arXiv subjects

Brian A. Powell

Publications and source records attributed to Brian A. Powell.

18 recordsLinked to original sources

arXiv2022

How I learned to stop worrying and love the curse of dimensionality: an appraisal of cluster validation in high-dimensional spaces

The failure of the Euclidean norm to reliably distinguish between nearby and distant points in high dimensional space is well-known. This phenomenon of distance concentration manifests in a variety of data distributions, with iid or correlated features, including centrally-distributed and clustered data. Unsupervised learning based on Euclidean nearest-neighbors and more general proximity-oriented data mining tasks like clustering, might therefore be adversely affected by distance concentration for high-dimensional applications. While considerable work has been done developing clustering algorithms with reliable high-dimensional performance, the problem of cluster validation--of determining the natural number of clusters in a dataset--has not been carefully examined in high-dimensional problems. In this work we investigate how the sensitivities of common Euclidean norm-based cluster validity indices scale with dimension for a variety of synthetic data schemes, including well-separated and noisy clusters, and find that the overwhelming majority of indices have improved or stable sensitivity in high dimensions. The curse of dimensionality is therefore dispelled for this class of fairly generic data schemes.

cs.LG↗

arXiv2021

Securing LSB embedding against structural steganalysis

This work explores the extent to which LSB embedding can be made secure against structural steganalysis through a modification of cover image statistics prior to message embedding. Natural images possess symmetries that are expressed through approximately equal cardinalities of certain sets of $k$-tuples of consecutive pixels. LSB embedding disturbs this balance and a $k^{\rm th}$-order structural attack infers the presence of a hidden message with a length in proportion to the size of the imbalance amongst sets of $k$-tuples. To protect against $k^{\rm th}$-order structural attacks, cover modifications involve the redistribution of $k$-tuples among the different sets so that symmetries of the cover image are broken, then repaired through the act of LSB embedding so that the stego image bears the statistics of the original cover. To protect against all orders up to some order $k$, the statistics of $n$-tuples must be preserved where $n$ is the least common multiple of all orders $\leq k$. We find that this is only feasible for securing against up to $3^{\rm rd}$-order attacks (Sample Pairs and Triples analyses) since higher-order protections result in virtually zero embedding capacities. Securing up to $3^{\rm rd}$-order requires redistribution of sextuplets: rather than perform these $6^{\rm th}$-order cover modifications, which result in tiny embedding capacities, we reduce the problem to the redistribution of triplets in a manner that also preserves the statistics of pairs. This is done by embedding into only certain pixels of each sextuplet, constraining the maximum embedding rate to be $\leq 2/3$ bits per channel. Testing on a variety of image formats, we report best performance for JPEG-compressed images with a mean maximum embedding rate undetectable by $2^{\rm nd}$- and $3^{\rm rd}$-order attacks of 0.21 bits per channel.

cs.CR↗

arXiv2021

Role-based lateral movement detection with unsupervised learning

Adversarial lateral movement via compromised accounts remains difficult to discover via traditional rule-based defenses because it generally lacks explicit indicators of compromise. We propose a behavior-based, unsupervised framework comprising two methods of lateral movement detection on enterprise networks: one aimed at generic lateral movement via either exploit or authenticated connections, and one targeting the specific techniques of process injection and hijacking. The first method is based on the premise that the role of a system---the functions it performs on the network---determines the roles of the systems it should make connections with. The adversary meanwhile might move between any systems whatever, possibly seeking out systems with unusual roles that facilitate certain accesses. We use unsupervised learning to cluster systems according to role and identify connections to systems with novel roles as potentially malicious. The second method is based on the premise that the temporal patterns of inter-system processes that facilitate these connections depend on the roles of the systems involved. If a process is compromised by an attacker, these normal patterns might be disrupted in discernible ways. We apply frequent-itemset mining to process sequences to establish regular patterns of communication between systems based on role, and identify rare process sequences as signalling potentially malicious connections.

cs.CR↗

arXiv2020

Detecting malicious logins as graph anomalies

Authenticated lateral movement via compromised accounts is a common adversarial maneuver that is challenging to discover with signature- or rules-based intrusion detection systems. In this work a behavior-based approach to detecting malicious logins to novel systems indicative of lateral movement is presented, in which a user's historical login activity is used to build a model of putative "normal" behavior. This historical login activity is represented as a collection of daily login graphs, which encode authentications among accessed systems. Each system, or graph vertex, is described by a set of graph centrality measures that characterize it and the local topology of its login graph. The unsupervised technique of non-negative matrix factorization is then applied to this set of features to assign each vertex to a role that summarizes how the system participates in logins. The reconstruction error quantifying how well each vertex fits into its role is then computed, and the statistics of this error can be used to identify outlier vertices that correspond to systems involved in unusual logins. We test this technique with a small cohort of privileged accounts using real login data from an operational enterprise network. The ability of the method to identify malicious logins among normal activity is tested with simulated graphs of login activity representative of adversarial lateral movement. We find that the method is generally successful at detecting a broad range of lateral movement for each user, with false positive rates significantly lower than those resulting from alerts based solely on login novelty.

cs.CR↗

arXiv2019

Malicious Overtones: hunting data theft in the frequency domain with one-class learning

A method for detecting electronic data theft from computer networks is described, capable of recognizing patterns of remote exfiltration occurring over days to weeks. Normal traffic flow data, in the form of a host's ingress and egress bytes over time, is used to train an ensemble of one-class learners. The detection ensemble is modular, with individual classifiers trained on different traffic features thought to characterize malicious data transfers. We select features that model the egress to ingress byte balance over time, periodicity, short time-scale irregularity, and density of the traffic. The features are most efficiently modeled in the frequency domain, which has the added benefit that variable duration flows are transformed to a fixed-size feature vector, and by sampling the frequency space appropriately, long-duration flows can be tested. When trained on days- or weeks-worth of traffic from individual hosts, our ensemble achieves a low false positive rate (<2%) on a range of different system types. Simulated exfiltration samples with a variety of different timing and data characteristics were generated and used to test ensemble performance on different kinds of systems: when trained on a client workstation's external traffic, the ensemble was generally successful at detecting exfiltration that is not simultaneously ingress-heavy, connection-sparse, and of short duration---a combination that is not optimal for attackers seeking to transfer large amounts of data. Remote exfiltration is more difficult to detect from egress-heavy systems, like web servers, with normal traffic exhibiting timing characteristics similar to a wide range of exfiltration types.

cs.CR↗

arXiv2019

The epidemiology of lateral movement: exposures and countermeasures with network contagion models

An approach is developed for analyzing computer networks to identify systems and accounts that are at particular risk of compromise by an adversary seeking to move laterally through the network via authentication. The dynamics of the adversary are modeled as a contagion spreading across systems linked via authentication relationships derived from Administrator account access and active session data. The adversary is assumed to traverse the network via credential chaining, where the adversary steals credentials from one system, uses them to authenticate to another, and repeats the process. Graph topology measures are used to analyze different contagion models applied to a real Windows network for three primary exposures by identifying: accounts which, either individually or collectively, provide wide and far-reaching access to many systems across the network; accounts with notable privilege escalation liability; and "gatekeeper" systems through which the adversary must pass in order to reach critical assets. The approach can be used to test how different mitigations and countermeasures affect these exposures; for example, we find that disabling remote logins by local accounts and implementing protections that prevent the caching of credentials on remote hosts can substantially curtail lateral movement and privilege escalation.

cs.CR↗

arXiv2013

The Degeneracy Problem in Non-Canonical Inflation

While attempting to connect inflationary theories to observational physics, a potential difficulty is the degeneracy problem: a single set of observables maps to a range of different inflaton potentials. Two important classes of models affected by the degeneracy problem are canonical and non-canonical models, the latter marked by the presence of a non-standard kinetic term that generates observables beyond the scalar and tensor two-point functions on CMB scales. The degeneracy problem is manifest when these distinguishing observables go undetected. We quantify the size of the resulting degeneracy in this case by studying the most well-motivated non-canonical theory having Dirac-Born-Infeld Lagrangian. Beyond the scalar and tensor two-point functions on CMB scales, we then consider the possible detection of equilateral non-Gaussianity at Planck-precision and a measurement of primordial gravitational waves from prospective space-based laser interferometers. The former detection breaks the degeneracy with canonical inflation but results in poor reconstruction prospects, while the latter measurement enables a determination of $n_T$ which, while not breaking the degeneracy, can be shown to greatly improve the non-canonical reconstruction.

astro-ph.CO↗

arXiv2012

Scalar runnings and a test of slow roll from CMB distortions

A future measurement of cosmic microwave μ-distortions by an experiment with the specifications of PIXIE will provide an equivalent 3-sigma detection of the running of running of the spectral index of scalar perturbations, β= dα/dln(k), if μ> 7.75 E-8, covering much of the PIXIE sensitivity range. This corresponds to a resolution limit of β> 0.015 which is relatively large given any presumption of slow roll, a result of the current tight constraints on α< 0 on CMB scales. We show that a detection of βat this level is in conflict with slow roll conditions if the primordial signal can be distinguished from any post-inflationary contamination.

astro-ph.CO↗

arXiv2011

Tensor Tilt from Primordial B-modes

A primordial cosmic microwave background B-mode is widely considered a "smoking gun" signature of an early period of inflationary expansion. However, competing theories of the origin of structure, including string gases and bouncing cosmologies, also produce primordial tensor perturbations that give rise to a B-mode. These models can be differentiated by the scale dependence of their tensor spectra: inflation predicts a red tilt ($n_T<0$), string gases and loop quantum cosmology predict a blue tilt ($n_T>0$), while a nonsingular matter bounce gives zero tilt ($n_T=0$). We perform a Bayesian analysis to determine how far $|n_T|$ must deviate from zero before a tilt can be detected with current and future B-mode experiments. We find that Planck in conjunction with QUIET (II) will decisively detect $n_T \neq 0$ if $|n_T| > 0.3$, too large to distinguish either single field inflation or string gases from the case $n_T=0$. While a future mission like CMBPol will offer improvement, only an ideal satellite mission will be capable of providing sufficient Bayesian evidence to distinguish between each model considered.

astro-ph.CO↗

arXiv2011

Identifying the inflaton with primordial gravitational waves

We explore the ability of experimental physics to uncover the underlying structure of the gravitational Lagrangian describing inflation. While the observable degeneracy of the inflationary parameter space is large, future measurements of observables beyond the adiabatic and tensor two-point functions, such as non-Gaussianity or isocurvature modes, might reduce this degeneracy. We show that even in the absence of such observables, the range of possible inflaton potentials can be reduced with a precision measurement of the tensor spectral index, as might be possible with a direct detection of primordial gravitational waves.

astro-ph.CO↗

arXiv2010

Optimizing future experimental probes of inflation

The discovery of many novel realizations of the inflationary universe paradigm has led to a degeneracy problem: many different inflationary Lagrangians generate the same perturbation spectra. Resolving this problem requires the future discovery of additional observables, beyond the scalar adiabatic and tensor two-point functions on CMB scales. One important source of degeneracy arises in models where the density perturbation is generated by a non-inflationary degree of freedom, for example, through curvatons or modulated reheating. We consider the curvaton scenario as representative of this class, and analyze the degeneracy with single field, canonical inflation that results if the curvaton goes undetected by future observations. We perform Monte Carlo potential reconstructions in the absence of distinguishing observables, such as non-Gaussiantities or isocurvature modes. The resulting degeneracy is considerable and the improved measurements of spectral parameters from future probes like CMBPol, offer little to better the situation. Given a degeneracy-breaking observation, the observables must still be inverted to obtain the inflationary potential, with different observations resulting in reconstructions of varying quality. We find that a future detection of isocurvature modes or a precision measurement of the tensor spectral index will enable the most successful reconstructions in the presence of curvatons.

astro-ph.CO↗

arXiv2010

Observational Signatures of Gravitational Couplings in DBI Inflation

In scalar-tensor theories the scalar fields generically couple nontrivially to gravity. We study the observable properties of inflationary models with non-minimally coupled inflaton and Dirac-Born-Infeld (DBI) kinetic term. Within the assumptions of the priors of our Monte-Carlo simulations we find these models can generate new interesting observable signatures. Our discussion focuses on string theory inspired phenomenological models of relativistic D-brane inflation. While successful string theory constructions of ultra-violet DBI brane inflation remain elusive, we show that in suitable regions of the parameter space it is possible to use cosmological observables to probe the non-minimial coupling. Fortunately, the most observationally promising range of parameters include models yielding intermediate levels of non-gaussianity in the range consistent with WMAP 5-year data, and to be constrained further by the Planck satellite.

astro-ph.CO↗

arXiv2009

Cosmological Constraints on Rapid Roll Inflation

We obtain cosmological constraints on models of inflation which exhibit rapid roll solutions. Rapid roll attractors exist for potentials with large mass terms and are thus of interest for inflationary model building within string theory. We constrain a general ansatz for the power spectrum arising from rapid roll inflation that, in the small field limit, can be associated with tree level hybrid potentials with variable mass terms and nonminimal gravitational coupling $ξRϕ^2$. We consider perturbations generated through modulated reheating and/or curvaton mechanisms in place of the observationally unacceptable primary spectra generated by inflaton fluctuations in these models. The lack of a hierarchy amongst higher-order $k$-dependencies of the power spectrum results in models with potentially large runnings, allowing us to impose tight constraints on such models using CMB and LSS data. In particular, we find $n_s <1$ and $|α| < 0.01$. We conclude with a concrete realization of rapid roll inflation within warped throat brane inflation that is in good agreement with current data.

astro-ph.CO↗

arXiv2009

Tensors, non-Gaussianities, and the future of potential reconstruction

We present projections for reconstruction of the inflationary potential expected from ESA's upcoming Planck Surveyor CMB mission. We focus on the effects that tensor perturbations and the presence of non-Gaussianities have on reconstruction efforts in the context of non-canonical inflation models. We consider potential constraints for different combinations of detection/null-detection of tensors and non-Gaussianities. We perform Markov Chain Monte Carlo and flow analyses on a simulated Planck-precision data set to obtain constraints. We find that a failure to detect non-Gaussianities precludes a successful inversion of the primordial power spectrum, greatly affecting uncertainties, even in the presence of a tensor detection. In the absence of a tensor detection, while unable to determine the energy scale of inflation, an observable level of non-Gaussianities provides correlations between the errors of the potential parameters, suggesting that constraints might be improved for suitable combinations of parameters. Constraints are optimized for a positive detection of both tensors and non-Gaussianities.

astro-ph↗

arXiv2007

Limits on primordial power spectrum resolution: An inflationary flow analysis

We investigate the ability of current CMB data to reliably constrain the form of the primordial power spectrum generated during inflation. We attempt to identify more exotic power spectra that yield equally good fits to the data as simple power-law spectra. In order to test a wide variety of spectral shapes, we combine the flow formalism, which is a method of stochastic model generation, with a numerical integration of the mode equations of quantum fluctuations. This allows us to handle inflation models that yield spectra that are not well described by the standard spectral parameterization. Using the latest WMAP data-set, we find a high degree of variation in possible spectral shapes. In particular, we find strongly running spectra arising from fast-rolling inflaton fields providing equally good fits to the data as power-law spectra arising from slowly-rolling fields. Current data poorly constrains the spectrum on scales (k < 0.01 h{\rm Mpc}^{-1}), where the error due to cosmic variance is large. Among the statistically degenerate models, we identify spectra with strong running on these larger scales, but with reduced running at smaller scales. These models predict values for the tensor-to-scalar ratio, (r), that lie outside the 2-(σ) confidence interval obtained from SDSS+WMAP data for spectra that are parametrized as power-laws or spectra with constant running. By considering more generalized power spectra, we therefore open up regions of parameter space excluded for simpler models.

astro-ph↗

arXiv2007

The pre-inflationary vacuum in the cosmic microwave background

We consider the effects on the primordial power spectrum of a period of radiation-dominated expansion prior to the inflationary era. If inflation lasts a total of only 60 e-folds or so, the boundary condition for quantum modes cannot be taken in the short-wavelength limit as in the standard perturbation calculation. Instead, the boundary condition is set by the vacuum state of the prior radiation-dominated epoch, which only corresponds to the inflationary vacuum state in the ultraviolet limit. This altered vacuum state results in a modulation of the inflationary power spectrum. We calculate the modification to a best-fit model from the WMAP3 data set, and find that power is suppressed at large scales. The modified power spectrum is favored only very weakly by the data.

astro-ph↗

arXiv2007

Photometric Decomposition of Barred Galaxies

We present a non-parametric method for decomposition of the light of disk galaxies into disk, bulge and bar components. We have developed and tested the method on a sample of 68 disk galaxies for which we have acquired I-band photometry. The separation of disk and bar light relies on the single assumption that the bar is a straight feature with a different ellipticity and position angle from that of the projected disk. We here present the basic method, but recognise that it can be significantly refined. We identify bars in only 47% of the more nearly face-on galaxies in our sample. The fraction of light in the bar has a broad range from 1.3% to 40% of the total galaxy light. If low-luminosity galaxies have more dominant halos, and if halos contribute to bar stability, the luminosity functions of barred and unbarred galaxies should differ markedly; while our sample is small, we find only a slight difference of low significance.

astro-ph↗

arXiv2006

The Lyth Bound and the End of Inflation

We derive an extended version of the well-known Lyth Bound on the total variation of the inflaton field, incorporating higher order corrections in slow roll. We connect the field variation $Δϕ$ to both the spectral index of scalar perturbations and the amplitude of tensor modes. We then investigate the implications of this bound for ``small field'' potentials, where the field rolls off a local maximum of the potential. The total field variation during inflation is {\em generically} of order $m_{\rm Pl}$, even for potentials with a suppressed tensor/scalar ratio. Much of the total field excursion arises in the last e-fold of inflation and in single field models this problem can only be avoided via fine-tuning or the imposition of a symmetry. Finally, we discuss the implications of this result for inflationary model building in string theory and supergravity.

astro-ph↗