Performance Metrics for Network Intrusion Systems

Intrusion systems have been the subject of considerable research during the past 33 years, since the original work of Anderson. Much has been published attempting to improve their performance using advanced data processing techniques including neural nets, statistical pattern recognition and genetic algorithms. Whilst some significant improvements have been achieved they are often the result of assumptions that are difficult to justify and comparing performance between different research groups is difficult. The thesis develops a new approach to defining performance focussed on comparing intrusion systems and technologies. A new taxonomy is proposed in which the type of output and the data scale over which an intrusion system operates is used for classification. The inconsistencies and inadequacies of existing definitions of detection are examined and five new intrusion levels are proposed from analogy with other detection-based technologies. These levels are known as detection, recognition, identification, confirmation and prosecution, each representing an increase in the information output from, and functionality of, the intrusion system. These levels are contrasted over four physical data scales, from application/host through to enterprise networks, introducing and developing the concept of a footprint as a pictorial representation of the scope of an intrusion system. An intrusion is now defined as “an activity that leads to the violation of the security policy of a computer system”. Five different intrusion technologies are illustrated using the footprint with current challenges also shown to stimulate further research. Integrity in the presence of mixed trust data streams at the highest intrusion level is identified as particularly challenging. Two metrics new to intrusion systems are defined to quantify performance and further aid comparison. Sensitivity is introduced to define basic detectability of an attack in terms of a single parameter, rather than the usual four currently in use. Selectivity is used to describe the ability of an intrusion system to discriminate between attack types. These metrics are quantified experimentally for network intrusion using the DARPA 1999 dataset and SNORT. Only nine of the 58 attack types present were detected with sensitivities in excess of 12dB indicating that detection performance of the attack types present in this dataset remains a challenge. The measured selectivity was also poor indicting that only three of the attack types could be confidently distinguished. The highest value of selectivity was 3.52, significantly lower than the theoretical limit of 5.83 for the evaluated system. Options for improving selectivity and sensitivity through additional measurements are examined.Stochastic Systems Lt

Separação de identificação e localização para mobilidade de veículos

Mestrado em Engenharia Eletrónica e TelecomunicaçõesVivemos num mundo tecnológico, onde assistimos a uma evolução progressiva dos dispositivos e de comunicação digitais. Hoje em dia, os smart-phones e smart TV vieram substituir o telemóvel e a televis ão, respetivamente. A internet está cada vez mais rápida, com mais serviços e aplicações, tornando-se num bem essencial e indispensável a nível mundial. Com uma constante interatividade entre utilizadores, as redes sociais são uma das grandes fontes de comunicação, dando-se, por vezes, prioridade à comunicação através do tão conhecido Face- book à comunicação pessoal. Estamos perante uma convergência e avanços tecnológicos, um mundo cada vez mais inter-relacionado e complexo. Devido a esta permanente necessidade de comunicação e ligação, as redes veiculares estão a atrair um interesse signi cativo. As redes veiculares têm sido desenvolvidas, não só para melhorar o tráfego rodoviário, mas também para proporcionar interligação e entretenimento aos seus utilizadores. A comunicação entre os veículos e o acesso à internet por parte dos passageiros têm sido o principal objetivo na evolução e investigação destas redes. Todavia, na evolução destas redes, permanecem inúmeros desa os. A grande mobilidade dos veículos durante o seu trajeto tem como consequência a necessidade de uma in nidade de handovers. Face a isto, é necessário um protocolo de mobilidade apropriado de forma a evitar a perda de ligação. Este protocolo deverá ser capaz de fornecer mobilidade, não só ao veículo, mas também aos seus passageiros. O objetivo desta dissertação de mestrado centra-se no estudo do protocolo de mobilidade já existente da Cisco Systems, The Locator/ID Separation Protocol (LISP), e da sua extensão LISP-MN da organiza- ção LISPmob, de maneira a veri car a possibilidade de o adaptar para redes veiculares. Através do router virtual da Cisco CSR 1000v, criou-se e con gurou-se num ambiente privado um servidor capaz de armazenar e monitorizar todos os veículos bem como os seus passageiros. Cada veículo, representado por um identi cador, regista-se no servidor indicando a sua localiza ção no momento, sendo esta sempre atualizada quando o veículo muda de rede e já não estiver ao alcance da anterior. Assim, o servidor é a parte central na comunicação entre veículos funcionando como um mapa contendo todas as localizações associadas a cada veículo e fornecendo assim, sempre que requisitada, a localização necessária de um veículo a outro, permitindo a criação de um túnel entre eles e consequente estabelecimento de ligação. Para proporcionar um handover mais rápido entre estações xas e móveis foram feitas alterações a nível de software do LISP-MN. Alterou-se a implementação LISP-MN de maneira a garantir mobilidade para veículos, ou seja, para handovers com rápidas transições, visto que na implementação da LISPmob só é garantida mobilidade para handovers lentos, tornando assim imposs ível o handover entre veículos e à consequente inutilização da tecnologia WAVE, criada especialmente para tal. Alterou-se também a forma de processamento na atualização das caches dos nós móveis que estão em comunicação, de maneira que, na ocorrência de handover, as atualizações das cache fossem permitidas, não só na receção de um novo endereço, como também na receção de uma nova gateway, evitando assim possíveis problemas de falhas de mensagens de controlo do protocolo essenciais para o estabelecimento de comunicação e transmissão de dados entre veículos. Posteriormente, criou-se um Connection Manager capaz de gerir o handover de forma automática independente da ligação de acesso bem como da versão do protocolo de internet utilizada, permitindo assim a ligação por parte dos veículos e seus passageiros à rede com melhor sinal. Assim, através do mecanismo de mobilidade referido garantiu-se a mobilidade entre veículos e respetivos passageiros. Os testes efetuados em laboratório e na estrada incidiram sobre as tecnologias de acesso IEEE 802.11p (WAVE), uma tecnologia desenvolvida especialmente para as redes veiculares, e o IEEE 802.11g (WI-FI), uma das tecnologias mais utilizadas atualmente. Veri cou-se através dos resultados obtidos que os tempos de handover através da tecnologia WAVE eram signi cativamente inferiores aos da tecnologia WI-FI, inferindo assim que a tecnologia de acesso IEEE 802.11p é a mais apropriada para as redes veiculares. Os resultados de handovers realizados em vários cenários de laboratório e estrada mostram que os mecanismos desenvolvidos permitem fornecer mobilidade transparente dos veículos e seus passageiros.We live in a technological world, where we witnessed a progressive evolution of devices and digital communication. Nowadays, the smartphones and smart TV have replaced the phone and television, respectively. The internet is getting faster, with more services and applications, making it very essential and indispensable worldwide. With a constant interactivity between users, social networks are a major source of communication, giving up sometimes priority to communication through the well-known "Facebook", instead of personal communication. We are facing a convergence and technological advances, an increasingly complex and interrelated world. Due to this constant need for communication and connection, vehicular networks are attracting signi cant interest. Vehicular networks have been developed, not only to improve road tra c, as well as interconnection and to provide entertainment to their users. The communication between vehicles and internet access by passengers have been the main goal in the development and investigation of these networks. However, in the evolution of these networks, many challenges remain. The high mobility of vehicles during their commute entails the need of a plethora of handovers. Mobility protocol suitable to prevent the connection loss is required. This protocol should be able to provide mobility, not only to the vehicles, but also to the passengers. The purpose of this dissertation focuses on the study of existing mobility protocol from Cisco Systems, the Locator/ID Separation Protocol (LISP), and its extension LISP-MN from LISPmob organization, in order to verify the possibility to adapt to vehicular networks. Through the virtual router from Cisco CSR 1000v, it was created and con gured in a private environment a server capable to store and monitor all vehicles and their passengers. Each vehicle, represented by an identi er, is recorded on the server indicating its location on the time, and it is always updated when the vehicle changes the network and it is no longer reachable through the other. Thus, the server is the central part in the communication between vehicles functioning as a map containing all locations associated at each vehicle and thus providing, when required, the necessary location of a vehicle to another, allowing the creation of a tunnel between them and consequent establishment of connection. To provide faster handover between xed and mobile stations, changes were made to the software of LISP-MN. LISP-MN implementation has changed in order to ensure vehicular mobility, with fast handover transitions, which with LISPmob is not guaranteed, it just only ensures mobility in slow handovers case. Thus, it makes impossible handovers between the vehicle and the consequent use of WAVE technology, specially created for these networks. It was also changed the way to update the caches of mobile nodes that are in communication, so that when the handover occurs, cache updates are allowed not only on the reception of a new address, but also on the reception of a new gateway, thereby avoiding potential problems on control messages of the protocol essential to establish the communication and further data transmission between vehicles. Subsequently, a Connection Manager was created capable to manage the handover automatically independently of the access network and of the Internet protocol version used, thus allowing the connection of the vehicle and its passengers to the network with best signal. Given those facts it was guaranteed the mobility of vehicles and their respective passengers. The tests performed in the laboratory and on the road were focused on the access technology IEEE 802.11p (WAVE), a technology developed especially for vehicular networks, and IEEE 802.11g (WI-FI), one of the most used technologies today. It was veri ed by the results obtained, that handover times through the WAVE technology were signi cantly lower than those of WI-FI technology, and thus inferring that the access technology IEEE 802.11p is the most suitable for vehicular networks. The results of handover performed in various lab and road scenarios show that the developed mechanisms provide transparent mobility of vehicles and their passengers

Application of intraoperative quality assurance to laparoscopic total mesorectal excision surgery

Introduction: The role of laparoscopy in the surgical management of rectal cancer is debated. Randomised trials have reported contrasting results with inadequate specimens obtained in a minority of patients. The reasons behind these findings are unclear. Complex surgical interventions and human performance are prone to variation, which may account for outcome differences, but neither are robustly measured. Application of quality assurance (QA) to the intraoperative period could explore surgical performance and any relationship with subsequent outcomes. The overarching aim of this thesis is the promotion of oncological and patient safety through application of QA to laparoscopic TME surgery. Methods: Evidence synthesis of QA tools was obtained through a systematic review to identify reported objective laparoscopic total mesorectal excision (TME) assessment tools. Development of novel QA tools for laparoscopic TME was performed and applied and validated using case video from two multicentre randomised trials with reliability and validity of the laparoscopic TME performance tool (L-TMEpt) assessed. A multicentre randomised trial comparing 3D vs. 2D laparoscopic TME was performed incorporating objective performance analyses. Scores divided surgeons into quartiles and compared with histopathological and clinical endpoints. A novel intraoperative adverse event classification was developed and piloted. Results: 176 cases from 48 credentialed surgeons were analysed. L-TMEpt inter-rater, test-retest and internal consistency reliabilities were established. Substantial variation in surgical performance were seen. Scores were strongly associated with the number of intraoperative errors, plane of mesorectal dissection and short-term patient morbidity. Upper quartile surgeons obtained excellent results compared with the lower quartile (mesorectal fascia 93% vs. 59%, NNT 2.9, p=0.002; 30-day morbidity 23% vs. 48%, NNT 4, p=0.043). Conclusions: Intraoperative QA using assessment tools can objectively and reliably measure complex cancer interventions. Laparoscopic TME surgical performance assessment showed substantial variation which is strongly associated with clinical outcomes holding implications for surgical trial design and interpretation.Open Acces

bump2bump: Designing and Evaluating Technology to Promote Maternal Wellbeing in the Transition to Motherhood

The notion of wellbeing is synonymous with feeling competent, supported and satisfied with one’s life. Understanding how to sustain one’s own wellbeing is important at times of significant life change. The transition to motherhood is characterised by major emotional and physiological changes, which can impact on maternal subjective wellbeing and affect pregnancy outcomes. While Human Computer Interaction (HCI) has begun to address some of the challenges in the prevention and treatment of affective disorders in vulnerable perinatal groups, approaches that promote holistic maternal wellbeing in the low-risk majority have received less attention. This thesis draws on the multidisciplinary legacy of digital intervention development, utilising best practice from eHealth and HCI. Six studies using quantitative and qualitative methods were conducted. Study 1 was a systematic, interdisciplinary literature review, which proposed an integrated framework of factors involved in the successful development and evaluation of digital perinatal wellbeing resources. Study 2 used qualitative methods to explore the contextualised usage of digital resources by perinatal women. Studies 3, 4 and 5 involved the iterative development and formative evaluation of a prototype (bump2bump). Study 6 used mixed methods to explore the longitudinal, in-the-wild usage of bump2bump by a group of women as they became mothers. This thesis contributes to current discourse in HCI on how technology might be used positively and presents recommendations regarding the development and use of digital resources in first time pregnancy. Digital resources are increasingly relied upon when community services are lacking, and usage of such resources is particularly nuanced at the transition to motherhood. Design features that support users’ trust in content, facilitate face-to-face interaction with local similar others, and provide brief, practical information were found to be most important in meeting user needs. These findings can be used to inform the development and evaluation of digital perinatal wellbeing resources

Development of a self-help digital intervention for young people with Tourette syndrome

Young people (YP) with Tourette Syndrome (TS) and Tic Disorders (TD) experience difficulties with psychological wellbeing and reduced quality of life (QoL). Nonetheless, accessing healthcare support for these YP is difficult due to barriers including a lack of healthcare professionals, low healthcare coverage and reduced help-seeking behaviour of YP. Current psychological interventions for people with tics do not show the cost-savings or effectiveness to substantiate large-scale implementation. Interventions delivered digitally, utilising a self-help approach may overcome these limitations and have been shown to be effective in YP with mental health difficulties. Furthermore, the development of a wellbeing intervention using person, evidence and theory-based approaches could promote adherence and engagement to such an intervention. The current research aims to develop a digital self-help intervention to support and promote psychological wellbeing in YP with TDs. A person-based approach (PBA) was applied throughout. The research included a systematic review to assess similar interventions that were available for YP with TDs and YP with reduced psychological wellbeing. Qualitative research methods were used to interview YP with TDs, professionals who work with YP with TDs, and focus groups with parents and YP with TDs to explore what would be needed from such an intervention. Thematic analysis was used to code data inductively and a hybrid thematic analytical approach was used to apply deductive analysis to the data. The findings from across the methods were integrated to develop guiding principles and a logic model to support the future development of the intervention. The systematic review identified 985 studies, leaving 11 to be included in the review. Across the qualitative methods, 16 professionals, 51 YP and 35 parents or caregivers were recruited for interviews or focus groups. A digital health intervention (DHI) that would be suitably applied to YP with tics was not identified in the literature, and it was concluded that such an intervention would be desired by YP and thought useful by professionals. Many features and functions of the intervention were highlighted across participant groups, and the most important features were prioritised. These were combined with theory to develop guiding principles and a logic model. The research outputs include the development of guiding principles and a logic model, informed using the PBA, behaviour change theory and evidence. These findings will support future developers in creating an engaging and effective intervention for YP with tics, to promote and support their wellbeing

An Approach to Guide Users Towards Less Revealing Internet Browsers

When browsing the Internet, HTTP headers enable both clients and servers send extra data in their requests or responses such as the User-Agent string. This string contains information related to the sender’s device, browser, and operating system. Previous research has shown that there are numerous privacy and security risks result from exposing sensitive information in the User-Agent string. For example, it enables device and browser fingerprinting and user tracking and identification. Our large analysis of thousands of User-Agent strings shows that browsers differ tremendously in the amount of information they include in their User-Agent strings. As such, our work aims at guiding users towards using less exposing browsers. In doing so, we propose to assign an exposure score to browsers based on the information they expose and vulnerability records. Thus, our contribution in this work is as follows: first, provide a full implementation that is ready to be deployed and used by users. Second, conduct a user study to identify the effectiveness and limitations of our proposed approach. Our implementation is based on using more than 52 thousand unique browsers. Our performance and validation analysis show that our solution is accurate and efficient. The source code and data set are publicly available and the solution has been deployed

Development of a self-help digital intervention for young people with Tourette syndrome

Young people (YP) with Tourette Syndrome (TS) and Tic Disorders (TD) experience difficulties with psychological wellbeing and reduced quality of life (QoL). Nonetheless, accessing healthcare support for these YP is difficult due to barriers including a lack of healthcare professionals, low healthcare coverage and reduced help-seeking behaviour of YP. Current psychological interventions for people with tics do not show the cost-savings or effectiveness to substantiate large-scale implementation. Interventions delivered digitally, utilising a self-help approach may overcome these limitations and have been shown to be effective in YP with mental health difficulties. Furthermore, the development of a wellbeing intervention using person, evidence and theory-based approaches could promote adherence and engagement to such an intervention. The current research aims to develop a digital self-help intervention to support and promote psychological wellbeing in YP with TDs. A person-based approach (PBA) was applied throughout. The research included a systematic review to assess similar interventions that were available for YP with TDs and YP with reduced psychological wellbeing. Qualitative research methods were used to interview YP with TDs, professionals who work with YP with TDs, and focus groups with parents and YP with TDs to explore what would be needed from such an intervention. Thematic analysis was used to code data inductively and a hybrid thematic analytical approach was used to apply deductive analysis to the data. The findings from across the methods were integrated to develop guiding principles and a logic model to support the future development of the intervention. The systematic review identified 985 studies, leaving 11 to be included in the review. Across the qualitative methods, 16 professionals, 51 YP and 35 parents or caregivers were recruited for interviews or focus groups. A digital health intervention (DHI) that would be suitably applied to YP with tics was not identified in the literature, and it was concluded that such an intervention would be desired by YP and thought useful by professionals. Many features and functions of the intervention were highlighted across participant groups, and the most important features were prioritised. These were combined with theory to develop guiding principles and a logic model. The research outputs include the development of guiding principles and a logic model, informed using the PBA, behaviour change theory and evidence. These findings will support future developers in creating an engaging and effective intervention for YP with tics, to promote and support their wellbeing

Effects of Diversity and Neuropsychological Performance in an NFL Cohort

Objective: The aim of this study was to examine the effect of ethnicity on neuropsychological test performance by comparing scores of white and black former NFL athletes on each subtest of the WMS. Participants and Methods: Data was derived from a de-identified database in South Florida consisting of 63 former NFL white (n=28, 44.4%) and black (n=35, 55.6%) athletes (Mage= 50.38; SD= 11.57). Participants completed the following subtests of the WMS: Logical Memory I and II, Verbal Paired Associates I and II, and Visual Reproduction I and II. Results: A One-Way ANOVA yielded significant effect between ethnicity and performance on several subtests from the WMS-IV. Black athletes had significantly lower scores compared to white athletes on Logical Memory II: F(1,61) = 4.667, p= .035, Verbal Paired Associates I: F(1,61) = 4.536, p = .037, Verbal Paired Associates: II F(1,61) = 4.677, p = .034, and Visual Reproduction I: F(1,61) = 6.562, p = .013. Conclusions: Results suggest significant differences exist between white and black athletes on neuropsychological test performance, necessitating the need for proper normative samples for each ethnic group. It is possible the differences found can be explained by the psychometric properties of the assessment and possibility of a non-representative sample for minorities, or simply individual differences. Previous literature has found white individuals to outperform African-Americans on verbal and non-verbal cognitive tasks after controlling for socioeconomic and other demographic variables (Manly & Jacobs, 2002). This highlights the need for future investigators to identify cultural factors and evaluate how ethnicity specifically plays a role on neuropsychological test performance. Notably, differences between ethnic groups can have significant implications when evaluating a sample of former athletes for cognitive impairment, as these results suggest retired NFL minorities may be more impaired compared to retired NFL white athletes