Query: SAD: web session anomaly detection based on parameter estimation

Relevant passages:
Service specific anomaly detection for network intrusion detection <=SEP=> The constant increase of attacks against networks and their resources (as recently shown by the CodeRed worm) causes a necessity to protect these valuable assets. Firewalls are now a common installation to repel intrusion attempts in the first place. Intrusion detection systems (IDS), which try to detect malicious activities instead of preventing them, offer additional protection when the first defense perimeter has been penetrated. ID systems attempt to pin down attacks by comparing collected data to predefined signatures known to be malicious (signature based) or to a model of legal behavior (anomaly based).Anomaly based systems have the advantage of being able to detect previously unknown attacks but they suffer from the difficulty to build a solid model of acceptable behavior and the high number of alarms caused by unusual but authorized activities. We present an approach that utilizes application specific knowledge of the network services that should be protected. This information helps to extend current, simple network traffic models to form an application model that allows to detect malicious content hidden in single network packets. We describe the features of our proposed model and present experimental data that underlines the efficiency of our systems.

An Achilles Heel in Signature-Based IDS : Squealing False Positives in SNORT <=SEP=> We report a vulnerability to network signature-based IDS which we have tested using Snort and we call “Squealing”. This vulnerability has significant implications since it can easily be generalized to any IDS. The vulnerability of signature-based IDS to high false positive rates has been welldocumented but we go further to show (at a high level) how packets can be crafted to match attack signatures such that a alarms on a target IDS can be conditioned or disabled and then exploited. This is the first academic treatment of this vulnerability that has already been reported to the CERT Coordination Center and the National Infrastructure Protection Center. Independently, other tools based on “squealing” are poised to appear that, while validating our ideas, also gives cause for concern. keywords: squealing, false positive, intrusion detection, IDS, signature-based, misuse behavior, network intrusion detection, snort

Snort: Lightweight Intrusion Detection for Networks <=SEP=> Network intrusion detection systems (NIDS) are an important part of any network security architecture. They provide a layer of defense which monitors network traffic for predefined suspicious activity or patterns, and alert system administrators when potential hostile traffic is detected. Commercial NIDS have many differences, but Information Systems departments must face the commonalities that they share such as significant system footprint, complex deployment and high monetary cost. Snort was designed to address these issues.

Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation <=SEP=> A intrusion detection evaluation test bed was developed which generated normal traffic similar to that on a government site containing 100’s of users on 1000’s of hosts. More than 300 instances of 38 different automated attacks were launched against victim UNIX hosts in seven weeks of training data and two weeks of test data. Six research groups participated in a blind evaluation and results were analyzed for probe, denialof-service (DoS), remote-to-local (R2L), and user to root (U2R) attacks. The best systems detected old attacks included in the training data, at moderate detection rates ranging from 63% to 93% at a false alarm rate of 10 false alarms per day. Detection rates were much worse for new and novel R2L and DoS attacks included only in the test data. The best systems failed to detect roughly half these new attacks which included damaging access to root-level privileges by remote users. These results suggest that further research should focus on developing techniques to find new attacks instead of extending existing rule-based

Data Preparation for Mining World Wide Web Browsing Patterns <=SEP=> The World Wide Web (WWW) continues to grow at an astounding rate in both the sheer volume of traffic and the size and complexity of Web sites. The complexity of tasks such as Web site design, Web server design, and of simply navigating through a Web site have increased along with this growth. An important input to these design tasks is the analysis of how a Web site is being used. Usage analysis includes straightforward statistics, such as page access frequency, as well as more sophisticated forms of analysis, such as finding the common traversal paths through a Web site. Web Usage Mining is the application of data mining techniques to usage logs of large Web data repositories in order to produce results that can be used in the design tasks mentioned above. However, there are several preprocessing tasks that must be performed prior to applying data mining algorithms to the data collected from server logs. This paper presents several data preparation techniques in order to identify unique users and user sessions. Also, a method to divide user sessions into semantically meaningful transactions is defined and successfully tested against two other methods. Transactions identified by the proposed methods are used to discover association rules from real world data using the WEBMINER system [15].

Differentially Private Stochastic Gradient Descent for in-RDBMS Analytics <=SEP=> This paper studies differential privacy for stochastic gradient descent (SGD) in an in-RDBMS system. While significant progress has been made separately on in-RDBMS SGD and private SGD, none of the major in-RDBMS machine learning frameworks have incorporated differentially private SGD. There are two inter-related issues for this disconnect between research and practice: (1) low model accuracy due to added noise to guarantee privacy, and (2) high development and runtime overhead of the private algorithms. This paper takes a first step to remedy this disconnect and proposes a private SGD algorithm to address both issues in an integrated manner. In contrast to the white-box approach adopted by previous algorithms, we revisit and use the classical technique of output perturbation. While using output perturbation trivially addresses (2), it gives rise to challenges in addressing (1). We address this challenge by providing a novel analysis of the L2-sensitivity of SGD, which allows, under the same privacy guarantees, better convergence of SGD when only a constant number of passes can be made over the data. We then integrate this algorithm, along with the state-of-the-art differentially private SGD, into Bismarck, an inRDBMS analytics system. Extensive experiments demonstrate that our algorithm can be easily integrated, incurs virtually no overhead, scales well, and most importantly, for a number of datasets yields substantially better (up to 4X) test accuracy than the state-of-the-art algorithms.

Developing Leadership Character in Business Programs <=SEP=> Our objective is to encourage and enable leadership character development in business education. Building on a model of character strengths and their link to virtues, values, and ethical decision making, we describe an approach to develop leadership character at the individual, group, and organizational levels. We contrast this approach to existing practices that have focused on teaching functional content over character and address how business educators can enable leadership character development through their own behaviors, relationships, and structures. Most important, we provide concrete suggestions on how to integrate a focus on character development into existing business programs, both in terms of individual courses as well as the overall curriculum. We highlight that the development of leadership character must extend beyond student engagement in a course since “it takes a village” to develop character. ........................................................................................................................................................................

Learning continuous grasp stability for a humanoid robot hand based on tactile sensing <=SEP=> Grasp stability estimation with complex robots in environments with uncertainty is a major research challenge. Analytical measures such as force closure based grasp quality metrics are often impractical because tactile sensors are unable to measure contacts accurately enough especially in soft contact cases. Recently, an alternative approach of learning the stability based on examples has been proposed. Current approaches of stability learning analyze the tactile sensor readings only at the end of the grasp attempt, which makes them somewhat time consuming, because the grasp can be stable already earlier. In this paper, we propose an approach for grasp stability learning, which estimates the stability continuously during the grasp attempt. The approach is based on temporal filtering of a support vector machine classifier output. Experimental evaluation is performed on an anthropomorphic ARMAR-IIIb. The results demonstrate that the continuous estimation provides equal performance to the earlier approaches while reducing the time to reach a stable grasp significantly. Moreover, the results demonstrate for the first time that the learning based stability estimation can be used with a flexible, pneumatically actuated hand, in contrast to the rigid hands used in earlier works.

Approximating displacement with the body velocity integral <=SEP=> In this paper, we present a technique for approximating the net displacement of a locomoting system over a gait without directly integrating its equations of motion. The approximation is based on a volume integral, which, among other benefits, is more open to optimization by algorithm or inspection than is the full displacement integral. Specifically, we develop the concept of a body velocity integral (BVI), which is computable over a gait as a volume integral via Stokes’s theorem. We then demonstrate that, given an appropriate choice of coordinates, the BVI for a gait approximates the displacement of the system over that gait. This consideration of coordinate choice is a new approach to locomotion problems, and provides significantly improved results over past attempts to apply Stokes’s theorem to gait analysis.

On Selecting the Largest Element in Spite of Erroneous Information <=SEP=> 

Octree-based decimation of marching cubes surfaces <=SEP=> The marching cubes (MC) algorithm is a method for generating isosurfaces. It also generates an excessively large number of triangles to represent an isosurface; this increases the rendering time. This paper presents a decimation method to reduce the number of triangles generated. Decimation is carried out before creating a large number of triangles. Four major steps comprise the algorithm: surface tracking, merging, crack patching and triangulation. Surface tracking is an enhanced implementation of the MC algorithm. Starting from a seed point, the surface tracker visits only those cells likely to compose part of the desired isosurface. The cells making up the extracted surface are stored in an octree that is further processed. A bottom-up approach is taken in merging the cells containing a relatively flat approximating surface. The finer surface details are maintained. Cells are merged as long as the error due to such an operation is within a user-specified error parameter, or a cell acquires more than one connected surface component in it. A crack patching method is described that forces edges of smaller cells to lie along those of the larger neighboring cells. The overall saving in the number of triangles depends both on the specified error value and the nature of the data. Use of the hierarchical octree data structure also presents the potential of incremental representation of surfaces. We can generate a highly smoothed surface representation which can be progressively refined as the user-specified error value is decreased.

An ensemble classifier with random projection for predicting multi-label protein subcellular localization <=SEP=> In protein subcellular localization prediction, a predominant scenario is that the number of available features is much larger than the number of data samples. Among the large number of features, many of them may contain redundant or irrelevant information, causing the prediction systems suffer from overfitting. To address this problem, this paper proposes a dimensionality-reduction method that applies random projection (RP) to construct an ensemble multi-label classifier for predicting protein subcellular localization. Specifically, the frequencies of occurrences of gene-ontology terms are used as feature vectors, which are projected onto lower-dimensional spaces by random projection matrices whose elements conform to a distribution with zero mean and unit variance. The transformed low-dimensional vectors are classified by an ensemble of one-vs-rest multi-label support vector machine (SVM) classifiers, each corresponding to one of the RP matrices. The scores obtained from the ensemble are then fused for making the final decision. Experimental results on two recent datasets suggest that the proposed method can reduce the dimensions by six folds and remarkably improve the classification performance.

Talking to machines (statistically speaking) <=SEP=> Statistical methods have long been the dominant approach in speech recognition and probabilistic modelling in ASR is now a mature technology. The use of statistical methods in other areas of spoken dialogue is however more recent and rather less mature. This paper reviews spoken dialogue systems from a statistical modelling perspective. The complete system is first presented as a partially observable Markov decision process. The various sub-components are then exposed by introducing appropriate intermediate variables. Samples of existing work are reviewed within this framework, including dialogue control and optimisation, semantic interpretation, goal detection, natural language generation and synthesis.

Mobile ECG measurement and analysis system using mobile phone as the base station <=SEP=> In this paper, we introduce an ECG measurement, analysis and transmission system which uses a mobile phone as a base station. The system is based on a small-sized mobile ECG recording device which sends measurement data wirelessly to the mobile phone. In the mobile phone the received data is analyzed and if abnormalities are found part of the measurement data is sent to a server for the use of medical personnel. The prototype of the system was made with a portable ECG monitor and Nokia 6681 mobile phone. The results show that modern smart phones are indeed capable for this kind of tasks. Thus, with their good networking and data processing capabilities, they are a potential part of the future wireless health care systems.

STANDARDISATION AND CLASSIFICATION OF ALERTS GENERATED BY INTRUSION DETECTION SYSTEMS <=SEP=> Intrusion detection systems are most popular de-fence mechanisms used to provide security to IT infrastructures. Organisation need best performance, so it uses multiple IDSs from different vendors. Different vendors are using different formats and protocols. Difficulty imposed by this is the generation of several false alarms. Major part of this work concentrates on the collection of alerts from different intrusion detection systems to represent them in IDMEF(Intrusion Detection Message Exchange Format) format. Alerts were collected from intrusion detection systems like snort, ossec, suricata etc. Later classification is attempted using machine learning technique, which helps to mitigate generation of false positives.

3D Surface Reconstruction of Noisy Point Clouds Using Growing Neural Gas: 3D Object/Scene Reconstruction <=SEP=> With the advent of low-cost 3D sensors and 3D printers, scene and object 3D surface reconstruction has become an important research topic in the last years. In this work, we propose an automatic (unsupervised) method for 3D surface reconstruction from raw unorganized point clouds acquired using low-cost 3D sensors. We have modified the growing neural gas network, which is a suitable model because of its flexibility, rapid adaptation and excellent quality of representation, to perform 3D surface reconstruction of different real-world objects and scenes. Some improvements have been made on the original algorithm considering colour and surface normal information of input data during the learning stage and creating complete triangular meshes instead of basic wire-frame representations. The proposed method is able to successfully create 3D faces online, whereas existing 3D reconstruction methods based on self-organizing maps required post-processing steps to close gaps and holes produced during the 3D reconstruction process. A set of quantitative and qualitative experiments were carried out to validate the proposed method. The method has been implemented and tested on real data, and has been found to be effective at reconstructing noisy point clouds obtained using low-cost 3D sensors.

Advanced PROPHET Routing in Delay Tolerant Network <=SEP=> To solve routing jitter problem in PROPHET in delay tolerant network, advanced PROPHET routing is proposed in this paper. Average delivery predictabilities are used in advanced PROPHET to avoid routing jitter. Furthermore, we evaluate it through simulations versus PROPHET routing protocol. The experimental results show there has higher average delivery rates and shorter average delays in advanced PROPHET. Thus, it is fair to say that advanced PROPHET gives better performance than PROPHET.

Error control and concealment for video communication: a review <=SEP=> The problem of error control and concealment in video communication is becoming increasingly important because of the growing interest in video delivery over unreliable channels such as wireless networks and the Internet. This paper reviews the techniques that have been developed for error control and concealment in the past ten to fifteen years. These techniques are described in three categories according to the roles that the encoder and decoder play in the underlying approaches. Forward error concealment includes methods that add redundancy at the source end to enhance error resilience of the coded bit streams. Error concealment by postprocessing refers to operations at the decoder to recover the damaged areas based on characteristics of image and video signals. Finally, interactive error concealment covers techniques that are dependent on a dialog between the source and destination. Both current research activities and practice in international standards are covered.

Regenerative braking strategy for electric vehicles <=SEP=> Regenerative braking is an effective approach for electric vehicles to extend their driving range. The control strategy of regenerative braking plays an important role in maintaining the vehicle's stability and recovering energy. In this paper, the main properties that have influence on brake energy regeneration are analyzed. Mathematical model of brake energy regenerating electric vehicles is established. By analyzing the charge and discharge characteristics of the battery and motor, a simple regenerative braking strategy is proposed. The strategy takes the braking torque required, the motor available braking torque, and the braking torque limit into account, and it can make the best use of the motor braking torque. Simulation results show higher energy regeneration compared to a parallel strategy when the proposed strategy is adopted.

Periodically Controlled Hybrid Systems Verifying A Controller for An Autonomous Vehicle <=SEP=> This paper introduces Periodically Controlled Hybrid Automata (PCHA) for describing a class of hybrid control systems. In a PCHA, control actions occur roughly periodically while internal and input actions, may occur in the interim changing the discrete-state or the setpoint. Based on periodicity and subtangential conditions, a new sufficient condition for verifying invariance of PCHAs is presented. This technique is used in verifying safety of the planner-controller subsystem of an autonomous ground vehicle, and in deriving geometric properties of planner generated paths that can be followed safely by the controller under environmental uncertainties.

Evaluation Metrics for Machine Reading Comprehension: Prerequisite Skills and Readability <=SEP=> Knowing the quality of reading comprehension (RC) datasets is important for the development of natural-language understanding systems. In this study, two classes of metrics were adopted for evaluating RC datasets: prerequisite skills and readability. We applied these classes to six existing datasets, including MCTest and SQuAD, and highlighted the characteristics of the datasets according to each metric and the correlation between the two classes. Our dataset analysis suggests that the readability of RC datasets does not directly affect the question difficulty and that it is possible to create an RC dataset that is easy to read but difficult to answer.

Neural Networks for Open Domain Targeted Sentiment <=SEP=> Open domain targeted sentiment is the joint information extraction task that finds target mentions together with the sentiment towards each mention from a text corpus. The task is typically modeled as a sequence labeling problem, and solved using state-of-the-art labelers such as CRF. We empirically study the effect of word embeddings and automatic feature combinations on the task by extending a CRF baseline using neural networks, which have demonstrated large potentials for sentiment analysis. Results show that the neural model can give better results by significantly increasing the recall. In addition, we propose a novel integration of neural and discrete features, which combines their relative advantages, leading to significantly higher results compared to both baselines.

On Throughput Efficiency of Geographic Opportunistic Routing in Multihop Wireless Networks <=SEP=> Geographic opportunistic routing (GOR) is a new routing concept in multihop wireless networks. In stead of picking one node to forward a packet to, GOR forwards a packet to a set of candidate nodes and one node is selected dynamically as the actual forwarder based on the instantaneous wireless channel condition and node position and availability at the time of transmission. GOR takes advantages of the spatial diversity and broadcast nature of wireless communications and is an efficient mechanism to combat the unreliable links. The existing GOR schemes typically involve as many as available next-hop neighbors into the local opportunistic forwarding, and give the nodes closer to the destination higher relay priorities. In this paper, we focus on realizing GOR’s potential in maximizing throughput. We start with an insightful analysis of various factors and their impact on the throughput of GOR, and propose a local metric named expected one-hop throughput (EOT) to balance the tradeoff between the benefit (i.e., packet advancement and transmission reliability) and the cost (i.e., medium time delay). We identify an upper bound of EOT and proof its concavity. Based on the EOT, we also propose a local candidate selection and prioritization algorithm. Simulation results validate our analysis and show that the metric EOT leads to both higher one-hop and path throughput than the corresponding pure GOR and geographic routing.

Estimating types in binaries using predictive modeling <=SEP=> Reverse engineering is an important tool in mitigating vulnerabilities in binaries. As a lot of software is developed in object-oriented languages, reverse engineering of object-oriented code is of critical importance. One of the major hurdles in reverse engineering binaries compiled from object-oriented code is the use of dynamic dispatch. In the absence of debug information, any dynamic dispatch may seem to jump to many possible targets, posing a significant challenge to a reverse engineer trying to track the program flow. We present a novel technique that allows us to statically determine the likely targets of virtual function calls. Our technique uses object tracelets – statically constructed sequences of operations performed on an object – to capture potential runtime behaviors of the object. Our analysis automatically pre-labels some of the object tracelets by relying on instances where the type of an object is known. The resulting type-labeled tracelets are then used to train a statistical language model (SLM) for each type.We then use the resulting ensemble of SLMs over unlabeled tracelets to generate a ranking of their most likely types, from which we deduce the likely targets of dynamic dispatches.We have implemented our technique and evaluated it over real-world C++ binaries. Our evaluation shows that when there are multiple alternative targets, our approach can drastically reduce the number of targets that have to be considered by a reverse engineer.

Competing Values in the Era of Digitalization <=SEP=> This case study examines three different digital innovation projects within Auto Inc -- a large European automaker. By using the competing values framework as a theoretical lens we explore how dynamic capabilities occur in a firm trying to meet increasing demands in originating and innovating from digitalization. In this digitalization process, our study indicates that established socio-technical congruences are being challenged. More so, we pinpoint the need for organizations to find ways to embrace new experimental learning processes in the era of digitalization. While such a change requires long-term commitment and vision, this study presents three informal enablers for such experimental processes these enablers are timing, persistence, and contacts.

Deep Emotion: A Computational Model of Emotion Using Deep Neural Networks <=SEP=> Emotions are very important for human intelligence. For example, emotions are closely related to the appraisal of the internal bodily state and external stimuli. This helps us to respond quickly to the environment. Another important perspective in human intelligence is the role of emotions in decision-making. Moreover, the social aspect of emotions is also very important. Therefore, if the mechanism of emotions were elucidated, we could advance toward the essential understanding of our natural intelligence. In this study, a model of emotions is proposed to elucidate the mechanism of emotions through the computational model. Furthermore, from the viewpoint of partner robots, the model of emotions may help us to build robots that can have empathy for humans. To understand and sympathize with people’s feelings, the robots need to have their own emotions. This may allow robots to be accepted in human society. The proposed model is implemented using deep neural networks consisting of three modules, which interact with each other. Simulation results reveal that the proposed model exhibits reasonable behavior as the basic mechanism of emotion.

Comorbidity of DSM-IV pathological gambling and other psychiatric disorders: results from the National Epidemiologic Survey on Alcohol and Related Conditions. <=SEP=> OBJECTIVE
To present nationally representative data on lifetime prevalence and comorbidity of pathological gambling with other psychiatric disorders and to evaluate sex differences in the strength of the comorbid associations.


METHOD
Data were derived from a large national sample of the United States. Some 43,093 household and group quarters residents age 18 years and older participated in the 2001-2002 survey. Prevalence and associations of lifetime pathological gambling and other lifetime psychiatric disorders are presented. The diagnostic interview was the National Institute on Alcohol Abuse and Alcoholism Alcohol Use Disorder and Associated Disabilities Interview Schedule-DSM-IV Version. Fifteen symptom items operationalized the 10 pathological gambling criteria.


RESULTS
The lifetime prevalence rate of pathological gambling was 0.42%. Almost three quarters (73.2%) of pathological gamblers had an alcohol use disorder, 38.1% had a drug use disorder, 60.4% had nicotine dependence, 49.6% had a mood disorder, 41.3% had an anxiety disorder, and 60.8% had a personality disorder. A large majority of the associations between pathological gambling and substance use, mood, anxiety, and personality disorders were overwhelmingly positive and significant (p < .05), even after controlling for sociodemographic and socioeconomic characteristics. Male sex, black race, divorced/separated/widowed marital status, middle age, and living in the West and Midwest were associated with increased risk for pathological gambling. Further, associations between alcohol dependence, any drug use disorder, drug abuse, nicotine dependence, major depressive episode, and generalized anxiety disorder and pathological gambling were stronger among women than men (p > .05).


CONCLUSION
Pathological gambling is highly comorbid with substance use, mood, anxiety, and personality disorders, suggesting that treatment for one condition should involve assessment and possible concomitant treatment for comorbid conditions.

Content-based image retrieval by integrating color and texture features <=SEP=> Content-based image retrieval (CBIR) has been an active research topic in the last decade. Feature extraction and representation is one of the most important issues in the CBIR. In this paper, we propose a content-based image retrieval method based on an efficient integration of color and texture features. As its color features, pseudo-Zernike chromaticity distribution moments in opponent chromaticity space are used. As its texture features, rotation-invariant and scale-invariant image descriptor in steerable pyramid domain are adopted, which offers an efficient and flexible approximation of early processing in the human visual system. The integration of color and texture information provides a robust feature set for color image retrieval. Experimental results show that the proposed method yields higher retrieval accuracy than some conventional methods even though its feature vector dimension is not higher than those of the latter for different test DBs.

VARIATIONAL RECURRENT ADVERSARIAL DEEP DOMAIN ADAPTATION <=SEP=> We study the problem of learning domain invariant representations for time series data while transferring the complex temporal latent dependencies between domains. Our model termed as Variational Recurrent Adversarial Deep Domain Adaptation (VRADA) is built atop a variational recurrent neural network (VRNN) and trains adversarially to capture complex temporal relationships that are domain-invariant. This is (as far as we know) the first to capture and transfer temporal latent dependencies of multivariate time-series data. Through experiments on real-world multivariate healthcare time-series datasets, we empirically demonstrate that learning temporal dependencies helps our model’s ability to create domain-invariant representations, allowing our model to outperform current state-of-the-art deep domain adaptation approaches.

Rfam 12.0: updates to the RNA families database <=SEP=> The Rfam database (available at http://rfam.xfam.org) is a collection of non-coding RNA families represented by manually curated sequence alignments, consensus secondary structures and annotation gathered from corresponding Wikipedia, taxonomy and ontology resources. In this article, we detail updates and improvements to the Rfam data and website for the Rfam 12.0 release. We describe the upgrade of our search pipeline to use Infernal 1.1 and demonstrate its improved homology detection ability by comparison with the previous version. The new pipeline is easier for users to apply to their own data sets, and we illustrate its ability to annotate RNAs in genomic and metagenomic data sets of various sizes. Rfam has been expanded to include 260 new families, including the well-studied large subunit ribosomal RNA family, and for the first time includes information on short sequence- and structure-based RNA motifs present within families.