This project mainly investigated three aspects of network security: i) state measurement and aggregation techniques for local network anomaly detection; ii) physical layer security for wireless network; iii) web server anomaly detection for civic services.

 
In the aspect of state measurement and aggregation techniques for local network anomaly detection, we proposed and evaluated an anomaly detection algorithm using compressed signals and a distance-based subspace anomaly detector. In addition, we implemented two distributed anomaly detection algorithms based on principal component analysis and analyzed the tradeoff between communication cost incurred by the distributed algorithm and the anomaly detection accuracy. We also analyzed the influence of training sample size on the anomaly detection accuracy and derived upper bound on the accuracy of the subspace obtained by the training data and an approximation to the anomaly detection error rate. We studied the problem of detecting denial-of-service attacks in wireless networks based on log-likelihood ratio test using Markov chain modeling. Finally, with respect to the problem of optimal transmission of distributed correlated discrete memoryless sources across a network with capacity constraints, we showed important structural properties of the polytope of feasible solutions, and investigated primal-dual based algorithms for finding the optimal solution. Next, we developed a comprehensive understanding of the set of feasible rates for the sensor encoders and how the network capacity constraints impact the feasibility of the vertices of the Slepian-Wolf rate region. We demonstrated a connection between conditional independence relationships amongst the sensors and the complexity of the optimization problem. We have shown that a decomposed/layered approach to solving the posed optimization problem, in general, leads to a suboptimal solution.

In the aspect of physical layer security for wireless network, we obtained significant results confirming that channel state information is a suitable source for physical layer security schemes leveraging reconfigurable antennas. Furthermore, we designed a practical sampling technique based on timer-based interrupts for implementing real-time wireless physical layer encryption techniques on standards-compliant devices. Finally, we invented a preamble-obfuscation technique for securing wireless devices from sophisticated cyber-attacks. 

In the aspect of web server anomaly detection for civic services, we designed an online automatic malware detection and classification system. Using the extracted features from live process-level system calls obtained by various sensors deployed on production hosts, the “quickest change” data fusion center can detect malware infection as quickly as possible. In addition, we evaluated the effectiveness of three machine learning based algorithms in detecting malware infections using system-call features. For malware classification, we evaluated our proposed malware classification system’s performance on data collected from production environments and experimentally identify the feature extraction, detection, and classification techniques that achieved high detection accuracy with low cost.

Last Modified: 10/09/2018
Modified by: Steven Weber