Showing papers by "Nagarajan Kandasamy published in 2015"

A fast algorithm for detecting anomalous changes in network traffic

Abstract: Anomalies in communication network traffic caused by malware or denial-of-service attacks manifest themselves in structural changes in the covariance matrix of traffic features. Real-time detection of anomalies in high-dimensional data demands a very efficient algorithm to identify these changes in a compact low-dimensional representation. This paper presents an efficient algorithm for the rapid detection of structural differences between two covariance matrices, as measured by the maximum possible angle between the subspaces specified by subsets of the two sets of principal components of the matrices. We show that our algorithm achieves a significantly lower computational complexity compared to a naive approach. Finally, we apply our results to real traffic traces from Internet backbone links and show that our approach offers a substantial reduction in the computational overhead of anomaly detection.

Rapid Prototyping of Wireless Physical Layer Modules Using Flexible Software/Hardware Design Flow

Abstract: This paper describes a step by step approach in designing wireless physical layer modules starting from a software implementation in MATLAB to a hardware implementation using Xilinx SysGen and ModelSim. The described design flow promotes baseband physical layer research by providing high flexibility and speed to the process of module creation verification and deployment. The novelty introduced into our system lies within the flexible components created using this design flow, which enables on-the-fly modification of multiple parameters to suit various wireless protocols.

Anomaly detection in computer systems using compressed measurements

Abstract: Online performance monitoring of computer systems incurs a variety of costs: the very act of monitoring a system interferes with its performance and if the information is transmitted to a monitoring station for analysis and logging, this consumes network bandwidth and disk space. Compressive sampling-based schemes can help reduce these costs on the local machine by acquiring data directly from the system in a compressed form, and in a computationally efficient way. This paper focuses on reducing the computational cost associated with recovering the original signal from the transmitted sample set at the monitoring station for anomaly detection. Towards this end, we show that the compressed samples preserve, in an approximate form, properties such as mean, variance, as well as correlation between data points in the original full-length signal. We then use this result to detect changes in the original signal that could be indicative of an underlying anomaly such as abrupt changes in magnitude and gradual trends without the need to recover the full-length data. We illustrate the usefulness of our approach via case studies involving IBM's Trade Performance Benchmark using signals from the disk and memory subsystems. Experiments indicate that abrupt changes can be detected using a compressed sample size of 25% with a hit rate of 95% for a fixed false alarm rate of 5%; trends can be detected within a confidence interval of 95% using a sample size of only 6%.

Hardware implementation of low-overhead data aided timing and Carrier Frequency Offset correction for OFDM signals

Abstract: In this paper a trained timing synchronization method using a matched filter and Carrier Frequency Offset synchronization method based on a modified correlation scheme is implemented in hardware for Orthogonal Frequency Division Multiplexing. MATLAB System Generator is used to target a Virtex-6 FPGA on the ML605 Xilinx evaluation board, with an optimized number of board resources utilized. A complex pseudo-noise sequence is used as a preamble for timing. The employed training sequence for frequency synchronization consists of only one pilot symbol, distinguishing this system from most approaches which rely upon multiple pilot symbols. By reducing the number of symbols required for the training period, it is possible to increase throughput. In addition, to ensure that the system has flexibility and is not protocol specific, the system allows for a variable number of FFT sizes and pilot symbol design parameters to be used. Performance of the system is shown to improve over an Additive White Gaussian Noise channel by implementing the design in comparison to not compensating for the distortion.

Leveraging an Agile RF Transceiver for Rapid Prototyping of Small-Cell Systems

Abstract: This paper describes a new software-defined radio (SDR) platform targeted for rapid prototyping of small-cell systems. The SDR hardware combines the signal processing power of Xilinx ML605 Virtex-6 FPGA board with the Nutaq Radio420X frequency-agile transceiver and reconfigurable antennas to form a highly versatile platform for spectrum sensing, spectrum access, and cooperative communications. We evaluate the platform with two example applications: an offline OFDM physical processing flow based on WARPLab, and a real-time online automatic gain control mechanism. The results show that our SDR platform can reliably handle both offline and online processing demands with the added benefit of frequency agility offered by a state-of-the-art radio transceiver.

FPGA Implementation of Trained Coarse Carrier Frequency Offset Estimation and Correction for OFDM Signals (Abstract Only)

Abstract: This paper develops an FPGA implementation of a trained coarse Carrier Frequency Offset estimation and correction scheme using MATLAB System Generator. The designed system is capable of supporting variable FFT sizes for Orthogonal Frequency Division Multiplexing signals and different pilot symbol structures making it compatible with a large number of wireless communication standards, unlike other work that is protocol specific. This design stands out from its more common implementations as it requires only one pilot symbol to be considered for synchronization by using a data-aided modified correlation scheme, allowing for an increase in throughput. The Bit Error Rate of the corrected signal received over an Additive White Gaussian Noise channel is compared to the case without correction. This scheme demonstrated increased performance throughput since only a single pilot symbol was used.

Efficient online performance monitoring of computing systems using predictive models

Abstract: Performance monitoring of datacenters provides vital information for dynamic resource provisioning, anomaly detection, capacity planning, and metering decisions. Online monitoring, however, incurs a variety of costs: the very act of monitoring a system interferes with its performance, consuming network bandwidth and disk space. With the goal of reducing these costs, we develop and validate a strategy based on exploiting the underlying structure of the signal being monitored to sparsify it prior to transmission to a monitoring station for analysis and logging. Specifically, predictive models are designed to estimate the signals of interest. These models are then used to obtain prediction errors -- the error between the signal and the corresponding estimate -- that are then treated as a sparse representation of the original signal while retaining key information. This transformation allows for far less data to be transmitted to the monitoring station, at which point the signal is reconstructed by simply using the prediction errors. We show that classical techniques such as principal component analysis (PCA) can be applied to the reconstructed signal for anomaly detection. Experimental results using the Trade6 and RuBBoS benchmarks indicate a significant reduction in overall transmission costs -- greater that 95% in some cases -- while retaining sufficient detection accuracy.