Dissertations / Theses on the topic 'Fast-flux'

Submitted by Kaio Barbosa (kaiorafael@gmail.com) on 2018-11-23T19:03:22Z No. of bitstreams: 4 main8.pdf: 5626368 bytes, checksum: d3778f7a787ea1c33de8006e8e9f83b4 (MD5) 39 ATA de Defesa - Kaio Rafael (Assinada).pdf: 168862 bytes, checksum: 949b4b93de6b1b36821292d15ed216af (MD5) 39 Folha de Aprovação - Kaio Rafael (Assinada).pdf: 192234 bytes, checksum: e04a9d8029f559ecc1aa33e00c5e4618 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5)<br>Approved for entry into archive by Secretaria PPGI (secretariappgi@icomp.ufam.edu.br) on 2018-11-23T19:09:52Z (GMT) No. of bitstreams: 4 main8.pdf: 5626368 bytes, checksum: d3778f7a787ea1c33de8006e8e9f83b4 (MD5) 39 ATA de Defesa - Kaio Rafael (Assinada).pdf: 168862 bytes, checksum: 949b4b93de6b1b36821292d15ed216af (MD5) 39 Folha de Aprovação - Kaio Rafael (Assinada).pdf: 192234 bytes, checksum: e04a9d8029f559ecc1aa33e00c5e4618 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5)<br>Approved for entry into archive by Divisão de Documentação/BC Biblioteca Central (ddbc@ufam.edu.br) on 2018-11-23T20:52:12Z (GMT) No. of bitstreams: 4 main8.pdf: 5626368 bytes, checksum: d3778f7a787ea1c33de8006e8e9f83b4 (MD5) 39 ATA de Defesa - Kaio Rafael (Assinada).pdf: 168862 bytes, checksum: 949b4b93de6b1b36821292d15ed216af (MD5) 39 Folha de Aprovação - Kaio Rafael (Assinada).pdf: 192234 bytes, checksum: e04a9d8029f559ecc1aa33e00c5e4618 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5)<br>Made available in DSpace on 2018-11-23T20:52:12Z (GMT). No. of bitstreams: 4 main8.pdf: 5626368 bytes, checksum: d3778f7a787ea1c33de8006e8e9f83b4 (MD5) 39 ATA de Defesa - Kaio Rafael (Assinada).pdf: 168862 bytes, checksum: 949b4b93de6b1b36821292d15ed216af (MD5) 39 Folha de Aprovação - Kaio Rafael (Assinada).pdf: 192234 bytes, checksum: e04a9d8029f559ecc1aa33e00c5e4618 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) Previous issue date: 2018-04-04<br>FAPEAM - Fundação de Amparo à Pesquisa do Estado do Amazonas<br>Remote control and remote access of malicious code-enabled computers allow the network operator (botnet) to perform various fraudulent activities such as orchestrating distributed denial of service (DDoS) attacks or propagating malicious code such as virus and IT worms. To maintain control of these infected machines, it is necessary to use a robust communication mechanism against attempts to disrupt network services and to be able to evade intrusion detection systems. Such a mechanism is also known as Command and Control (C&C) channel. To do this, some malicious networks often adopt the Domain Name System (DNS) because of its global and distributed operation, allowing them to simulate legitimate network behaviors from techniques such as Round-Robin DNS (RRDNS) and Content Distribution Networks (CDN). Malicious networks that employ these strategies are called Fast Flow Service Networks, because they are able to modify their behavior to ensure the continuous operation of the services, as well as the Command and Control (C&C) channel. To identify such networks, current intrusion detection systems are constructed from models based on a fixed set of attributes observed at a given time point. However, the operators of these networks are able to subvert such detection models by modifying characteristics such as the number of IP addresses or the lifetime (TTL) of a domain name. For these reasons, this work presents a bioinspired model in the concept of Optimization by Colony of Ants for detection of botnets based on Fast Flow Service Networks. The main objective is to analyze a suspicious domain from different perspectives, because even if it is possible to manipulate certain features, the operator is unlikely to modify a of attributes to evade different classification models at the same time. The experimental results using a real database show that the model is able to generate classification rules that prioritize lower cost from the combination of different detection methods, obtaining an accuracy of more than 93%.<br>O controle e o acesso remoto de computadores infectados por códigos maliciosos permitem ao operador desse tipo de rede (botnet) realizar diferentes atividades fraudulentas como orquestrar ataques distribuídos de negação de serviço (DDoS) ou propagar códigos maliciosos como vírus e worms. Para manter o controle dessas máquinas infectadas, é necessário utilizar um mecanismo de comunicação robusto contra tentativas de interrupção dos serviços da rede e que seja capaz de evadir sistemas de detecção de intrusos. Tal mecanismo é também conhecido como canal de Comando e Controle (C&C). Para isso, algumas redes maliciosas adotam com frequência o Sistema de Nomes de Domínios (DNS) devido ao seu funcionamento global e distribuído, permitindo assim que simulem comportamentos de redes legítimas a partir de técnicas como Round-Robin DNS (RRDNS) e Redes de Distribuição de Conteúdo (CDN). Redes maliciosas que empregam essas estratégias são denominadas como Redes de Serviço de Fluxo Rápido, pois são capazes de modificar seu comportamento para garantir a operação contínua dos serviços, assim como do canal de Comando e Controle (C&C). Para identificar essas redes, os sistemas de detecção de intrusos atuais são construídos a partir de modelos baseados em um conjunto fixo de atributos observados em determinado instante de tempo. No entanto, os operadores dessas redes são capazes de subverter tais modelos de detecção pela modificação de características como a quantidade de endereços IP ou tempo de vida (TTL) de um nome de domínio. Por esses motivos, este trabalho apresenta um modelo bioinspirado no conceito de Otimização por Colônia de Formigas para detecção de botnets baseadas em Redes de Serviço de Fluxo Rápido. O principal objetivo é analisar um domínio suspeito a partir de diferentes perspectivas, pois mesmo que seja possível a manipulação de determinadas características, é improvável que o operador modifique um conjunto considerável de atributos para evadir diferentes modelos de classificação ao mesmo tempo. Os resultados experimentais usando uma base de dados real mostram que o modelo é capaz de gerar regras de classificação que priorizam menor custo a partir da combinação de diferentes métodos de detecção, obtendo uma acurácia superior a 93%.

This master thesis deals with the design and implementation of a tool for malware detection using DNS traffic analysis. Text of the thesis is divided into theoretical and practical part. In theoretical part the reader will be acknowledged with the domain of malware and botnet detection. Consequently, various options and methods of malware detection will be described. Practical part of the thesis contains description of malware detection tool architecture as well as key aspects of its implementation. Moreover, the emphasis is being placed on testing and experiments. The result of the thesis is a tool, written in python, for malware detection using DNS traffic analysis, that uses a combination of several methods of detection.

Made available in DSpace on 2014-10-09T12:32:36Z (GMT). No. of bitstreams: 0<br>Made available in DSpace on 2014-10-09T14:10:17Z (GMT). No. of bitstreams: 1 03269.pdf: 4525465 bytes, checksum: 8d08a1f89182180eaf465278796a6732 (MD5)<br>Tese (Doutoramento)<br>IPEN/T<br>Instituto de Pesquisas Energeticas e Nucleares - IPEN/CNEN-SP

Made available in DSpace on 2014-10-09T12:48:41Z (GMT). No. of bitstreams: 0<br>Made available in DSpace on 2014-10-09T13:57:45Z (GMT). No. of bitstreams: 1 09250.pdf: 2620343 bytes, checksum: 7c7a04350dced4d288c23f2472f9b667 (MD5)<br>Dissertacao (Mestrado)<br>IPEN/D<br>Instituto de Pesquisas Energeticas e Nucleares - IPEN/CNEN-SP

A Generation IV Sodium cooled Fast Reactor (SFR) is being researched and developed at CEA, Cadarache France under the project named ASTRID. Monitoring gas presence in SFR is important with respect to its safe operation. In accordance with the principles of diversity, techniques based on different measurement principles have been proposed. This thesis concerns the detection and characterization of void using magnetic flux perturbation principle. An Eddy Current Flow Meter (ECFM) device is used for this purpose. From the technological point of view, the objective is to evaluate the feasibility of ECFM as a flow and/or void monitoring/characterizing device; and to determine which parameters are of interest and what are the precision of these measurements; and whether it is possible to measure the flow rate and void fraction simultaneously with the same ECFM device. From the physics point of view, the ECFM system involves the magnetic flux perturbation due to voids in the presence of Faraday induction and Lorentz force effects. Therefore ECFM integrated signal contains informations about the void, Faraday induction and Lorentz force effects based perturbation in magnetic flux and their couplings. Our objective is to understand the nature and extent of these couplings. Specific experiments have been developed to study the effects of flow velocity, void fraction and magnetic flux pulsations on the response of an ECFM. It consists in modeling the two-phase flow by a moving aluminium rod (plug flow) with holes and grooves to simulate voids. Flow velocity range of variation was 0<U<1 m/s, void fraction 0<<6.9% and pulsation 1500<<12000 rad/s (for this range of pulsations the electromagnetic skin depth is of order but smaller than the aluminium rod radius). An ellipse fitting method was proposed to analyze the output signal of the secondary coils. The results show that ECFM is sensitive to void fractions between 0.3 % and 6.9%. Furthermore, the response to void fraction is insensitive to the mean velocity of the twophase medium. A second approach based on demodulation analyses of the secondary coils output signal has been developed. We have proposed a theoretical model based on a first order expansion of magnetic flux in U and a. With this model it was possible to interpret the experimental results in terms of contributions of U and a. Despite the strong coupling between Faraday induction and Lorentz force effects, the results show that the contributions of U and a. can be well separated at low magnetic Reynolds number (Rem < 0.12) and low a values ( < 6.9%). A very important result is that the contribution of _ on magnetic flux is insensitive to variations of velocity in this range of Rem. Moreover, different geometries of void have been studied: grooves and holes. It was observed that the geometry of void do not change the variation of magnetic flux with a. This second approach revealed to be more sensitive to void fraction variations than ellipse fitting method. Finally, preliminary experiments with liquid metal galinstan with glass beads were done, which showed sensitivity of ECFM signal with velocity and void. In conclusion, this work has shown that ECFM can measure simultaneously void and velocity in the range of parameters studied, in particular 0.06%< < 6.9%.

De plus en plus de preuves montrent que le transport axonal rapide (FAT) joue un rôle crucial au cours des maladies neurodégénératives (NDs). La maladie de Huntington est une maladie neurodégénérative causée par une expansion anormale de polyglutamines dans la partie Nterminale de la protéine huntingtine (HTT) : une grande protéine d’échafaudage impliquée dans la régulation du transport. La présence de HTT mutante comme l’absence de la HTT induisent des défauts de transport chez les mammifères. Chez la Drosophile, la HTT mutante reproduit le phénotype observée chez les mammifères, cependant la fonction conservée de la HTT chez la Drosophile melanogaster (DmHTT) n’est pas encore clairement établie. Ici nous mettons en évidence que DmHTT s’associe aux vésicules, aux microtubules et intéragit avec la proteine dynéine. Dans les neurones corticaux de rat, DmHTT remplace partiellement la HTT de mammifère dans le transport axonal rapide, et les drosophiles invalidées pour la HTT montrent des défauts de transport axonal in vivo. Ces résultats suggèrent que la fonction de la HTT est conservée dans le modèle Drosophile.Le FAT est un processus qui requiert un apport constant d’énergie. Les mitochondries sont les principales sources de production d’ATP de la cellule. Cependant nous avons démontré que le FAT ne dépend non pas de cette source d’énergie là, contrairement à ce que l’on pensait, mais de l’ATP glycolytique produit par les vésicules. La dérégulation de GAPDH ou de PK, les deux enzymes glycolytiques productrices d’ATP, ralentit le transport vésiculaire. Néanmoins, l’invalidation de GAPDH n’affecte pas le transport mitochondrial. En outre, toutes les enzymes glycolytiques sont associées à des vésicules dynamiques et sont capables de produire leur propre ATP. Enfin nous montrons que l’ATP produit est suffisant pour assurer leur propre transport, prouvant l’autonomie énergétique des vésicules pour le transport<br>Growing evidence support the idea that impairments in Fast Axonal Transport (FAT) play a crucial role in Neurodegenerative Diseases (NDs). Huntington’s Disease is neurodegenerative disorder caused by an abnormal polyglutamine expansion in the N-Terminal part of huntingtin (HTT), a large scaffold protein implicated in transport regulation. Both the presence of the mutated HTT as the loss of HTT leads to transport defects in mammals. In the fruit fly overexpression of the mutant HTT recapitulates the phenotype observed in mammals. However, it is still unclear whether HTT’s function is conserved in D. melanogaster. Here, we show that D. melanogaster HTT (DmHTT) associates with vesicles, microtubules, and interacts with dynein. In rat cortical neurons, DmHTT partially replaces mammalian HTT in fast axonal transport, and DmHTT KO flies show axonal transport defects in vivo. These results suggest that HTT function in transport is conserved in D. melanogaster.FAT is a process that requires a constant supply of energy. Mitochondria are the main producers of ATP in the cell. However, we have demonstrated that FAT does not depend on this source of energy, as previously thought, but it depends on glycolytic ATP produced on vesicles. Perturbing GAPDH or PK, the two ATP generating glycolytic enzymes, slows down vesicular transport. However, knocking down GAPDH does not affect mitochondrial transport. Furthermore, all of the glycolytic enzymes are associated with dynamic vesicles, and are capable of producing their own ATP. Finally, we show that this ATP production is sufficient to sustain their own transport, demonstrating the energetical autonomy of vesicles for transport

L’objet de ce travail est d’étudier l’influence de l’anisotropie structurale, induite lors de la mise en forme d’un Polylactide (PLA), sur les dynamiques moléculaires de la phase amorphe. Deux procédés de mise en oeuvre sont retenus : l’électrofilage et la cristallisation induite par flux. Le premier permet d’aboutir à un système non-cristallin, lorsque le deuxième permet d’aboutir à un système semi-cristallin. Pour chaque système, une étude microstructurale est préalablement réalisée pour mettre en avant l’anisotropie structurale induite lors de la mise en oeuvre. Pour ce faire différentes techniques d’analyses sont utilisées : microscopie optique, microscopie électronique, diffraction des rayons X, calorimétrie à balayage différentielle (DSC) et calorimétrie à balayage rapide (FSC). L’utilisation de la FSC s’avère précieuse. Du fait des vitesses extrêmement rapide (1000 K.s-1) et de la diminution importante de la masse (dizaine de nanogrammes), la transition vitreuse et la cinétique de vieillissement physique sont au préalable étudiées dans le cas d’un PLA amorphe. Il est montré que les vitesses de refroidissement atteignable en FSC permettent d’accélérer les cinétiques de vieillissement physique. Les dynamiques moléculaires sont ensuite étudiées à travers le concept de coopérativité et le phénomène de vieillissement physique. Il est montré que l’orientation préférentielle induite dans le système non-cristallin aboutit à la formation de mésophase qui augmente la coopérativité, autrement dit les interactions intermoléculaires. Dans le cas du système semi-cristallin, les dynamiques moléculaires sont influencées par le couplage amorphe/cristal et le confinement des cristaux, et non pas par l’anisotropie structurale induite avant cristallisation<br>The aim of this work is to investigate the molecular dynamics of Polylactide (PLA) subjected to structural anisotropy during its processing. To do so, two experimental set-ups were used: electrospinning and flow induced crystallization. The first one leads to non-crystalline system, while the second one leads to semi-crystalline system. For each system, the microstructure is investigated to highlight the structural anisotropy induced during the processing. Different experimental techniques are used: optical microscopy, electronic microscopy, X-ray diffraction, differential scanning calorimetry (DSC) and fast scanning calorimetry (FSC). FSC proves to be useful. Due to the high scanning rates (1000 K.s-1) and the decrease of the sample mass (few tens of nanogrammes), glass transition and physical aging kinetics are beforehand investigated in the case of a wholly amorphous PLA. It is shown that high cooling rates available by FSC allow to accelerate physical aging kinetics. Molecular dynamics are then investigated through concept of cooperativity and phenomenon of physical aging. It is shown that preferential orientation induced during electrospinning leads to the formation of mesophase, which increase cooperativity, namely the intermolecular interactions. With regard to semi-crystalline system, molecular dynamics are only affected by the coupling between amorphous/crystal and the confinement effect of the crystals, rather than the structural anisotropy induced before the crystallization step

L'ère du Big Data a révolutionné la manière dont les données sont créées et traitées. Dans ce contexte, de nombreux défis se posent, compte tenu de la quantité énorme de données disponibles qui doivent être efficacement gérées et traitées afin d’extraire des connaissances. Cette thèse explore la symbiose de l'apprentissage en mode batch et en flux, traditionnellement considérés dans la littérature comme antagonistes, sur le problème de la classification à partir de flux de données en évolution. L'apprentissage en mode batch est une approche bien établie basée sur une séquence finie: d'abord les données sont collectées, puis les modèles prédictifs sont créés, finalement le modèle est appliqué. Par contre, l’apprentissage par flux considère les données comme infinies, rendant le problème d’apprentissage comme une tâche continue (sans fin). De plus, les flux de données peuvent évoluer dans le temps, ce qui signifie que la relation entre les caractéristiques et la réponse correspondante peut changer. Nous proposons un cadre systématique pour prévoir le surendettement, un problème du monde réel ayant des implications importantes dans la société moderne. Les deux versions du mécanisme d'alerte précoce (batch et flux) surpassent les performances de base de la solution mise en œuvre par le Groupe BPCE, la deuxième institution bancaire en France. De plus, nous introduisons une méthode d'imputation évolutive basée sur un modèle pour les données manquantes dans la classification. Cette méthode présente le problème d'imputation sous la forme d'un ensemble de tâches de classification / régression résolues progressivement.Nous présentons un cadre unifié qui sert de plate-forme d'apprentissage commune où les méthodes de traitement par batch et par flux peuvent interagir de manière positive. Nous montrons que les méthodes batch peuvent être efficacement formées sur le réglage du flux dans des conditions spécifiques. Nous proposons également une adaptation de l'Extreme Gradient Boosting algorithme aux flux de données en évolution. La méthode adaptative proposée génère et met à jour l'ensemble de manière incrémentielle à l'aide de mini-lots de données. Enfin, nous présentons scikit-multiflow, un framework open source en Python qui comble le vide en Python pour une plate-forme de développement/recherche pour l'apprentissage à partir de flux de données en évolution<br>The Big Data era has revolutionized the way in which data is created and processed. In this context, multiple challenges arise given the massive amount of data that needs to be efficiently handled and processed in order to extract knowledge. This thesis explores the symbiosis of batch and stream learning, which are traditionally considered in the literature as antagonists. We focus on the problem of classification from evolving data streams.Batch learning is a well-established approach in machine learning based on a finite sequence: first data is collected, then predictive models are created, then the model is applied. On the other hand, stream learning considers data as infinite, rendering the learning problem as a continuous (never-ending) task. Furthermore, data streams can evolve over time, meaning that the relationship between features and the corresponding response (class in classification) can change.We propose a systematic framework to predict over-indebtedness, a real-world problem with significant implications in modern society. The two versions of the early warning mechanism (batch and stream) outperform the baseline performance of the solution implemented by the Groupe BPCE, the second largest banking institution in France. Additionally, we introduce a scalable model-based imputation method for missing data in classification. This method casts the imputation problem as a set of classification/regression tasks which are solved incrementally.We present a unified framework that serves as a common learning platform where batch and stream methods can positively interact. We show that batch methods can be efficiently trained on the stream setting under specific conditions. The proposed hybrid solution works under the positive interactions between batch and stream methods. We also propose an adaptation of the Extreme Gradient Boosting (XGBoost) algorithm for evolving data streams. The proposed adaptive method generates and updates the ensemble incrementally using mini-batches of data. Finally, we introduce scikit-multiflow, an open source framework in Python that fills the gap in Python for a development/research platform for learning from evolving data streams

Les futures expériences de physique des particules devront être opérationnelles pour un flux de particules et une luminosité croissants. Plus particulièrement, les détecteurs proches du point d'interaction devront présenter une très bonne robustesse pour faire face à un flux de particules très élevé. De plus, une résolution temporelle de quelques dizaines de picosecondes pour les particules au minimum d’ionisation sera nécessaire pour assurer une séparation nette des vertex reconstruits et réduire l'empilement d’événements. Ce manuscrit a pour sujet l’instrument PICOSEC-Micromegas, un détecteur de particules innovant basé sur la lecture d’un détecteur Micromegas couplé à un radiateur Cherenkov et une photocathode. Dans ce dispositif, chaque électron primaire étant produit à la surface de la photocathode, l’étalement en temps du signal est minimal, alors qu’il peut atteindre plusieurs nanosecondes lorsque les ionisations primaires ont lieu sur le passage d'une particule dans l’espace de dérive. La hauteur de ce dernier est ici du même ordre de grandeur que celle de la région d'amplification (100-200 μm) afin de minimiser l'ionisation directe du gaz. L’espace de dérive est également utilisée comme espace de pré-amplification. Un modèle mathématique, basé sur des simulations GARFIELD++, a été développé pour décrire le développement de l'avalanche de pré-amplification. Il a permis de montrer que la longueur et la multiplication de l'avalanche dans l’espace de dérive sont les facteurs dominants dans la résolution temporelle. Le concept PICOSEC-Micromegas a été étudié avec plusieurs prototypes optimisant les champs électriques, la distance de dérive et le mélange gazeux auprès de l’installation laser du LIDYL (Laboratoire Interactions, Dynamiques et Lasers). Une résolution temporelle de ~44 ps a été obtenue pour un photo‑électron unique. Par ailleurs, des mesures effectuées en faisceau test au CERN ont permis d'obtenir une résolution temporelle de 24 ps pour des muons de 150 GeV, avec un espace de dérive de 200 μm et une photocathode en CsI (10 photoélectrons par MIP). Afin de passer du concept de détection à un démonstrateur plusieurs prototypes ont été développés, en se concentrant sur les propriétés spécifiques nécessaires aux applications futures: segmentation de l'anode, annulation des étincelles, efficacité de la photocathode et robustesse à haut flux de particules. Un prototype à pads hexagonaux a été testé en faisceau et montré une résolution temporelle de ~36 ps dans le pad central. Les performances à haut flux sont testées avec des détecteurs résistifs dans des faisceaux de muons et de pions. Des résolutions temporelles nettement inférieures à 100 ps et un fonctionnement stable en faisceau de pions sont obtenus avec tous les prototypes résistifs. Des matériaux de photocathode robustes, comme alternative au CsI, sont étudiés pour réduire la dégradation due au retour des ions. Les matériaux les plus prometteurs sont le “diamond-like carbon” (DLC) et le carbure de bore (B4C). Compte tenu des résultats obtenus, deux cas d'application sont considérés pour les perspectives de ce programme de R&amp;D. La première application considérée est l'utilisation du détecteur PICOSEC à l'intérieur d'un calorimètre comme couche de synchronisation ou de nombreuses particules secondaires sont produites dans un calorimètre électromagnétique après quelques longueurs de radiation. Une résolution temporelle de ~5 ps est attendue avec le PICOSEC-Micromegas. La seconde application est l'identification des particules par des mesures de temps de vol (TOF) ou PICOSEC-Micromegas devrait permettre de doubler la plage d’impulsion des détecteurs TOF actuels pour la séparation π/Κ avec 3σ<br>Future particle physics experiments will face an increasing particle flux with rising beam luminosity. Detectors close to the interaction point will need to provide robustness against the high particle flux. Moreover, a time resolution of tens of picosecond for Minimum Ionising Particles will be necessary to ensure a clear vertex separation of the reconstructed secondary particles and to reduce pile-up. This manuscript focusses on the PICOSEC-Micromegas, an innovative particle detector based on the Micromegas readout coupled to a Cherenkov radiator and a photocathode in front of the gaseous volume. In this way, each primary electron is located on the surface of the photocathode, suppressing thus the inevitable time jitter of several nanoseconds, due to the different ionisation positions created by the passage of a particle from the drift region of a gaseous detector. The drift region length is reduced to the same order of magnitude as the amplification region (100-200 μm) to minimise direct gas ionisation, and it is additionally used as a pre-amplification stage. A mathematical model, based on GARFIELD++ simulations, is developed to describe the propagation of the pre-amplification avalanche showing that the length and multiplication of the avalanche in the drift region is the dominant factor in the timing performance. The PICOSEC-Micromegas concept is studied with several prototypes optimising the electric fields, the drift distance, and the gas mixture in the LIDYL (Laboratoire Interactions, Dynamiques et Lasers) UV laser facility. A single photoelectron time resolution of ~44 ps is measured with the shortest tested drift region length of 119,μm and the highest stable field setting. Measurements performed in the secondary particle beam at CERN have resulted in a time resolution of 24 ps for 150 GeV muons with a drift region length of 200 μm and a CsI photocathode providing 10 photoelectrons per MIP. In order to evolve from the detection concept to a versatile instrument, several prototypes are developed, focusing on specific properties needed for future applications: anode segmentation, spark quenching, photocathode efficiency and robustness for higher particle flux. An hexagonal segmented multipad prototype is tested in the beam with a time resolution of ~36 ps in the central pad. The operation in high rate environments is studied with different resistive strip and floating strip anodes resistive detectors in muon and pion beams. Time resolutions significantly under 100 ps and stable operation in the pion beam are achieved with all resistive prototypes. Robust photocathode materials, as an alternative to CsI, are investigated to reduce degradation from the ion-backflow generated in the pre-amplification avalanche. The most promising materials are diamond-like carbon (DLC) and boron carbide (B4C). Considering all the results achieved, two application cases are projected with the PICOSEC-Micromegas detector. The first one is the use in a calorimeter as a timing layer. Many secondary particles are produced in an electromagnetic calorimeter after few radiation lengths and a time resolution down to ~5 ps is expected with the PICOSEC-Micromegas. The second one is particle identification trough time-of-flight (TOF) measurements. The PICOSEC-Micromegas is expected to double the momentum range of current TOF detectors for π/Κ separation with 3σ

The continuously increasing demand for clean renewable energy has rekindled interest in multi-terminal high voltage direct current (HVDC) grids. Although such grids have several advantages and a great potential, their materialization has been thwarted due to the absence of HVDC breakers. In comparison with traditional alternating current (AC) breakers, they should operate and interrupt fault currents in a time frame of a few milliseconds. The aim of this thesis is focused on the design of ultra-fast electro-mechanical actuator systems suitable for such HVDC breakers.Initially, holistic multi-physics and hybrid models with different levels of complexity and computation time were developed to simulate the entire switch. These models were validated by laboratory experiments. Following a generalized analysis, in depth investigations involving simulations complemented with experiments were carried out on two of the sub-components of the switch: the ultra-fast actuator and the damper. The actuator efficiency, final speed, peak current, and maximum force were explored for different design data.The results show that models with different levels of complexity should be used to model the entire switch based on the magnitude of the impulsive forces. Deformations in the form of bending or elongation may deteriorate the efficiency of the actuator losing as much as 35%. If that cannot be avoided, then the developed first order hybrid model should be used since it can simulate the behavior of the mechanical switch with a very good accuracy. Otherwise, a model comprising of an electric circuit coupled to an electromagnetic FEM model with a simple mechanics model, is sufficient.It has been shown that using a housing made of magnetic material such as Permedyn, can boost the efficiency of an actuator by as much as 80%. In light of further optimizing the ultra-fast actuator, a robust optimization algorithm was developed and parallelized. In total, 20520 FEM models were computed successfully for a total simulation time of 7 weeks. One output from this optimization was that a capacitance of 2 mF, a charging voltage of 1100 V and 40 turns yields the highest efficiency (15%) if the desired velocity is between 10 m/s and 12 m/s.The performed studies on the passive magnetic damper showed that the Halbach arrangement gives a damping force that is two and a half times larger than oppositely oriented axially magnetized magnets. Furthermore, the 2D optimization model showed that a copper thickness of 1.5 mm and an iron tube that is 2 mm thick is the optimum damper configuration.<br><p>QC 20150422</p>

碩士<br>雲林科技大學<br>資訊管理系碩士班<br>98<br>As the highly development of Internet, one of the most serious threats we face is cyber-security. There are many groups of criminals using the Internet to engage in illegal activities like Trojan horse, viruses, DDoS attacks, spam emails and phishing. They motivated by illegal profit, have a high demand in availability of their illegal activities, and to confuse the location of their services. These criminals recently started to use a new technique called Fast-Flux Service Networks, composed of large groups of bots and acting as proxies to their scam contents. In this thesis we implemented a system, detecting whether the data which are from Malware Domain List are belong to FFSN or not. Also, we investigate the utilization of FFSN by miscreants on the Internet, and analyzing the location details of the infected bots.

碩士<br>國立中央大學<br>資訊工程研究所<br>99<br>FFSNs have become severe threats on the Internet in recent years. They consist of a large amount of compromised hosts for malicious activities such as launching DDoS, delivering spam mails, hosting phishing sites and distributing malicious programs. As a result of the highest concealment of FFSNs, it is really difficult to find out attackers and foil down the entire illegal networks. In this paper, we discovered a novel and simple feature, difference, which measures the degree of the load balance of all IP addresses in a domain name. And we also present FFRTD that can make a brand-new domain name be classified into benign and fast-flux ones by the difference with DNS lookup results within two hours. With our method, there is no need to access database but use the ff-score threshold we generated in the training phase while classifying domain names. According to experimental results, our proposed detection system, FFRTD, is able to accurately detect FFSNs. Furthermore, we contribute a new vision to observe the behavior of a fast-flux domain name.

碩士<br>國立雲林科技大學<br>資訊管理系碩士班<br>100<br>Fast-Flux Service Networks (FFSN) derives from Round-Robin DNS. RR-DNS is a method of choosing a resource for a task from a list of available resources, usually for the purposes of load balancing. FFSN is similar to RR-DNS, but there have some differentials that the list of available resources is come from the victim hosts, and those victim hosts are used to protect phishing sites, malicious sites and spam server by hackers. In the past, the research usually focused on “To DNS query a specific domain, and finding the difference between each results of DNS query”, the result of detection will easily be influenced by the network environment, and the time of detection may be increased. In this thesis, we use the nmap to scan host’s port in specific domain, to calculate the discrepancy between each hosts, and to determine the FFSN domain (high differentiate) and the benign domain (low differentiate), in addition, we use another FFSN feature “The standard deviation of DNS query time”, if the standard deviation are higher than threshold, then it is a FFSN domain, if it not, it is a benign domain. We combine this two FFSN feature, and then we get a high accuracy. We also analyze this two FFSN feature about their detection speed, we find that the feature “differentiate of each host’s port” is not the same with the past’s research, it do not need to wait for TTL time, it’s average of complete the detection is about 47 seconds, and the past’s research is more than 100 seconds. “Differentiate of each host’s port” is not only decreasing the time of detection, but also keep the accuracy higher.

碩士<br>國立臺灣海洋大學<br>資訊工程學系<br>100<br>The rapid development and deployment of Internet creates a paradise for malicious attackers. In addition to traditional attacks like phishing, spam, and botnet, recently modern attackers leverage the fast-flux technique to prevent their attacks from being shutdown by network administrators. The use of fast-flux techniques is able to improve the lifetime and availability of malicious services. A fast-flux domain name is often mapped to a large number of IP addresses of vulnerable personal computers. These computers are spread world-wide so that the fast-flux domain cannot be easily shutdown if only some of them are disconnected from the Internet. 　　Most existing detection techniques are based on analyzing DNS records. However, these techniques requires a longer period of time to collect sufficient amount of DNS records and therefore they are not able to detect fast-flux domains in real time. Although Hsu et al. proposed a real-time detection solution based on the measurement of network delays, the solution has to send network probe packets actively so that it is not suitable to deploy in a large scale network. 　　The goal of this paper is to detect fast-flux domains in a passive and efficient manner. Therefore, it is not only applicable to a single host, it can be further used to detect fast-flux domains in a large scale network. By combining features collected from both DNS records and network delays, the proposed solution is able to differentiate benign and malicious domains within several seconds. Our experiments show that the proposed solution has high precision and recall rates (both higher than 0.95) and the error rate is lower than 0.05.

碩士<br>國立中興大學<br>環境工程學系所<br>97<br>At present, the flux measurement in the world is often measured using the Eddy Covariance System. In the past, Chamber method was often used to measure the methane concentration and flux, however it had several limits, such as of small spatial distribution. This study uses the fast methane analyzer based on Cavity-enhanced laser absorption with the Eddy covariance System to directly measure the methane flux at the rice paddy. The fast methane analyzer can continually measure with a high frequency. We also use soil data (such as soil moisture, soil heat flux, and soil temperature) and meteorological data to realize the methane flux between the atmosphere and the surface on a specific time. The study site is located at Wung-Fong Agricultural Research Institute where the interference caused by buildings which affect the wind direction to Eddy Covariance System can be reduced to the minimum. The measurement was made from 28th April to 5th June in 2009 through automated measurement and data logging system. The measurement in the rice paddy started in the growing period and ended in harvest period. The soil of the rice paddy was covered by water during measured period, and this condition provides a good anaerobic environment for methane production. The vertical wind velocity and the friction velocity are -0.3 - 0.1 m s-1 and 0.03-0.4 m s-1, respectively. The air temperature is 23 -31 ℃, and the diurnal variation on soil temperature is distributed in 20-30℃. The soil water content is more than 40% because the rice paddy was flooded all the time when the measurement was in proceeding. For the methane concentration, there was an obvious diurnal variation during the measurement period. From the composite diurnal methane concentration, the minimum concentration occurred around the noon and the mean concentration was about 1.9 ppm during daytime. The maximum concentration is about 2.08 ppm at dawn. The observed methane concentrations at Wung-fong station and Dali station were compared and the result showed similar diurnal variation. Although there was no obvious signal on the day-after-day methane flux measurement, the diurnal variation of methane flux was -0.13~0.11 μg m-2 s-1. A reason which leads to unobvious methane flux signal may be caused by the inadequate setting of the delay-time. Another reason may be caused by the suspended particle which dirtied the instrument and produced stronger noise to influence the precision.

碩士<br>國立雲林科技大學<br>資訊管理系碩士班<br>100<br>During recent decades, the explosive development of the Internet brings a remarkable advance in information exchange. Hence, people’s daily life and commercial activities rely on the Internet much tremendously. More and more hackers try to gain enormous illegal profits by such illegitimate invasion and attack approaches. For instance, Fast-Flux Service Networks is one of emerging attack technologies, which is used to invade the system through combining the RR-DNS technology (Round Robin DNS) of DNS. Fast-Flux can protect malicious websites by keeping changing the IP address of the Mothership. In most cases, naïve users’ computers are usually the attack targets so the damage is getting worse with each passing day. Therefore, this study uses FFSN characterization and original features as detection patterns to construct a detection system. The data from ATLAS and ALEXA are tested to evaluate the detection rate and accuracy of the proposed system. Finally, through the analysis of the detection effectiveness after features mapping, the best solution can be found as the future detection pattern.

碩士<br>國立暨南國際大學<br>資訊工程學系<br>99<br>In this paper we proposed an active DNS detecting strategy, which can detect whether the domain make use of fast-flux or not. In the beginning, fast-flux is used to ensure the normal sites’ availability and scalability. However, in recent years, more and more cyber-criminals also use this technique to enhance their phishing sites’ or botnets’ availability and scalability. Previous studies focused on long term active detection with fast-flux, which will take few days or even months. In our studies, we adopt hidden Markov model (HMM) methods, which previously often used for speech recognition. Simulation results show that detect fast-flux with HMM methods can not only complete in several minutes or even hours but efficiently recognize domain whether to use fast-flux with the accuracy reach up to 95%.

碩士<br>國立雲林科技大學<br>資訊管理系碩士班<br>99<br>With the Internet being used more frequently in the business, network attack have caused damage to the interests gradually expanded. Hackers use the Internet for illegal activities, such as Trojan, viruses, DDoS attacks, spam and phishing, etc. In order to obtain huge benefits, the offender’s demand for illegal activities growth, and to make such fraud a high degree of concealment, the offender began to use the attack tactics called Fast-Flux Service Network (FFSN). FFSN is composed by who is used by a group of agents to service as a proxy of the botnet. Use these infected host can redirect the user to the malicious content that offender set. In this thesis we implemented a system, we use the detection feature discuss in this thesis and the features that is already discussed in other study to detect whether the data which are from Malware Domain List and ATLAS are belong to FFSN or not. Also, we investigate the utilization of FFSN by miscreants on the Internet, and analyze the detection performance and select the best case as the baseline of detection in the future.

碩士<br>國立臺灣科技大學<br>資訊工程系<br>100<br>Fast-Flux Service Networks (FFSNs), broadly used by botnets, are an evasive technique for conducting malicious behavior via rapid activities. FFSN detection easily fails in the case of poor performance and causes a high incidence of false positives due to the similarity of an FFSN to a content distribution network (CDN), a normal behavior for load balance. In this study, we propose a localized spatial geolocation detection (LSGD) system for identifying FFSNs in real time. We believe that the grid distribution of LSGD possesses a precise spatial locating capability for profiling the spatial relations among IP address resolutions. Furthermore, autonomous system numbers (ASNs) are used for enhancing localized geographic characteristics. The proposed system, incorporating LSGD, ASNs, and the domain name system (DNS), can respond well to identify potential FFSNs. The results of our experiment show that the proposed LSGD system has a better detection capability than state-of-the-art spatial or temporal detection approaches, with a lower false positive rate in real-time detection than the approach based on a spatial snapshot alone.

碩士<br>國立雲林科技大學<br>資訊管理系碩士班<br>100<br>The purpose of this study is to estimate the group size of Fast-Flux Service Network (FFSN.) FFSN is one of the enormous threats of internet. It can hide the attackers behind a group of agents and by this way the attackers can avoid being detected. The benefit of FFSN to attackers is the malicious websites can be protected and the survival time can be prolonged. The danger of FFSN is getting more serious and Flux-Agent could be a Bot note. To estimate the size of FFSN can find the danger degree but to estimate the size is not easy. Hence, this study uses Capture-Recapture Method (CRM) to estimate the group size of Flux-Agent. By computing the joint hypergeometric maximum likelihood estimator (JHE) of Program NOREMARK, the group size can be found. The experiment needs just the query samples among six days before and the group size of FFSN can be found. The experiment result can more quickly find the group size than census can.

碩士<br>國立臺灣科技大學<br>資訊工程系<br>97<br>The latent detection of fast-flux could cause more damages, such as Botnet propagation and on-line scams. Hence, we propose Spatial Snapshot Fast-flux Detection system (SSFD) with latent-free detection to reduce the damages. The concept of the latent-free detection mechanism is that temporal characteristic for detecting fast-flux attack is replaced with spatial information in snapshot. The used spatial snapshot mechanism implies that for a domain name, geographical information of normal servers or infected hosts is snapshotted at the moment. Furthermore, in the different periods, variances problem of spatial distribution for infected hosts are considered. Also, in real network environment, unbalanced data problem is deliberated. Accordingly, the proposed SSFD system provides spatial snapshot mechanism for latent-free detection and alleviation strategy for these problems. The spatial snapshot benefits from the truth that infected hosts are distributed over all the countries. In detail, time zone entropy and spatial service relationship (i.e. provider-consumer relationship) provide the spatial scatter degree and spatial service relationship in snapshot mechanism. We apply the feature discretizaiton method to obtain tolerated ranges in each feature for tolerating the pattern variance. Also, the dependence graph classifier (i.e. Baysian Network classifier) is applied to alleviate these two problems through joint probability distribution. Our experimental results indicate that the proposed SSFD system is latent-free with higher accuracy and lower False Positive (FP) rate than flux-score based detection.

Botnets are becoming the predominant threat on the Internet today and is the primary vector for carrying out attacks against organizations and individuals. Botnets have been used in a variety of cybercrime, from click-fraud to DDOS attacks to the generation of spam. In this thesis we propose an approach to detect botnet activity using two different strategies both based on machine learning techniques. In one, we examine the network flow based metrics of potential botnet traffic and show that we are able to detect botnets with only data from a small time interval of operation. For our second technique, we use a similar strategy to identify botnets based on their potential fast flux behavior. For both techniques, we show experimentally that the presence of botnets may be detected with a high accuracy and identify their potential limitations.<br>Graduate

碩士<br>國立雲林科技大學<br>資訊管理系<br>104<br>Fast-Flux Service Networks(FFSN) this technology is currently the most widely used are the perpetrators of attack, this technology is that multiple distributed servers use a same host name to achieve load balancing and hide attackers in a group of proxy servers (agent). these may be the agent botnets collection, That will be not easy to make the back-end to query and it’s more difficult to external detect and killing system to find the zombies controller (bot master). Otherwise, there are same attacker in Flux-Agent cluster. this study use the clustering method to find the FFSN Agent distribution result and use Label Propagation Algorithm, Euclidean Distance, and Gephi software to show the clustering result , by clustering result after the data for the analysis, understand the threat FFSN caused.

HTTP botnets are currently the most popular form of botnets compared to IRC and P2P botnets. This is because, they are not only easier to implement, operate, and maintain, but they can easily evade detection. Likewise, HTTP botnets flows can easily be buried in the huge volume of legitimate HTTP traffic occurring in many organizations, which makes the detection harder. In this thesis, a new detection framework involving three detection models is proposed, which can run independently or in tandem. The first detector profiles the individual applications based on their interactions, and isolates accordingly the malicious ones. The second detector tracks the regularity in the timing of the bot DNS queries, and uses this as basis for detection. The third detector analyzes the characteristics of the domain names involved in the DNS, and identifies the algorithmically generated and fast flux domains, which are staples of typical HTTP botnets. Several machine learning classifiers are investigated for each of the detectors. Experimental evaluation using public datasets and datasets collected in our testbed yield very encouraging performance results.<br>Graduate