Department Publications

The development of computer based systems expands the usage of computer based application in human life. It can be observed that illegal activities such as unauthorized data access, data theft, data modification and various other intrusion activities are rapidly growing during last decade. Hence, deployment and continuous improvement of Intrusion Detection Systems (IDS) are of paramount importance. Training, testing and evaluation of IDS with real network traffic is significant challenge, so most of IDS evaluation is based on intrusion datasets. Therefore, analysis of intrusion datasets are of paramount importance. In this paper, we evaluated Aegean Wi-Fi Intrusion Dataset (AWID) with different machine learning techniques. Feature reduction techniques such as Information Gain (IG) and Chi-Squared statistics (CH) were applied to evaluate dataset performance with feature reduction. Results of experiments show …

The P300 wave is an Event Related Potential that is elicited in the brain when a subject is presented with a familiar stimulus. The Guilty Knowledge Test is used to determine if certain information is stored in the brain by detecting the P300 wave. In this paper, an improved Guilty Knowledge Test has been conducted on 14 subjects. Although a variety of feature extraction and classification algorithms for detecting the P300 have been used thus far, this paper introduces the use of deep learning techniques for the Guilty Knowledge Test. Two deep learning techniques; Deep Belief Networks and Stacked Autoencoders, have been compared. The input to these classifiers was the filtered EEG signal without any feature extraction. A mean accuracy of 86.9% was achieved for the Deep Belief Network and 86.01% for the Stacked Autoencoder on our dataset, outperforming the conventional Support Vector Machine.

Intrusion detection is only a starting step in securing IT infrastructure. Prediction of intrusions is the next step to provide an active defense against incoming attacks. Current intrusion prediction methods focus mainly on prediction of either intrusion type or intrusion category and do not use or provide contextual information such as source and target IP address. In addition most of them are dependant on domain knowledge and specific scenario knowledge. The proposed algorithm employs a bag-of-words model together with a hidden Markov model which not depend on specific domain knowledge. Since this algorithm depends on a training process it is adaptable to different conditions. A key advantage of the proposed algorithm is the inclusion of contextual data such as source IP address, destination IP range, alert type and alert category in its prediction, which is crucial for an eventual response. Experiments conducted using a public data set generated over 2500 alert predictions and achieved accuracy of 81% and 77% for single step and five step predictions respectively for prediction of the next alert cluster. It also achieved an accuracy of prediction of 95% and 92% for single step and five step predictions respectively for prediction of the next alert category. The proposed methods achieved a prediction accuracy improvement of 5% for alert category over existing variable length Markov chain intrusion prediction methods, while providing more information for a possible defense.

Intrusion detection is only a starting step in securing IT infrastructure. Prediction of intrusions is the next step to provide an active defense against incoming attacks. Most of the existing intrusion prediction methods mainly focus on prediction of either intrusion type or intrusion category. Also, most of them are built based on domain knowledge and specific scenario knowledge. This thesis proposes an alert prediction framework which provides more detailed information than just the intrusion type or category to initiate possible defensive measures. The proposed algorithm is based on hidden Markov model and it does not depend on specific domain knowledge. Instead, it depends on a training process. Hence the proposed algorithm is adaptable to different conditions. Also, it is based on prediction of the next alert cluster, which contains source IP address, destination IP range, alert type and alert category. Hence …

The P300 Speller is a Brain Computer Interface that enables communication using the EEG signal. The P300 wave is an Event Related Potential that occurs as a response to a familiar stimulus. This system can be used to aid persons who are unable to communicate via conventional methods. In this paper, the P300 Speller has been modified to allow communication in three languages: English, Sinhala and Tamil. Classification of the P300 waveform was done using an ensemble of Support Vector Machines. A mean letter classification accuracy of 83.76% and a mean P300 classification accuracy of 90.68% was achieved on our dataset.

The rapid advancement of technology has made the telecommunication sector very competitive. In order to keep up with the competition, telecommunication operators have to identify the exact needs of the customers and offer services in-line with the customer needs. The aim of this research is to find out how data mining can be applied to identify customer needs and how telecommunication companies can benefit from using data mining techniques in their business and how to develop a data mining framework for identifying the customer needs in order to develop products and services to increase the revenue levels of the companies. The objective of this study includes the investigation of the relationship between data mining practices and the customer behavior patterns, the relationship between customer needs and products or services, relationship between new product design initiatives and revenue increases of the companies, the impact of data mining on the revenue of telecommunications companies and the development of the data mining frame work to improve the overall ARPU levels of the industry and a Business Intelligence (BI) tool to enhance decision making for improving the overall ARPU levels of the industry. Firstly the conceptual model is developed to indicate the main information areas that the study seeks to provide insights on and is tested through a sample of employees who hold positions in the telecommunications sector. This model has four main variables; an independent variable (data mining), two intermediate variables (customer behavior and product) and a dependent variable (increased revenue). Secondly the …