Search

We show that a recurrent neural network is able to learn a model to represent sequences of communications between computers on a network and can be used to identify outlier network traffic. Defending computer networks is a challenging problem and is typically addressed by manually identifying known malicious actor behavior and then specifying rules to recognize such behavior in network communications. However, these rule-based approaches often generalize poorly and identify only those patterns that are already known to researchers. An alternative approach that does not rely on known malicious behavior patterns can potentially also detect previously unseen patterns. We tokenize and compress netflow into sequences of "words" that form "sentences" representative of a conversation between computers. These sentences are then used to generate a model that learns the semantic and syntactic grammar of the newly generated language. We use Long-Short-Term Memory (LSTM) cell Recurrent Neural Networks (RNN) to capture the complex relationships and nuances of this language. The language model is then used predict the communications between two IPs and the prediction error is used as a measurement of how typical or atyptical the observed communication are. By learning a model that is specific to each network, yet generalized to typical computer-to-computer traffic within and outside the network, a language model is able to identify sequences of network activity that are outliers with respect to the model. We demonstrate positive unsupervised attack identification performance (AUC 0.84) on the ISCX IDS dataset which contains seven days of network activity with normal traffic and four distinct attack patterns., Comment: Prepared for the 2017 National Symposium on Sensor and Data Fusion

A new technique is presented for solving the problem of enforcing control limits in power flow studies. As an added benefit, it greatly increases the achievable precision at nose points. The method is exemplified for the case of Mvar limits in generators regulating voltage on both local and remote buses. Based on the framework of the Holomorphic Embedding Loadflow Method (HELM), it provides a rigorous solution to this fundamental problem by framing it in terms of \emph{optimization}. A novel Lagrangian formulation of power-flow, which is exact for lossless networks, leads to a natural physics-based minimization criterion that yields the correct solution. For networks with small losses, as is the case in transmission, the AC power flow problem cannot be framed exactly in terms of optimization, but the criterion still retains its ability to select the correct solution. This foundation then provides a way to design a HELM scheme to solve for the minimizing solution. Although the use of barrier functions evokes interior point optimization, this method, like HELM, is based on the analytic continuation of a germ (of a particular branch) of the algebraic curve representing the solutions of the system. In this case, since the constraint equations given by limits result in an unavoidable singularity at $s=1$, direct analytic continuation by means of standard Pad\'e approximation is fraught with numerical instabilities. This has been overcome by means of a new analytic continuation procedure, denominated Pad\'e-Weierstrass, that exploits the covariant nature of the power flow equations under certain changes of variables. One colateral benefit of this procedure is that it can also be used when limits are not being enforced, in order to increase the achievable numerical precision in highly stressed cases.

The Holomorphic Embedding Load-Flow Method (HELM) was recently introduced as a novel technique to constructively solve the power-flow equations in power grids, based on advanced complex analysis. In this paper, the theoretical foundations of the method are established in detail. Starting from a fundamental projective invariance of the power-flow equations, it is shown how to devise holomorphicity-preserving embeddings that ultimately allow regarding the power-flow problem as essentially a study in algebraic curves. Complementing this algebraic-geometric viewpoint, which lays the foundation of the method, it is shown how to apply standard analytic techniques (power series) for practical computation. Stahl's theorem on the maximality of the analytic continuation provided by Pad\'e approximants then ensures the completeness of the method. On the other hand, it is shown how to extend the method to accommodate smooth controls, such as the ubiquitous generator-controlled PV bus., Comment: 17 pages, 1 figure