The Internet has become a vital source of information; internal and external attacks threaten the integrity of the LAN connected to the Internet. In this work, several techniques have been described for detection of such threats. We have focussed on anomaly-based intrusion detection in the campus environment at the network edge. A campus LAN consisting of more than 9000 users with a 90 Mbps internet access link is a large network. Therefore, efficient techniques are required to handle such big data and to model user behaviour. Proxy server logs of a campus LAN and edge router traces have been used for anomalies like abusive Internet access, systematic downloading (internal threats) and DDoS attacks (external threat); our techniques involve machine learning and time series analysis applied at different layers in TCP/IP stack. Accuracy of our techniques has been demonstrated through extensive experimentation on huge and varied datasets. All the techniques are applicable at the edge and can be integrated into a Network Intrusion Detection System.

No abstract

Urban flooding is a common problem across the world. In India, it leads to casualties every year, and financial loss to the tune of tens of billions of rupees. The damage done due to flooding can be mitigated if the locations deserving attention are known. This will enable an effective emergency response, and provide enough information for the construction of appropriate storm water drains to mitigate the effect of floods. In this work, a new technique to detect flooding level is introduced, which requires no additional equipment, and consequent installation and maintenance costs. The gait characteristics in different flooding levels have been captured by smartphone sensors, which are then used to classify flooding levels. In order to accomplish this, smartphone sensor readings have been taken by 12 volunteers in pools of different depths, and have been used to train machine learning models in a supervised manner. Support vector machines, random forests and naïve bayes models have been attempted, of which, support vector machines perform best with a classification accuracy of 99.45%. Further analysis of the most relevant features for classification agrees with our intuition of gait characteristics in different depths.

In a LAN, Internet access should be managed weil for a better user experience. Those using a larger share of the bandwidth may be restricted during peak hours to enable others to use the Internet. This can be viewed as a problem of classifying the users based on their Internet usage into normal and high categories, following which control policies may be applied. For this purpose, a proxy-based mechanism has been proposed for classification of users according to the share of their Internet access. The advantage of this approach is that users sharing the same computer can be distinguished by the proxy server and appropriate control policies can be exercised. To understand user behaviour, data is collected at the proxy server in a campus LAN. Machine learning algorithms are then used to learn and characterise user behaviour. In particular, Naive Bayes' and Gaussian Mixture Model based classifiers are used.It is observed that the algorithms are able to scale in that users are clustered into two different groups. Performance evaluation on a held out data set indicates that users can be accurately distinguished 94.96% of the time. The algorithm is also practical since the time consuming task of model building need be done only once a month offiine, while the daily task of classification may be accomplished in a period of 20 mins for GMMs. It has also been shown how the user behavior of the two groups of users may be characterized. This would be a useful aid in the design of policies and algorithms for Internet access control.

No abstract