Theses supervised by Prof. Dr. Emin Anarım
10 theses · Boğaziçi University
On the user keyboard usage behavior analysis
Although many services available today in emerging information technologies started to use fingerprint, electronic key, face recognition methods to identify authorized or privileged users, still the majority usage of such services requires keyboard typed password. In order to increase the security and prevent unwanted accesses, security authorities mandate users to pick a password that has enough complexity and change it periodically but by ignoring the share of the password intentionally or unintentionally with third persons that workarounds all complexity relied on for security. This thesis is the part of more general topic that is Privileged Access Management (PAM). Firstly, this study examines user keyboard behavior, extracting features from the data collected during brief text entry, and attempts to authenticate the user's identity using various classification methods. The performance metrics of these methods are then calculated and compared. Secondly, in addition to classifiers found in the literature, a new GRU-based Siamese network architecture has been designed. The results of this architecture have been analyzed in the presence of leakage, and a method that completely prevents leakage has been proposed and the results shared. Finally, since the PAM project aims to offer all its services and functions in a cloud environment, CMU's keystroke database will be simulated in a network environment through a real-time embedded system. The performance of the proposed classification methods will be examined and compared under the conditions of new data collected using protocols such as UDP, TCP, and SSL.
Matris profil ve gramıan açısal toplam alan tabanlı özgün bir ağ saldırısı tespiti ve uygulama tanıma yaklaşımı
Network intrusions and attacks constitute a serious threat to internet structure. It is necessary to recognize attacks accurately to maintain the integrity of communication networks. Also, network traffic needs to be accurately classified for security and quality of service considerations. Machine learning applications have demonstrated superior performance in classification problems in several areas including network security. Uncovering hidden patterns is considered complex and therefore open to several novel methods. Matrix Profile (MP) and Gramian Angular Summation Field (GASF) are such mathematical algorithms that may successfully be utilized in machine learning models. This thesis presents a novel network intrusion detection and application classification methodology that incorporates MP and GASF with machine learning classifiers. Success of Random Forest model may be enhanced with MP and accuracy of Convolutional Neural Network (CNN) classifier may be improved with GASF. Features are converted to image using GASF to visualize patterns in time-series. Images are then fed to CNN model. Similarities in time-series are computed with MP algorithm as input to Random Forest classifier. Assessment of the proposed model is accomplished with publicly available datasets that contain several intrusions and network traffic application types. Validation results certainly prove that presented approach is successful and applicable. Major achievement of this study is to demonstrate that mathematical algorithms such as MP and GASF may be merged with machine learning models to yield accurate network intrusion and application classification.
The known network attack detection and unknown network attack identification based on deep learning methods
As accessing information has become easier, the encountered threats along the way have become more frequent. When it was realized that these ways of accessing information were not sufficiently reliable, various prevention techniques were implemented. One of the most useful of these measures is the intrusion detection systems. The Intrusion Detection Systems provide a comprehensive analysis of the network. This way, potential threats can be rapidly detected as quickly as possible and the necessary measures can be taken. On the other hand, classifying network traffic is not only important for identifying threats but it is also crucial for gaining insight into the network's overall behaviour. Utilizing generative networks for these purposes has become one of the most popular methods in recent times. In this study, deep learning methods are employed to analyze network traffic by using autoencoder models. In the proposed method, network traffic analysis consists of two stages. The first stage aims to correctly classify the classes in the training data. The second stage focuses on detecting unknown classes which is achieved through the application of Extreme Value Theory. Thanks to this mathematical approach, successful separation of known and unknown classes is achieved. The utilized data can be evaluated under two different headings. The first one consists of network attack types while the second comprises popular social media traffics. According to the performance evaluation metrics, the proposed procedure demonstrates satisfactory results in both the classification of known classes and the detection of unknown classes.
Vision correction for the visually impaired via digital image processing
In this study, an adjustment based on the mathematical modeling on digital screens for people with refractive visual impairments is proposed. According to the laws of refraction and diffraction, the human eye can be considered as a linear and space-invariant system. In such a case, if the impulse response of the eye (point spread function) is known, the convolution law can determine how the light entering the eye (input) is shaped according to the response of the eye. When the studies using point spread function for this purpose are examined, it is seen that the point spread function of the eye is found only on the basis of the crystalline lens. In this study, the incoming distance of light, the cornea structure, accommodation, age of the person and gradient-index structure of the crystalline lens are included in the human eye model. The idea in this study is that, based on the inverse convolution (deconvolution) method, if the light entering the eye is shaped according to the inverse of the impulse response of the eye, theoretically, the patient clearly sees the object whose light comes into the eye. The biggest problem with this approach, which can easily be adapted to personal computers, portable devices and smart glasses that are expected to be developed in the future, is that the deconvolved digital image has a much higher dynamic range than the dynamic range of the standard screens, hence, the disappearance of the necessary contrast. In order to solve this problem, methods that are different from studies in the literature are proposed. In the simulations, it is seen that the newly presented methods give better visual results than the existing ones. Although the existing methods are improved with this study, it is suggested as the future work that dynamic range compression and contrast enhancement methods should be further investigated and more complex methods should be proposed.
A novel scheduling strategy for priority-aware iot networks for age of information optimization
As the need for wireless communication grows, the need to increase spectral efficiency and reduce latency in communication has become more critical. In this study a novel scheduling strategy is proposed based on solving the Knapsack problem in Internet of Thing networks. The main goal is to minimize the difference between Age of Information (AoI) values of sensors and Peak AoI (PAoI) constraints subject to average and peak transmission power constraints given the communication resources are scarce. At first, we formulated the problem according to the specified PAoI constraint, transmission power, and frequency band constraints.The proposed approach involves reformulating the original problem as a Knapsack problem. This is done by assigning a value as the decrease in AoI of a sensor if a status update transmission is successful. In addition, a weight is specified as the frequency band amount that a sensor requires to transmit its update. Additionally, Fully Polynomial-Time Approximation scheme (FPTAS) is proposed to decrease the computational complexity while preserving the quality of results. Secondly, algorithms of benchmark methods were created together with the proposed method. Finally, the results of the simulations completed using the adapted algorithms are given. The proposed scheduling method is shown to outperform the benchmarks which are Multi-Armed-Bandit Q-learning and Whittle's Index strategies.
Performance analysis of multiple model kalman filters for target tracking
Target tracking is a computer vision problem on which many studies have been done and research on this topic is still ongoing. The main tasks of target tracking systems can be listed as determining the position, velocity or acceleration of one or more moving targets. Target tracking relies on a recursive prediction using noisy measurements from the radar in order to calculate the next movement of the target. Usually the data measured by monitoring devices is not precise, as the measurements have some kind of measurement noise depending on the sensor. Therefore, the measurement noise of the sensors complicates the target tracking and it is necessary to filter the noise in order to estimate the real path of the moving targets and improve the estimation of the trajectories of the targets. Although the measurement coming from the radar is in polar coordinates, in modern target tracking applications, since the motion of the target is linear in the Cartesian system, the state estimation of the next movement of the target is done in the Cartesian coordinate system. In this thesis, various Kalman Filters were investigated to monitor polar measurements with Cartesian coordinates, remodel noise and then compare the performances of these filters. In addition, since the target does not depend on a single movement model in real life, systems that enable the interaction of more than one movement model are used. Furthermore, the motion models and sample tracking scenarios used to evaluate the performance of these filters were defined, and the performance of multiple filter systems was evaluated through simulations made on different scenarios.
DDoS attack detection using signal processing and statistical approaches
DDoS attacks cause a variety of changes in the properties of the attributes in the network traffic. Modeling these changes using signal processing and statistical approaches provides detection of these attacks. This thesis focuses on detecting DDoS attacks using time series analysis, sparse signal representation methods, and statistical modeling. We also investigate the effect of DDoS attacks on traffic features in a statistical manner. In addition, we propose two simple but effective network-based DDoS attack detection methods based on the statistical signal processing approach, using the advantage of statistical changes in traffic features. We propose a novel DDoS detection framework using the Matching Pursuit algorithm to detect resource depletion type DDoS attacks. We use multiple characteristics of network traffic simultaneously to detect low-density DDoS attacks efficiently. The proposed method uses the dictionary produced from the parameters of the network traffic using the K-SVD algorithm. Dictionary generation using network traffic provides legitimate and attack traffic models and adds adaptability to the proposed method to network traffic. We also implement DDoS detection approaches that use Matching Pursuit and Wavelet techniques and compare them using two different data sets. Additionally, we offer a hybrid DDoS detection framework that combines these approaches with a decision-making mechanism using an artificial neural network. We evaluate the proposed methods with two different data sets. In the hybrid intrusion detection system with more than one attack, the detection performances of other approaches have decreased. In contrast, the proposed method achieves true-positive rates higher than 99% with a false positive rate lower than 0.7%.
Revisiting image captioning structures based on CNN and RNN, and improving the performance using modified decoders with residual connections
In this thesis, the image captioning structure consisting of a Convolutional Neural Network (CNN) as the encoder and a Recurrent Neural Network (RNN) as the decoder is visited by comparing and evaluating the effects of different image feature extractors, different RNN cells, different types of word embeddings, and the involvement of residual connections between the RNN cells. The famous ``Show, Attend and Tell" model is modified by adding residual connections between the RNN cells and adding other modifications on both the encoder and the decoder side, which improved the performance of the model on the image captioning task. Furthermore, models were trained by implementing 3 different pre-trained word embeddings and their benefits were explored. With the best model, 34 BLEU-4 points and 15 SPICE points improvement were achieved compared with the base model. The effects of training our best model with the images transformed into the frequency domain rather than the images represented in the spatial domain are investigated and it is concluded that this approach cannot enhance the performance of the model. The results of the experiments demonstrate the effectiveness of the proposed modifications and provide insights into the potential of residual connections.
Payload based multi-phase traffic classification with majority voting
Internet is becoming an essential part of our lives with even simple daily tasks depending on it. This led to an increase in network traffic accompanied with increase in number of applications hosted on internet. In this heavy traffic environment, classifying network flows in a fast and accurate manner, has great importance for network management. Internet Service Providers try to address this issue by using different approaches from port-based methods to machine learning models but due to widespread usage of dynamic ports and encrypted packets by modern applications, accuracy of these approaches declined. To overcome this challenge, recent studies focus on solutions using deep learning architectures. In this thesis, a multi-phase classification model based on voting and deep learning is proposed for encrypted traffic classification. The proposed model relies on the payload of the transmitted packets to classify flows. In this approach, deep learning based classifiers are trained using different numbers of packets from flows as input and the prediction of multi-phase model is an ensemble of these classifiers calculated by different voting strategies. This approach enables classification of flows starting from the first transmitted packet with payload, and updates the predicted class as the number of transmitted packets in flow increases. This approach has been tested on datasets containing real network flows from various applications. The performance of proposed approach is evaluated by comparing different classification models and different voting strategies.
Distributed denial of service attack detection using densitybased clustering and information fusion techniques
The devices in networks are constantly under numerous attack threat in today's complex internet world. DDoS is the well-known type of attack since it is easy to launch and disrupt the target traffic. Attackers can implement various techniques to launch their attacks by masquerading their real identities behind false addresses. In order to ensure confidentiality, integrity and availability, the implementing an Intrusion Prevention Systems is of primary importance in order to establish a secure network infrastructure. In thesis, we propose DDoS attack prevention framework in which multiple metrics from packet headers are used and then fused to generate a collective judgment on whether an attack occurs. Dempster-Shafer Theory is an information fusion approach for combining various evidences from various sources. An unsupervised BPA approach is employed to adapt assignment of beliefs to the most up to date attribute of the network traffic. The BPA approach is simple but highly effective. It has outstanding accuracy with low false alarms and very high attack identification rate. It is hard to find publicly available datasets for DDoS schemes. We used CAIDA and Bogazici University datasets. Datasets with more comprehensive features would be better to test success of our method. A descriptive analysis of the produced results, for all the used datasets are given. The performance evaluation of the effectiveness of proposed scheme is measured by using different attack rates.