Introduction/purpose: The artificial immune system is a computational model inspired by the biological or human immune system. Of particular interest in artificial immune systems is the way the human ...body reacts to new pathogens and adapts to remain immune for a long period after a disease has been combated, which refers to the recognition of known malicious attacks and the way the immune system identifies self-cells not to be reacted to, which refers to the anomaly detection. Methods: Negative selection, positive selection, clonal selection, immune networks, danger theory, and dendritic cell algorithm are presented. Results: A variety of algorithms and models related to artificial immune systems and two classification principles are presented; one based on the detection of a particular attack and the other based on anomaly detection. Conclusion: Artificial immune systems are often used in intrusion detection since they are accurate and fast. Experiments show that the models can be used in both known attack and anomaly detection. Eager machine learning classifiers show better results in the decision, which is an advantage if runtime is not a significant parameter. Dendritic cell and negative selection algorithms show better results for real-time detection.
Introduction: Analyzing the high-dimensional datasets used for intrusion detection becomes a challenge for researchers. This paper presents the most often used data sets. ADFA contains two data sets ...containing records from Linux/Unix. AWID is based on actual traces of normal and intrusion activity of an IEEE 802.11 Wi-Fi network. CAIDA collects data types in geographically and topologically diverse regions. In CIC-IDS2017, HTTP, HTTPS, FTP, SSH, and email protocols are examined. CSECIC-2018 includes abstract distribution models for applications, protocols, or lower-level network entities. DARPA contains data of network traffic. ISCX 2012 dataset has profiles on various multi-stage attacks and actual network traffic with background noise. KDD Cup '99 is a collection of data transfer from a virtual environment. Kyoto 2006+ contains records of real network traffic. It is used only for anomaly detection. NSL-KDD corrects flaws in the KDD Cup '99 caused by redundant and duplicate records. UNSW-NB-15 is derived from real normal data and the synthesized contemporary attack activities of the network traffic. Methods: This study uses both quantitative and qualitative techniques. The scientific references and publicly accessible information about given dataset are used. Results: Datasets are often simulated to meet objectives required by a particular organization. The number of real datasets are very small compared to simulated dataset. Anomaly detection is rarely used today. Conclusion: 95 The main characteristics and a comparative analysis of the data sets in terms of the date they were created, the size, the number of features, the traffic types, and the purpose are presented.
Introduction/purpose: The anomaly-based intrusion detection system detects intrusions based on a reference model which identifies the normal behavior of a computer network and flags an anomaly. ...Machine-learning models classify intrusions or misuse as either normal or anomaly. In complex computer networks, the number of training records is large, which makes the evaluation of the classifiers computationally expensive. Methods: A feature selection algorithm that reduces the dataset size is presented in this paper. Results: The experiments are conducted on the Kyoto 2006+ dataset and four classifier models: feedforward neural network, k-nearest neighbor, weighted k-nearest neighbor, and medium decision tree. The results show high accuracy of the models, as well as low false positive and false negative rates. Conclusion: The three-step pre-processing algorithm for feature selection and instance normalization resulted in improving performances of four binary classifiers and in decreasing processing time. / Введение/цель: Система обнаружения атак, основанных на аномалиях, выявляет вторжение в компьютерную сеть, основываясь на эталонной модели, которая идентифицирует нормальное поведение компьютерной сети, детектируя аномалию. Модели машинного обучения классифицируют вторжения или злоупотребления по двум группам: нормальный трафик или аномалия. Оценка моделей классификаторов является достаточно сложным процессом, так как в сложных компьютерных сетях большое количество обучающих записей. Методы: В данной статье представлен алгоритм выбора атрибутов, который уменьшает множество данных. Результаты: Эксперименты проведены на множестве данных Kyoto 2006+ базы и на четырех моделях классификаторов, с помощью следующих методов: метод нейронной сети с прямой связью, метод k-ближайшего соседа, метод взвешенных kближайших соседей и метод дерева принятия решений. Результаты проведенных экспериментов показали высокую точность моделей. Выводы: Трехступенчатый алгоритм предварительной обработки для выбора атрибутов и нормализации экземпляров обеспечил улучшение характеристик четырех бинарных классификаторов и сократил время обработки данных. / Uvod/cilj: Sistem za detekciju upada koji se zasniva na detekciji anomalije otkriva napad na računarsku mrežu na osnovu referentnog modela koji identifikuje normalno ponašanje računarske mreže i detektuje anomaliju. Modeli mašinskog učenja klasifikuju upade ili zloupotrebe u dve grupe: grupu normalnog saobraćaja i grupu anomalija. U složenim računarskim mrežama broj instanci u obučavajućem skupu može biti veliki, što evaluaciju modela klasifikatora čini teškom. Metode: U radu je prikazan algoritam za izbor atributa koji smanjuje veličinu skupa podataka. Rezultati: Eksperimenti su izvedeni na skupu podataka iz Kyoto 2006+ baze i na četiri modela klasifikatora: modelu feedforward neuronska mreža, modelu k-najbližih suseda, modelu ponderisanih k-najbližih suseda i modelu stabla odlučivanja. Rezultati pokazuju visoku tačnost modela. Zaključak: Preprocesuiranje trokoračnim algoritmom za izbor atributa i normalizaciju instanci rezultiralo je poboljšanjem performansi četiri binarna klasifikatora i smanjilo vreme procesuiranja.
This paper presents a review of three datasets, namely KDD Cup ‘99, NSL-KDD and Kyoto 2006+ datasets, which are widely used in researching intrusion detection in computer networks. The KDD Cup ‘99 ...dataset consists of five million records, each containing 41 features which can classify malicious attacks into four classes: Probe, DoS, U2R and R2L. The KDD Cup ‘99 dataset cannot reflect real traffic data since it was generated by simulation over a virtual computer network. In the NSL-KDD dataset, redundant and duplicate records form the KDD Cup ‘99 dataset are removed from training and test sets, respectively. The Kyoto 2006+ dataset is built on real three year-network traffic data which are labeled as normal (no attack), attack (known attack) and unknown attack. The Kyoto 2006+ dataset contains 14 statistical features derived from the KDD Cup ‘99 dataset and 10 additional features. / В данной работе представлен обзор трех баз данных: KDD Cup ‘99, NSL-KDD и Kyoto 2006+ базa данных, которые широко используются в исследованиях обнаружения взлома компьютерных сетей. KDD Cup ‘99 база данных состоит из пяти миллионов записей, каждая из них содержит 41 атрибут, который может классифицировать атаки по следующим четырем видам: Probe, DoS, U2R и R2L. KDD Cup ‘99 база данных не в состоянии отражать реальные данные, так как она генерирована моделированием на виртуальной компьютерной сети. Из NSL-KDD базы удалены избыточные записи, а дублированные записи удалены из баз обучения и тестирования KDD Cup ’99. Kyoto 2006+ база образована на основании данных трехлетнего реального сетевого трафика, которые обозначены, как: нормальный (не атака), атака (известная атака) и неизвестная атака. Kyoto 2006+ база содержит 14 статистических атрибутов, выбранных из KDD Cup ‘99 базы и дополнительных 10 атрибутов. / U radu je prikazan pregled tri baze podataka: KDD Cup ‘99, NSLKDD i Kyoto 2006+, koje se često koriste u istraživanju detekcije upada u računarske mreže. KDD Cup ‘99 baza podataka sastoji se od pet miliona zapisa, od kojih svaki sadrži 41 atribut, koji mogu da klasifikuju napade u četiri klase: Probe, DoS, U2R i R2L. KDD Cup ‘99 baza podataka ne može da reflektuje realne podatke, jer je generisana simulacijom na virtuelnoj računarskoj mreži. Iz NSL-KDD baze uklonjeni su redundantni zapisi i duplikati iz KDD Cup ‘99 trenintg i test-baze, respektivno. Kyoto 2006+ baza formirana je na osnovu podataka trogodišnjeg realnog mrežnog saobraćaja, koji su označeni kao: normalan (nije napad), napad (poznat napad) i nepoznat napad. Kyoto 2006+ baza sadrži 14 statističkih atributa izdvojenih iz KDD Cup ‘99 baze i dodatnih 10 atributa.
Introduction/purpose: SMART orthopedic systems use fixators with remote monitoring, processing, and communication capabilities to leverage healing progression data for personalized, real-time ...monitoring of a healing process. The fixators incorporate small and compact piezoelectric sensors that generate electrical signals upon the application of force to the piezoelectric diaphragm. This enables doctors to remotely guide fixation devices using indirectly and remotely controlled stepper motors known for their precision and accuracy. Reliability of stepper motors makes them a viable alternative for the mechanical tools traditionally used by doctors for fixator extension. Methods: This study focuses on the evaluation of sensor-based technology in orthopedic applications. The paper presents a theoretical framework for the application of SMART devices in the bone fracture healing process. It delves into the structure and functionality of piezoelectric transducers, offering a comprehensive insight into this technology and various engineering aspects of SMART systems. Results: The implementation of SMART systems has significantly enhanced doctor-patient communication. This improvement is facilitated through a dual-phase process involving gathering, processing, and transmitting the data wirelessly from the patient's (sensor) interface to the doctor who uses specialized software for data analysis and wireless transmission to the stepper motor actuator. Subsequently, the data is forwarded to the decoder at the motor site, where a motor controller generates the control signal for the stepper motor driver. Conclusion: SMART implants can provide doctors with quantitative data that can be used in directing a rehabilitation plan. The sensor-based technology offers insights into the stress induced by the callus formation enabling bidirectional communication between the doctor and the patient. The stepper motor is a tool that aids in personalized treatment from the distance.
Introduction/purpose: The security of systems can be jeopardized by compromising emanations. This paper provides an overview of computer screen attacks. New technologies can be used to exfiltrate ...sensitive data from computer screens. Emission security is the prevention of electromagnetic signal attacks that are conducted or radiated. Methods: This paper examines the impact of a side-channel attack that intercepts compromised information from a computer screen. The leakage of electromagnetic data is also explained. Software-defined radios are described to explain malicious attacks on computer monitors. Results: The source of the electromagnetic signal determines the nature of the side-channel information they carry. The most well-known issue associated with revealing emissions is the possibility of intercepting visual information displayed on computer monitors. Conclusion: Visual data displayed on computer monitors could be intercepted by a software-defined radio which can digitize the desired frequency spectrum directly from an antenna, present it to a digital signal processor, and output it to an application for revealing sensitive data. A Grdović, M. et al, Screen reading: electromagnetic information leakage from the computer monitor, pp.836-855 variety of countermeasures, such as shielding, zoning, soft TEMPEST, and similar techniques, can be used to prevent data leakage.
The development of technology has changed the world economy and induced new political trends. The European Union (EU) and many non-EU member states apply the strategies of information society ...development that raise the level of information security (IS). The Serbian Government (Government) has adopted the Strategy for Information Society in Serbia by 2020 (Strategy), and pointed to the challenges for the development of a modern Serbian information society. This paper presents an overview of the open-ended questions about IS, critical infrastructures and protection of critical infrastructures. Based on publicly available data, some critical national infrastructures are listed. As a possible solution to the problem of IS, the Public Key Infrastructure (PKI)-based Information security integrated information system (ISIIS) is presented. The ISIIS provides modularity and interoperability of critical infrastructures both in Serbia and neighboring countries.
Introduction/purpose: This paper provides an overview of research on computer system vulnerabilities caused by compromised electromagnetic radiation by wireless keyboards. Wireless devices that use ...event-triggered communication have been shown to have critical privacy issues due to the inherent leakage associated with radio frequency emissions. Wireless connectivity technology is a source of signal emanation that must be protected in terms of performance and security. Methods: Wireless device vulnerabilities and side-channel attacks are observed, along with electromagnetic emission of radio waves. Results: The findings highlight a specific wireless keyboard's security and encryption flaws. The results of penetration testing reveal vulnerabilities of targeted wireless keyboards in terms of outdated firmware, encryption, wireless reliability, and connection strength. Conclusion: Wireless keyboards have security flaws that disrupt radio communication, giving a malicious user complete access to the computer to which the keyboard is connected. An attacker can steal sensitive data by observing how the system works using compromised electromagnetic emissions.
This paper presents six critical infrastructure sectors: electric power systems, energy sources and supply, manufacturing, transport and storage of hazardous substances, traffic and transportation, ...information- telecommunication infrastructure, and supply with basic viands. The sources of adverse unwanted events due to accidents, technical faults, natural disasters, and human error are presented. Prediction and prevention of these events are explained in details. / В данной работе приведены шесть видов критической инфраструктуры: электроэнергетические системы, сети распределения и снабжения энергоносителей, производство, сбыт, складирование и хранение опасных материалов, первозка и транспорт, информационно-телекоммуникационные сети, снабжение продуктами питания. В статье также представлены источники возникновения потенциальных аварий, чрезвычайных ситуаций, несчастных случаев, технических ошибок, опасных природных явлений и влияние человеческого фактора. Подробно описаны мероприятия по предотвращению и профилактике приведенных рисков. / U radu je prikazano šest kritičnih infrastruktura: elektroenergetski sistemi, mreža distribucije i snabdevanje energentima, proizvodnja, promet i skladištenje opasnih materija, saobraćaj i transport; informaciono-telekomunikaciona infrastruktura i snabdevanje osnovnim životním namirnicama. Prikazani su izvori mogućih neželjenih događaja usled nezgoda, nesreća, tehničkih grešaka, kvarova, prirodnih nepogoda i uticaja ljudskog faktora. Detaljno su objašnjene prevencija i predikcija ovih događaja.
Neural cryptography based on the tree parity machine (TPM) is presented in this paper. A mutual learning-based synchronization of two networks is studied. The training of the TPM based on the ...Hebbian, anti-Hebbian and random walk as well as on the secure key generation protocol is described. The most important attacks on the key generation process are shown. / В работе представлена нейрокриптография, основанная синхронизации на двух древовидных машин четности (TPM, tree parity machines). Представлен анализ синхронизации методом двунаправленного обучения. Описан ТРМ тренинг, основанный на: правиле Хебба, анти-правиле Хебба и случайном блуждании, а также на протоколе генерации скрытого ключа. В работе приведены самые значимые атаки на процесс генерации ключа. / U ovom radu prikazana je neuronska kriptografija, zasnovana na tree parity mašini (TPM). Proučavana je sinhronizacija dve mreže bazirana na međusobnom obučavanju. Opisan je trening TPM zasnovan na Hebbovom, anti-Hebbovom i random walk protokolu, kao i na protokolu za generisanje tajnog ključa. Prikazani su najznačajniji napadi na proces generisanja ključa.
PDF
