolves over time. In addition, they allow an insight into new attacks appearing. One major problem is analysing the large amounts of data generated by such honeypots and correlating between multiple honeypots. Honey Plotter is a web-based query and visualisation tool to allow investigation into data gathered by a distributed honeypot network. It is built on top of a relational database, which allows great flexibility in the questions that can be asked and has automatic generation of visualisations based on the results of queries. The main focus is on aggregate statistics but individual attacks can also be analysed. Statistical comparison of distributions is also provided to assist with detecting anomalies in the data; helping separate out common malicious traffic from new threats and trends. Two short case studies are presented to give an example of the types of analysis that can be performed.

The task of exploring and analysing large quantities of communication network security data is difficult. Visualisation of the data should help the analyses and make data exploration faster and easier. This paper describes prototype software that visualises the alerts effectively and provides a simple presentation. The needs analysis of this prototype is based on the suggested needs of network security analyst's tasks as seen in the literature. The prototype software incorporates various projections of the alert data in 3-dimensional displays. Filtering, drill-down and playback of alerts at variable speed are incorporated to strengthen the analysis. We integrate a false alert classifier using classification tree algorithm to classify alerts into false and true alerts. Real-time visual observation is also included. We describe some example analyses to prove the usefulness of our prototype.

A wide range of applications have started to use Wireless Sensor Networks (WSNs) as an information collection and monitoring tool. However, the networks may suffer from various factors that degrade their functionality. One of these factors is the frequent deviation of WSN nodes from their normal operation because of sensor device problems, battery issues and harsh environment they are in. These deviations may case a decrease in the quality and the quantity of the collected data, and use more network resources that reduce network lifetime. The goal of this paper is to propose a new distributed performance algorithm that insures the detection of deviations that degrade WSN collected data and reduce their impact on network functionality. Simulation results showed that the proposed algorithm achieved a high-level of detection reliability on node status. In addition, they showed that the proposed algorithm is resilient to both high packet loss and environmental changes.

As communication networks increase in performance and complexity, and more dependence is placed upon them, it becomes ever more important that their behaviour is understood in an efficient and timely manner. Visualisation is an established technique for the presentation of the vast volume of data yielded in monitoring such networks. It is apparent, however, that much of the work in this area has been performed in isolation, and it is timely that a review of this research is conducted. The techniques for the visualisation of communication networks and related measurements are surveyed. The research is classified by the type of visualisation used and is separated into three classes: geographic visualisations, in which the data are presented with respect to the physical location of nodes in the network; abstract topological visualisations, in which the relationships between nodes are presented independently of physical location; and plot-based visualisation, in which the focus is a single point in the network, often presented with respect to time. The research in this area is reviewed and the techniques proposed are discussed in terms of these three classes.

Security within the Internet is a serious concern. The developing e-business culture is undermined by the security threats posed by Internet crime. Traditionally, network security has been managed on a local basis. Several mature technologies exist for threat detection and mitigation at the edges of the network but certain classes of security threat are best combated within the core of the network. This paper presents a threat detection system deployed within the core of a national network. The approach combines the use of light-weight statistical summaries, gathered at distributed points within the network, with data mining techniques, to identify security threats

This paper presents the performance evaluation of a PC-based active router, in terms of packet loss within the router. The architecture of the active router consists of two parts: a software part that is implemented using two Linux hosts and a hardware part that contains a PCI-based FPGA (field programmable gate array) board. A description of the modules comprising the router is given and then the method used to gather the performance evaluation data is described. The main sources for the CPU cycles consumption in the router are highlighted and a method for minimising the packet loss is applied. An example of the active network approach is given by implementing an active secure FTP application. Its performance is compared to that of passive FTP. The performance evaluation of the active secure FTP application reveals several bottlenecks, especially in the hardware extension of the active router

Network performance monitoring is an ongoing process as networks and their users are constantly changing. Networks are subject to various changes, some of which are controlled by the network providers (such as upgrades or re-routes) and some are not (equipment failure, usage). Network monitoring may include the detecting of such changes. These changes can be referred to as network events.

This paper discusses various approaches to the development of an integrated and automated network performance measurement tool. Adopting an object-orientated approach to the entire system design can assist this requirement for intelligence in a distributed manner. The authors have found the JAVA language to greatly assist in this task and this language has been used for all aspects of the system from traffic generation/reception, to the database and display systems. Finally, examples of the systems have been developed and implemented at various levels, from experimental operations on ATM networks, to a prototype operational system on BT's commercial SMDS (Switched Multi-megabit Data Service) network.

The authors describe a series of measurements of the statistics of viewphone-type video signals, with particular regard to the possible transmission of such signals over an asynchronous transfer mode (ATM) network. Measurements include the frame-to-frame differences and the cluster length distribution. It is known that with efficient picture coding, the information rate required for a constant picture quality varies significantly and creates problems in a constant-bit-rate system. The multiplexing of a number of sources in a variable-bit-rate (VBR) system is considered. It is shown that considerable reduction in the variability of the data rate is obtained. While the results are derived from one particular type of picture coder, it is expected that the conclusion will apply to other coding schemes.>