Search

Ovaj rad dotiče temu diferencijabilnog programiranja kao novog pogleda na područje neuronskih mreža. Definiraju se neprijateljski napadi i opisuje njihova podjela na usmjerene i neusmjerene napade. Implementirana su tri modela na kojima je testirana dana teoretska podloga: dva potpuno povezana modela (s jednim i dva skrivena sloja) i konvolucijski model. U nastavku je opisano treniranje robusnih modela. Detaljno su opisani FGSM i PGD napadi. Predstavljen je kratak osvrt na programski okvir TensorFlow i skup podataka MNIST koji je korišten za testiranje teoretskih kocepata opisanih u radu. Potpuno povezani modeli (s jednim odnosno dva skrivena sloja) i konvolucijski model prilikom normalnog treniranja postižu točnost od oko 87%, 88% odnosno 97%. Prilikom neprijateljskih napada isti modeli za apsolutnu vrijednost neprijateljske perturbacije od 0.1 postižu točnost od 0.6%, 0.8% odnosno 2.3% kada se radi o PGD napadima. Za FGSM napade i jednaku vrijednost perturbacije točnosti su 3.6%, 1.3% i 27.9%. Treniranjem robusnih modela postignuto je poboljšanje u točnosti prilikom napada na 87% za vrijednost perturbacije 0.3. Dodatno, u radu je prikazana i programska implementacija opisanih napada. This work addresses the topic of differentiable programming as a new shift in perspective on the field of neural networks. The definition of adversarial attacks are presented, as well as their classification into two major groups: targeted and untargeted attacks. In the scope of this work, three different models were implemented and used for testing the theoretical background: two dense fully connected neural networks (with one and two hidden layers, respectively), and one convolutional model. The process of training these models is given, as well as a detailed description of the FGSM and PGD types of attacks. Further, the work presents a brief introduction to the TensorFlow library and the MNIST dataset. During the normal training procedure, the tested models achieved accuracies of 87%, 88% and 97% (respectively), while under adversarial attacks with perturbation of 0.1 the same models achieve accuracies of 0.6%, 0.8% and 2.3% (respectively) for the PGD type, and 3.6%, 1.3% and 27.9% for the FGSM type (respectively). By training the robust model, the accuracy was significantly improved, up to 87% for the perturbation value of 0.3. Additionally, this work also presents the software implementation of the described adversarial attacks.

Electric power has become an essential part of daily life: we plug our electronic devices in, switch our lights on, and expect to have power. As the availability of power is usually taken for granted in modern societies, we mostly feel annoyed at its absence and perceive the importance of power during outages which have severe effects on the public order. Blackouts have had disastrous consequences for many countries and they continue to occur frequently. Such examples demonstrate the necessity for careful analysis and planning of power grids, to ultimately increase the reliability of power grids. The power grids have evolved due to economic, environmental and human-caused factors. In addition to the contingency analysis, nowadays, the operation and planning of power grids are facing many other challenges (such as demand growth, targeted attacks, cascading failures, and renewable energy integration). Thus, many questions arise, including: which buses (nodes) to connect with a new line (link)? What are the impacts of malicious attacks on power grids? How may an initial failure result in a cascade of failures? How to prepare for the integration of renewable energy? Answering such questions requires developing new concepts and tools for analysing and planning of power grids.Power grids are one of the largest and the most complex man-made systems on earth. The complex nature of power grids and its underlying structure make it possible to analyse power grids relying on network science. The applications of network science on power grids have shown the promising potential to capture the interdependencies between components and to understand the collective emergent behaviour of complex power grids. This thesis is motivated by the increasing need of reliable power grids and the merits of network science on the investigation of power grids. In this context, relying on network science, we model and analyse the power grid and its near-future challenges in terms of line removals/additions, malicious attacks, cascading failures, and renewable integration.

Electric power has become an essential part of daily life: we plug our electronic devices in, switch our lights on, and expect to have power. As the availability of power is usually taken for granted in modern societies, we mostly feel annoyed at its absence and perceive the importance of power during outages which have severe effects on the public order. Blackouts have had disastrous consequences for many countries and they continue to occur frequently. Such examples demonstrate the necessity for careful analysis and planning of power grids, to ultimately increase the reliability of power grids. The power grids have evolved due to economic, environmental and human-caused factors. In addition to the contingency analysis, nowadays, the operation and planning of power grids are facing many other challenges (such as demand growth, targeted attacks, cascading failures, and renewable energy integration). Thus, many questions arise, including: which buses (nodes) to connect with a new line (link)? What are the impacts of malicious attacks on power grids? How may an initial failure result in a cascade of failures? How to prepare for the integration of renewable energy? Answering such questions requires developing new concepts and tools for analysing and planning of power grids.Power grids are one of the largest and the most complex man-made systems on earth. The complex nature of power grids and its underlying structure make it possible to analyse power grids relying on network science. The applications of network science on power grids have shown the promising potential to capture the interdependencies between components and to understand the collective emergent behaviour of complex power grids. This thesis is motivated by the increasing need of reliable power grids and the merits of network science on the investigation of power grids. In this context, relying on network science, we model and analyse the power grid and its near-future challenges in terms of line removals/additions, malicious attacks, cascading failures, and renewable integration.

Most of transportation networks interacts with other to support our modern society way of life. The proper performance of interdependent networks depends on the normal operation of the networks that are interconnected. The aim of this thesis is to measure and analyze the robustness of different interdependent networks models under large-scale failures and, in particular, to consider interdependent networks where at least one of the networks is a telecommunication network. Both, the effects of different network models and the dynamic process of failure propagation between networks are considered. New interconnection strategies are proposed to improve the robustness of the interconnected networks by analyzing the vulnerability of networks to failures and targeted attacks. Moreover, an enhanced region-based interconnection model is proposed by considering a limit to the number of interlinks between the interconnected nodes. La mayoría de redes de transporte interactúan con otras para para soportar el modo de vida de la sociedad moderna. En las redes interdependientes, el correcto funcionamiento depende de la operación normal de las redes que están interconectadas. El objetivo de esta tesis es medir y analizar la robustez de diferentes modelos de redes interdependientes bajo fallas de gran escala y, en particular, considerar redes interdependientes donde al menos una de las redes es una red de telecomunicaciones. Los efectos de diferentes modelos de red y procesos dinámicos de propagación de fallos entre redes son considerados. Nuevas estrategias de interconexión son propuestas para mejorar la robustez de las redes interconectadas mediante el análisis de la vulnerabilidad de las redes a fallas y ataques dirigidos. Además, se propone un modelo mejorado para la interconexión basada en regiones considerando un límite para el número de enlaces de interconexión entre las redes interconectadas

Content Delivery Networks (CDNs) are a major enabler of large-scale content distribution for Internet applications. Many of these applications require high bandwidth and low latency for a satisfactory user experience, e.g., cloud gaming, augmented reality, tactile Internet and vehicular communications. Replication is one of the most prominent solutions to meet the requirements of latency-sensitive applications. However, infrastructure disruptions can greatly degrade the performance of such applications, or even cease their proper execution. The extent of degradation can be exacerbated by malicious attackers that target the critical elements of the CDN physical infrastructure to disconnect or severely degrade services. QC 20171002

For years governments, organizations and companies have made great efforts to keep hackers, malware, cyber attacks at bay with different degrees of success. On the other hand, cyber criminals and miscreants produced more advanced techniques to compromise Internet infrastructure. Targeted attack or advanced persistent threat (APT) attack is a new challenge and aims to accomplish a specific goal, most often espionage. APTs are presently the biggest threat to governments and organizations. This paper states research questions and propose a novel approach to intrusion detection system processes network traffic and able to detect potential APT attack. This detection of APT attack is based on the correlation between the events which we get as outputs of our detection methods. Each detection method aims to detect one technique used in one of APT attack steps. Provozovatelé a uživatelé počítačových sítí se dlouhou dobu snaží eliminovat vliv hackerů a jejich škodlivého SW na své informační systémy s různým stupněm úspěšnosti. Na druhou stranu, počítačoví zločinci vytvářejí stále důmyslnější techniky pro kompromitaci internetové infrastruktury. Cílený útok typu pokročilá trvalá hrozba (APT) je novou metodou jak ovládnout atakovanou síť. APT jsou v současnosti největší hrozbou pro státní instituce a jejich organizace. Tento článek diskutuje související teoretický otázky a navrhnuje nový přístup ke struktuře systému detekcí průniků, který zpracovává síťový provoz a schopen odhalit potenciální APT útoky. Tato detekce APT útoků je založena na korelaci mezi událostmi, které získáme jako výstupy našich detekčních metod. Každá metoda detekce si klade za cíl odhalit jednu techniku používanou v jednom z kroků APT kroku. For years governments, organizations and companies have made great efforts to keep hackers, malware, cyber attacks at bay with different degrees of success. On the other hand, cyber criminals and miscreants produced more advanced techniques to compromise Internet infrastructure. Targeted attack or advanced persistent threat (APT) attack is a new challenge and aims to accomplish a specific goal, most often espionage. APTs are presently the biggest threat to governments and organizations. This paper states research questions and propose a novel approach to intrusion detection system processes network traffic and able to detect potential APT attack. This detection of APT attack is based on the correlation between the events which we get as outputs of our detection methods. Each detection method aims to detect one technique used in one of APT attack steps.

Hedefli saldırılar devlet ve ticari kurumlar için büyük bir tehdit oluşturmaktadır. Her yıl giderek artan sayıda hedefli saldırı, özellikle Gelişmiş Sürekli Tehditler, çeşitli siber güvenlik firmaları tarafından tespit edilerek ortaya çıkarılmaktadır. Bu saldırıların temel özellikleri, iyi finanse edilen ve yetenekli aktörlerin devamlı olarak belirli kurumları hedef alması, karmaşık araç ve tekniklerin kullanımı, tespit edilene kadar sızılan ortamlarda uzun süreli kalınması ve gizli faaliyet yürütülmesidir. Zararlı yazılımlar hedefli saldırılarda sistemlerin ele geçirilmesi, kalıcılığın sağlanması, aktörlerle haberleşme, komutların yerine getirilmesi gibi çeşitli görevlerde çok hayati bir rol oynar. Gizli çalışma doğası gereği hedefli saldırılarda kullanılan zararlı yazılımların dinamik olarak kontrollü sanal bir ortamda incelendiğinde geleneksel zararlı yazılımlara göre farklı davranması beklenir.Bu tezde hedefli saldırılarda kullanılan zararlı yazılımlara odaklandık ve hedefli zararlı yazılımları davranışsal ve hafıza öznitelikleri kullanarak makine öğrenimi yoluyla tespit eden ve sınıflandıran bir yöntem sunduk. Çalışmanın hedefli zararlı yazılımların sınıflandırıldığı ve davranışsal özniteliklere hafıza özniteliklerinin eklendiği literatürdeki ilk çalışma olduğunu belirtmek gerekir. Sunulan yöntem, geleneksel ve hedefli zararlı yazılımların dinamik analiz sisteminde hafıza analizi aracıyla birlikte çalıştırılması, analiz raporlarında bulunan davranışsal ve hafıza izlerinden ayırt edici özniteliklerin çıkartılması ve çıkartılan öznitelikler üzerinde makine öğrenmesi uygulanması adımlarını içermektedir. Hedefli zararlı yazılımları daha etkili sınıflandırmak üzere yeni davranışsal ve hafıza öznitelikleri tanımlandı. Yöntem, hedefli ve geleneksel zararlı yazılımlardan oluşan bir veri kümesi üzerinde farklı gözetimli öğrenme algoritmaları ile test edilerek değerlendirildi. Elde edilen sonuçlar, dinamik analiz sonuçlarından davranışsal ve hafıza öznitelikleri çıkartılıp makine öğrenimi kullanılarak hedefli zararlı yazılımların başarılı bir şekilde tespit edilip sınıflandırılabileceğini gösterdi. Targeted attacks pose a great threat to governments and commercial entities. Increasing number of targeted attacks, especially Advanced Persistent Threats, are being discovered and exposed in each year by various cyber security organizations. Key characteristics of these attacks are well-funded and skilled actors persistently targeting specific entities, sophisticated tools and tactics, long-time presence in breached environments before detection and stealth operation. Malware plays a crucial role in a targeted attack for various tasks such as compromising systems, maintaining presence, communicating with the operators, carrying out commands, etc. Because of its stealthy nature, malware used in targeted attacks is expected to act different than the traditional malware when it is dynamically analyzed in a sandbox environment.In this thesis we focused on the malware used in targeted attacks and present a method to automatically detect and classify targeted malware through machine learning using behavioral and memory features. It's worth noting that it is a first work published in the literature that classifies targeted malware and incorporates memory features into the dynamic features. The method comprises the steps of running both traditional and targeted malware in a dynamic analysis system along with a memory analysis tool, extracting features from behavioral and memory artifacts found in analysis results and employing machine learning on the extracted features. New behavioral and memory features were defined in order to classify targeted malware more effectively. Method is then evaluated over a dataset comprised of targeted and traditional malware with different supervised learning algorithms. The results show that machine learning can be employed successfully to automatically detect and classify targeted malware from dynamic analysis results using behavioral and memory features. 53

In this study, we have performed a comprehensive analysis of public transport networks(PTN) combining tools of complex network theory, computer modelling, and analytical calculations. We have started from an empirical analysis of the PTN of 14 major cities of the world and have determined their principal characteristics in terms of the complex network theory. Our empirical analysis gives a strong evidence, that the networks under consideration appear to be strongly correlated small-world structures with high values of clustering coefficients and comparatively low mean shortest path values. We further have introduced several PTN models. This was done both in 2d and 1d embedding spaces. In particular, our model of mutually interacting self-avoiding walks in 2d captures both special features of PTN as well as generating profiles of network characteristics in the various representations. We continued our analysis by studying the behavior of PTN under attacks. This enabled us to propose criteria that allow an a priori estimate of PTN robustness.; Dans cette étude, nous produisons une analyse des réseaux de transport publics (acronyme PTN en anglais) en combinant des outils de la théorie des réseaux complexes, des simulations numériques et des approches analytiques. Nous avons commencé par une analyse empirique des PTN de 14 villes importantes dans le monde et en avons déterminé les principales caractéristiques en termes de réseaux complexes. Cette apporche empirique montre que les PTN apparaissent comme des réseaux ("small world") fortement corrélés avec des "coefficients d'agrégation" élevés et des "distances les plus courtes moyennes" comparativement faibles. Nous avons ensuite introduit divers modèles de PTN à 1 et 2 dimensions. Le modèle de marches aléatoires auto-évitantes (SAW) en interactions mutuelles capture certaines des propriété statistiques des PTN dans les divers modes de représentation. Nous avons poursuivi cette étude en examinant la résistance des PTN à divers scénarios d'attaques, ce qui permet de définir des critères de robustesse des réseaux considérés.