We claim that modelling network trac as a time series with a supervised learning approach, using known genuine and malicious behaviour, improves intrusion detection. To substantiate this, we trained long short-term memory (LSTM) recurrent neural networks with the training data provided by the DARPA / KDD Cup ’99 challenge. To identify suitable LSTM-RNN network parameters and structure we experimented with various network topologies. We found networks with four memory blocks containing two cells each oer a good compromise between computational cost and detection performance. We applied forget gates and shortcut connections respectively. A learning rate of 0.1 and up to 1,000 epochs showed good results. We tested the performance on all features and on extracted minimal feature sets respectively. We evaluated dierent feature sets for the detection of all attacks within one network and also to train networks specialised on individual attack classes. Our results show that the LSTM classier provides superior performance in comparison to results previously published results of strong static classiers. With 93.82% accuracy and 22.13 cost, LSTM outperforms the winning entries of the KDD Cup ’99 challenge by far. This is due to the fact that LSTM learns to look back in time and correlate consecutive connection records. For the rst time ever, we have demonstrated the usefulness of LSTM networks to intrusion detection.
{"title":"Applying long short-term memory recurrent neural networks to intrusion detection","authors":"R. C. Staudemeyer","doi":"10.18489/SACJ.V56I1.248","DOIUrl":"https://doi.org/10.18489/SACJ.V56I1.248","url":null,"abstract":"We claim that modelling network trac as a time series with a supervised learning approach, using known genuine and malicious behaviour, improves intrusion detection. To substantiate this, we trained long short-term memory (LSTM) recurrent neural networks with the training data provided by the DARPA / KDD Cup ’99 challenge. To identify suitable LSTM-RNN network parameters and structure we experimented with various network topologies. We found networks with four memory blocks containing two cells each oer a good compromise between computational cost and detection performance. We applied forget gates and shortcut connections respectively. A learning rate of 0.1 and up to 1,000 epochs showed good results. We tested the performance on all features and on extracted minimal feature sets respectively. We evaluated dierent feature sets for the detection of all attacks within one network and also to train networks specialised on individual attack classes. Our results show that the LSTM classier provides superior performance in comparison to results previously published results of strong static classiers. With 93.82% accuracy and 22.13 cost, LSTM outperforms the winning entries of the KDD Cup ’99 challenge by far. This is due to the fact that LSTM learns to look back in time and correlate consecutive connection records. For the rst time ever, we have demonstrated the usefulness of LSTM networks to intrusion detection.","PeriodicalId":55859,"journal":{"name":"South African Computer Journal","volume":"56 1","pages":"136-154"},"PeriodicalIF":0.0,"publicationDate":"2015-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"67992653","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Despite the advantages dynamic reconfiguration adds to a system, it only improves system performance if the execution time exceeds the configuration time. As a result, dynamic reconfiguration is only capable of improving the performance of quasi-static applications. In order to improve the performance of dynamic applications, researchers focus on improving the reconfiguration throughput. These approaches are mostly limited by the bus commonly used to connect the configuration controller to the memory, which contributes to the configuration time. A method proposed to ameliorate this overhead is an architecture utilizing localised block RAM (BRAM) connected to the configuration controller to store the configuration bitstream. The aim of this paper is to illustrate the advantages of the proposed architecture, especially for reconfiguring real-time applications. This is done by validating the throughput of the architecture and comparing this to the maximum theoretical throughput of the internal configuration access port (ICAP). It was found that the proposed architecture is capable of reconfiguring an application within a time-frame suitable for real-time reconfiguration. The drawback of this method is that the BRAM is extremely limited and only a discrete set of configurations can be stored. This paper also proposes a method on how this can be mitigated without affecting the throughput.
{"title":"Block RAM-based architecture for real-time reconfiguration using Xilinx® FPGAs","authors":"Rikus le Roux, G. V. Schoor, P. V. Vuuren","doi":"10.18489/SACJ.V56I1.252","DOIUrl":"https://doi.org/10.18489/SACJ.V56I1.252","url":null,"abstract":"Despite the advantages dynamic reconfiguration adds to a system, it only improves system performance if the execution time exceeds the configuration time. As a result, dynamic reconfiguration is only capable of improving the performance of quasi-static applications. In order to improve the performance of dynamic applications, researchers focus on improving the reconfiguration throughput. These approaches are mostly limited by the bus commonly used to connect the configuration controller to the memory, which contributes to the configuration time. A method proposed to ameliorate this overhead is an architecture utilizing localised block RAM (BRAM) connected to the configuration controller to store the configuration bitstream. The aim of this paper is to illustrate the advantages of the proposed architecture, especially for reconfiguring real-time applications. This is done by validating the throughput of the architecture and comparing this to the maximum theoretical throughput of the internal configuration access port (ICAP). It was found that the proposed architecture is capable of reconfiguring an application within a time-frame suitable for real-time reconfiguration. The drawback of this method is that the BRAM is extremely limited and only a discrete set of configurations can be stored. This paper also proposes a method on how this can be mitigated without affecting the throughput.","PeriodicalId":55859,"journal":{"name":"South African Computer Journal","volume":"56 1","pages":"22-32"},"PeriodicalIF":0.0,"publicationDate":"2015-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"67992965","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Design science research (DSR) is a relatively unfamiliar research paradigm within the computing field in South Africa. In light of recent interest in this paradigm, this study sought to explore DSR perspectives among local computing researchers. Key theoretical concepts from social representations theory (SRT) such as anchoring and objectification were used to explore how researchers construct their understanding of DSR. A visual approach was used to administer drawing and association tasks to two focus groups; each focus group comprised around 25 participants ranging from doctoral students to experienced researchers. The focus group discussions invoked interesting complementary and distinctive associations about the process and content of DSR – anchored in dominant and conventional research practices. The results also illustrated several ways in which DSR is objectified by the researchers in drawings and metaphorical constructions. We conclude that SRT is useful for exploring beliefs about novel and relatively unfamiliar research practices. This study contributes to an enhanced understanding of how computing researchers go about making sense and assigning meaning to changing research practices. The findings are developed into recommendations for introducing changes to research practices. These recommendations can be used to direct efforts to more appropriately accommodate changing research practices within the computing community to broaden knowledge generation.
{"title":"A social representations analysis of design science research","authors":"R. Naidoo, A. V. D. Merwe, A. Gerber, A. Hevner","doi":"10.18489/SACJ.V56I1.274","DOIUrl":"https://doi.org/10.18489/SACJ.V56I1.274","url":null,"abstract":"Design science research (DSR) is a relatively unfamiliar research paradigm within the computing field in South Africa. In light of recent interest in this paradigm, this study sought to explore DSR perspectives among local computing researchers. Key theoretical concepts from social representations theory (SRT) such as anchoring and objectification were used to explore how researchers construct their understanding of DSR. A visual approach was used to administer drawing and association tasks to two focus groups; each focus group comprised around 25 participants ranging from doctoral students to experienced researchers. The focus group discussions invoked interesting complementary and distinctive associations about the process and content of DSR – anchored in dominant and conventional research practices. The results also illustrated several ways in which DSR is objectified by the researchers in drawings and metaphorical constructions. We conclude that SRT is useful for exploring beliefs about novel and relatively unfamiliar research practices. This study contributes to an enhanced understanding of how computing researchers go about making sense and assigning meaning to changing research practices. The findings are developed into recommendations for introducing changes to research practices. These recommendations can be used to direct efforts to more appropriately accommodate changing research practices within the computing community to broaden knowledge generation.","PeriodicalId":55859,"journal":{"name":"South African Computer Journal","volume":"56 1","pages":"33-49"},"PeriodicalIF":0.0,"publicationDate":"2015-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"67993978","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Protecting computing infrastructure is an expensive but necessary task. Companies that run their own computing infrastructure need to constantly vigilant in order to guard against intruders on their networks and groups or individuals that seek to intercept their communications. Companies turn to Firewall and Intrusion Detection System vendors to help them safeguard their information and infrastructure. These companies are putting their faith in expensive devices that attempt to distinguish between friendly and malicious traffic. Despite the expense and complexity of these systems, malicious users seem to find ways to avoid detection and news of massive breaches have become an almost daily occurrence. We propose to fundamentally change the way to look at information security. We highlight some of the fundamental flaws in current systems and expose risks that many experts know, but are not aware of.
{"title":"Burning money with firewalls","authors":"R. C. Staudemeyer, James Connan","doi":"10.18489/SACJ.V56I1.322","DOIUrl":"https://doi.org/10.18489/SACJ.V56I1.322","url":null,"abstract":"Protecting computing infrastructure is an expensive but necessary task. Companies that run their own computing infrastructure need to constantly vigilant in order to guard against intruders on their networks and groups or individuals that seek to intercept their communications. Companies turn to Firewall and Intrusion Detection System vendors to help them safeguard their information and infrastructure. These companies are putting their faith in expensive devices that attempt to distinguish between friendly and malicious traffic. Despite the expense and complexity of these systems, malicious users seem to find ways to avoid detection and news of massive breaches have become an almost daily occurrence. We propose to fundamentally change the way to look at information security. We highlight some of the fundamental flaws in current systems and expose risks that many experts know, but are not aware of.","PeriodicalId":55859,"journal":{"name":"South African Computer Journal","volume":"56 1","pages":"165-167"},"PeriodicalIF":0.0,"publicationDate":"2015-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"67993870","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
The aim of this paper is to provide an overview of the investigation into customer e-service adoption. The investigation includes a qualitative survey and observation of participants using e-services. E-services are used to attract customers and persuade them to transact online and the customer’s perception of an e-service contributes greatly to e-service adoption or rejection. This paper describes the factors that influence customer perception towards e-services. Relationships between the identified factors were also considered in order to build a conceptual framework. Grounded theory was used for its flexibility, repetitive comparisons of data, and emergence of concepts and theories.
{"title":"The factors that influence customer e-services adoption","authors":"K. Persad, Keshnee Padayachee","doi":"10.18489/SACJ.V56I1.209","DOIUrl":"https://doi.org/10.18489/SACJ.V56I1.209","url":null,"abstract":"The aim of this paper is to provide an overview of the investigation into customer e-service adoption. The investigation includes a qualitative survey and observation of participants using e-services. E-services are used to attract customers and persuade them to transact online and the customer’s perception of an e-service contributes greatly to e-service adoption or rejection. This paper describes the factors that influence customer perception towards e-services. Relationships between the identified factors were also considered in order to build a conceptual framework. Grounded theory was used for its flexibility, repetitive comparisons of data, and emergence of concepts and theories.","PeriodicalId":55859,"journal":{"name":"South African Computer Journal","volume":"56 1","pages":"80-106"},"PeriodicalIF":0.0,"publicationDate":"2015-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"67992930","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
General-purpose computation on graphics processing units (GPGPU) has great potential to accelerate many scientific models and algorithms. However, some problems are considerably more difficult to accelerate than others, and it may be challenging for those new to GPGPU to ascertain the difficulty of accelerating a particular problem. Through what was learned in the acceleration of three problems, problem attributes have been identified that can assist in the evaluation of the difficulty of accelerating a problem on a GPU. The identified attributes are a problem's available parallelism, inherent parallelism, synchronisation requirements, and data transfer requirements. We envisage that with further development, these attributes could form the foundation of a difficulty classification system that could be used to determine whether GPU acceleration is practical for a candidate GPU acceleration problem, aid in identifying appropriate techniques and optimisations, and outline the required GPGPU knowledge.
{"title":"Identifying attributes of GPU programs for difficulty evaluation","authors":"Dale Tristram, K. Bradshaw","doi":"10.18489/sacj.v53i0.195","DOIUrl":"https://doi.org/10.18489/sacj.v53i0.195","url":null,"abstract":"General-purpose computation on graphics processing units (GPGPU) has great potential to accelerate many scientific models and algorithms. However, some problems are considerably more difficult to accelerate than others, and it may be challenging for those new to GPGPU to ascertain the difficulty of accelerating a particular problem. Through what was learned in the acceleration of three problems, problem attributes have been identified that can assist in the evaluation of the difficulty of accelerating a problem on a GPU. The identified attributes are a problem's available parallelism, inherent parallelism, synchronisation requirements, and data transfer requirements. We envisage that with further development, these attributes could form the foundation of a difficulty classification system that could be used to determine whether GPU acceleration is practical for a candidate GPU acceleration problem, aid in identifying appropriate techniques and optimisations, and outline the required GPGPU knowledge.","PeriodicalId":55859,"journal":{"name":"South African Computer Journal","volume":"53 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2014-08-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"67991773","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
We have mostly cleared the backlog in reviewing since I took over editorship in June 2012. The paper longest under review published in this issue was submitted on 27 September 2012. The paper that had the shortest time to publication was submitted on 4 April 2013. We will continue to try to speed up publication. To do so, we need quality papers that need minimal changes after review, and I urge anyone wanting to help speed up the process to volunteer to review. The workload is not high, and the reward of helping your fellow academics to improve their work is worth it in itself - and my experience is that reviewing the work of others improves my own writing. The papers longest in the publication queue now are papers where the authors have been invited to make substantial changes after review, and have as yet not submitted a revision.
{"title":"Ringing the changes: editorial","authors":"P. Machanick","doi":"10.18489/sacj.v50i1.180","DOIUrl":"https://doi.org/10.18489/sacj.v50i1.180","url":null,"abstract":"We have mostly cleared the backlog in reviewing since I took over editorship in June 2012. The paper longest under review published in this issue was submitted on 27 September 2012. The paper that had the shortest time to publication was submitted on 4 April 2013. We will continue to try to speed up publication. To do so, we need quality papers that need minimal changes after review, and I urge anyone wanting to help speed up the process to volunteer to review. The workload is not high, and the reward of helping your fellow academics to improve their work is worth it in itself - and my experience is that reviewing the work of others improves my own writing. The papers longest in the publication queue now are papers where the authors have been invited to make substantial changes after review, and have as yet not submitted a revision.","PeriodicalId":55859,"journal":{"name":"South African Computer Journal","volume":"50 1","pages":"v-vi"},"PeriodicalIF":0.0,"publicationDate":"2013-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"67991879","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
京ICP备2023020795号-1
扫码关注我们
求助内容：
应助结果提醒方式：