Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection

The need for countering Advanced Persistent Threat (APT) attacks has led to the solutions that ubiquitously monitor system activities in each enterprise host, and perform timely abnormal system behavior detection over the stream of monitoring data. However, existing stream-based solutions lack explicit language constructs for expressing anomaly models that capture abnormal system behaviors, thus facing challenges in incorporating expert knowledge to perform timely anomaly detection over the large-scale monitoring data. To address these limitations, we build SAQL, a novel stream-based query system that takes as input, a real-time event feed aggregated from multiple hosts in an enterprise, and provides an anomaly query engine that queries the event feed to identify abnormal behaviors based on the specified anomaly models. SAQL provides a domain-specific query language, Stream-based Anomaly Query Language (SAQL), that uniquely integrates critical primitives for expressing major types of anomaly models. In the demo, we aim to show the complete usage scenario of SAQL by (1) performing an APT attack in a controlled environment, and (2) using SAQL to detect the abnormal behaviors in real time by querying the collected stream of system monitoring data that contains the attack traces. The audience will have the option to interact with the system and detect the attack footprints in real time via issuing queries and checking the query results through a command-line UI.Comment: Accepted paper at ICDE 2020 demonstrations track. arXiv admin note: text overlap with arXiv:1806.0933

COMPETITIVES SPORTS PROFILES OF YOGYAKARTA

This study aims to determine the pattern of achievement in sports coaching in Yogyakarta, knowing the pattern of performance of the sport organizations, knowing the sport competitive and leading sports characteristics. This research use descriptive analytical method with the unit of Nasioanl Indonesian Sports Committee (KONI) of Yogyakarta. The methods that will be used in data collection is a survey by questionnaire technique / questionnaires, study documentation and interviews. The data obtained will be qualitative descriptive analysis. The research has provided the readiness figure of KONI Yogyakarta in 2008 in PON XVII at East Kalimantan to obtain the best possible performance with the target in investing medal match of competitive sport. Competitive sport consists of competitive priority I. It consists of 4 branches of motor sport racing, Racing Bike, Climbing, and Flying kites. Leading to the Second Priority consists of 4 branches of the Umbrella Falls, Archery, Body Building, and Billiard

Apparent annual survival of staging ruffs during a period of population decline: insights from sex and site-use related differences

The ruff Philomachus pugnax, a lekkingshorebird wintering in Africa and breeding across northernEurasia, declined severely in its western range. Based on acapture-mark-resighting programme (2004–2011) in thewesternmost staging area in Friesland (the Netherlands),we investigated changes in apparent annual survival inrelation to age and sex to explore potential causes ofdecline. We also related temporal variation in apparentsurvival to environmental factors. We used the Capture-Mark-Recapture multievent statistical framework to overcomebiases in survival estimates after testing for hiddenheterogeneity of detection. This enabled the estimation ofthe probability to belong to high or low detectabilityclasses. Apparent survival varied between years but wasnot related to weather patterns along the flyway, or to floodlevels in the Sahel. Over time, a decline in apparent survivalis suggested. Due to a short data series and flag loss inthe last period this cannot be verified. Nevertheless, thepatterns in sex-specific detectability and survival lead tonew biological insights. Among highly detectable birds,supposedly most reliant on Friesland, males survived betterthan females (?/HDmales = 0.74, range 0.51–0.93;?/HDfemales = 0.51, range 0.24–0.81). Among lowdetectable birds, the pattern is reversed (?/LDmales = 0.64,range 0.37–0.89; ?/LDfemales = 0.73, range 0.48–0.93).Probably the staging population contains a mixture of sexspecificmigration strategies. A loss of staging femalescould greatly affect the dynamics of the western ruffpopulation. Further unravelling of these population processesrequires geographically extended demographicmonitoring and the use of tracking devices

Estimation of lifetime reproductive success when reproductive status cannot always be assessed

International audienceThe Lifetime Reproductive Success (LRS) of an individual i.e. the number of young raised during its lifespan is an indicator of its contribution t o future generations and thus a measure of fitness. Nevertheless, the LRS is hard to estimate because of the difficulty to keep track of the outcome of each breed- ing attempt (successful or failed and, if successful, number of young raised). We propose two new methods to estimating the LRS that takes into account the uncertainty about the reproductive status when the individuals are not de- tected or when the reproductive status cannot be assessed. We illustrate these two methods using roe deer reproductive histories and discuss their advantages and disadvantages

Even Between-Lap Pacing Despite High Within-Lap Variation During Mountain Biking

Purpose: Given the paucity of research on pacing strategies during competitive events, this study examined changes in dynamic high-resolution performance parameters to analyze pacing profiles during a multiple-lap mountain-bike race over variable terrain. Methods: A global-positioning-system (GPS) unit (Garmin, Edge 305, USA) recorded velocity (m/s), distance (m), elevation (m), and heart rate at 1 Hz from 6 mountain-bike riders (mean ± SD age = 27.2 ± 5.0 y, stature = 176.8 ± 8.1 cm, mass = 76.3 ± 11.7 kg, VO2max = 55.1 ± 6.0 mL · kg–1 . min–1) competing in a multilap race. Lap-by-lap (interlap) pacing was analyzed using a 1-way ANOVA for mean time and mean velocity. Velocity data were averaged every 100 m and plotted against race distance and elevation to observe the presence of intralap variation. Results: There was no significant difference in lap times (P = .99) or lap velocity (P = .65) across the 5 laps. Within each lap, a high degree of oscillation in velocity was observed, which broadly reflected changes in terrain, but high-resolution data demonstrated additional nonmonotonic variation not related to terrain. Conclusion: Participants adopted an even pace strategy across the 5 laps despite rapid adjustments in velocity during each lap. While topographical and technical variations of the course accounted for some of the variability in velocity, the additional rapid adjustments in velocity may be associated with dynamic regulation of self-paced exercise

A mobile antineutrino detector with plastic scintillators

We propose a new type segmented antineutrino detector made of plastic scintillators for the nuclear safeguard application. A small prototype was built and tested to measure background events. A satisfactory unmanned field operation of the detector system was demonstrated. Besides, a detailed Monte Carlo simulation code was developed to estimate the antineutrino detection efficiency of the detector.Comment: 23 pages, 11 figures; accepted for publication in Nuclear Instruments and Methods in Physics Research

Basis Pursuit Receiver Function

Receiver functions (RFs) are derived by deconvolution of the horizontal (radial or transverse) component of ground motion from the vertical component, which segregates the PS phases. Many methods have been proposed to employ deconvolution in frequency as well as in time domain. These methods vary in their approaches to impose regularization that addresses the stability problem. Here, we present application of a new time-domain deconvolution technique called basis pursuit deconvolution (BPD) that has recently been applied to seismic exploration data. Unlike conventional deconvolution methods, the BPD uses an L1 norm constraint on model reflectivity to impose sparsity. In addition, it uses an overcomplete wedge dictionary based on a dipole reflectivity series to define model constraints, which can achieve higher resolution than that obtained by the traditional methods. We demonstrate successful application of BPD based RF estimation from synthetic data for a crustal model with a near-surface thin layer of thickness 5, 7, 10, and 15 km. The BPD can resolve these thin layers better with much improved signal-to-noise ratio than the conventional methods. Finally, we demonstrate application of the BPD receiver function (BPRF) method to a field dataset from Kutch, India, where near-surface sedimentary layers are known to be present. The BPRFs are able to resolve reflections from these layers very well.Jackson Chair funds at the Jackson School of Geosciences, University of Texas, AustinCouncil of Scientific and Industrial Research twelfth five year plan project at the Council of Scientific and Industrial Research National Geophysical Research Institute (CSIR-NGRI), HyderabadInstitute for Geophysic