Theses supervised by Prof. Dr. Emin Anarım
20 theses · Boğaziçi University
A Novel system model implementation of network attacks and countermeasures
The Internet is an open and efficient TCP/IP protocol which is most widely usedin the world. As usage of the Internet and TCP/IP protocols increases, their lack ofbuilt-in security has become more and more problematic. Nowadays, network attacksare the most important and serious problem on the Internet. DoS attack is the oneof these network attacks which takes advantage of the lack of authenticity in the IPprotocol and stateless nature of the Internet.This thesis examines the TCP/IP architecture, general network structures andnetwork security mechanisms.Second, DDoS attacks and server system models are covered in this work. Newattack models are proposed and developed. These new models and also existing attackmodels are simulated. While generating dierent attacks, new proposed server model isalso designed and coded. This server is called \virtual server with a new perspective".Third, after generating the custom attacks against the custom server system,protection and warning mechanisms are required on the server side. In that case,custom intrusion detection and intrusion prevention system models are designed. Inaddition, numerous of simulation are completed.Finally, at the end of the research, many point of views about conutermeasuressystems are proposed, and their results are investigated.
Enhanced resource-aware video multicasting via access gateways in multi-hop wireless mesh networks
Wireless mesh networks (WMN) are the communication networks made up of radio nodes organized in a mesh topology. In recent years there are many applications like video survelliance, video conferencing that have been implemented over these kind of networks. As wireless mesh networks become more popular and their size and complexity continues to grow, mesh networks that contain multiple hops become increasingly vulnerable to problems such as bandwidth degredation, radio interference and network latency. In extreme cases, where voice and video applications are heavily at work, a complete connection loss can occur when latency and RF interference reach unacceptable levels. This thesis work studies video multicasting in large scale areas using wireless mesh networks. The focus is on the use of internet access gateways that allow a choice of alternative routes to avoid potentially lengthy multi-hop wireless paths with low capacity. We mainly get inspired from the set of heuristic-based algorithms that were described at the paper named ?Resource aware video multicasting via Access Gateways in Wireless Mesh Networks?: the two-tier integrated architecture algorithm (TIA), the weighted gateway uploading algorithm (WGU) and the link-controlled routing tree algorithm (LCRT). Two enhancements were developed for both TIA and LCRT, and afterwards performance analysis have been made to obtain the contribution of the new scheme.
Elektronik nesne kontrol (EAS) sistemleri uygulama, analiz ve gerçeklenmesi
The aim of this work is to design, implement and verify a low cost microcontrollerbased electronic article surveillance (EAS) system prototype and is accomplished ingreat success. An EAS system is basically used for preventing the shoplifters. The systembasically consists of three parts, namely, the tag, the transceiver and the antenna.The tag is a series LC circuit that consists of a wire wound coil and a capacitor. Thetransceiver circuit is responsible for detecting the presence of the tag in the environmentand finally the antenna is basically a large coil that is used for energizing the tagin the environment. Our study basically consists of two parts, namely the simulationresults based on acquired data and the hardware implementation. The physical datais captured via a commercially available EAS system from Checkpoint Company. Thetransceiver circuit and the antenna is used to energize the tag in the environment. Aseparate loop antenna that is tuned for 8.2 MHz is used for capturing data. This loopantenna is called ?sniffer? throughout the rest of this work. The captured data is savedvia Tektronix DPO4104 oscilloscope as ?csv? files. MATLAB is used for processingthe captured data and for developing the algorithm. The hardware implementationpart is the practical realization of our work. There are mainly five blocks used in atypical EAS system which are frequency synthesizer, amplifier, receiver, power unitand the processing unit. Each of them are carefully designed and tested as they willbe explained in great detail within the relevant chapter.
DDoS attack detection using frequency domain characteristics
Providing 24-hour service to the users, is one of the major concerns of network administrators. A denial of service attack refers to a condition that a server cannot give normal services to its legitimate clients due to the large amount of bogus packets sent by an unknown source. In a distributed denial of service (DDoS) attack, an attacker launches the attack on a server via a large number of unaware computers through Internet. During a DDoS attack, the victim is forced to reply to the requests from those infected nodes called zombies. The first step of countermeasure against these types of threats is detection. Conventional methods analyze the contents of packets arrived to the victim node to find an abnormality. Although they can identify some simple attacks, they are almost unable to segregate the source of normal traffic from attack one when attackers alter the source IP address into the normal source IP address. Additionally the contents of the abnormal packets are usually changed intentionally by attackers to be close to those in normal packets and therefore they can easily be passed through a system employing traditional detection approaches. In this thesis, a frequency domain analysis is proposed to detect DDoS attacks. The number of packets received by the victim in a specific interval are sampled and considered as a random process. Employing two different methods of power spectral density estimation, the frequency characteristic of the time series is estimated. Using each spectrum estimation methods, two sets of frequency characteristics, one for normal and another for DDoS traffic, are acquired, and utilized by a signature based intrusion detection system to detect abnormality.
Active packet filtering against DDoS attack
Distributed Denial of Service (DDoS) attacks are one of the dominant and persistent threats to the security of the Internet nowadays. The aim of these attacks are mainly resource or the bandwidth consumption with enormous number of normal packets. Their target are at layer three or four of the network which are network and transport layers, where distinguishing a normal packet from a malicious one is an arduous task. However, these are not the only precarious aspects of DDoS attacks. A DDoS attacker may easily spoof its source IP address, to hide the origins of the attack. Therefore, developing a distributed defense filtering strategy which can efficiently detect and drop attack packets with the least possible false negative probability is crucial. In this thesis, we propose an incorporated filtering scheme in victim host and edge routers, which detects and drops the illegitimate packets while mitigating the huge amount of data coming toward the victim in edge routers. First, a novel anomaly detection based on feature statistical behavior and payload characteristics of normal and attack traffic is proposed. In the second step, a host-based filtering strategy that detects spoofed packets with a combination of IP history based and hops counting filters, is applied in victim side by means of an advanced matrix bloom filter. Along with this filter, the defense and availability of the service on the target is guaranteed by turning off several edge routers by optimization system. This optimization, selects edge routers to be turned off for the good throughput to reach to the victim via two optimization algorithms, (i) Genetic evolutionary algorithm and (ii) linear programming algorithm.
Malware analysis with side-channel information on android smartphones
In recent years, smartphones have become inseparable components of people's daily life. However, the great popularity of smartphones causes some security problems. For example, users may store their contact lists, passwords and other credentials in their smartphones. In addition to various features, smartphones also have various motion sensors like accelerometer and gyroscope. Therefore, number of malwares focused on smartphones goes up while capabilities of smartphones increase. It is well-known fact that Android has gained great popularity in smartphone technology and it is leader of smartphone market. This unluckily leads attackers to the Android platform. There are various malwares targeting Android smartphones like premium-SMS malwares. Since users intensely use touchscreen of their smartphones, attackers are highly interested in touchscreen nowadays. Furthermore, attackers use motion sensors as a side-channel information to obtain user's private data. There are several studies in the literature which show how motion sensors can be used as a side-channel. In this thesis, we firstly investigate malwares targeting Android smartphones, analyse their behavior and motivations. Then, we show that accelerometer sensor data can be used to infer user's input on touchscreen. We handle available studies in this area and propose new feature set for PIN inference by using accelerometer data. We considerably reduce the number of feature vectors while slightly improve the accuracy rate in PIN inference. Another important contribution of the thesis is to determine user's age interval by using accelerometer sensor as a side-channel. We show that by analyzing user's tap event on the touchscreen we can determine whether the user is child or adult. This is actually our great contribution to the literature because this information may give attackers extra avenues for their malicious acitivities.
Paket karakterleri ile DDoS atak tespiti
DDoS attacks have been in internet life for a long time and most of hosts are still vulnerable for DDoS attacks. Complete detection and prevention of DDoS attacks is almost impossible, since their working method. Especially, if you are observing a network, not only one host, detecting DDoS attack can be much harder. To detect DDoS attacks existence, we used 11 features. We first used only threshold value of each features to detect DDoS attacks. Then, we used RMS (Root Mean Square) to improve our detection rates. We found different features are the best for Syn flood attack detection and UDP Flood attack detection. The hardest issue for working on DDoS attacks is lack of publicly available datasets. We used UCLA dataset (University of California, Los Angeles), NUST datasets (National University of Sciences and Technology) and we composed 2 more datasets in Bogazici University to work on. In total, we applied our methods on 5 different datasets from 3 different institutes. Then, we compared our results with other similar studies. Our analysis showed that the best feature to detect TCP Syn flood attack is "SYN/ACK ratio" and the best feature to detect UDP flood is "flow generating rate".
Sparse signal recovery from incomplete and perturbed data
Sparse signal recovery consists of algorithms that are able to recover undersampled high dimensional signals accurately. These algorithms require fewer measurements than traditional Shannon/Nyquist sampling theorem demands. Sparse signal recovery has found many applications including magnetic resonance imaging, electromagnetic inverse scattering, radar/sonar imaging, seismic data collection, sensor array processing and channel estimation. The focus of this thesis is on electromagentic inverse scattering problem and joint estimation of the frequency offset and the channel impulse response in OFDM. In the electromagnetic inverse scattering problem, the aim is to find the electromagnetic properties of unknown targets from measured scattered field. The reconstruction of closely placed point-like objects is investigated. The application of the greedy pursuit based sparse recovery methods, OMP and FTB-OMP, is proposed for increasing the reconstruction resolution. The performances of the proposed methods are compared against NESTA and MT-BCS methods. Simulations show that the FTB-OMP method increases the resolution of the regular OMP and is superior to NESTA for less noisy measurements. OFDM is a multicarrier modulation technique that is very sensitive to frequency synchronization and channel estimation errors. Frequency offset destroys the orthogonality of the OFDM carriers and results in intercarrier inteference that causes severe performance degradation. A new approach that represents the channel impulse response as a 1-block sparse signal in a dictionary built by concatenating subspaces of frequency offset values is proposed. Thus the frequency offset and the channel impulse response can be jointly estimated. Only one OFDM training block is used and noise or channel statistics are not required. Its performance is close to maximum likelihood estimation and does not depend on frequency offset.
User behavior and authentication analysis on smart devices
Smart devices, including smartphones, tablets, and wearable watches, have seamlessly integrated into daily life, gaining popularity due to their portability and user-friendly interfaces. The increased usage of these devices has catalyzed research in various domains. In these studies, the interactions between users and devices are investigated, leading to valuable insights into user habits and behaviors. These insights find applications in diverse fields, such as advertising, healthcare, and security, contributing to improving user experience and augmenting existing systems. However, there remains a need to address the limitations in current research, enhance their performance, and explore new opportunities. Therefore, this thesis focuses on analyzing user behaviors on smart devices, delving into three primary areas: age group detection, gender detection, and user authentication. Initially, a method for detecting user age groups utilizing smartphone accelerometer data is presented. Subsequently, four distinct gender detection schemes for smartphones are proposed. These schemes first involve machine learning approaches to detect gender across various user activities. Gender detection methods are then introduced based on deep learning approaches, comprising time-series to image transformation, continuous wavelet transform, and convolutional neural networks. Finally, two innovative methods for user authentication on smartphones are proposed. The first method employs traditional machine learning algorithms to analyze sensor data and touching behaviors. In contrast, the second method integrates data augmentation, discrete wavelet transform, and autoencoder models for user authentication. The proposed models demonstrate promising performance and address limitations in previous studies.
Comparing matrix profile lightweight algorithms usingself-collected data for detecting DDoS attacks in IoTequipment
With the rise of mobile network technologies like 5G and Beyond 5G, the integration of Internet of Things (IoT) or, more broadly, Internet of Everything (IoE) has become increasingly widespread across industries and daily life. However,the inherent vulnerabilities in IoT networks, characterized by their extensive distribution and the limited security measures and processing power of IoT devices, expose them to various threats, notably Distributed Denial of Service (DDoS) attacks that jeopardize network availability. To address the challenge of lightweight DDoS detection in IoT environments with constrained resources, this study focuses on Matrix Profile (MP) based anomaly detection. Known for its efficacy in analyzing time series data and its advantages in terms of speed and minimal processing load, six MP based algorithms are compared in this research, all designed to operate efficiently on IoT devices. The goal is to evaluate the performance of these algorithms in detecting DDoS attacks using the system data of IoT devices, proposing a new approach to enhance the security of IoT networks against these threats.
Vision correction for the visually impaired via digital image processing
In this study, an adjustment based on the mathematical modeling on digital screens for people with refractive visual impairments is proposed. According to the laws of refraction and diffraction, the human eye can be considered as a linear and space-invariant system. In such a case, if the impulse response of the eye (point spread function) is known, the convolution law can determine how the light entering the eye (input) is shaped according to the response of the eye. When the studies using point spread function for this purpose are examined, it is seen that the point spread function of the eye is found only on the basis of the crystalline lens. In this study, the incoming distance of light, the cornea structure, accommodation, age of the person and gradient-index structure of the crystalline lens are included in the human eye model. The idea in this study is that, based on the inverse convolution (deconvolution) method, if the light entering the eye is shaped according to the inverse of the impulse response of the eye, theoretically, the patient clearly sees the object whose light comes into the eye. The biggest problem with this approach, which can easily be adapted to personal computers, portable devices and smart glasses that are expected to be developed in the future, is that the deconvolved digital image has a much higher dynamic range than the dynamic range of the standard screens, hence, the disappearance of the necessary contrast. In order to solve this problem, methods that are different from studies in the literature are proposed. In the simulations, it is seen that the newly presented methods give better visual results than the existing ones. Although the existing methods are improved with this study, it is suggested as the future work that dynamic range compression and contrast enhancement methods should be further investigated and more complex methods should be proposed.
Distributed denial of service attack detection using densitybased clustering and information fusion techniques
The devices in networks are constantly under numerous attack threat in today's complex internet world. DDoS is the well-known type of attack since it is easy to launch and disrupt the target traffic. Attackers can implement various techniques to launch their attacks by masquerading their real identities behind false addresses. In order to ensure confidentiality, integrity and availability, the implementing an Intrusion Prevention Systems is of primary importance in order to establish a secure network infrastructure. In thesis, we propose DDoS attack prevention framework in which multiple metrics from packet headers are used and then fused to generate a collective judgment on whether an attack occurs. Dempster-Shafer Theory is an information fusion approach for combining various evidences from various sources. An unsupervised BPA approach is employed to adapt assignment of beliefs to the most up to date attribute of the network traffic. The BPA approach is simple but highly effective. It has outstanding accuracy with low false alarms and very high attack identification rate. It is hard to find publicly available datasets for DDoS schemes. We used CAIDA and Bogazici University datasets. Datasets with more comprehensive features would be better to test success of our method. A descriptive analysis of the produced results, for all the used datasets are given. The performance evaluation of the effectiveness of proposed scheme is measured by using different attack rates.
DDoS attack detection using signal processing and statistical approaches
DDoS attacks cause a variety of changes in the properties of the attributes in the network traffic. Modeling these changes using signal processing and statistical approaches provides detection of these attacks. This thesis focuses on detecting DDoS attacks using time series analysis, sparse signal representation methods, and statistical modeling. We also investigate the effect of DDoS attacks on traffic features in a statistical manner. In addition, we propose two simple but effective network-based DDoS attack detection methods based on the statistical signal processing approach, using the advantage of statistical changes in traffic features. We propose a novel DDoS detection framework using the Matching Pursuit algorithm to detect resource depletion type DDoS attacks. We use multiple characteristics of network traffic simultaneously to detect low-density DDoS attacks efficiently. The proposed method uses the dictionary produced from the parameters of the network traffic using the K-SVD algorithm. Dictionary generation using network traffic provides legitimate and attack traffic models and adds adaptability to the proposed method to network traffic. We also implement DDoS detection approaches that use Matching Pursuit and Wavelet techniques and compare them using two different data sets. Additionally, we offer a hybrid DDoS detection framework that combines these approaches with a decision-making mechanism using an artificial neural network. We evaluate the proposed methods with two different data sets. In the hybrid intrusion detection system with more than one attack, the detection performances of other approaches have decreased. In contrast, the proposed method achieves true-positive rates higher than 99% with a false positive rate lower than 0.7%.
Performance analysis of multiple model kalman filters for target tracking
Target tracking is a computer vision problem on which many studies have been done and research on this topic is still ongoing. The main tasks of target tracking systems can be listed as determining the position, velocity or acceleration of one or more moving targets. Target tracking relies on a recursive prediction using noisy measurements from the radar in order to calculate the next movement of the target. Usually the data measured by monitoring devices is not precise, as the measurements have some kind of measurement noise depending on the sensor. Therefore, the measurement noise of the sensors complicates the target tracking and it is necessary to filter the noise in order to estimate the real path of the moving targets and improve the estimation of the trajectories of the targets. Although the measurement coming from the radar is in polar coordinates, in modern target tracking applications, since the motion of the target is linear in the Cartesian system, the state estimation of the next movement of the target is done in the Cartesian coordinate system. In this thesis, various Kalman Filters were investigated to monitor polar measurements with Cartesian coordinates, remodel noise and then compare the performances of these filters. In addition, since the target does not depend on a single movement model in real life, systems that enable the interaction of more than one movement model are used. Furthermore, the motion models and sample tracking scenarios used to evaluate the performance of these filters were defined, and the performance of multiple filter systems was evaluated through simulations made on different scenarios.
Payload based multi-phase traffic classification with majority voting
Internet is becoming an essential part of our lives with even simple daily tasks depending on it. This led to an increase in network traffic accompanied with increase in number of applications hosted on internet. In this heavy traffic environment, classifying network flows in a fast and accurate manner, has great importance for network management. Internet Service Providers try to address this issue by using different approaches from port-based methods to machine learning models but due to widespread usage of dynamic ports and encrypted packets by modern applications, accuracy of these approaches declined. To overcome this challenge, recent studies focus on solutions using deep learning architectures. In this thesis, a multi-phase classification model based on voting and deep learning is proposed for encrypted traffic classification. The proposed model relies on the payload of the transmitted packets to classify flows. In this approach, deep learning based classifiers are trained using different numbers of packets from flows as input and the prediction of multi-phase model is an ensemble of these classifiers calculated by different voting strategies. This approach enables classification of flows starting from the first transmitted packet with payload, and updates the predicted class as the number of transmitted packets in flow increases. This approach has been tested on datasets containing real network flows from various applications. The performance of proposed approach is evaluated by comparing different classification models and different voting strategies.
Revisiting image captioning structures based on CNN and RNN, and improving the performance using modified decoders with residual connections
In this thesis, the image captioning structure consisting of a Convolutional Neural Network (CNN) as the encoder and a Recurrent Neural Network (RNN) as the decoder is visited by comparing and evaluating the effects of different image feature extractors, different RNN cells, different types of word embeddings, and the involvement of residual connections between the RNN cells. The famous ``Show, Attend and Tell" model is modified by adding residual connections between the RNN cells and adding other modifications on both the encoder and the decoder side, which improved the performance of the model on the image captioning task. Furthermore, models were trained by implementing 3 different pre-trained word embeddings and their benefits were explored. With the best model, 34 BLEU-4 points and 15 SPICE points improvement were achieved compared with the base model. The effects of training our best model with the images transformed into the frequency domain rather than the images represented in the spatial domain are investigated and it is concluded that this approach cannot enhance the performance of the model. The results of the experiments demonstrate the effectiveness of the proposed modifications and provide insights into the potential of residual connections.
The known network attack detection and unknown network attack identification based on deep learning methods
As accessing information has become easier, the encountered threats along the way have become more frequent. When it was realized that these ways of accessing information were not sufficiently reliable, various prevention techniques were implemented. One of the most useful of these measures is the intrusion detection systems. The Intrusion Detection Systems provide a comprehensive analysis of the network. This way, potential threats can be rapidly detected as quickly as possible and the necessary measures can be taken. On the other hand, classifying network traffic is not only important for identifying threats but it is also crucial for gaining insight into the network's overall behaviour. Utilizing generative networks for these purposes has become one of the most popular methods in recent times. In this study, deep learning methods are employed to analyze network traffic by using autoencoder models. In the proposed method, network traffic analysis consists of two stages. The first stage aims to correctly classify the classes in the training data. The second stage focuses on detecting unknown classes which is achieved through the application of Extreme Value Theory. Thanks to this mathematical approach, successful separation of known and unknown classes is achieved. The utilized data can be evaluated under two different headings. The first one consists of network attack types while the second comprises popular social media traffics. According to the performance evaluation metrics, the proposed procedure demonstrates satisfactory results in both the classification of known classes and the detection of unknown classes.
A novel scheduling strategy for priority-aware iot networks for age of information optimization
As the need for wireless communication grows, the need to increase spectral efficiency and reduce latency in communication has become more critical. In this study a novel scheduling strategy is proposed based on solving the Knapsack problem in Internet of Thing networks. The main goal is to minimize the difference between Age of Information (AoI) values of sensors and Peak AoI (PAoI) constraints subject to average and peak transmission power constraints given the communication resources are scarce. At first, we formulated the problem according to the specified PAoI constraint, transmission power, and frequency band constraints.The proposed approach involves reformulating the original problem as a Knapsack problem. This is done by assigning a value as the decrease in AoI of a sensor if a status update transmission is successful. In addition, a weight is specified as the frequency band amount that a sensor requires to transmit its update. Additionally, Fully Polynomial-Time Approximation scheme (FPTAS) is proposed to decrease the computational complexity while preserving the quality of results. Secondly, algorithms of benchmark methods were created together with the proposed method. Finally, the results of the simulations completed using the adapted algorithms are given. The proposed scheduling method is shown to outperform the benchmarks which are Multi-Armed-Bandit Q-learning and Whittle's Index strategies.
On the user keyboard usage behavior analysis
Although many services available today in emerging information technologies started to use fingerprint, electronic key, face recognition methods to identify authorized or privileged users, still the majority usage of such services requires keyboard typed password. In order to increase the security and prevent unwanted accesses, security authorities mandate users to pick a password that has enough complexity and change it periodically but by ignoring the share of the password intentionally or unintentionally with third persons that workarounds all complexity relied on for security. This thesis is the part of more general topic that is Privileged Access Management (PAM). Firstly, this study examines user keyboard behavior, extracting features from the data collected during brief text entry, and attempts to authenticate the user's identity using various classification methods. The performance metrics of these methods are then calculated and compared. Secondly, in addition to classifiers found in the literature, a new GRU-based Siamese network architecture has been designed. The results of this architecture have been analyzed in the presence of leakage, and a method that completely prevents leakage has been proposed and the results shared. Finally, since the PAM project aims to offer all its services and functions in a cloud environment, CMU's keystroke database will be simulated in a network environment through a real-time embedded system. The performance of the proposed classification methods will be examined and compared under the conditions of new data collected using protocols such as UDP, TCP, and SSL.
A novel network intrusion detection and application identification approach based on matrix profile and gramian angular summation field
Network intrusions and attacks constitute a serious threat to internet structure. It is necessary to recognize attacks accurately to maintain the integrity of communication networks. Also, network traffic needs to be accurately classified for security and quality of service considerations. Machine learning applications have demonstrated superior performance in classification problems in several areas including network security. Uncovering hidden patterns is considered complex and therefore open to several novel methods. Matrix Profile (MP) and Gramian Angular Summation Field (GASF) are such mathematical algorithms that may successfully be utilized in machine learning models. This thesis presents a novel network intrusion detection and application classification methodology that incorporates MP and GASF with machine learning classifiers. Success of Random Forest model may be enhanced with MP and accuracy of Convolutional Neural Network (CNN) classifier may be improved with GASF. Features are converted to image using GASF to visualize patterns in time-series. Images are then fed to CNN model. Similarities in time-series are computed with MP algorithm as input to Random Forest classifier. Assessment of the proposed model is accomplished with publicly available datasets that contain several intrusions and network traffic application types. Validation results certainly prove that presented approach is successful and applicable. Major achievement of this study is to demonstrate that mathematical algorithms such as MP and GASF may be merged with machine learning models to yield accurate network intrusion and application classification.