Research and development automatically generate detection rules for IDS based on machine learning technology

Abstract—Nowadays, there have been many signature-based intrusion detection systems deployed and widely used. These systems are capable of detecting known attacks with low false alarm rates, fast detection times, and little system resource requirements. However, these systems are less effective against new attacks that are not included in the ruleset. In addition, recent studies provide a new approach to the problem of detecting unknown types of network attacks based on machine learning and deep learning. However, this new approach requires a lot of resources, processing time and has a high false alarm rate. Therefore, it is necessary to find a solution that combines the advantages of the two approaches above in the problem of detecting network attacks. In this paper, the authors present a method to automatically generate network attack detection rules for the IDS system based on the results of training machine learning models. Through testing, the author proves that the system that automatically generates network attack detection rules for IDS based on machine learning meets the requirements of increasing the ability to detect new types of attacks, ensuring automatic effective updates of new signs of network attacks. Tóm tắt—Ngày nay, đã có nhiều hệ thống phát hiện xâm nhập dựa trên chữ ký được triển khai và sử dụng rộng rãi. Các hệ thống này có khả năng phát hiện các cuộc tấn công đã biết với tỷ lệ báo động giả thấp, thời gian phát hiện nhanh và yêu cầu ít tài nguyên hệ thống. Tuy nhiên, các hệ thống này kém hiệu quả khi chống lại các cuộc tấn công mới không có trong tập luật. Các nghiên cứu gần đây cung cấp một cách tiếp cận mới cho vấn đề phát hiện các kiểu tấn công mạng mới dựa trên học máy và học sâu. Tuy nhiên, cách tiếp cận này đòi hỏi nhiều tài nguyên, thời gian xử lý. Vì vậy, cần tìm ra giải pháp kết hợp ưu điểm của hai cách tiếp cận trên trong bài toán phát hiện tấn công mạng. Trong bài báo này, nhóm tác giả trình bày phương pháp tự động sinh luật phát hiện tấn công mạng cho hệ thống phát hiện xâm nhập dựa trên kết quả huấn luyện mô hình học máy. Qua thử nghiệm, tác giả chứng minh rằng phương pháp này đáp ứng yêu cầu tăng khả năng phát hiện chính xác các kiểu tấn công mới, đảm bảo tự động cập nhật hiệu quả các dấu hiệu tấn công mạng mới vào tập luật.

Europan Molecular Indicators of Life Investigation (EMILI) for a Future Europa Lander Mission

The Europan Molecular Indicators of Life Investigation (EMILI) is an instrument concept being developed for the Europa Lander mission currently under study. EMILI will meet and exceed the scientific and technical/resource requirements of the organic composition analyzer identified as a core instrument on the Lander. EMILI tightly couples two complementary analytical techniques, based on 1) liquid extraction and processing with capillary electrophoresis and 2) thermal and chemical extraction with gas chromatography, to robustly detect, structurally characterize, and quantify the broadest range of organics and other Europan chemicals over widely-varying concentrations. Dual processing and analysis paths enable EMILI to perform a thorough characterization of potential molecular biosignatures and contextual compounds in collected surface samples. Here we present a summary of the requirements, design, and development status of EMILI with projected scientific opportunities on the Europa Lander as well as on other potential life detection missions seeking potential molecular biosignatures in situ.

Energy planning with renewable energy sources

The urban energy model is based on imports from external sources. The continuous increase in energy demand due to population growth and development implies increasing resource requirements. The alternative is to use renewable energies that take advantage of urban resources. The diversity of typologies of cities in terms of resources, demands, architectural conditions, infrastructure, or density, makes a specific analysis necessary. This work identifies fourteen factors concerning the planning process that would allow choosing the most appropriate technology for a given city. Through consultation of experts, the existence of the resource is defined as the most prevalent factor, followed by economic conditions; On the other hand, it is detected that environmental aspects such as global warming, eutrophication, or acidification, are the least incidents when selecting technologies.

European carbon storage resource requirements of climate change mitigation targets

As a part of climate change mitigation plans in Europe, CO2 storage scenarios have been reported for the United Kingdom and the European Union with injection rates reaching 75 – 330 MtCO2 yr-1 by 2050. However, these plans are not constrained by geological properties or growth rates with precedent in the hydrocarbon industry. We use logistic models to identify growth trajectories and the associated storage resource base consistent with European targets. All of the targets represent ambitious growth, requiring average annual growth in injection rates of 9% – 15% from 2030-2050. Modelled plans are not constrained by CO2 storage availability and can be accommodated by the resources of offshore UK or Norway alone. Only if the resource base is significantly less, around 10% of current estimates, does storage availability limit mitigation plans. We further demonstrate the use of the models to define 2050 rate targets within conservative bounds of both growth rate and storage resource needs.

Multi-Cloud Resource Management Techniques for Cyber-Physical Systems

Information technology is based on data management between various sources. Software projects, as varied as simple applications or as complex as self-driving cars, are heavily reliant on the amounts, and types, of data ingested by one or more interconnected systems. Data is not only consumed but is transformed or mutated which requires copious amounts of computing resources. One of the most exciting areas of cyber-physical systems, autonomous vehicles, makes heavy use of deep learning and AI to mimic the highly complex actions of a human driver. Attempting to map human behavior (a large and abstract concept) requires large amounts of data, used by AIs to increase their knowledge and better attempt to solve complex problems. This paper outlines a full-fledged solution for managing resources in a multi-cloud environment. The purpose of this API is to accommodate ever-increasing resource requirements by leveraging the multi-cloud and using commercially available tools to scale resources and make systems more resilient while remaining as cloud agnostic as possible. To that effect, the work herein will consist of an architectural breakdown of the resource management API, a low-level description of the implementation and an experiment aimed at proving the feasibility, and applicability of the systems described.

Resources Required for Implementation of SARS-CoV-2 Screening in Massachusetts K-12 Public Schools in Winter/Spring 2021

Importance CDC guidance emphasizes the importance of in-person education for students in grades kindergarten to 12 (K-12) during the COVID-19 pandemic. CDC encourages weekly SARS-CoV-2 testing of asymptomatic, unvaccinated students and staff ("screening") to reduce infection risk and provide data about in-school SARS-CoV-2 prevalence where community incidence is high. The financial costs of screening assays have been described, but the human resource requirements at the school and district level to implement a SARS-CoV-2 screening program are not well known. Objective To quantify the resources required to implement a screening program in K-12 schools. Design, Setting, and Participants A consortium of Massachusetts public K-12 schools was formed to implement and evaluate a range of SARS-CoV-2 screening approaches. Participating districts were surveyed weekly about their programs, including: type of assay used, individual vs. pooled screening, approaches to return of results and deconvolution (identification of positive individual specimens) of positive pools, number and type of personnel implementing the screening program, and hours spent on program implementation. Main Outcomes and Measures Costs, resource utilization Results In 21 participating districts, over 21 weeks from January to June 2021, the positivity rate was 0.0%-0.21% among students and 0.0%-0.13% among educators/staff, and 4 out of 21 (19%) districts had at least one classroom transition to remote learning at any point due to a positive case. The average weekly cost to implement a screening program, including assay and personnel costs, was $17.00 per person tested; this was $46.68 for individual screenings and $15.61 for pooled screenings. The total weekly costs by district ranged from $1,644-$93,486, and districts screened between 58 and 3,675 people per week. The reported number of personnel working per week ranged from 1-5 to >50, and the total number of hours worked by all personnel ranged from 5-10 to >50. Conclusion and Relevance The human resources required to implement SARS-CoV-2 screening in Massachusetts public K-12 schools were substantial. Where screening is recommended for the 2021-22 school year due to high COVID-19 incidence (e.g., where vaccination uptake is low and/or more infectious variants predominate), understanding the human resources required to implement screening will assist districts policymakers in planning.

Method for Fast Map Construction Based on GPS Data and Compressed Grid Algorithm

Electronic maps play an important role in the field of urban traffic management, but the interface functions provided by map service agencies are limited, and commercial maps are generally expensive. Furthermore, the map generation algorithms based on the Global Positioning System (GPS) data can be very complex and take up a lot of storage space, which limits their application to specific practical problems, such as the real-time update of area maps, temporary road control, emergency route planning, and other scenarios. In order to solve this problem, an intuitive, extensible, and flexible method of constructing urban road maps is proposed. Using the Othello-coordinated method, the representation of the unit grid cell was redesigned. Through this method, the disadvantages of the raster map’s large storage space and computing resource requirements are compensated for during processing, improving the topological expression ability of the raster map and the speed with which the construction of the map is realized. The application potential of the proposed method is demonstrated by the evaluation of public transport service and road network resilience. In our experiments, the optimization efficiency of storage space was up to 99.914%, and the calculation accuracy of bus coverage was about 99.86%.

Quantization noise in low bit quantization and iterative adaptation to quantization noise in quantizable neural networks

Quantization is one of the most popular and widely used methods of speeding up a neural network. At the moment, the standard is 8-bit uniform quantization. Nevertheless, the use of uniform low-bit quantization (4- and 6-bit quantization) has significant advantages in speed and resource requirements for inference. We present our quantization algorithm that offers advantages when using uniform low-bit quantization. It is faster than quantization-aware training from scratch and more accurate than methods aimed only at selecting thresholds and reducing noise from quantization. We also investigated quantization noise in neural networks for low-bit quantization and concluded that quantization noise is not always a good metric for quantization quality.

Self-Adaptive Approximate Mobile Deep Learning

Edge intelligence is currently facing several important challenges hindering its performance, with the major drawback being meeting the high resource requirements of deep learning by the resource-constrained edge computing devices. The most recent adaptive neural network compression techniques demonstrated, in theory, the potential to facilitate the flexible deployment of deep learning models in real-world applications. However, their actual suitability and performance in ubiquitous or edge computing applications has not, to this date, been evaluated. In this context, our work aims to bridge the gap between the theoretical resource savings promised by such approaches and the requirements of a real-world mobile application by introducing algorithms that dynamically guide the compression rate of a neural network according to the continuously changing context in which the mobile computation is taking place. Through an in-depth trace-based investigation, we confirm the feasibility of our adaptation algorithms in offering a scalable trade-off between the inference accuracy and resource usage. We then implement our approach on real-world edge devices and, through a human activity recognition application, confirm that it offers efficient neural network compression adaptation in highly dynamic environments. The results of our experiment with 21 participants show that, compared to using static network compression, our approach uses 2.18× less energy with only a 1.5% drop in the average accuracy of the classification.