Anomaly detection using pattern-of-life visual metaphors

Complex dependencies exist across the technology estate, users and purposes of machines. This can make it difficult to efficiently detect attacks. Visualization to date is mainly used to communicate patterns of raw logs, or to visualize the output of detection systems. In this paper we explore a novel approach to presenting cybersecurity-related information to analysts. Specifically, we investigate the feasibility of using visualizations to make analysts become anomaly detectors using Pattern-of-Life Visual Metaphors. Unlike glyph metaphors, the visualizations themselves (rather than any single visual variable on screen) transform complex systems into simpler ones using different mapping strategies. We postulate that such mapping strategies can yield new, meaningful ways to showing anomalies in a manner that can be easily identified by analysts. We present a classification system to describe machine and human activities on a host machine, a strategy to map machine dependencies and activities to a metaphor. We then present two examples, each with three attack scenarios, running data generated from attacks that affect confidentiality, integrity and availability of machines. Finally, we present three in-depth use-case studies to assess feasibility (i.e. can this general approach be used to detect anomalies in systems?), usability and detection abilities of our approach. Our findings suggest that our general approach is easy to use to detect anomalies in complex systems, but the type of metaphor has an impact on user's ability to detect anomalies. Similar to other anomaly-detection techniques, false positives do exist in our general approach as well. Future work will need to investigate optimal mapping strategies, other metaphors, and examine how our approach compares to and can complement existing techniques

Metaphoric coherence: Distinguishing verbal metaphor from `anomaly\u27

Theories and computational models of metaphor comprehension generally circumvent the question of metaphor versus “anomaly” in favor of a treatment of metaphor versus literal language. Making the distinction between metaphoric and “anomalous” expressions is subject to wide variation in judgment, yet humans agree that some potentially metaphoric expressions are much more comprehensible than others. In the context of a program which interprets simple isolated sentences that are potential instances of cross‐modal and other verbal metaphor, I consider some possible coherence criteria which must be satisfied for an expression to be “conceivable” metaphorically. Metaphoric constraints on object nominals are represented as abstracted or extended along with the invariant structural components of the verb meaning in a metaphor. This approach distinguishes what is preserved in metaphoric extension from that which is “violated”, thus referring to both “similarity” and “dissimilarity” views of metaphor. The role and potential limits of represented abstracted properties and constraints is discussed as they relate to the recognition of incoherent semantic combinations and the rejection or adjustment of metaphoric interpretations

Interpreting visual metaphors : asymmetry and reversibility

In a verbal metaphor, the target and the source domains can usually be distinguished clearly, and some features of the source domain are mapped to the target domain, and not vice versa. This asymmetry of metaphor has been acknowledged in conceptual metaphor theory, as well as in interaction theory. However, the asymmetry of visual metaphor, in which concepts are depicted in images, is debated in the existing literature. The authors argue that the main reason behind this is that images lack an explicit copula ("X is Y"); so it is not always clear what a visual metaphor is about (what its target is). The authors explore the asymmetry of visual metaphors by considering a number of examples, and also by using the results of an empirical study they conducted with forty-four participants. Their study shows that, although the source and the target of visual metaphors are reversible more often than in their verbal counterparts, the transferred features usually change drastically by the reversal. This essay argues that the visual metaphors can appear to be symmetric more often than the verbal metaphors because the lack of copula can turn the focus on the comparison between the source and the target, instead of the target itself. The examples demonstrate that context plays a major role in this process by identifying the source and the target of a visual metaphor

"Going back to our roots": second generation biocomputing

Researchers in the field of biocomputing have, for many years, successfully "harvested and exploited" the natural world for inspiration in developing systems that are robust, adaptable and capable of generating novel and even "creative" solutions to human-defined problems. However, in this position paper we argue that the time has now come for a reassessment of how we exploit biology to generate new computational systems. Previous solutions (the "first generation" of biocomputing techniques), whilst reasonably effective, are crude analogues of actual biological systems. We believe that a new, inherently inter-disciplinary approach is needed for the development of the emerging "second generation" of bio-inspired methods. This new modus operandi will require much closer interaction between the engineering and life sciences communities, as well as a bidirectional flow of concepts, applications and expertise. We support our argument by examining, in this new light, three existing areas of biocomputing (genetic programming, artificial immune systems and evolvable hardware), as well as an emerging area (natural genetic engineering) which may provide useful pointers as to the way forward.Comment: Submitted to the International Journal of Unconventional Computin

Youtube, Dr, Pimple Popper, and the Human Body

Pimple poppers around the world rejoice at the Youtube series, Dr. Pimple Popper, where they can experience a range of different ways to pop something out of the skin. A highly popular series that features videos of Dr. Sandra Lee, a certified medical dermatologist, who squeezes and cuts open cysts, lipomas, and any other forms of degenerative skin conditions. These videos are taken by her medical assistants, while she performs surgeries on her patients. Dr. Lee has gained a mass following as her views and subscriptions surpass a million. The popularity of her channel demonstrates validity of a research topic, as many speculations can be made about this channel’s popular appeal. This channel is a media and communications topic, while integrating other academic fields, as it transcends into symbolic constructions and perceptions of what is a clean human body. The perception of the human body has historically been abstractified and critiqued as a medium of interpretation or as a tool to execute systemic power. Now, we must ponder the current interpretation of the human body, as it becomes the focus of a popular Youtube series. This postulation can be explored through Michel Foucault’s medical gaze theory and Mary Douglas’s cultural theory on dirt. The utilization of anthropological and philosophical theories, applied to Dr. Pimple Popper, can give us answers about how Dr. Lee’s patients are affecting the way viewers make sense of their own bodies through visually graphic material

Symbolic Computing with Incremental Mindmaps to Manage and Mine Data Streams - Some Applications

In our understanding, a mind-map is an adaptive engine that basically works incrementally on the fundament of existing transactional streams. Generally, mind-maps consist of symbolic cells that are connected with each other and that become either stronger or weaker depending on the transactional stream. Based on the underlying biologic principle, these symbolic cells and their connections as well may adaptively survive or die, forming different cell agglomerates of arbitrary size. In this work, we intend to prove mind-maps' eligibility following diverse application scenarios, for example being an underlying management system to represent normal and abnormal traffic behaviour in computer networks, supporting the detection of the user behaviour within search engines, or being a hidden communication layer for natural language interaction.Comment: 4 pages; 4 figure