7 WG 6 - HCI and Cognitive Modelling

firewalls are not appropriate for ad hoc networks), IDS can help to monitor and analyze the traffic in UbiComp applications based on sensor networks. The analysis of audit data for the construction of intrusion detection models can be based on Data Mining algorithms which return frequent activity patterns. However, sensor networks pose new challenging requirements to DM methods, since the solution should be fully distributed and inexpensive in terms of communication, energy, and memory requirements. In addition, the networked nature of sensor networks allows new, automated defenses against DoS attacks. Some Interactive attacks, that is, the misuse of the UbiComp systems augmented facilities for responding to or receiving environmental signals, can be considered as a form of availability attacks specific of UbiComp applications. Indeed, when an interactive attack occurs, the UbiComp system might simply not properly react to some environmental signals because it is too busy to process other requests or because its reaction do not reach the environmental context. For instance, a wireless-equipped car whose processor is flooded of requests from a malicious node of an ad hoc network, will not be able to timely react to environmental signals that indicate a hazardous situation. Once again, it is important to develop the appropriate DM methods for the analysis of the stream of requests in order to identify possible misuse of the UbiComp systems augmented facilities. Since reaction time is a critical factor, the efficiency of the DM method should be considered a fundamental requirement when detecting interactive attacks. Real-time data mining can become a new active research area, where efforts on distributed data mining, knowledge discovery from data streams and on-line learning algorithms do synergistically meet.