Towards a Platform for Widespread Embedded Intelligence - ERCIM

One problem for these more widely
deployed smaller projects based on high
performance embedded modules is the
design cost and turnaround time.
Unfortunately there is no all-encompassing
design tool for DAQ systems.
The design process relies on an increasingly
large and diverse portfolio of complex
tools that require a high level of
expertise to operate. Thus there is a
growing cost of keeping up with the tool
flows required to access more powerful
hardware.
Currently we have an R&D program
funded internally by our Centre for
Instrumentation (CFI) which will investigate
the embedded processor design
tools. This project aims to reduce the
cost of the firmware and software design
for DAQ projects by developing a unified
approach based around FPGA
vendor embedded development tools.
Security
Network Anomaly Detection
by Means of Machine Learning
by Roland Kwitt
The strategy we propose is to exploit the
hardware IP modules and facilities
existing within the embedded design
tools by adding instrumentation-specific
DAQ IP for integration of the sensor data
stream. Customising the vendor’s framework
minimises the cost by reducing the
amount of work that needs to be done,
and minimises the risk by using standard
interfaces.
A similar approach is taken for the software
libraries - by using standard network
protocols (Ethernet) and operating
system APIs the software side of the
DAQ library is more like ‘DAQ middleware’.
The addition of embedded networked
microprocessors within our designs
gives us the ability to add higher levels
of intelligence to our systems which
might otherwise be difficult to include.
Anomaly detection should be an integral part of every computer security system,
since it is the only way to tackle the problem of identifying novel and modified
attacks. Our work focuses on machine-learning approaches for anomaly detection
and tries to deal with the problems that come along with it.
Since the number of reported security
incidents caused by network attacks is
dramatically increasing every year, corresponding
attack detection systems
have become a necessity in every company's
network security system.
Generally, there are two approaches to
tackle the detection problem. Most commercial
intrusion detection systems
employ some kind of signature-matching
algorithms to detect malicious activities.
In intrusion detection terminology this is
called “misuse detection”. Generally,
such systems have very low false alarm
rates and work very well in the event that
the corresponding attack signatures are
present. However, the last point leads
directly to the potential drawback of
misuse detection: missing signatures
inevitably lead to undetected attacks!
Here, the second approach, termed
anomaly detection, is in evidence.
Anomaly detection maps normal
behaviour to a baseline profile and tries
to detect deviations. Thus, no a priori
knowledge about attacks is needed any
longer and the problem of missing attack
signatures does not exist.
Our work deals with the applicability of
machine-learning approaches, specifically
Self-Organising Maps and neural
networks in the field of network anomaly
detection. By presenting a set of normal
(problem-specific) feature vectors to a
Self-Organising Map, it can learn the
specific characteristics of these vectors
and provide a distance measure of how
well a new input vector fits into the class
of normal data. In contrast to other
machine-learning approaches, Self-
R&D AND TECHNOLOGY TRANSFER
Even allowing for the availability of C to
hardware tools and an abundant gate
count in the FPGA using embedded
microprocessors would still be an efficient
method.
Examples of the type of features which
could be added include real-time tuning
of the data flow and processing algorithms,
logging of environmental information,
safety critical monitoring of sensors
(eg to prevent radiation damage),
interaction with higher level control systems
using standard protocols and provision
of information to the e-science systems
to aid in the management of the
integrity of the data set.
Please contact:
Rob Halsall, CCLRC Technology
Rutherford Appleton Laboratory UK
Tel: +44 1235 445140
E-mail: R.Halsall@rl.ac.uk
Organizing Maps do not require a
teacher who determines the favoured
output.
Considering the aforementioned feature
vectors, the vector elements strongly
depend on the preferred layer of detection.
That means, if anomaly detection is
carried out at the connection level for
instance, connection specific features,
for example packet counts, connection
duration, etc., have to be collected.
However, if we require detection at a
higher level, for example at application
layer, another set of features will be necessary.
Generally we can state, that the
more discriminative power a feature possesses,
the better detection results we
get.
In case we use a neural network architecture
for anomaly detection, such as a
Feed-Forward Multi-Layer Perceptron
(MLP), the training procedure for
normal behaviour might not be apparent
at first sight, since such networks gener-
ERCIM News No. 67, October 2006
63