How Institutional Arrangements impede Realization of Smart Ecosystems: the Case of Door-to-Door Mobility integrators.Schulz, Thomas; Überle, Martin P. M. Bednar, Frank, U., Kautz, K. (eds.) (2018). 135.
Detection of slow port scans in flow-based network traffic.Ring, Markus; Landes, Dieter; Hotho, Andreas in PLOS ONE (2018). 13(9) 1-18.
Frequently, port scans are early indicators of more serious attacks. Unfortunately, the detection of slow port scans in company networks is challenging due to the massive amount of network data. This paper proposes an innovative approach for preprocessing flow-based data which is specifically tailored to the detection of slow port scans. The preprocessing chain generates new objects based on flow-based data aggregated over time windows while taking domain knowledge as well as additional knowledge about the network structure into account. The computed objects are used as input for the further analysis. Based on these objects, we propose two different approaches for detection of slow port scans. One approach is unsupervised and uses sequential hypothesis testing whereas the other approach is supervised and uses classification algorithms. We compare both approaches with existing port scan detection algorithms on the flow-based CIDDS-001 data set. Experiments indicate that the proposed approaches achieve better detection rates and exhibit less false alarms than similar algorithms.
Flow-based Network Traffic Generation using Generative Adversarial Networks.Ring, Markus; Schlör, Daniel; Landes, Dieter; Hotho, Andreas in Computing Research Repository CoRR (2018). abs/1810.07795
Flow-based data sets are necessary for evaluating network-based intrusion de- tection systems (NIDS). In this work, we propose a novel methodology for gener- ating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous at- tributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the gener- ated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.
Body Weight Estimation for Dose-Finding and Health Monitoring of Lying, Standing and Walking Patients Based on RGB-D Data.Pfitzner, C.; May, S.; Nüchter, A. in Sensors (2018). 18(5)
This paper describes the estimation of the body weight of a person in front of an RGB-D camera. A survey of different methods for body weight estimation based on depth sensors is given. First, an estimation of people standing in front of a camera is presented. Second, an approach based on a stream of depth images is used to obtain the body weight of a person walking towards a sensor. The algorithm first extracts features from a point cloud and forwards them to an artificial neural network (ANN) to obtain an estimation of body weight. Besides the algorithm for the estimation, this paper further presents an open-access dataset based on measurements from a trauma room in a hospital as well as data from visitors of a public event. In total, the dataset contains 439 measurements. The article illustrates the efficiency of the approach with experiments with persons lying down in a hospital, standing persons, and walking persons. Applicable scenarios for the presented algorithm are body weight-related dosing of emergency patients.
Edge Preserving Compression of CT Scans using Wavelets.Stock, Michael; Herl, Gabriel; Sauer, Thomas; Hiller, Jochen I. S. on Structural Health Monitoring, Nondestructive Testing 4-5 October 2018, S. (eds.) (2018).
This work addresses the subject of efficient storage of computed tomography (CT) data with an emphasis on the quality of surfaces. Industrial dimensional metrology often requires high measurement accuracy and we show that this is retained using wavelet-based compression methods. The applied techniques include a tensor product wavelet transform and soft wavelet shrinkage. In our tests on real objects, we compared dimensional CT measurements of compressed and uncompressed volumes. We were able to reduce the necessary storage space significantly with a minimal loss of accuracy. For a multi sphere phantom, we decreased the storage space to 4.7% (from 638 MB to 30 MB) with an average deviation below 1 µm from the original volume.
Digitalisierung, Verarbeitung und Analyse kultureller und industrieller Objekte: Wertschöpfung aus großen Datenmengen.Kasperl, Stefan; Hanke, Randolf; Oeckl, Steven; Schmitt, Peter; Uhlmann, Norman; Heinz, Daniel; Herl, Gabriel; Hiller, Jochen; Kämmler, Achim; Miller, Thomas; Stock, A.Michael; Sauer, Tomas D. G. für zerstörungsfreie Prüfung Jahrestagung (2018) (ed.) (2018).
Im Zuge der Digitalisierung dreidimensionaler Objekte in großer Genauigkeit fallen Daten in bisher ungekannten Dimensionen an, die gespeichert, verarbeitet und in Information umgewandelt werden müssen.
Digitization, Data Processing and Analysis of Industrial and Cultural Objects: Creating Additional Value from Big Data.Kasperl, Stefan; Hanke, Randolf; Oeckl, Steven; Schmitt, Peter; Uhlmann, Norman; Heinz, Daniel; Herl, Gabriel; Hiller, Jochen; Kämmler, Achim; Miller, Thomas; Stock, Andreas M; Sauer, Tomas E. C. on N. -D. T. (E. C. N. D. T. ) 2018 12th (ed.) (2018).
Abstract In the course of the digitization of three-dimensional objects with great precision, data in hitherto unknown dimensions are amassed which have to be stored, processed and converted into information.
Metal artifact reduction by fusion of CT scans from different positions using the unfiltered backprojection Gabriel.Herl, Gabriel; Rettenberger, Simon; Hiller, Jochen; Sauer, Tomas W. 8th Conference on Industrial Computed Tomography (ed.) (2018).
Abstract Metal objects or metal parts in an object are still a major problem of X-ray computed tomography (CT) because of so called metal artifacts. We propose a new method – a multipositional data fusion – for automatically fusing multiple CT volumes from different positions to reduce these metal artifacts. After scanning a specimen several times at different positions and reconstruction of every scan (e.g. by the filtered backprojection), we also perform an unfiltered backprojection. Based on the assumption that metal artifacts occur the most wherever X-rays are attenuated a lot, the unfiltered backprojection is used to autonomously estimate the likelihood of metal artifacts in every voxel of every scan. The different volumes are registered and then fused by weighted sum preferring the voxels with low values in the unfiltered backprojection results. In our tests on real objects, our method fully automatically created optimized volumes with significantly less metal artifacts. The multipositional data fusion was compared to the commercially multi spectra fusion of Werth Messtechnik GmbH and outperformed it in one of the use cases.
Detection and Purging of Specular Reflective and Transparent Object Influences in 3D Range Measurements.Koch, R.; May, S.; Nüchter, A. in ISPRS Archives Photogrammetry and Remote Senssing Spatial Inf. Sci., Volume XLII/W3 (2017). 377--384.
3D laser scanners are favoured sensors for mapping in mobile service robotics at indoor and outdoor applications, since they deliver precise measurements at a wide scanning range. The resulting maps are detailed since they have a high resolution. Based on these maps robots navigate through rough terrain, fulfil advanced manipulation, and inspection tasks. In case of specular reflective and transparent objects, e.g., mirrors, windows, shiny metals, the laser measurements get corrupted. Based on the type of object and the incident angle of the incoming laser beam there are three results possible: a measurement point on the object plane, a measurement behind the object plane, and a measurement of a reflected object. It is important to detect such situations to be able to handle these corrupted points. This paper describes why it is difficult to distinguish between specular reflective and transparent surfaces. It presents a 3D- Reflection-Pre-Filter Approach to identify specular reflective and transparent objects in point clouds of a multi-echo laser scanner. Furthermore, it filters point clouds from influences of such objects and extract the object properties for further investigations. Based on an Iterative-Closest-Point-algorithm reflective objects are identified. Object surfaces and points behind surfaces are masked according to their location. Finally, the processed point cloud is forwarded to a mapping module. Furthermore, the object surface corners and the type of the surface is broadcasted. Four experiments demonstrate the usability of the 3D-Reflection-Pre-Filter. The first experiment was made in a empty room containing a mirror, the second experiment was made in a stairway containing a glass door, the third experiment was made in a empty room containing two mirrors, the fourth experiment was made in an office room containing a mirror. This paper demonstrate that for single scans the detection of specular reflective and transparent objects in 3D is possible. It is more reliable in 3D as in 2D. Nevertheless, collect the data of multiple scans and post-filter them as soon as the object was bypassed should pursued. This is why future work concentrates on implementing a post-filter module. Besides, it is the aim to improve the discrimination between specular reflective and transparent objects.
Creation of Flow-Based Data Sets for Intrusion Detection.Ring, Markus; Wunderlich, Sarah; Grüdl, Dominik; Landes, Dieter; Hotho, Andreas in Journal of Information Warfare (2017). 16(4) 41-54.
Publicly available labelled data sets are necessary for evaluating anomaly-based Intrusion Detection Systems (IDS). However, existing data sets are often not up-to-date or not yet published because of privacy concerns. This paper identifies requirements for good data sets and proposes an approach for their generation. The key idea is to use a test environment and emulate realistic user behaviour with parameterised scripts on the clients. Comprehensive logging mechanisms provide additional information which may be used for a better understanding of the inner dynamics of an IDS. Finally, the proposed approach is used to generate the flow-based CIDDS-002 data set.
IP2Vec: Learning Similarities Between IP Addresses.Ring, Markus; Landes, Dieter; Dallmann, Alexander; Hotho, Andreas (2017). 657-666.
IP Addresses are a central part of packet- and flow-based network data. However, visualization and similarity computation of IP Addresses are challenging to due the missing natural order. This paper presents a novel similarity measure IP2Vec for IP Addresses that builds on ideas from Word2Vec, a popular approach in text mining. The key idea is to learn similarities by extracting available context information from network data. IP Addresses are similar if they appear in similar contexts. Thus, IP2Vec is automatically derived from the given network data set. The proposed approach is evaluated experimentally on two public flow-based data sets. In particular, we demonstrate the effectiveness of clustering IP Addresses within a botnet data set. In addition, we use visualization methods to analyse the learned similarities in more detail. These experiments indicate that IP2Vec is well suited to capture the similarity of IP Addresses based on their network communications.
A Toolset for Intrusion and Insider Threat Detection.Ring, Markus; Wunderlich, Sarah; Grüdl, Dominik; Landes, Dieter; Hotho, Andreas in Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications, I. Palomares Carrascosa, Kalutarage, H. K., Huang, Y. (eds.) (2017). 3--31.
Company data are a valuable asset and must be protected against unauthorized access and manipulation. In this contribution, we report on our ongoing work that aims to support IT security experts with identifying novel or obfuscated attacks in company networks, irrespective of their origin inside or outside the company network. A new toolset for anomaly based network intrusion detection is proposed. This toolset uses flow-based data which can be easily retrieved by central network components. We study the challenges of analysing flow-based data streams using data mining algorithms and build an appropriate approach step by step. In contrast to previous work, we collect flow-based data for each host over a certain time window, include the knowledge of domain experts and analyse the data from three different views. We argue that incorporating expert knowledge and previous flows allow us to create more meaningful attributes for subsequent analysis methods. This way, we try to detect novel attacks while simultaneously limiting the number of false positives.
Flow-based benchmark data sets for intrusion detection.Ring, Markus; Wunderlich, Sarah; Grüdl, Dominik; Landes, Dieter; Hotho, Andreas (2017). 361--369.
Anomaly based intrusion detection systems suffer from a lack of appropriate evaluation data sets. Often, existing data sets may not be published due to privacy concerns or do not reflect actual and current attack scenarios. In order to overcome these problems, we identify characteristics of good data sets and develop an appropriate concept for the generation of labelled flow-based data sets that satisfy these criteria. The concept is implemented based on OpenStack, thus demonstrating the suitability of virtual environments. Virtual environments offer advantages compared to static data sets by easily creating up-to-date data sets with recent trends in user behaviour and new attack scenarios. In particular, we emulate a small business environment which includes several clients and typical servers. Network traffic is generated by scripts which emulate typical user activities like surfing the web, writing emails, or printing documents on the clients. These scripts follow some guidelines to ensure that the user behaviour is as realistic as possible, also with respect to working hours and lunch breaks. The generated network traffic is recorded in unidirectional NetFlow format. For generating malicious traffic, attacks like Denial of Service, Brute Force, and Port Scans are executed within the network. Since origins, targets, and timestamps of executed attacks are known, labelling of recorded NetFlow data is easily possible. For inclusion of actual traffic, which has its origin outside the OpenStack environment, an external server with two services is deployed. This server has a public IP address and is exposed to real and up-to-date attacks from the internet. We captured approximately 32 million flows over a period of four weeks and categorized them into five classes. Further, the chronological sequence of the flows is analysed and the distribution of normal and malicious traffic is discussed in detail. The main contribution of this paper is the demonstration of a novel approach to use OpenStack as a basis for generating realistic data sets that can be used for the evaluation of network intrusion detection systems.
Evaluation of Features from RGB-D Data for Human Body Weight Estimation.Pfitzner, C.; May, S.; Nüchter, A. (2017).
Body weight is a crucial parameter when it comes to drug or radiation dosing. In case of emergency treatment time is short so that physicians estimate the body weight by the visual appearance of a patient. Further, visual body weight estimation might be a feature for person identification. This paper presents the anthropometric feature extraction from RGB-D sensor data, recorded from frontal view. The features are forwarded to an artificial neural network for weight estimation. Experiments with 233 people demonstrate the capability of different features for body weight estimation. To prove robustness against sensor modalities, a structured light sensor is used, as well as a time-of-flight sensor. An additional experiment including temperature features from a thermal camera improves the body weight estimation beyond.
Towards EEG-Based Eye-Tracking for Interaction Design in Head-Mounted Devices.Marc Philipp Dietrich, Götz Winterfeldt 2017 I. E. E. E. 7th International Conference on Consumer Electronics Berlin (ICCE-Berlin) (ed.) (2017).
Augmented Reality (AR), Mixed Reality (MR) and Virtual Reality (VR) have an increasing impact on our daily lives. They improve workers' performance in industry and medicine. In addition gaming and entertainment profit from these innovations. The enabling devices are often head-mounted. New intuitive interaction methods must be developed to control application, because conventional input devices such as keyboards, touch screens or classical touch pads cannot be used. This paper introduces electroencephalographic (EEG) eye-tracking as an additional interaction channel. Ocular artefacts (EOG) in the EEG signal are used to detect eye positions. A Brain-Computer Interface (BCI) is used to capture the data. Data is processed and EOG artefacts are extracted to compute the position of the pupil. The first test runs confirm that ocular artefacts in the EEG signal are strongly correlated with the position of the pupils. Extreme positions of the pupils (horizontal left, horizontal right, vertical up and vertical down) can be detected with high accuracy (true-positive-rate of up to 96,6%). In future tests, we successively refine the direction and speed of eye movement and verify their usage under real-time conditions.
Out of lab calibration of a rotating 2D scanner for 3D mapping.Koch, R.; Böttcher, L.; Jahrsdörfer, M.; Maier, J.; Trommer, M.; May, S.; Nüchter, A. (2017). (Vol. 10332) 10332 - 10332 - 8.
Mapping is an essential task in mobile robotics. To fulfil advanced navigation and manipulation tasks a 3D representation of the environment is required. Applying stereo cameras or Time-of-flight cameras (TOF cameras) are one way to archive this requirement. Unfortunately, they suffer from drawbacks which makes it difficult to map properly. Therefore, costly 3D laser scanners are applied. An inexpensive way to build a 3D representation is to use a 2D laser scanner and rotate the scan plane around an additional axis. A 3D point cloud acquired with such a custom device consists of multiple 2D line scans. Therefore the scanner pose of each line scan need to be determined as well as parameters resulting from a calibration to generate a 3D point cloud. Using external sensor systems are a common method to determine these calibration parameters. This is costly and difficult when the robot needs to be calibrated outside the lab. Thus, this work presents a calibration method applied on a rotating 2D laser scanner. It uses a hardware setup to identify the required parameters for calibration. This hardware setup is light, small, and easy to transport. Hence, an out of lab calibration is possible. Additional a theoretical model was created to test the algorithm and analyse impact of the scanner accuracy. The hardware components of the 3D scanner system are an HOKUYO UTM-30LX-EW 2D laser scanner, a Dynamixel servo-motor, and a control unit. The calibration system consists of an hemisphere. In the inner of the hemisphere a circular plate is mounted. The algorithm needs to be provided with a dataset of a single rotation from the laser scanner. To achieve a proper calibration result the scanner needs to be located in the middle of the hemisphere. By means of geometric formulas the algorithms determine the individual deviations of the placed laser scanner. In order to minimize errors, the algorithm solves the formulas in an iterative process. First, the calibration algorithm was tested with an ideal hemisphere model created in Matlab. Second, laser scanner was mounted differently, the scanner position and the rotation axis was modified. In doing so, every deviation, was compared with the algorithm results. Several measurement settings were tested repeatedly with the 3D scanner system and the calibration system. The results show that the length accuracy of the laser scanner is most critical. It influences the required size of the hemisphere and the calibration accuracy.
Effective Distinction Of Transparent And Specular Reflective Objects In Point Clouds Of A Multi-Echo Laser Scanner.Koch, R.; May, S.; Nüchter, A. (2017). 566--571.
A favoured sensor for mapping is a 3D laser scanner since it allows a wide scanning range, precise measurements, and is usable indoor and outdoor. Hence, a mapping module delivers detailed and high resolution maps which makes it possible to navigate safely. Difficulties result from transparent and specular reflective objects which cause erroneous and dubious measurements. At such objects, based on the incident angle, measurements result from the object surface, an object behind the transparent surface, or an object mirrored with respect to the reflective surface. This paper describes an enhanced Pre-Filter-Module to distinguish between these cases. Two experiments demonstrate the usability and show that for single scans the identification of mentioned objects in 3D is possible. The first experiment was made in an empty room with a mirror. The second experiment was made in a stairway which contains a glass door. Further, results show that a discrimination between a specular reflective and a transparent object is possible. Especially for transparent objects the detected size is restricted to the incident angle. That is why future work concentrates on implementing a post-filter module. Gained experience shows that collecting the data of multiple scans and postprocess them as soon as the object was bypassed will improve the map.
