Measuring inconsistency in a network intrusion detection rule set based on Snort

In this preliminary study, we investigate how inconsistency in a network intrusion detection rule set can be measured. To achieve this, we first examine the structure of these rules which are based on Snort and incorporate regular expression (Regex) pattern matching. We then identify primitive elements in these rules in order to translate the rules into their (equivalent) logical forms and to establish connections between them. Additional rules from background knowledge are also introduced to make the correlations among rules more explicit. We measure the degree of inconsistency in formulae of such a rule set (using the Scoring function, Shapley inconsistency values and Blame measure for prioritized knowledge) and compare the *This is a revised and significantly extended version of [1]

Supporting the reconciliation of models of object behaviour

This paper presents Reconciliation+, a method which identifies overlaps between models of software systems behaviour expressed as UML object interaction diagrams (i.e., sequence and/or collaboration diagrams), checks whether the overlapping elements of these models satisfy specific consistency rules and, in cases where they violate these rules, guides software designers in handling the detected inconsistencies. The method detects overlaps between object interaction diagrams by using a probabilistic message matching algorithm that has been developed for this purpose. The guidance to software designers on when to check for inconsistencies and how to deal with them is delivered by enacting a built-in process model that specifies the consistency rules that can be checked against overlapping models and different ways of handling violations of these rules. Reconciliation+ is supported by a toolkit. It has also been evaluated in a case study. This case study has produced positive results which are discussed in the paper

Resolving the Inner Structure of QSO Discs by Fold Caustic Crossing Events

Though the bulk of the observed optical flux from the discs of intermediate-redshift lensed quasars is formed well outside the region of strong relativistic boosting and light-bending, relativistic effects have important influence on microlensing curves. The reason is in the divergent nature of amplification factors near fold caustics increasingly sensitive to small spatial size details. Higher-order disc images produced by strong light bending around the black hole may affect the amplification curves, making a contribution of up to several percent near maximum amplification. In accordance with theoretical predictions, some of the observed high-amplification events possess fine structure. Here we consider three putative caustic crossing events, one by SBS1520+530 and two events for individual images of the Einstein's cross (QSO J2237+0305). Using relativistic disc models allows to improve the fits, but the required inclinations are high, about 70deg or larger. Such high inclinations apparently contradict the absence of any strong absorption that is likely to arise if a disc is observed edge-on through a dust torus. Still, the high inclinations are required only for the central parts of the disc, that allows the disc itself to be initially tilted by 60-90deg with respect to the black hole and aligned toward the black hole equatorial plane near the last stable orbit radius. For SBS1520+530, an alternative explanation for the observed amplification curve is a superposition of two subsequent fold caustic crossings. While relativistic disc models favour black hole masses ~10^10 solar (several times higher than the virial estimates) or small Eddington ratios, this model is consistent with the observed distribution of galaxies over peculiar velocities only if the black hole mass is about 3 10^8 solar.Comment: 19 pages, 16 figures, 3 tables; accepted to MNRAS; small proof corrections mad

Łukasiewicz-Moisil Many-Valued Logic Algebra of Highly-Complex Systems

A novel approach to self-organizing, highly-complex systems (HCS), such as living organisms and artificial intelligent systems (AIs), is presented which is relevant to Cognition, Medical Bioinformatics and Computational Neuroscience. Quantum Automata (QAs) were defined in our previous work as generalized, probabilistic automata with quantum state spaces (Baianu, 1971). Their next-state functions operate through transitions between quantum states defined by the quantum equations of motion in the Schroedinger representation, with both initial and boundary conditions in space-time. Such quantum automata operate with a quantum logic, or Q-logic, significantly different from either Boolean or Łukasiewicz many-valued logic. A new theorem is proposed which states that the category of quantum automata and automata--homomorphisms has both limits and colimits. Therefore, both categories of quantum automata and classical automata (sequential machines) are bicomplete. A second new theorem establishes that the standard automata category is a subcategory of the quantum automata category. The quantum automata category has a faithful representation in the category of Generalized (M,R)--Systems which are open, dynamic biosystem networks with defined biological relations that represent physiological functions of primordial organisms, single cells and higher organisms