More Like this

1. Insider Attack Detection for Science DMZs Using System Performance Data

   https://doi.org/10.1109/CNS48642.2020.9162260  

   Gegan, Ross; Perry, Brian; Ghosal, Dipak; Bishop, Matt (June 2020, 2020 IEEE Conference on Communications and Network Security (CNS))

   null (Ed.)

   The science DMZ is a specialized network model developed to guarantee secure and efficient transfer of data for large-scale distributed research. To enable a high level of performance, the Science DMZ includes dedicated data transfer nodes (DTNs). Protecting these DTNs is crucial to maintaining the overall security of the network and the data, and insider attacks are a major threat. Although some limited network intrusion detection systems (NIDS) are deployed to monitor DTNs, this alone is not sufficient to detect insider threats. Monitoring for abnormal system behavior, such as unusual sequences of system calls, is one way to detect insider threats. However, the relatively predictable behavior of the DTN suggests that we can also detect unusual activity through monitoring system performance, such as CPU and disk usage, along with network activity. In this paper, we introduce a potential insider attack scenario, and show how readily available system performance metrics can be employed to detect data tampering within DTNs, using DBSCAN clustering to actively monitor for unexpected behavior. 

   more » « less
2. A Machine Learning Approach for Anomaly Detection in Industrial Control Systems Based on Measurement Data

   https://doi.org/10.3390/electronics10040407  

   Mokhtari, Sohrab; Abbaspour, Alireza; Yen, Kang; Sargolzaei, Arman (February 2021, Electronics)

   Attack detection problems in industrial control systems (ICSs) are commonly known as a network traffic monitoring scheme for detecting abnormal activities. However, a network-based intrusion detection system can be deceived by attackers that imitate the system’s normal activity. In this work, we proposed a novel solution to this problem based on measurement data in the supervisory control and data acquisition (SCADA) system. The proposed approach is called measurement intrusion detection system (MIDS), which enables the system to detect any abnormal activity in the system even if the attacker tries to conceal it in the system’s control layer. A supervised machine learning model is generated to classify normal and abnormal activities in an ICS to evaluate the MIDS performance. A hardware-in-the-loop (HIL) testbed is developed to simulate the power generation units and exploit the attack dataset. In the proposed approach, we applied several machine learning models on the dataset, which show remarkable performances in detecting the dataset’s anomalies, especially stealthy attacks. The results show that the random forest is performing better than other classifier algorithms in detecting anomalies based on measured data in the testbed. 

   more » « less
3. Anomalous Behavior Detection in Trajectory Data of Older Drivers

   https://doi.org/10.1109/HONET59747.2023.10374878  

   Ara Ghoreishi, Seyedeh Gol; Moshfeghi, Sonia; Jan, Muhammad Tanveer; Conniff, Joshua; Yang, KwangSoo; Jang, Jinwoo; Furht, Borko; Tappen, Ruth; Newman, David; Rosselli, Monica; et al (January 2024, IEEE 20th International Conference on Smart Communities: Improving Quality of Life using AI, Robotics and IoT (HONET))

   Given a road network and a set of trajectory data, the anomalous behavior detection (ABD) problem is to identify drivers that show significant directional deviations, hard-brakings, and accelerations in their trips. The ABD problem is important in many societal applications, including Mild Cognitive Impairment (MCI) detection and safe route recommendations for older drivers. The ABD problem is computationally challenging due to the large size of temporally-detailed trajectories dataset. In this paper, we propose an Edge-Attributed Matrix that can represent the key properties of temporally-detailed trajectory datasets and identify abnormal driving behaviors. Experiments using real-world datasets demonstrated that our approach identifies abnormal driving behaviors. 

   more » « less
4. Rapid Detection of Bacteria Using Raman Spectroscopy and Deep Learning

   https://doi.org/10.1109/CCWC51732.2021.9375955  

   Kukula, Kaitlyn; Farmer, Denzel; Duran, Jesse; Majid, Nishatul; Chatterley, Christie; Jessing, Jeff; Li, Yiyan (January 2021, 2021 IEEE 11th Annual Computing and Communication Workshop and Conference (CCWC))

   null (Ed.)

   Bacteria identification can be a time-consuming process. Machine learning algorithms that use deep convolutional neural networks (CNNs) provide a promising alternative. Here, we present a deep learning based approach paired with Raman spectroscopy to rapidly and accurately detect the identity of a bacteria class. We propose a simple 4-layer CNN architecture and use a 30-class bacteria isolate dataset for training and testing. We achieve an identification accuracy of around 86% with identification speeds close to real-time. This optical/biological detection method is promising for applications in the detection of microbes in liquid biopsies and concentrated environmental liquid samples, where fast and accurate detection is crucial. This study uses a recently published dataset of Raman spectra from bacteria samples and an improved CNN model built with TensorFlow. Results show improved identification accuracy and reduced network complexity. 

   more » « less
5. Towards Safe Autonomy in Hybrid Traffic: Detecting Unpredictable Abnormal Behaviors of Human Drivers via Information Sharing

   https://doi.org/10.1145/3616398  

   Wang, Jiangwei; Su, Lili; Han, Songyang; Song, Dongjin; Miao, Fei (September 2023, ACM Transactions on Cyber-Physical Systems)

   Hybrid traffic which involves both autonomous and human-driven vehicles would be the norm of the autonomous vehicles’ practice for a while. On the one hand, unlike autonomous vehicles, human-driven vehicles could exhibit sudden abnormal behaviors such as unpredictably switching to dangerous driving modes – putting its neighboring vehicles under risks; such undesired mode switching could arise from numbers of human driver factors, including fatigue, drunkenness, distraction, aggressiveness, etc. On the other hand, modern vehicle-to-vehicle (V2V) communication technologies enable the autonomous vehicles to efficiently and reliably share the scarce run-time information with each other [1]. In this paper, we propose, to the best of our knowledge, the first efficient algorithm that can (1) significantly improve trajectory prediction by effectively fusing the run-time information shared by surrounding autonomous vehicles, and can (2) accurately and quickly detect abnormal human driving mode switches or abnormal driving behavior with formal assurance without hurting human drivers’ privacy. To validate our proposed algorithm, we first evaluate our proposed trajectory predictor on NGSIM and Argoverse datasets and show that our proposed predictor outperforms the baseline methods. Then through extensive experiments on SUMO simulator, we show that our proposed algorithm has great detection performance in both highway and urban traffic. The best performance achieves detection rate of\(97.3\% \), average detection delay of 1.2s, and 0 false alarm. 

   more » « less