Inferring the source and destination of the anomalous traffic in networks using spatio-temporal correlation

Orientadores: Leonardo de Souza Mendes, Mario Lemes Proença JuniorDissertação (mestrado) - Universidade Estadual de Campinas, Faculdade de Engenharia Elétrica e de ComputaçãoResumo: Estratégias voltadas para a detecção de anomalias em redes de computadores emitem alarmes como forma de notificação ao administrador de rede. Esses alarmes são essenciais para a gerencia de rede, pois são evidencias de uma anormalidade. Entretanto, uma única anomalia pode gerar um numero excessivo de alarmes, tornando a inspeção manual inviável. Nesta dissertação, e apresentado um sistema de correlação de alarmes automatizado, divido em três camadas, que obtém os alarmes primitivos e apresenta ao administrador de rede uma visão global do cenário afetado pela anomalia. A camada de pré-processamento faz a compressão dos alarmes utilizando seus atributos espaciais e temporais, os quais são reduzidos a um único alarme denominado DLA (Alarme em Nível de Equipamento). A camada de correlação busca, através dos DLAs e de informações sobre a topologia da rede, inferir o caminho de propagação da anomalia, sua origem e destino. A camada de apresentação prove a visualização do caminho e elementos de redes afetados pela propagação da anomalia. O sistema apresentado nesta dissertação foi aplicado em diversos cenários que apresentavam anomalias reais detectadas na rede da Universidade Estadual de Londrina. Foi demonstrada sua capacidade de identificar, de forma automatizada, o caminho de propagação do trafego anômalo, proporcionando informações úteis e corretas ao administrador de rede para o diagnostico do problemaAbstract: Anomaly detection systems for computer networks send alarms in order to notify the network administrator. These alarms are essential for network management because they are evidences of an abnormality. However, a single anomaly may generate an excessive volume of alarms, making the manual inspection unfeasible. In this work, it is presented an automated alarm correlation system divided into three layers, which obtains raw alarms and presents to network administrator a global view of the scenario affected by the anomaly. In the preprocessing layer, it is performed the alarm compression using their spatial and temporal attributes, which are reduced to a unique alarm named DLA (Device Level Alarm). The correlation layer aims to infer the anomaly propagation path and its origin and destination using DLAs and network topology information. The presentation layer provides the visualization of the path and network elements affected by the anomaly propagation through the network. The presented system was applied in various scenarios that had real anomalies detected on the State University of Londrina network. It demonstrated its ability to identify in an automated manner the anomalous traffic propagation path, providing useful and accurate information to the network administrator to diagnose the problemMestradoTelecomunicações e TelemáticaMestre em Engenharia Elétric

Active self-diagnosis in telecommunication networks

Les réseaux de télécommunications deviennent de plus en plus complexes, notamment de par la multiplicité des technologies mises en œuvre, leur couverture géographique grandissante, la croissance du trafic en quantité et en variété, mais aussi de par l évolution des services fournis par les opérateurs. Tout ceci contribue à rendre la gestion de ces réseaux de plus en plus lourde, complexe, génératrice d erreurs et donc coûteuse pour les opérateurs. On place derrière le terme réseaux autonome l ensemble des solutions visant à rendre la gestion de ce réseau plus autonome. L objectif de cette thèse est de contribuer à la réalisation de certaines fonctions autonomiques dans les réseaux de télécommunications. Nous proposons une stratégie pour automatiser la gestion des pannes tout en couvrant les différents segments du réseau et les services de bout en bout déployés au-dessus. Il s agit d une approche basée modèle qui adresse les deux difficultés du diagnostic basé modèle à savoir : a) la façon d'obtenir un tel modèle, adapté à un réseau donné à un moment donné, en particulier si l'on souhaite capturer plusieurs couches réseau et segments et b) comment raisonner sur un modèle potentiellement énorme, si l'on veut gérer un réseau national par exemple. Pour répondre à la première difficulté, nous proposons un nouveau concept : l auto-modélisation qui consiste d abord à construire les différentes familles de modèles génériques, puis à identifier à la volée les instances de ces modèles qui sont déployées dans le réseau géré. La seconde difficulté est adressée grâce à un moteur d auto-diagnostic actif, basé sur le formalisme des réseaux Bayésiens et qui consiste à raisonner sur un fragment du modèle du réseau qui est augmenté progressivement en utilisant la capacité d auto-modélisation: des observations sont collectées et des tests réalisés jusqu à ce que les fautes soient localisées avec une certitude suffisante. Cette approche de diagnostic actif a été expérimentée pour réaliser une gestion multi-couches et multi-segments des alarmes dans un réseau IMS.While modern networks and services are continuously growing in scale, complexity and heterogeneity, the management of such systems is reaching the limits of human capabilities. Technically and economically, more automation of the classical management tasks is needed. This has triggered a significant research effort, gathered under the terms self-management and autonomic networking. The aim of this thesis is to contribute to the realization of some self-management properties in telecommunication networks. We propose an approach to automatize the management of faults, covering the different segments of a network, and the end-to-end services deployed over them. This is a model-based approach addressing the two weaknesses of model-based diagnosis namely: a) how to derive such a model, suited to a given network at a given time, in particular if one wishes to capture several network layers and segments and b) how to reason a potentially huge model, if one wishes to manage a nation-wide network for example. To address the first point, we propose a new concept called self-modeling that formulates off-line generic patterns of the model, and identifies on-line the instances of these patterns that are deployed in the managed network. The second point is addressed by an active self-diagnosis engine, based on a Bayesian network formalism, that consists in reasoning on a progressively growing fragment of the network model, relying on the self-modeling ability: more observations are collected and new tests are performed until the faults are localized with sufficient confidence. This active diagnosis approach has been experimented to perform cross-layer and cross-segment alarm management on an IMS network.RENNES1-Bibl. électronique (352382106) / SudocSudocFranceF

Waveforms and Sonic Boom Perception and Response (WSPR): Low-Boom Community Response Program Pilot Test Design, Execution, and Analysis

The Waveforms and Sonic boom Perception and Response (WSPR) Program was designed to test and demonstrate the applicability and effectiveness of techniques to gather data relating human subjective response to multiple low-amplitude sonic booms. It was in essence a practice session for future wider scale testing on naive communities, using a purpose built low-boom demonstrator aircraft. The low-boom community response pilot experiment was conducted in California in November 2011. The WSPR team acquired sufficient data to assess and evaluate the effectiveness of the various physical and psychological data gathering techniques and analysis methods

Deliverable D2.3 Specification of Web mining process for hypervideo concept identification

This deliverable presents a state-of-art and requirements analysis report for the web mining process as part of the WP2 of the LinkedTV project. The deliverable is divided into two subject areas: a) Named Entity Recognition (NER) and b) retrieval of additional content. The introduction gives an outline of the workflow of the work package, with a subsection devoted to relations with other work packages. The state-of-art review is focused on prospective techniques for LinkedTV. In the NER domain, the main focus is on knowledge-based approaches, which facilitate disambiguation of identified entities using linked open data. As part of the NER requirement analysis, the first tools developed are described and evaluated (NERD, SemiTags and THD). The area of linked additional content is broader and requires a more thorough analysis. A balanced overview of techniques for dealing with the various knowledge sources (semantic web resources, web APIs and completely unstructured resources from a white list of web sites) is presented. The requirements analysis comes out of the RBB and Sound and Vision LinkedTV scenarios

Using Gamification to Support Positive Health Behaviour Change: A Kaupapa Māori Approach

As our lives become increasingly technology-dependent, healthcare practitioners and researchers recognise the opportunities to deliver effective digital healthcare initiatives to improve patient outcomes. Gamification is one such technological approach to consider. While some important work has been done in gamification, to date, there have been few gamified healthy lifestyle intervention studies undertaken within an Indigenous or minority population. Therefore, this research extends the current knowledge of gamification with a focus on an Indigenous population. Māori are the Indigenous People of New Zealand, and as in many other colonised countries, Māori are over-represented in obesity statistics; a factor which contributes to significant health inequities, such as a higher incidence of chronic illness among Māori people. Gamification may be an effective means of supporting positive lifestyle choices (e.g., increased physical activity) to reduce the prevalence of chronic illness. This research takes a Kaupapa Māori approach to address the research question: How can gamification support positive health behaviour change? Kaupapa Māori is a philosophical Māori-centric approach that ensures tino rangatiratanga (the right to self-determination). The research approach follows Māori tikanga (customary practices) and recognises the importance of Te Reo Māori (Māori language) and Te Ao Māori (a Māori worldview). This research followed a design science research (DSR) process and consisted of two phases: Phase One was a prototype design phase, and Phase Two evaluated the prototype. Phase One involved a series of co-design hui (focus groups) to explore the social context and health aspirations of Māori and to ideate potential solutions. Phase One found that normative beliefs strongly influence effective gamification design preference for Māori and that culturally-tailored design is effective for Māori; a notion that contradicts previous Western-oriented gamification implementations. Phase Two consisted of a cross-sectional survey and regression analysis to evaluate the prototype designed during Phase One. Major findings from Phase Two show that three critical factors predict whether Māori users would use the gamified intervention: Perceived Ease-of-Use; Māori-Centric Design; and the use of Whakataetae (competitive) persuasive design strategies. This research contributes to gamification literature by identifying the gamification elements that most significantly impact behavioural intention toward gamified health applications for Māori; knowledge that may be transferable to other Indigenous populations. The importance of implementing a competitive strategy contradicts previous literature on collectivist cultures and guides the development of future gamified interventions. This research also contributes to theoretical and practical knowledge by demonstrating that effective persuasive strategies are not universal; Māori-centric design is a self-determined approach that keeps the needs of the target audience central to the design of a solution. This research provides theory-driven practical guidelines for design processes and design decisions that are driven by the needs and aspirations of Māori

Applied Information Systems Research Program (AISRP). Workshop 2: Meeting Proceedings

The Earth and space science participants were able to see where the current research can be applied in their disciplines and computer science participants could see potential areas for future application of computer and information systems research. The Earth and Space Science research proposals for the High Performance Computing and Communications (HPCC) program were under evaluation. Therefore, this effort was not discussed at the AISRP Workshop. OSSA's other high priority area in computer science is scientific visualization, with the entire second day of the workshop devoted to it

Front-Line Physicians' Satisfaction with Information Systems in Hospitals

Day-to-day operations management in hospital units is difficult due to continuously varying situations, several actors involved and a vast number of information systems in use. The aim of this study was to describe front-line physicians' satisfaction with existing information systems needed to support the day-to-day operations management in hospitals. A cross-sectional survey was used and data chosen with stratified random sampling were collected in nine hospitals. Data were analyzed with descriptive and inferential statistical methods. The response rate was 65 % (n = 111). The physicians reported that information systems support their decision making to some extent, but they do not improve access to information nor are they tailored for physicians. The respondents also reported that they need to use several information systems to support decision making and that they would prefer one information system to access important information. Improved information access would better support physicians' decision making and has the potential to improve the quality of decisions and speed up the decision making process.Peer reviewe

The effect of psychosocial information resources on the psychological impact of genetic testing for patients

Genet Test Mol Biomarkers. 2010 Dec;14(6):807-15. Epub 2010 Oct 12. Living without a diagnosis: the parental experience. Lewis C, Skirton H, Jones R.J Genet Couns. 2011 Feb;20(1):80-97. Epub 2010 Sep 29. Can we make assumptions about the psychosocial impact of living as a carrier, based on studies assessing the effects of carrier testing? Lewis C, Skirton H, Jones R.The effect of psychosocial information resources on the psychological impact of genetic testing for patients Background: The genetic testing process has been shown to have a profound psychosocial impact on patients and families, yet research suggests that there is a lack of practical and helpful psychosocial information written to support decision-making. Ideally, this should be available for use both before and after genetic testing and should be easily accessed through genetic clinics. The development of pre-written leaflets or on-line resources which draw on the experiences and advice of families who have been through similar experiences, and are readily available through genetic clinics, might be one way of helping families make necessary adjustments. Aim: The aim of this study was to develop information resources for a) people undergoing carrier testing, and b) parents of children with undiagnosed conditions, and to pilot the use of these resources with service users. Methods: A systematic literature review was conducted to identify key themes to inform the content of the resources. To build on these findings, in-depth interviews were conducted with 11 people who had undergone carrier testing and 14 parents of children without a diagnosis. Interview data were analysed using the grounded theory method. A grey literature search of existing patient information was also conducted. These three phases informed the content of information resources. The development process also included input from genetic specialists, patient group representatives and interviewees. Finally, a pilot study was conducted through three genetic centres to assess the feasibility of a study testing the use of the resources. Findings: The participants in this study were striving for empowerment: carriers sought reproductive empowerment; parents developed empowerment strategies in order to advocate for their child. Moreover, a theory named ‘reconstructing the meaning of being a parent’ was constructed to describe the experience of parenting a child for whom no clear care pathway existed. The importance of providing timely information was identified as being a key factor in supporting parents during their search for a diagnosis. A new model was built to summarise the overarching experience of participants in this study. Conclusions: Empowerment was identified as a dynamic and multi-faceted construct. Health professionals and support groups can help facilitate the empowerment process through the provision of timely psychosocial information. This is particularly important in an age when patients are expected to take greater control than ever before over decisions affecting their healthcare