Query: 7 Key Challenges for Visualization in Cyber Network Defense

Relevant passages:
Visualizing cyber security: Usable workspaces <=SEP=> The goal of cyber security visualization is to help analysts increase the safety and soundness of our digital infrastructures by providing effective tools and workspaces. Visualization researchers must make visual tools more usable and compelling than the text-based tools that currently dominate cyber analysts' tool chests. A cyber analytics work environment should enable multiple, simultaneous investigations and information foraging, as well as provide a solution space for organizing data. We describe our study of cyber-security professionals and visualizations in a large, high-resolution display work environment and the analytic tasks this environment can support. We articulate a set of design principles for usable cyber analytic workspaces that our studies have brought to light. Finally, we present prototypes designed to meet our guidelines and a usability evaluation of the environment.

Visual Analytics: Scope and Challenges <=SEP=> In today’s applications data is produced at unprecedented rates. While the capacity to collect and store new data rapidly grows, the ability to analyze these data volumes increases at much lower rates. This gap leads to new challenges in the analysis process, since analysts, decision makers, engineers, or emergency response teams depend on information hidden in the data. The emerging field of visual analytics focuses on handling these massive, heterogenous, and dynamic volumes of information by integrating human judgement by means of visual representations and interaction techniques in the analysis process. Furthermore, it is the combination of related research areas including visualization, data mining, and statistics that turns visual analytics into a promising field of research. This paper aims at providing an overview of visual analytics, its scope and concepts, addresses the most important research challenges and presents use cases from a wide variety of application scenarios.

The Eyes Have It: A Task by Data Type Taxonomy for Information Visualizations <=SEP=> A useful starting point for designing advanced graphical user interfaces is the Visual InformationSeeking Mantra: Overview first, zoom and filter, then details-on-demand. But this is only a starting point in trying to understand the rich and varied set of information visualizations that have been proposed in recent years. This paper offers a task by data type taxonomy with seven data types (1-, 2-, 3-dimensional data, temporal and multi-dimensional data, and tree and network data) and seven tasks (overview, zoom, filter, details-on-demand, relate, history, and extract).

The base-rate fallacy and the difficulty of intrusion detection <=SEP=> Many different demands can be made of intrusion detection systems. An important requirement is that an intrusion detection system be effective; that is, it should detect a substantial percentage of intrusions into the supervised system, while still keeping the false alarm rate at an acceptable level. This article demonstrates that, for a reasonable set of assumptions, the false alarm rate is the limiting factor for the performance of an intrusion detection system. This is due to the base-rate fallacy phenomenon, that in order to achieve substantial values of the Bayesian detection rate P(Intrusion***Alarm), we have to achieve a (perhaps in some cases unattainably) low false alarm rate. A selection of reports of intrusion detection performance are reviewed, and the conclusion is reached that there are indications that at least some types of intrusion detection have far to go before they can attain such low false alarm rates.

Generalized fisheye views <=SEP=> In many contexts, humans often represent their own “neighborhood” in great detail, yet only major landmarks further away. This suggests that such views (“fisheye views”) might be useful for the computer display of large information structures like programs, data bases, online text, etc. This paper explores fisheye views presenting, in turn, naturalistic studies, a general formalism, a specific instantiation, a resulting computer program, example displays and an evaluation.

Automatic Root Cause Analysis for LTE Networks Based on Unsupervised Techniques <=SEP=> The increase in the size and complexity of current cellular networks is complicating their operation and maintenance tasks. While the end-to-end user experience in terms of throughput and latency has been significantly improved, cellular networks have also become more prone to failures. In this context, mobile operators start to concentrate their efforts on creating self-healing networks, i.e., those networks capable of troubleshooting in an automatic way, making the network more reliable and reducing costs. In this paper, an automatic diagnosis system based on unsupervised techniques for Long-Term Evolution (LTE) networks is proposed. In particular, this system is built through an iterative process, using self-organizing maps (SOMs) and Ward's hierarchical method, to guarantee the quality of the solution. Furthermore, to obtain a number of relevant clusters and label them properly from a technical point of view, an approach based on the analysis of the statistical behavior of each cluster is proposed. Moreover, with the aim of increasing the accuracy of the system, a novel adjustment process is presented. It intends to refine the diagnosis solution provided by the traditional SOM according to the so-called silhouette index and the most similar cause on the basis of the minimum Xth percentile of all distances. The effectiveness of the developed diagnosis system is validated using real and simulated LTE data by analyzing its performance and comparing it with reference mechanisms.

A journey to highly dynamic, self-adaptive service-based applications <=SEP=> Future software systems will operate in a highly dynamic world. Systems will need to operate correctly despite of unespected changes in factors such as environmental conditions, user requirements, technology, legal regulations, and market opportunities. They will have to operate in a constantly evolving environment that includes people, content, electronic devices, and legacy systems. They will thus need the ability to continuously adapt themselves in an automated manner to react to those changes. To realize dynamic, self-adaptive systems, the service concept has emerged as a suitable abstraction mechanism. Together with the concept of the service-oriented architecture (SOA), this led to the development of technologies, standards, and methods to build service-based applications by flexibly aggregating individual services. This article discusses how those concepts came to be by taking two complementary viewpoints. On the one hand, it evaluates the progress in software technologies and methodologies that led to the service concept and SOA. On the other hand, it discusses how the evolution of the requirements, and in particular business goals, influenced the progress towards highly dynamic self-adaptive systems. Finally, based on a discussion of the current state of the art, this article points out the possible future evolution of the field.

An Efficient Synchronization Mechanism for Mirrored Game Architectures <=SEP=> Existing online multiplayer games typically use a client-server model, which introduces added latency as well as a single bottleneck and single point of failure to the game. Distributed multiplayer games minimize latency and remove the bottleneck, but require special synchronization mechanisms to provide a consistent game for all players. Current synchronization methods have been borrowed from distributed military simulations and are not optimized for the requirements of fast-paced multiplayer games. In this paper we present a new synchronization mechanism, trailing state synchronization (TSS), which is designed around the requirements of distributed first-person shooter games. We look at TSS in the environment of a mirrored game architecture, which is a hybrid between traditional centralized architectures and the more scalable peer-to-peer architectures. Mirrored architectures allow for improved performance compared to client-server architectures while at the same time allowing for a greater degree of centralized administration than peer-to-peer architectures. We evaluate the performance of TSS and other synchronization methods through simulation and examine heuristics for selecting the synchronization delays needed for TSS.

Algorithmic Design of Low-Power Variable-Stiffness Mechanisms <=SEP=> Compliant actuators enabling low-power stiffness adaptation are missing ingredients and key enablers of next generation robotic systems. One of the key components of these actuators is the mechanism implementing stiffness adaptation that requires sophisticated control and nontrivial mechanical design. However, despite recent advances in controlling these systems, their design remains experience based and not well understood. In this paper, we present an optimization-based computational framework for the design of intrinsically low-power compliant variable stiffness mechanisms. The core ingredient of this framework is the mathematical formulation of the design problem—provided by a constrained nonlinear parameter optimization—which is computationally solved here to identify optimal variable stiffness designs. We show the basic capability of this formulation in finding parameters for variable stiffness mechanisms that require the least power by design. Further, we demonstrate the generality of this method in cross-comparing mechanisms with different kinematic topology to identify the one that requires the least power by design.

Semantic Representation <=SEP=> In recent years, there has been renewed interest in the NLP community in genuine language understanding and dialogue. Thus the long-standing issue of how the semantic content of language should be represented is reentering the communal discussion. This paper provides a brief “opinionated survey” of broadcoverage semantic representation (SR). It suggests multiple desiderata for such representations, and then outlines more than a dozen approaches to SR–some longstanding, and some more recent, providing quick characterizations, pros, cons, and some comments on imple-

Computer- vs. paper-based tasks: are they equivalent? <=SEP=> In 1992, Dillon published his critical review of the empirical literature on reading from paper vs. screen. However, the debate concerning the equivalence of computer- and paper-based tasks continues, especially with the growing interest in online assessment. The current paper reviews the literature over the last 15 years and contrasts the results of these more recent studies with Dillon's findings. It is concluded that total equivalence is not possible to achieve, although developments in computer technology, more sophisticated comparative measures and more positive user attitudes have resulted in a continuing move towards achieving this goal. Many paper-based tasks used for assessment or evaluation have been transferred directly onto computers with little regard for any implications. This paper considers equivalence issues between the media by reviewing performance measures. While equivalence seems impossible, the importance of any differences appears specific to the task and required outcomes.

Learning Explanatory Rules from Noisy Data <=SEP=> Artificial Neural Networks are powerful function approximators capable of modelling solutions to a wide variety of problems, both supervised and unsupervised. As their size and expressivity increases, so too does the variance of the model, yielding a nearly ubiquitous overfitting problem. Although mitigated by a variety of model regularisation methods, the common cure is to seek large amounts of training data—which is not necessarily easily obtained—that sufficiently approximates the data distribution of the domain we wish to test on. In contrast, logic programming methods such as Inductive Logic Programming offer an extremely data-efficient process by which models can be trained to reason on symbolic domains. However, these methods are unable to deal with the variety of domains neural networks can be applied to: they are not robust to noise in or mislabelling of inputs, and perhaps more importantly, cannot be applied to non-symbolic domains where the data is ambiguous, such as operating on raw pixels. In this paper, we propose a Differentiable Inductive Logic framework, which can not only solve tasks which traditional ILP systems are suited for, but shows a robustness to noise and error in the training data which ILP cannot cope with. Furthermore, as it is trained by backpropagation against a likelihood objective, it can be hybridised by connecting it with neural networks over ambiguous data in order to be applied to domains which ILP cannot address, while providing data efficiency and generalisation beyond what neural networks on their own can achieve.

Cellular commitment in the developing cerebellum <=SEP=> The mammalian cerebellum is located in the posterior cranial fossa and is critical for motor coordination and non-motor functions including cognitive and emotional processes. The anatomical structure of cerebellum is distinct with a three-layered cortex. During development, neurogenesis and fate decisions of cerebellar primordium cells are orchestrated through tightly controlled molecular events involving multiple genetic pathways. In this review, we will highlight the anatomical structure of human and mouse cerebellum, the cellular composition of developing cerebellum, and the underlying gene expression programs involved in cell fate commitments in the cerebellum. A critical evaluation of the cell death literature suggests that apoptosis occurs in ~5% of cerebellar cells, most shortly after mitosis. Apoptosis and cellular autophagy likely play significant roles in cerebellar development, we provide a comprehensive discussion of their role in cerebellar development and organization. We also address the possible function of unfolded protein response in regulation of cerebellar neurogenesis. We discuss recent advancements in understanding the epigenetic signature of cerebellar compartments and possible connections between DNA methylation, microRNAs and cerebellar neurodegeneration. Finally, we discuss genetic diseases associated with cerebellar dysfunction and their role in the aging cerebellum.

Newtonian Image Understanding: Unfolding the Dynamics of Objects in Static Images <=SEP=> In this paper, we study the challenging problem of predicting the dynamics of objects in static images. Given a query object in an image, our goal is to provide a physical understanding of the object in terms of the forces acting upon it and its long term motion as response to those forces. Direct and explicit estimation of the forces and the motion of objects from a single image is extremely challenging. We define intermediate physical abstractions called Newtonian scenarios and introduce Newtonian Neural Network (N3) that learns to map a single image to a state in a Newtonian scenario. Our evaluations show that our method can reliably predict dynamics of a query object from a single image. In addition, our approach can provide physical reasoning that supports the predicted dynamics in terms of velocity and force vectors. To spur research in this direction we compiled Visual Newtonian Dynamics (VIND) dataset that includes more than 6000 videos aligned with Newtonian scenarios represented using game engines, and more than 4500 still images with their ground truth dynamics.

Neural networks in building QSAR models. <=SEP=> This chapter critically reviews some of the important methods being used for building quantitative structure-activity relationship (QSAR) models using the artificial neural networks (ANNs). It attends predominantly to the use of multilayer ANNs in the regression analysis of structure-activity data. The highlighted topics cover the approximating ability of ANNs, the interpretability of the resulting models, the issues of generalization and memorization, the problems of overfitting and overtraining, the learning dynamics, regularization, and the use of neural network ensembles. The next part of the chapter focuses attention on the use of descriptors. It reviews different descriptor selection and preprocessing techniques; considers the use of the substituent, substructural, and superstructural descriptors in building common QSAR models; the use of molecular field descriptors in three-dimensional QSAR studies; along with the prospects of "direct" graph-based QSAR analysis. The chapter starts with a short historical survey of the main milestones in this area.

Complexity of vehicle routing and scheduling problems <=SEP=> The complexity of a class of vehicle routing and scheduling problems is investigated. We review known NP-hardness results and compile the results on the worst-case performance of approximation algorithms. Some directions for future research are suggested. The presentation is based on two discussion sessions during the Workshop to Investigate Future Directions in Routing and Scheduling of Vehicles and Crews, held at the University of Maryland at College Park, June 4-6, 1979.

Short-Text Clustering using Statistical Semantics <=SEP=> Short documents are typically represented by very sparse vectors, in the space of terms. In this case, traditional techniques for calculating text similarity results in measures which are very close to zero, since documents even the very similar ones have a very few or mostly no terms in common. In order to alleviate this limitation, the representation of short-text segments should be enriched by incorporating information about correlation between terms. In other words, if two short segments do not have any common words, but terms from the first segment appear frequently with terms from the second segment in other documents, this means that these segments are semantically related, and their similarity measure should be high. Towards achieving this goal, we employ a method for enhancing document clustering using statistical semantics. However, the problem of high computation time arises when calculating correlation between all terms. In this work, we propose the selection of a few terms, and using these terms with the Nystr\"om method to approximate the term-term correlation matrix. The selection of the terms for the Nystr\"om method is performed by randomly sampling terms with probabilities proportional to the lengths of their vectors in the document space. This allows more important terms to have more influence on the approximation of the term-term correlation matrix and accordingly achieves better accuracy.

Flat-Region Detection and False Contour Removal in the Digital TV Display <=SEP=> Bit-depth reduction in digital displays results in false contours in the image. Moreover some of video enhancement processing in the digital TV display, such as histogram equalization, contrast enhancement, and increasing sharpness, etc., make false contours more visible. Bit-depth reduction comes from various display limitations such as video memory constraints, physical characteristics of the display, display drivers, and coarse MPEG quantization, etc. Daly, SJ et al., (2004). We present an efficient method for detecting and segmenting flat-region in the image, and a technique for bit-depth extension to effectively remove false contours. We have simulated bit-depth reduction followed by video enhancement processing that cause false contours with various video image sequences including simple patterns. Our result shows that false contours are effectively removed in the flat-region in the image while the sharpness of object edges is preserved

BakerSFIeld : Bringing software fault isolation to x 64 <=SEP=> We present BakerSFIeld, a Software Fault Isolation (SFI) framework for the x64 instruction set architecture. BakerSFIeld is derived from PittSFIeld, and retains the assembly language rewriting style of sandboxing, but has been substantially re-architected for greater clarity, separating the concerns of rewriting the program for memory safety, and re-aligning the code for control-flow safety. BakerSFIeld also corrects several significant security flaws we found in PittSFIeld. We measure the performance of BakerSFIeld on a modern 64-bit desktop machine and determine that it has significantly lower overhead than its 32-bit cousin.

Leveraging Multiple Domains for Sentiment Classification <=SEP=> Sentiment classification becomes more and more important with the rapid growth of usergenerated content. However, sentiment classification task usually comes with two challenges: first, sentiment classification is highly domain-dependent and training sentiment classifier for every domain is inefficient and often impractical; second, since the quantity of labeled data is important for assessing the quality of classifier, it is hard to evaluate classifiers when labeled data is limited for certain domains. To address the challenges mentioned above, we focus on learning high-level features that are able to generalize across domains, so a global classifier can benefit with a simple combination of documents from multiple domains. In this paper, the proposed model incorporates both labeled and unlabeled data from multiple domains and learns new feature representations. Our model doesn’t require labels from every domain, which means the learned feature representation can be generalized for sentiment domain adaptation. In addition, the learned feature representation can be used as classifier since our model defines the meaning of feature value and arranges high-level features in a prefixed order, so it is not necessary to train another classifier on top of the new features. Empirical evaluations demonstrate our model outperforms baselines and yields competitive results to other state-of-the-art works on the benchmark dataset.

Factors that relate to good and poor handwriting. <=SEP=> OBJECTIVE
This study investigated the relationships between specific performance components, eye-hand coordination, visuomotor integration, in-hand manipulation, and handwriting skill.


METHOD
A sample of 48 typical first grade students were identified as good and poor handwriters by their teachers. Each child completed the Motor Accuracy Test; the Developmental Test of Visual-Motor Integration (VMI); two tests of in-hand manipulation, including a rotation and a translation task; and the Minnesota Handwriting Test (MHT).


RESULTS
All test scores for the subjects with good handwriting were significantly higher than those of the subjects with poor handwriting. Each performance component test was significantly correlated to MHT scores. Translation, VMI, and rotation scores were significant predictors of MHT scores, accounting for almost 73% of variance. A discriminant analysis using the performance components correctly classified 98% of the students as good or poor handwriters.


CONCLUSION
In-hand manipulation has significant association to handwriting skill.

Cloud Log Forensics: Foundations, State of the Art, and Future Directions <=SEP=> Cloud log forensics (CLF) mitigates the investigation process by identifying the malicious behavior of attackers through profound cloud log analysis. However, the accessibility attributes of cloud logs obstruct accomplishment of the goal to investigate cloud logs for various susceptibilities. Accessibility involves the issues of cloud log access, selection of proper cloud log file, cloud log data integrity, and trustworthiness of cloud logs. Therefore, forensic investigators of cloud log files are dependent on cloud service providers (CSPs) to get access of different cloud logs. Accessing cloud logs from outside the cloud without depending on the CSP is a challenging research area, whereas the increase in cloud attacks has increased the need for CLF to investigate the malicious activities of attackers. This paper reviews the state of the art of CLF and highlights different challenges and issues involved in investigating cloud log data. The logging mode, the importance of CLF, and cloud log-as-a-service are introduced. Moreover, case studies related to CLF are explained to highlight the practical implementation of cloud log investigation for analyzing malicious behaviors. The CLF security requirements, vulnerability points, and challenges are identified to tolerate different cloud log susceptibilities. We identify and introduce challenges and future directions to highlight open research areas of CLF for motivating investigators, academicians, and researchers to investigate them.

Local Indicators of Spatial Association <=SEP=> The capabilities for visualization, rapid data retrieval, and manipulation in geographic information systems (GIS) have created the need for new techniques of exploratory data analysis that focus on the "spatial" aspects of the data. The identification of local patterns of spatial association is an important concern in this respect. In this paper, I outline a new general class of local indicators of spatial association (LISA) and show how they allow for the decomposition of global indicators, such as Moran's I, into the contribution of each observation. The LISA statistics serve two purposes. On one hand, they may be interpreted as indicators of local pockets of nonstationarity, or hot spots, similar to the Gi and G; statistics of Getis and Ord (1992). On the other hand, they may be used to assess the influence of individual locations on the magnitude of the global statistic and to identify "outliers," as in Anselin's Moran scatterplot (1993a). An initial evaluation of the properties of a LISA statistic is carried out for the local Moran, which is applied in a study of the spatial pattern of conflict for African countries and in a number of Monte Carlo simulations.

Relations among positive parenting, children's effortful control, and externalizing problems: a three-wave longitudinal study. <=SEP=> In a 3-wave longitudinal study (with assessments 2 years apart) involving 186 early adolescents (M ages of approximately 9.3, 11.4, and 13.4), the hypothesis that parental warmth/positive expressivity predicts children's effortful control (EC) (a temperamental characteristic contributing to emotion regulation) 2 years later, which in turn predicts low levels of externalizing problems another 2 years later, was examined. The hypothesis that children's EC predicts parenting over time was also examined. Parents were observed interacting with their children; parents and teachers reported children's EC and externalizing problems; and children's persistence was assessed behaviorally. Children's EC mediated the relation between positive parenting and low levels of externalizing problems (whereas there was no evidence that children's EC predicted parenting).

OctoPocus: a dynamic guide for learning gesture-based command sets <=SEP=> We describe OctoPocus, an example of a dynamic guide that combines on-screen feedforward and feedback to help users learn, execute and remember gesture sets. OctoPocus can be applied to a wide range of single-stroke gestures and recognition algorithms and helps users progress smoothly from novice to expert performance. We provide an analysis of the design space and describe the results of two experi-ments that show that OctoPocus is significantly faster and improves learning of arbitrary gestures, compared to con-ventional Help menus. It can also be adapted to a mark-based gesture set, significantly improving input time compared to a two-level, four-item Hierarchical Marking menu.

Uninvited Connections: A Study of Vulnerable Devices on the Internet of Things (IoT) <=SEP=> The Internet of Things (IoT) continues to grow as uniquely identifiable objects are added to the internet. The addition of these devices, and their remote connectivity, has brought a new level of efficiency into our lives. However, the security of these devices has come into question. While many may be secure, the sheer number creates an environment where even a small percentage of insecure devices may create significant vulnerabilities. This paper evaluates some of the emerging vulnerabilities that exist and puts some figures to the scale of the threat.

Adaptive Current Control for Grid-Connected Converters With LCL Filter <=SEP=> This paper presents a discrete-time adaptive current controller for grid-connected pulse width modulation voltage source converters with LCL filter. The main attribute of the proposed current controller is that, in steady state, the damping of the LCL resonance does not depend on the grid characteristic since the adaptive feedback gains ensure a predefined behavior for the closed-loop current control. An overview of model reference adaptive state feedback theory is presented aiming to give the reader the required background for the adaptive current control design. The digital implementation delay is included in the model, and the stability concerning the variation of the grid parameters is analyzed in detail. Furthermore, current distortions due to the grid background voltage are rejected without using the conventional stationary resonant controllers or the synchronous proportional-plus-integral controllers. Simulation and experimental results are presented to validate the analysis and to demonstrate the good performance of the proposed controller for grid-connected converters subjected to large grid impedance variation and grid voltage disturbances.

Domain Adaptation for Relation Extraction with Domain Adversarial Neural Network <=SEP=> Relations are expressed in many domains such as newswire, weblogs and phone conversations. Trained on a source domain, a relation extractor’s performance degrades when applied to target domains other than the source. A common yet labor-intensive method for domain adaptation is to construct a target-domainspecific labeled dataset for adapting the extractor. In response, we present an unsupervised domain adaptation method which only requires labels from the source domain. Our method is a joint model consisting of a CNN-based relation classifier and a domain-adversarial classifier. The two components are optimized jointly to learn a domain-independent representation for prediction on the target domain. Our model outperforms the state-of-the-art on all three test domains of ACE 2005.

What is Your Organization 'Like'?: A Study of Liking Activity in the Enterprise <=SEP=> The 'like' button, introduced by Facebook several years ago, has become one of the most prominent icons of social media. Similarly to other popular social media features on the web, enterprises have also recently adopted it. In this paper, we present a first comprehensive study of liking activity in the enterprise. We studied the logs of an enterprise social media platform within a large global organization along a period of seven months, in which 393,720 'likes' were performed. In addition, we conducted a survey of 571 users of the platform's 'like' button. Our evaluation combines quantitative and qualitative analysis to inspect what employees like, why they use the 'like' button, and to whom they give their 'likes'.

Time series contextual anomaly detection for detecting market manipulation in stock market <=SEP=> Anomaly detection in time series is one of the fundamental issues in data mining that addresses various problems in different domains such as intrusion detection in computer networks, irregularity detection in healthcare sensory data and fraud detection in insurance or securities. Although, there has been extensive work on anomaly detection, majority of the techniques look for individual objects that are different from normal objects but do not take the temporal aspect of data into consideration. We are particularly interested in contextual outlier detection methods for time series that are applicable to fraud detection in securities. This has significant impacts on national and international securities markets. In this paper, we propose a prediction-based Contextual Anomaly Detection (CAD) method for complex time series that are not described through deterministic models. The proposed method improves the recall from 7% to 33% compared to kNN and Random Walk without compromising the precision.