Detecting zero-day attacks using context-aware anomaly detection at the application-layer

Anomaly detection allows for the identification of unknown and novel attacks in network traffic. However, current approaches for anomaly detection of network packet payloads are limited to the analysis of plain byte sequences. Experiments have shown that application-layer attacks become difficult to detect in the presence of attack obfuscation using payload customization. The ability to incorporate syntactic context into anomaly detection provides valuable information and increases detection accuracy. In this contribution, we address the issue of incorporating protocol context into payload-based anomaly detection. We present a new data representation, called \({c}_n\)-grams, that allows to integrate syntactic and sequential features of payloads in an unified feature space and provides the basis for context-aware detection of network intrusions. We conduct experiments on both text-based and binary application-layer protocols which demonstrate superior accuracy on the detection of various types of attacks over regular anomaly detection methods. Furthermore, we show how \({c}_n\)-grams can be used to interpret detected anomalies and thus, provide explainable decisions in practice.     

The Asynchronous Bounded-Cycle model

This paper shows how synchrony conditions can be added to the purely asynchronous model in a way that avoids any reference to message delays and computing step times, as well as system-wide constraints on execution patterns and network topology. Our Asynchronous Bounded-Cycle (ABC) model just bounds the ratio of the number of forward- and backward-oriented messages in certain (“relevant”) cycles in the space-time diagram of an asynchronous execution. We show that clock synchronization and lock-step rounds can be implemented and proved correct in the ABC model, even in the presence of Byzantine failures. Furthermore, we prove that any algorithm working correctly in the partially synchronous Θ-Model also works correctly in the ABC model. In our proof, we first apply a novel method for assigning certain message delays to asynchronous executions, which is based on a variant of Farkas’ theorem of linear inequalities and a non-standard cycle space of graphs. Using methods from point-set topology, we then prove that the existence of this delay assignment implies model indistinguishability for time-free safety and liveness properties. We also introduce several weaker variants of the ABC model, and relate our model to the existing partially synchronous system models, in particular, the classic models of Dwork, Lynch and Stockmayer and the query-response model by Mostefaoui, Mourgaya, and Raynal. Finally, we discuss some aspects of the ABC model’s applicability in real systems, in particular, in the context of VLSI Systems-on-Chip.     

Solvatochromic betaine dyes as optochemical sensor materials: detection of polar and non-polar vapors

Solvatochromic effects in the UV/VIS spectra of dyes can be applied to the monitoring of solvents in the gaseous phase. Within the class of solvatochromic dyes Reichhardt's betaine reveals an outstanding hypsochromic effect on protic solvents with a band shift of up to 350 nm. For vapor detection, the sensor behavior was optimized according to the linearity of the response signal, the sensitivity and a minimum influence of humidity by hydrophobizing siloxanes as additives. Furthermore, the dyes were immobilized under mild conditions by a sol–gel process which generates a high porosity for easy analyte access. The detection principle could be further extended to aprotic, polar solvents by embedding the dyes in protic matrices that form hydrogen bonds to the betaine oxygen. Then, the analyte disturbs the hydrogen bonds resulting in a bathochromic band shift resembling a back titration. Finally, the betaine phenol blue even allows the detection of halogenated hydrocarbons that lack a pronounced functionality but nonetheless a hyperchromic effect occurs during analyte exposition. Mechanistic aspects of these solvent absorption processes were traced by mass-sensitive measurements.     

Convergence analysis of geometrical multigrid methods for solving data-sparse boundary element equations

The convergence analysis of multigrid methods for boundary element equations arising from negative-order pseudo-differential operators is quite different from the usual finite element multigrid analysis for elliptic partial differential equations. In this paper, we study the convergence of geometrical multigrid methods for solving large-scale, data-sparse boundary element equations. In particular, we investigate multigrid methods for \(\mathcal{H}\)-matrices arising from the adaptive cross approximation to the single layer potential operator.     

Platform Independent Timing of Java Virtual Machine Bytecode Instructions

The accurate measurement of the execution time of Java bytecode is one factor that is important in order to estimate the total execution time of a Java application running on a Java Virtual Machine. In this paper we document the difficulties and solutions for the accurate timing of Java bytecode. We also identify trends across the execution times recorded for all imperative Java bytecodes. These trends would suggest that knowing the execution times of a small subset of the Java bytecode instructions would be sufficient to model the execution times of the remainder. We first review a statistical approach for achieving high precision timing results for Java bytecode using low precision timers and then present a more suitable technique using homogeneous bytecode sequences for recording such information. We finally compare instruction execution times acquired using this platform independent technique against execution times recorded using the read time stamp counter assembly instruction. In particular our results show the existence of a strong linear correlation between both techniques.     

Analysis of the human immune response to vaccinia by use of a novel protein microarray suggests that antibodies recognize less than 10% of the total viral proteome

Control of smallpox by mass vaccination was one of the most effective public health measures ever employed for eradicating a devastating infectious disease. However, new methods are needed for monitoring smallpox immunity within current vulnerable populations, and for the development of replacement vaccines for use by immunocompromized or low-responding individuals. As a measure for achieving this goal, we developed a protein microarray of the vaccinia virus proteome by using high-throughput baculovirus expression and purification of individual elements. The array was validated with therapeutic-grade, human hyperimmune sera, and these data were compared to results obtained from individuals vaccinated against smallpox using Dryvax. A high level of reproducibility with a very low background were apparent in repetitive assays that confirmed previously reported antigens and identified new proteins that may be important for neutralizing viral infection. Our results suggest that proteins recognized by antibodies from all vaccinees constituted <10% of the total vaccinia proteome.     

Muscular capabilities and workload of flight attendants for pushing and pulling trolleys aboard aircraft

Increasingly in the recent years, passengers’ services are extended into the ascent and descent flight phases on short distance flights. Trolleys containing the required meal and beverage items are used for these service operations and pushed or pulled along the aisles of the aircraft. Flight attendants reported about increased musculo-skeletal disorders and had been complaining about high physical workload from handling trolleys. In order to ensure acceptable load levels for pushing or pulling operations of trolleys, the physical capabilities of the collective “flight attendants” had been investigated by means of force measurements at maximum voluntary contraction (MVC) level and associated relevant anthropometrical and biometrical data. CEN and ISO standards as well as international and national German methods were used to derive recommended force limits for pushing/pulling operations with respect to the physical capabilities of the target group “flight attendants”. Comparing these recommended limits with the force requirements per shift under various conditions of trolley handlings (inclination of the floor, type and weight of trolley, mode of handling, frequency of operation) showed that especially for higher floor inclinations and trolley weights, flight attendants work (substantially) above recommended limits. It became also apparent that the handling of half-size trolleys is unexpectedly high demanding due to high vertical force components, caused by the unfavorable location of their center of gravity.

Relevance to industry

On short-distance flights, passengers’ services are performed by means of trolleys from the ascent to the descent flight phases. Flight attendants had been complaining about high physical workload. This study offers recommendations on maximum force limits for the handling of trolleys with respect to the muscular capacities and work situations of flight attendants on short-distance flights.     

Physical workload of flight attendants when pushing and pulling trolleys aboard aircraft

The musculoskeletal loads from moving trolleys aboard aircraft were assessed by observation of trolley handling on planes and by physical workload analyses of pushing and pulling of trolleys in a laboratory set up. Trolley handling by a total of 15 female flight attendants was observed on 10 short- and medium-distance flights in different types of aircraft. About 25 selected flight attendants (22 females; 3 males) of five German airlines took part in the laboratory study, which comprised three-dimensional (3D) measurements of posture and hand forces during pushing and pulling of trolleys in a variety of configurations. From the on-flight observations performed, between 150 and 250 trolley movements can be projected for a work shift. The greatest physical workload is to be expected at the beginning of service: The trolleys are fully laden then, and the cabin floor can still be inclined up to 8°, as the aircraft is still climbing, particularly on short-distance flights. The laboratory investigation revealed that the musculoskeletal workload from pushing and pulling depends essentially on the trolley load and on the gradient of the cabin floor. In addition, the degree of stressing depends significantly on the trolley type, mode of handling and personal dexterity. The up/down force component perpendicular to the direction of motion often achieved considerable amplitudes-in some cases equal to or exceeding the force in the direction of movement. The posture analysis demonstrated that pulling forced the flight attendants to adopt ergonomically unfavourable postures such as pronounced flexion of the back, particularly among female subjects. The highest values for flexion of the back occurred while pulling the half-size trolley. The results demonstrate that female flight attendants are likely to overload themselves if they frequently have to move heavily laden trolleys unaided on an inclined cabin floor.

Relevance to industry

On short distance flights, flight attendants have been complaining increasingly of high physical workload from manoeuvring trolleys. On the basis of the presented data airline companies may improve the trolley handling skills of their flight attendances by practical trainings and may ergonomically optimize the general service procedures aboard aircrafts.     

Exploring the Interaction between Java's Implicitly Thrown Exceptions and Instruction Scheduling

The frequent occurrence of implicitly thrown exceptions poses one of the challenges present in a Java compiler. Not only do these implicitly thrown exceptions directly affect the performance by requiring explicit checks, they also indirectly impact the performance by restricting code movement in order to satisfy the precise exception model in Java. In particular, instruction scheduling is one transformation that is restricted by implicitly thrown exceptions due to the heavy reliance on reordering instructions to exploit maximum hardware performance. The goal of this study is two-fold: first, investigate the degree to which implicitly thrown exceptions in Java hinder instruction scheduling, and second, find new techniques for allowing more efficient execution of Java programs containing implicitly thrown exceptions. Experimental results show that with aggressive scheduling techniques, such as superblock scheduling, the negative performance impact can be greatly reduced.