AI Solutions for MDS: Artificial Intelligence Techniques for Misuse Detection and Localisation in Telecommunication Environments

This report considers the application of Articial Intelligence (AI) techniques to the problem of misuse detection and misuse localisation within telecommunications environments. A broad survey of techniques is provided, that covers inter alia rule based systems, model-based systems, case based reasoning, pattern matching, clustering and feature extraction, articial neural networks, genetic algorithms, arti cial immune systems, agent based systems, data mining and a variety of hybrid approaches. The report then considers the central issue of event correlation, that is at the heart of many misuse detection and localisation systems. The notion of being able to infer misuse by the correlation of individual temporally distributed events within a multiple data stream environment is explored, and a range of techniques, covering model based approaches, `programmed' AI and machine learning paradigms. It is found that, in general, correlation is best achieved via rule based approaches, but that these suffer from a number of drawbacks, such as the difculty of developing and maintaining an appropriate knowledge base, and the lack of ability to generalise from known misuses to new unseen misuses. Two distinct approaches are evident. One attempts to encode knowledge of known misuses, typically within rules, and use this to screen events. This approach cannot generally detect misuses for which it has not been programmed, i.e. it is prone to issuing false negatives. The other attempts to `learn' the features of event patterns that constitute normal behaviour, and, by observing patterns that do not match expected behaviour, detect when a misuse has occurred. This approach is prone to issuing false positives, i.e. inferring misuse from innocent patterns of behaviour that the system was not trained to recognise. Contemporary approaches are seen to favour hybridisation, often combining detection or localisation mechanisms for both abnormal and normal behaviour, the former to capture known cases of misuse, the latter to capture unknown cases. In some systems, these mechanisms even work together to update each other to increase detection rates and lower false positive rates. It is concluded that hybridisation offers the most promising future direction, but that a rule or state based component is likely to remain, being the most natural approach to the correlation of complex events. The challenge, then, is to mitigate the weaknesses of canonical programmed systems such that learning, generalisation and adaptation are more readily facilitated

Swarm-Based Spatial Sorting

Purpose: To present an algorithm for spatially sorting objects into an annular structure. Design/Methodology/Approach: A swarm-based model that requires only stochastic agent behaviour coupled with a pheromone-inspired "attraction-repulsion" mechanism. Findings: The algorithm consistently generates high-quality annular structures, and is particularly powerful in situations where the initial configuration of objects is similar to those observed in nature. Research limitations/implications: Experimental evidence supports previous theoretical arguments about the nature and mechanism of spatial sorting by insects. Practical implications: The algorithm may find applications in distributed robotics. Originality/value: The model offers a powerful minimal algorithmic framework, and also sheds further light on the nature of attraction-repulsion algorithms and underlying natural processes.Comment: Accepted by the Int. J. Intelligent Computing and Cybernetic

CBPRS: A City Based Parking and Routing System

Navigational systems assist drivers in finding a route between two locations that is time optimal in theory but seldom in practice due to delaying circumstances the system is unaware of, such as traffic jams. Upon arrival at the destination the service of the system ends and the driver is forced to locate a parking place without further assistance. We propose a City Based Parking Routing System (CBPRS) that monitors and reserves parking places for CBPRS participants within a city. The CBPRS guides vehicles using an ant based distributed hierarchical routing algorithm to their reserved parking place. Through means of experiments in a simulation environment we found that reductions of travel times for participants were significant in comparison to a situation where vehicles relied on static routing information generated by the well known Dijkstra’s algorithm. Furthermore, we found that the CBPRS was able to increase city wide traffic flows and decrease the number and duration of traffic jams throughout the city once the number of participants increased.information systems;computer simulation;dynamic routing

Bioinspired Principles for Large-Scale Networked Sensor Systems: An Overview

Biology has often been used as a source of inspiration in computer science and engineering. Bioinspired principles have found their way into network node design and research due to the appealing analogies between biological systems and large networks of small sensors. This paper provides an overview of bioinspired principles and methods such as swarm intelligence, natural time synchronization, artificial immune system and intercellular information exchange applicable for sensor network design. Bioinspired principles and methods are discussed in the context of routing, clustering, time synchronization, optimal node deployment, localization and security and privacy

Performance Evaluation of Reactive Routing Protocols in MANETs in Association with TCP Newreno

We inspect the performance of TCP NewReno protocol for data transfer in Mobile Ad hoc networks (MANETs). Dynamic Source Routing (DSR) protocols and AdHoc On-demand Distance Vector (AODV) are standard reactive routing protocols widely used in MANETs. In addition we also have to consider Transmission Control Protocol (TCP) as essential for MANETs since it is one of the widely used internet protocol for dependable data transmission. TCP has its variants namely TCP Reno, TCP NewReno , TCP Vegas and TCP SACK. In this paper we are evaluating the performance of DSR and AODV in association with TCP Newreno with respect to various parameters such as Average throughput, instant throughput, residual energy, packet delivery ratio. The ns-2 network simulator was used for simulation