R-CAD: Rare Cyber Alert Signature Relationship Extraction Through Temporal Based Learning

The large number of streaming intrusion alerts make it challenging for security analysts to quickly identify attack patterns. This is especially difficult since critical alerts often occur too rarely for traditional pattern mining algorithms to be effective. Recognizing the attack speed as an inherent indicator of differing cyber attacks, this work aggregates alerts into attack episodes that have distinct attack speeds, and finds attack actions regularly co-occurring within the same episode. This enables a novel use of the constrained SPADE temporal pattern mining algorithm to extract consistent co-occurrences of alert signatures that are indicative of attack actions that follow each other. The proposed Rare yet Co-occurring Attack action Discovery (R-CAD) system extracts not only the co-occurring patterns but also the temporal characteristics of the co-occurrences, giving the `strong rules\u27 indicative of critical and repeated attack behaviors. Through the use of a real-world dataset, we demonstrate that R-CAD helps reduce the overwhelming volume and variety of intrusion alerts to a manageable set of co-occurring strong rules. We show specific rules that reveal how critical attack actions follow one another and in what attack speed

Ecological indicators for abandoned mines, Phase 1: Review of the literature

Mine waters have been identified as a significant issue in the majority of Environment Agency draft River Basin Management Plans. They are one of the largest drivers for chemical pollution in the draft Impact Assessment for the Water Framework Directive (WFD), with significant failures of environmental quality standards (EQS) for metals (particularly Cd, Pb, Zn, Cu, Fe) in many rivers linked to abandoned mines. Existing EQS may be overprotective of aquatic life which may have adapted over centuries of exposure. This study forms part of a larger project to investigate the ecological impact of metals in rivers, to develop water quality targets (alternative objectives for the WFD) for aquatic ecosystems impacted by long-term mining pollution. The report reviews literature on EQS failures, metal effects on aquatic biota and effects of water chemistry, and uses this information to consider further work. A preliminary assessment of water quality and biology data for 87 sites across Gwynedd and Ceredigion (Wales) shows that existing Environment Agency water quality and biology data could be used to establish statistical relations between chemical variables and metrics of ecological quality. Visual representation and preliminary statistical analyses show that invertebrate diversity declines with increasing zinc concentration. However, the situation is more complex because the effects of other metals are not readily apparent. Furthermore, pH and aluminium also affect streamwater invertebrates, making it difficult to tease out toxicity due to individual mine-derived metals. The most characteristic feature of the plant communities of metal-impacted systems is a reduction in diversity, compared to that found in comparable unimpacted streams. Some species thrive in the presence of heavy metals, presumably because they are able to develop metal tolerance, whilst others consistently disappear. Effects are, however, confounded by water chemistry, particularly pH. Tolerant species are spread across a number of divisions of photosynthetic organisms, though green algae, diatoms and blue-green algae are usually most abundant, often thriving in the absence of competition and/or grazing. Current UK monitoring techniques focus on community composition and, whilst these provide a sampling and analytical framework for studies of metal impacts, the metrics are not sensitive to these impacts. There is scope for developing new metrics, based on community-level analyses and for looking at morphological variations common in some taxa at elevated metal concentrations. On the whole, community-based metrics are recommended, as these are easier to relate to ecological status definitions. With respect to invertebrates and fish, metals affect individuals, population and communities but sensitivity varies among species, life stages, sexes, trophic groups and with body condition. Acclimation or adaptation may cause varying sensitivity even within species. Ecosystem-scale effects, for example on ecological function, are poorly understood. Effects vary between metals such as cadmium, copper, lead, chromium, zinc and nickel in order of decreasing toxicity. Aluminium is important in acidified headwaters. Biological effects depend on speciation, toxicity, availability, mixtures, complexation and exposure conditions, for example discharge (flow). Current water quality monitoring is unlikely to detect short-term episodic increases in metal concentrations or evaluate the bioavailability of elevated metal concentrations in sediments. These factors create uncertainty in detecting ecological impairment in metal-impacted ecosystems. Moreover, most widely used biological indicators for UK freshwaters were developed for other pressures and none distinguishes metal impacts from other causes of impairment. Key ecological needs for better regulation and management of metals in rivers include: i) models relating metal data to ecological data that better represent influences on metal toxicity; ii) biodiagnostic indices to reflect metal effects; iii) better methods to identify metal acclimation or adaptation among sensitive taxa; iv) better investigative procedures to isolate metal effects from other pressures. Laboratory data on the effects of water chemistry on cationic metal toxicity and bioaccumulation show that a number of chemical parameters, particularly pH, dissolved organic carbon (DOC) and major cations (Na, Mg, K, Ca) exert a major influence on the toxicity and/or bioaccumulation of cationic metals. The biotic ligand model (BLM) provides a conceptual framework for understanding these water chemistry effects as a combination of the influence of chemical speciation, and metal uptake by organisms in competition with H+ and other cations. In some cases where the BLM cannot describe effects, empirical bioavailable models have been successfully used. Laboratory data on the effects of metal mixtures across different water chemistries are sparse, with implications for transferring understanding to mining-impacted sites in the field where mixture effects are likely. The available field data, although relatively sparse, indicate that water chemistry influences metal effects on aquatic ecosystems. This occurs through complexation reactions, notably involving dissolved organic matter and metals such as Al, Cu and Pb. Secondly, because bioaccumulation and toxicity are partly governed by complexation reactions, competition effects among metals, and between metals and H+, give rise to dependences upon water chemistry. There is evidence that combinations of metals are active in the field; the main study conducted so far demonstrated the combined effects of Al and Zn, and suggested, less certainly, that Cu and H+ can also contribute. Chemical speciation is essential to interpret and predict observed effects in the field. Speciation results need to be combined with a model that relates free ion concentrations to toxic effect. Understanding the toxic effects of heavy metals derived from abandoned mines requires the simultaneous consideration of the acidity-related components Al and H+. There are a number of reasons why organisms in waters affected by abandoned mines may experience different levels of metal toxicity than in the laboratory. This could lead to discrepancies between actual field behaviour and that predicted by EQS derived from laboratory experiments, as would be applied within the WFD. The main factors to consider are adaptation/acclimation, water chemistry, and the effects of combinations of metals. Secondary effects are metals in food, metals supplied by sediments, and variability in stream flows. Two of the most prominent factors, namely adaptation/ acclimation and bioavailability, could justify changes in EQS or the adoption of an alternative measure of toxic effects in the field. Given that abandoned mines are widespread in England and Wales, and the high cost of their remediation to meet proposed WFD EQS criteria, further research into the question is clearly justified. Although ecological communities of mine-affected streamwaters might be over-protected by proposed WFD EQS, there are some conditions under which metals emanating from abandoned mines definitely exert toxic effects on biota. The main issue is therefore the reliable identification of chemical conditions that are unacceptable and comparison of those conditions with those predicted by WFD EQS. If significant differences can convincingly be demonstrated, the argument could be made for alternative standards for waters affected by abandoned mines. Therefore in our view, the immediate research priority is to improve the quantification of metal effects under field circumstances. Demonstration of dose-response relationships, based on metal mixtures and their chemical speciation, and the use of better biological tools to detect and diagnose community-level impairment, would provide the necessary scientific information

Corporate Smart Content Evaluation

Nowadays, a wide range of information sources are available due to the evolution of web and collection of data. Plenty of these information are consumable and usable by humans but not understandable and processable by machines. Some data may be directly accessible in web pages or via data feeds, but most of the meaningful existing data is hidden within deep web databases and enterprise information systems. Besides the inability to access a wide range of data, manual processing by humans is effortful, error-prone and not contemporary any more. Semantic web technologies deliver capabilities for machine-readable, exchangeable content and metadata for automatic processing of content. The enrichment of heterogeneous data with background knowledge described in ontologies induces re-usability and supports automatic processing of data. The establishment of “Corporate Smart Content” (CSC) - semantically enriched data with high information content with sufficient benefits in economic areas - is the main focus of this study. We describe three actual research areas in the field of CSC concerning scenarios and datasets applicable for corporate applications, algorithms and research. Aspect- oriented Ontology Development advances modular ontology development and partial reuse of existing ontological knowledge. Complex Entity Recognition enhances traditional entity recognition techniques to recognize clusters of related textual information about entities. Semantic Pattern Mining combines semantic web technologies with pattern learning to mine for complex models by attaching background knowledge. This study introduces the afore-mentioned topics by analyzing applicable scenarios with economic and industrial focus, as well as research emphasis. Furthermore, a collection of existing datasets for the given areas of interest is presented and evaluated. The target audience includes researchers and developers of CSC technologies - people interested in semantic web features, ontology development, automation, extracting and mining valuable information in corporate environments. The aim of this study is to provide a comprehensive and broad overview over the three topics, give assistance for decision making in interesting scenarios and choosing practical datasets for evaluating custom problem statements. Detailed descriptions about attributes and metadata of the datasets should serve as starting point for individual ideas and approaches

Mining High Utility Itemsets with Regular Occurrence

High utility itemset mining (HUIM) plays an important role in the data mining community and in a wide range of applications. For example, in retail business it is used for finding sets of sold products that give high profit, low cost, etc. These itemsets can help improve marketing strategies, make promotions/ advertisements, etc. However, since HUIM only considers utility values of items/itemsets, it may not be sufficient to observe product-buying behavior of customers such as information related to "regular purchases of sets of products having a high profit margin". To address this issue, the occurrence behavior of itemsets (in the term of regularity) simultaneously with their utility values was investigated. Then, the problem of mining high utility itemsets with regular occurrence (MHUIR) to find sets of co-occurrence items with high utility values and regular occurrence in a database was considered. An efficient single-pass algorithm, called MHUIRA, was introduced. A new modified utility-list structure, called NUL, was designed to efficiently maintain utility values and occurrence information and to increase the efficiency of computing the utility of itemsets. Experimental studies on real and synthetic datasets and complexity analyses are provided to show the efficiency of MHUIRA combined with NUL in terms of time and space usage for mining interesting itemsets based on regularity and utility constraints

The 2010-12 drought and subsequent extensive flooding: a remarkable hydrological transformation

Across most of the UK, the 2010‑12 period was remarkable in climatic terms with exceptional departures from normal rainfall, runoff and aquifer recharge patterns. Generalising broadly, drought conditions developed through 2010, intensified during 2011 and were severe across much of England & Wales by the early spring of 2012. Record late spring and summer rainfall then triggered a hydrological transformation that has no close modern parallel. Seasonally extreme river flows were common through the summer, heralding further extensive flooding during the autumn and, particularly, the early winter when record runoff at the national scale provided a culmination to the wettest nine‑month sequence for England & Wales in an instrumental record beginning in 1766. This report provides comprehensive documentation and hydrometeorological appraisals of a three‑year period which incorporated a number of important regional drought episodes as well as the outstanding runoff and recharge patterns which characterised most of 2012. An examination of the wide range of impacts of the drought and flood episodes is included and the extreme hydrometeorological conditions are examined within an extended historical context. Finally, the recent exceptional conditions are reviewed in the light of observational evidence for trends in temperature, rainfall, river flow and aquifer recharge patterns