Nonparametric Anomaly Detection and Secure Communication

Two major security challenges in information systems are detection of anomalous data patterns that reflect malicious intrusions into data storage systems and protection of data from malicious eavesdropping during data transmissions. The first problem typically involves design of statistical tests to identify data variations, and the second problem generally involves design of communication schemes to transmit data securely in the presence of malicious eavesdroppers. The main theme of this thesis is to exploit information theoretic and statistical tools to address the above two security issues in order to provide information theoretically provable security, i.e., anomaly detection with vanishing probability of error and guaranteed secure communication with vanishing leakage rate at eavesdroppers. First, the anomaly detection problem is investigated, in which typical and anomalous patterns (i.e., distributions that generate data) are unknown \emph{a priori}. Two types of problems are investigated. The first problem considers detection of the existence of anomalous geometric structures over networks, and the second problem considers the detection of a set of anomalous data streams out of a large number of data streams. In both problems, anomalous data are assumed to be generated by a distribution $q$, which is different from a distribution $p$ generating typical samples. For both problems, kernel-based tests are proposed, which are based on maximum mean discrepancy (MMD) that measures the distance between mean embeddings of distributions into a reproducing kernel Hilbert space. These tests are nonparametric without exploiting the information about $p$ and $q$ and are universally applicable to arbitrary $p$ and $q$. Furthermore, these tests are shown to be statistically consistent under certain conditions on the parameters of the problems. These conditions are further shown to be necessary or nearly necessary, which implies that the MMD-based tests are order level optimal or nearly order level optimal. Numerical results are provided to demonstrate the performance of the proposed tests. The secure communication problem is then investigated, for which the focus is on degraded broadcast channels. In such channels, one transmitter sends messages to multiple receivers, the channel quality of which can be ordered. Two specific models are studied. In the first model, layered decoding and layered secrecy are required, i.e., each receiver decodes one more message than the receiver with one level worse channel quality, and this message should be kept secure from all receivers with worse channel qualities. In the second model, secrecy only outside a bounded range is required, i.e., each message is required to be kept secure from the receiver with two-level worse channel quality. Communication schemes for both models are designed and the corresponding achievable rate regions (i.e., inner bounds on the capacity region) are characterized. Furthermore, outer bounds on the capacity region are developed, which match the inner bounds, and hence the secrecy capacity regions are established for both models

Теоретико-информационное представление виртуализации сетевого канала перехвата

The most difficult task of secure telecommunication systems using symmetric encryption, due to the need for preliminary and resource-intensive organization of secret channels for delivering keys to network correspondents, is key management. An alternative is the generating keys methods through open communication channels. In information theory, it is shown that these methods are implemented under the condition that the channel information rate of correspondents exceeds the rate of the intruder interception channel. The search for methods that provide the informational advantage of correspondents is being updated. The goal is to determine the information-theoretical conditions for the formation of a virtual network and an interception channel, for which the best ratio of information speeds for correspondents is provided compared to the ratio of the original network and interception channel. The paper proposes an information transfer model that includes a connectivity model and an information transfer method for asymptotic lengths of code words. The model includes three correspondents and is characterized by the introduction of an ideal broadcast channel in addition to an errored broadcast channel. The model introduces a source of "noisy" information, which is transmitted over the channel with errors, so the transmission of code words using the known method of random coding is carried out over the channel without errors. For asymptotic lengths of code words, all actions of correspondents in processing and transmitting information in the model are reduced to the proposed method of transmitting information. The use of the method by correspondents within the framework of the transmission model makes it possible to simultaneously form for them a new virtual broadcast channel with information rate as in the original channel with errors, and for the intruder a new virtual broadcast interception channel with a rate lower than the information rate of the initial interception channel. The information-theoretic conditions for deterioration of the interception channel are proved in the statement. The practical significance of the results obtained lies in the possibility of using the latter to assess the information efficiency of open network key formation in the proposed information transfer model, as well as in the development of well-known scientific achievements of open key agreement. The proposed transmission model can be useful for researching key management systems and protecting information transmitted over open channels. Further research is related to the information-theoretic assessment of the network key throughput, which is the potential information-theoretic speed of network key formation.Сложнейшей задачей защищенных телекоммуникационных систем, использующих симметричное шифрование, в связи с необходимостью предварительной и ресурсоемкой организации секретных каналов доставки ключей сетевым корреспондентам, является управление ключами. Альтернативой выступают методы формирования ключей по открытым каналам связи. В теории информации показано, что эти методы реализуются при условии превышения информационной скорости канала корреспондентов над скоростью канала перехвата нарушителя. Актуализируется поиск методов, обеспечивающих получение информационного преимущества корреспондентов. Цель заключается в определении теоретико-информационных условий формирования виртуальных сети и канала перехвата, для которых обеспечивается лучшее у корреспондентов отношение информационных скоростей по сравнению с отношением исходных сети и канала перехвата. В работе предлагается модель передачи информации, включающая модель связности и метод передачи информации для асимптотических длин кодовых слов. Модель включает трех корреспондентов и отличается введением идеального широковещательного канала в дополнение к широковещательному каналу с ошибками. В модели введен источник «зашумляющей» информации, которая передается по каналу с ошибками, поэтому передача кодовых слов с использованием известного метода случайного кодирования производится по каналу без ошибок. Для асимптотических длин кодовых слов все действия корреспондентов по обработке и передаче информации в модели сведены в предлагаемый метод передачи информации. Использование метода корреспондентами в рамках модели передачи позволяет одновременно сформировать для них новый виртуальный широковещательный канал с информационной скоростью, как и в первоначальном канале с ошибками, а для нарушителя новый виртуальный широковещательный канал перехвата со скоростью меньшей информационной скорости первоначального канала перехвата. Теоретико-информационные условия ухудшения канала перехвата доказывается в утверждении. Практическая значимость полученных результатов заключается в возможности использования последних для оценки информационной эффективности открытого сетевого формирования ключей в предложенной модели передачи информации, а также в развитии известных научных достижений открытого ключевого согласования. Предлагаемая модель передачи может быть полезной для проведения исследований систем управления ключами и защиты информации, передаваемой по открытым каналам. Дальнейшие исследования связаны с теоретико-информационной оценкой сетевой ключевой пропускной способности, представляющей собой потенциальную теоретико-информационную скорость формирования сетевого ключа

Degraded Broadcast Channel with Secrecy Outside a Bounded Range

The K-receiver degraded broadcast channel with secrecy outside a bounded range is studied, in which a transmitter sends K messages to K receivers, and the channel quality gradually degrades from receiver K to receiver 1. Each receiver k is required to decode message W 1 , ..., W k , for 1 ≤ k ≤ K, and to be kept ignorant of W k+2 , .. ., W K , fork = 1, ..., K -2. Thus, each message W k is kept secure from receivers with at least two-level worse channel quality, i.e., receivers 1, ..., k -2 . The secrecy capacity region is fully characterized. The achievable scheme designates one superposition layer to each message with binning employed for each layer. Joint embedded coding and binning are employed to protect all upper-layer messages from lower-layer receivers. Furthermore, the scheme allows adjacent layers to share rates so that part of the rate of each message can be shared with its immediate upper-layer message to enlarge the rate region. More importantly, an induction approach is developed to perform Fourier-Motzkin elimination of 2 K variables from the order of K 2 bounds to obtain a close-form achievable rate region. An outer bound is developed that matches the achievable rate region, whose proof involves recursive construction of the rate bounds and exploits the intuition gained from the achievable scheme

Degraded Broadcast Channel with Secrecy Outside a Bounded Range

The K-receiver degraded broadcast channel with secrecy outside a bounded range is studied, in which a transmitter sends K messages to K receivers, and the channel quality gradually degrades from receiver K to receiver 1. Each receiver k is required to decode message W 1 , ..., W k , for 1 ≤ k ≤ K, and to be kept ignorant of W k+2 , .. ., W K , fork = 1, ..., K -2. Thus, each message W k is kept secure from receivers with at least two-level worse channel quality, i.e., receivers 1, ..., k -2 . The secrecy capacity region is fully characterized. The achievable scheme designates one superposition layer to each message with binning employed for each layer. Joint embedded coding and binning are employed to protect all upper-layer messages from lower-layer receivers. Furthermore, the scheme allows adjacent layers to share rates so that part of the rate of each message can be shared with its immediate upper-layer message to enlarge the rate region. More importantly, an induction approach is developed to perform Fourier-Motzkin elimination of 2 K variables from the order of K 2 bounds to obtain a close-form achievable rate region. An outer bound is developed that matches the achievable rate region, whose proof involves recursive construction of the rate bounds and exploits the intuition gained from the achievable scheme