Adding Contextual Information to Intrusion Detection Systems Using Fuzzy Cognitive Maps

The file attached to this record is the author's final peer reviewed version. The Publisher's final version can be found by following the DOI link.In the last few years there has been considerable increase in the efficiency of Intrusion Detection Systems (IDSs). However, networks are still the victim of attacks. As the complexity of these attacks keeps increasing, new and more robust detection mechanisms need to be developed. The next generation of IDSs should be designed incorporating reasoning engines supported by contextual information about the network, cognitive information and situational awareness to improve their detection results. In this paper, we propose the use of a Fuzzy Cognitive Map (FCM) in conjunction with an IDS to incorporate contextual information into the detection process. We have evaluated the use of FCMs to adjust the Basic Probability Assignment (BPA) values defined prior to the data fusion process, which is crucial for the IDS that we have developed. The experimental results that we present verify that FCMs can improve the efficiency of our IDS by reducing the number of false alarms, while not affecting the number of correct detections

Adding contextual information to intrusion detection systems using fuzzy cognitive maps

In the last few years there has been considerable increase in the efficiency of Intrusion Detection Systems (IDSs). However, networks are still the victim of attacks. As the complexity of these attacks keeps increasing, new and more robust detection mechanisms need to be developed. The next generation of IDSs should be designed incorporating reasoning engines supported by contextual information about the network, cognitive information from the network users and situational awareness to improve their detection results. In this paper, we propose the use of a Fuzzy Cognitive Map (FCM) in conjunction with an IDS to incorporate contextual information into the detection process. We have evaluated the use of FCMs to adjust the Basic Probability Assignment (BPA) values defined prior to the data fusion process, which is crucial for the IDS that we have developed. The results that we present verify that FCMs can improve the efficiency of our IDS by reducing the number of false alarms, while not affecting the number of correct detections

A Threat Assessment Model under Uncertain Environment

Threat evaluation is extremely important to decision makers in many situations, such as military application and physical protection systems. In this paper, a new threat assessment model based on interval number to deal with the intrinsic uncertainty and imprecision in combat environment is proposed. Both objective and subjective factors are taken into consideration in the proposed model. For the objective factors, the genetic algorithm (GA) is used to search out an optimal interval number representing all the attribute values of each object. In addition, for the subjective factors, the interval Analytic Hierarchy Process (AHP) is adopted to determine each object’s threat weight according to the experience of commanders/experts. Then a discounting method is proposed to integrate the objective and subjective factors. At last, the ideal of Technique for Order Preference by Similarity to Ideal Solution (TOPSIS) is applied to obtain the threat ranking of all the objects. A real application is used to illustrate the effectiveness of the proposed model

An evolutionary approach to optimising neural network predictors for passive sonar target tracking

Object tracking is important in autonomous robotics, military applications, financial time-series forecasting, and mobile systems. In order to correctly track through clutter, algorithms which predict the next value in a time series are essential. The competence of standard machine learning techniques to create bearing prediction estimates was examined. The results show that the classification based algorithms produce more accurate estimates than the state-of-the-art statistical models. Artificial Neural Networks (ANNs) and K-Nearest Neighbour were used, demonstrating that this technique is not specific to a single classifier. [Continues.

Changes to the Amplification of Risk Information within the British Press: 1985-2017

Research suggests that news reporting of health, science, and environmental hazards during the late 1990s / early 2000s became orientated around the disproportional amplification of risk information. From causal media observations, it has been speculated that the quality of British risk reporting has undergone significant improvements from the mid-2000s onward. This speculative assertion has remained largely under-researched by empirical inquiry. This thesis utilised quantitative and qualitative content analyses, alongside interviews with members of the press, to investigate if British risk reporting has become less amplified over the past thirty years. Both sets of content analyses were conducted on a corpus of British risk reporting (n=63,423) from across the full range of daily national newspapers. The qualitative content analysis investigated the changes to the volume of risk-based news publication, alongside the expression of sensationalist and politicising language. The qualitative content analysis utilised a rhetorical framing analysis to explore the changes to risk amplifying news frames across a sample of highly amplified news stories (n= 1490). The framing analysis sought to investigate the temporal changes to the expression of uncertainty, certainty, blame, trust, stigma and dread within risk reporting. Targeted interviews were conducted with twenty members of the British press who have reported on health, science, and environmental risks across their career. The interview schedule was designed to explore the changes to risk-based newswork across four distinct areas: (1) key historic news stories, (2) changing responsibilities and skills of newswork, (3) changes to the process of reporting risk information, (4) changing newsroom dynamics. The data generated from these investigations provided evidence to suggest that amplified reporting of risk information is subject to the prevailing professional conventions embedded across four distinct periods of risk reporting. The first period of risk reporting extended from 1985-1994 can be described as a period of low-risk amplification. The first period of risk reporting is characterised by a relatively low volume of risk reporting and high expression of uncertainty frames. Evidence suggests that, during this first period, risk reporters faced systemic difficulties in accessing reliable and credible scientific news sources. Risk reporters would have to rely on journalistic instincts to process the array of information from conflicting news sources. The relative availability of "pressure group" campaigners made them ideal news sources for risk reporters during the first period, as their agenda driven framing of risk information contrasted well against Government framing of risk within official reports and safety assurances. The second period of risk reporting extended from 1995-2004 can be described as an era of high-risk amplification. The second period of risk reporting was characterised by rapid proliferation of published risk reporting, and the disproportional expression of certainty frames within news. Across the second period, the volume of published risk reporting increased from 803 articles in 1995 to 2654 articles in 2004. In 2000, the published volume of risk reporting peaked at 3187 articles - and would remain uncontested as the year of most risk reporting until 2015 (3514 articles). The increased proliferation and peak volume of risk reporting lend evidence to suggest a major reorientation across British news organisation to focus on promoting risk reporting within their newspapers. During interviews, risk reporters established how the Government's admission of cross-species transmission of BSE/CJD in 1995 validated newspaper information campaigning efforts - which had maintained that cross special transmission was possible, despite Government assurances otherwise. What followed was a 'skeptical phase' of risk reporting, where government safety assurances were openly debated within ongoing newspaper campaigns against risky technologies. The observable increase in certainty frames during the second period were primarily due to the statements provided by contrasting news sources. While government safety assurances openly express a degree of confidence towards the known safety of technologies, statements from pressure group sources were equally confident in their expectation of hidden harms. Furthermore, pressure group sources drew upon historic social facts of risk to confidently suggest that vulnerable populations will be damaged should risky technologies be permitted by government. The third period of risk reporting extends from 2005-2014 and can be described as an era of low-risk amplification. The third period is characterised by high volume of risk reporting, but a correspondingly low exhibition of certainty frames. While the volume of risk reporting published during the third period constitutes 45% of the entire sample, there is further evidence to suggest that risk became less amplified during this decade. Firstly, the proliferative publication of risk reporting underwent stagnation during the third period. Secondly, there were also notable lulls in reporting, where the volume of reporting declined sharply in the year(s) following a prominent risk event. It was further suggested by interviewees that risk reporting became a routine aspect of a newspaper's media offering and that focus of risk reporters pivoted away from exploring links between hidden hazards and institutional malfeasance. The evidence provided from the content analysis further supports this claim, as the proportional difference between uncertainty and certainty frames increased from 16.6% in the second period to 48.9% in the third period. The key reason for this change in the framing of risk information was that risk reporters began to prioritise statements from academic sources over pressure group sources. Interviewees suggested that prioritisation of scientific sources appears to demonstrate that they were attempting to introduce "scientific balance" into their reporting. It was observed that the higher expression of uncertainty frames was generated from the generally tentative language used by scientific sources when discussing risk and their research. Furthermore, During the third period, risk reporters demonstrated a tendency to include several statements from different scientific sources as a counterbalance to the risk information provided within government reports. The fourth period of risk reporting was observed between 2015-2017. However, given the previous trends, it is presumed by this thesis that the fourth period is still emerging. It is acknowledged that the observations made within the fourth period are somewhat speculative but may suggest the formation of novel conventions. The data obtained so far suggests that the emergent fourth era of risk reporting could be another era of high-risk amplification. So far, the proportional difference between uncertainty and certainty frames has decreased by 1.9% over three years. This small increase in certainty framing appears to correspond with a sudden increase in "opinion-based" content. The average number of opinion articles increased from 136 per year within the third period, to 246 per year within the emergent fourth period. During the content analysis, it was also observed that statements from scientific news sources appeared more inclined to politicise risk information by including prescriptive policy recommendations. Interviewees also suggested that the quality of risk reporting has also declined, as newsroom pressures promote the simple repackaging of academic press releases without critical inquiry