Flow-based intrusion detection

The spread of 1-10Gbps technology has in recent years paved the way to a flourishing\ud landscape of new, high-bandwidth Internet services. As users, we depend on the Internet\ud in our daily life for simple tasks such as checking e-mails, but also for managing private\ud and financial information. However, entrusting such information to the Internet also means\ud that the network has become an alluring place for hackers. To this threat, the research\ud community has answered with an increased interest in intrusion detection, and the\ud researchers' attention is focused on developing new techniques to timely detect intruders\ud and prevent damage. Our studies in the field of intrusion detection, however, made us\ud realize that additional research is needed, in particular: the creation of shared data sets to\ud validate Intrusion Detection Systems (IDSs) and the development of automatic procedures\ud to tune the parameters of IDSs.\ud The contribution of this thesis is that it develops a structured approach to intrusion\ud detection that focuses on (i) shared ground-truth data sets and (ii) automatic parameter\ud tuning. We develop our approach by focusing on network flows, which offer an\ud aggregated view of network traffic in terms of the amount of packets and bytes exchanged\ud over the network, and on flow-based time series, which describe how the number of flows,\ud packets and bytes changes over time. We approach the problem of shared ground truth\ud first, by manually creating it, and, second, by proposing network models to generate\ud artificial ground truth. Finally, the performance of an IDS is governed by the trade-off\ud between detecting all anomalies (at the expense of raising alarms too often), and missing\ud anomalies (but not issuing many false alarms). We approach the problem of automatic\ud tuning of IDSs by developing a procedure that aims to mathematically optimize the system\ud performance in a systematic manner

Violations of Human Rights during Military Operations in Chechnya

The case-law of the European Court of Human Rights concerning violations of human rights law during armed conflict has been extended after the first decisions on cases arose from violations, committed during the war in Chechnya between 1999 and 2000. In the words of the Court, at that time the situation called for exceptional measures, in order to regain control over the Republic and suppress an illegal armed insurgency. The Court has been ready to admit those measures, including the deployment of army units equipped with heavy combat weapons, military aviation and artillery, were necessary to counter the aggressiveness of the separatists, but in such a way as to avoid or minimize, to the greatest extent possible, damage to civilians. This brief paper focuses on the means and methods employed. It aims firstly at illustrating the core of the Court’s decisions, in order to identify the key aspects of the protection granted by the system of the European Convention in situations requiring the use of military force. Then it clarifies the approach of the Court to the law of armed conflict. © Federico Sperotto. All rights reserved. This paper may be freely circulated in electronic or hard copy provided it is not modified in any way, the rights of the author not infringed, and the paper is not quoted or cited without express permission of the author. The editors cannot guarantee a stable URL for any paper posted here, nor will they be responsible for notifying others if the URL is changed or the paper is taken off the site. Electronic copies of this paper may not be posted on any other website without express permission of the author

The International Security Presence in Kosovo and the Protection of Human Rights

On March 11th, 2000, two children who were playing in the neighborhoods of Mitrovica, Kosovo, got hurt by an “unexploded ordnance”. One of them died in the explosion, the other was severely injured. An inquire clarified that the ordnance was a “bomblet”, a part of a cluster bomb dropped during the 1999 NATO air campaign against the Federal Republic of Yugoslavia. © Federico Sperotto. All rights reserved. This paper may be freely circulated in electronic or hard copy provided it is not modified in any way, the rights of the author not infringed, and the paper is not quoted or cited without express permission of the author. The editors cannot guarantee a stable URL for any paper posted here, nor will they be responsible for notifying others if the URL is changed or the paper is taken off the site. Electronic copies of this paper may not be posted on any other website without express permission of the author

A Human Rights-Oriented Approach to Military Operations

Counterinsurgency is the dominant aspect of US operations in Afghanistan, and since ISAF—the NATO-led security and assistance force—has assumed growing security responsibility throughout the country, it is also a mission for the Europeans.1 The frame in which military operations are conducted is irregular warfare, a form of conflict which differs from conventional operations in two main aspects. First, it is warfare among and within the people. Second, it is warfare in which insurgents avoid a direct military confrontation, using instead unconventional methods and terrorist tactics. © Federico Sperotto. All rights reserved. This paper may be freely circulated in electronic or hard copy provided it is not modified in any way, the rights of the author not infringed, and the paper is not quoted or cited without express permission of the author. The editors cannot guarantee a stable URL for any paper posted here, nor will they be responsible for notifying others if the URL is changed or the paper is taken off the site. Electronic copies of this paper may not be posted on any other website without express permission of the author

Beyond Bankovic: Extraterritorial Application of the European Convention on Human Rights

The obligations set forth in the international and regional instruments on human rights are considered as having a strictly territorial scope. States parties have the duty to guarantee the rights recognized in the treaties to all individuals within their territories. The territorial reach of these obligations is expanding by way of interpretation. In its decision on Bankovic, the European Court reduced the impact of this international trend toward a progressive enlargement of the protection granted by human rights treaties, affirming those attacks conducted by NATO against Yugoslavia in 1999 fell out of the extraterritorial reach of the European Convention. After Bankovic, the Court provided a more articulated interpretation of the issue of extraterritorial acts, previously limited to the European legal space. In examining the case law, this paper deals with the issue of whether and to what extent a State party of the European Convention is accountable for human rights violations perpetrated by its armed forces during military operations conducted abroad. © Federico Sperotto. All rights reserved. This paper may be freely circulated in electronic or hard copy provided it is not modified in any way, the rights of the author not infringed, and the paper is not quoted or cited without express permission of the author. The editors cannot guarantee a stable URL for any paper posted here, nor will they be responsible for notifying others if the URL is changed or the paper is taken off the site. Electronic copies of this paper may not be posted on any other website without express permission of the author

Diderot: Space and Movement Introduction

Space and movement are not central concepts in discussing Diderot’s physical and philosophical thought, however they become quite interesting when the discussion shifts to aesthetics. Because of that, the question of space and movement in Diderot’s works is the main focus of this issue of Itinera. An analysis is carried out of the rhetorical and literary use of space and movement by Diderot to spatialise his materialist written expression and “put thinking in motion”. Special attention is devoted to the philosopher’s aesthetic considerations, of which space and movement are an important theoretical piece. Some of Diderot’s main works - among which the Lettre sur le aveugles, the Salons, Jacques le fataliste - are investigated under different perspectives in order to show the relevance of space and movement.Space and movement are not central concepts in discussing Diderot’s physical and philosophical thought, however they become quite interesting when the discussion shifts to aesthetics. Because of that, the question of space and movement in Diderot’s works is the main focus of this issue of Itinera. An analysis is carried out of the rhetorical and literary use of space and movement by Diderot to spatialise his materialist written expression and “put thinking in motion”. Special attention is devoted to the philosopher’s aesthetic considerations, of which space and movement are an important theoretical piece. Some of Diderot’s main works - among which the Lettre sur le aveugles, the Salons, Jacques le fataliste - are investigated under different perspectives in order to show the relevance of space and movement

Law in Times of War: the Case of Chechnya

In October 1999 “the second Chechen war” broke out. In December the Russian federal army started an operation to take control of Grozny. During the confrontation between the Federal forces and the Chechen separatists, serious human rights violations occurred. Several cases concerning violations of fundamental rights, in and around the city, have been brought before the European Court of Human Rights against Russia. The lawsuits concerned in particular physical integrity issues. This study provides some insights on the jurisprudence of the European Court on Human Rights in order to ascertain the adequacy of the mechanism of protection provided by the European Convention of 1950 in situations of armed conflict. © Federico Sperotto. All rights reserved. This paper may be freely circulated in electronic or hard copy provided it is not modified in any way, the rights of the author not infringed, and the paper is not quoted or cited without express permission of the author. The editors cannot guarantee a stable URL for any paper posted here, nor will they be responsible for notifying others if the URL is changed or the paper is taken off the site. Electronic copies of this paper may not be posted on any other website without express permission of the author

Evaluating Third-Party Bad Neighborhood Blacklists for Spam Detection

The distribution of malicious hosts over the IP address space is far from being uniform. In fact, malicious hosts tend to be concentrate in certain portions of the IP address space, forming the so-called Bad Neighborhoods. This phenomenon has been previously exploited to filter Spam by means of Bad Neighborhood blacklists. In this paper, we evaluate how much a network administrator can rely upon different Bad Neighborhood blacklists generated by third-party sources to fight Spam. One could expect that Bad Neighborhood blacklists generated from different sources contain, to a varying degree, disjoint sets of entries. Therefore, we investigate (i) how specific a blacklist is to its source, and (ii) whether different blacklists can be interchangeably used to protect a target from Spam. We analyze five Bad Neighborhood blacklists generated from real-world measurements and study their effectiveness in protecting three production mail servers from Spam. Our findings lead to several operational considerations on how a network administrator could best benefit from Bad Neighborhood-based Spam filtering