Entropy/IP: Uncovering Structure in IPv6 Addresses

In this paper, we introduce Entropy/IP: a system that discovers Internet address structure based on analyses of a subset of IPv6 addresses known to be active, i.e., training data, gleaned by readily available passive and active means. The system is completely automated and employs a combination of information-theoretic and machine learning techniques to probabilistically model IPv6 addresses. We present results showing that our system is effective in exposing structural characteristics of portions of the IPv6 Internet address space populated by active client, service, and router addresses. In addition to visualizing the address structure for exploration, the system uses its models to generate candidate target addresses for scanning. For each of 15 evaluated datasets, we train on 1K addresses and generate 1M candidates for scanning. We achieve some success in 14 datasets, finding up to 40% of the generated addresses to be active. In 11 of these datasets, we find active network identifiers (e.g., /64 prefixes or `subnets') not seen in training. Thus, we provide the first evidence that it is practical to discover subnets and hosts by scanning probabilistically selected areas of the IPv6 address space not known to contain active hosts a priori.Comment: Paper presented at the ACM IMC 2016 in Santa Monica, USA (https://dl.acm.org/citation.cfm?id=2987445). Live Demo site available at http://www.entropy-ip.com

Next Generation Application-Aware Flow Monitoring

Deep packet inspection (DPI) and IP flow monitoring are frequently used network monitoring approaches. Although the DPI provides application visibility, detailed examination of every packet is computationally intensive. The IP flow monitoring achieves high performance by processing only packet headers, but provides less details about the traffic itself. Application-aware flow monitoring is proposed as an attempt to combine DPI accuracy and IP flow monitoring performance. However, the impacts, benefits and disadvantages of application flow monitoring have not been studied in detail yet. The work proposed in this paper attempts to rectify this lack of research. We also propose a next generation flow measurement for application monitoring. The flows will represent events within the application protocol, e.g., web page download, instead of packet stream. Finally, we will investigate the performance of different approaches to application classification and application parsing with a computational complexity in mind.Často používané metody monitorování sítě jsou hloubková inspekce paketů (DPI) a monitorování síťových IP toků. Přestože DPI poskytuje formace z aplikační vrstvy, podrobné zkoumání každého paketu je výpočetně náročné. Monitorování pomocí IP síťových toků dosahuje vysokého výkonu, protože zpracovává pouze záhlaví paketů, ale také poskytuje méně informací o provozu samotném. Měření aplikačních síťových toků bylo navrženo jako pokus zkombinovat přesnost DPI a výkon IP síťových toků. Dopady, výhody a nevýhody aplikačních síťových toků zatím ale nebyly dostatečně prostudovány. Práce navrhovaná v tomto článku se snaží napravit tento nedostatek výzkumu. Navíc také navrhujeme další generaci měření síťových toků. Tyto toky budou místo sekvence paketů reprezentovat události v aplikačních protokolech, například stažení webové stránky. Budeme se také zabývat výkonem a výpočetní složitostí různých přístupů ke klasifikaci provozu a zpracování aplikačních protokolů

Standalone vertex finding in the ATLAS muon spectrometer

A dedicated reconstruction algorithm to find decay vertices in the ATLAS muon spectrometer is presented. The algorithm searches the region just upstream of or inside the muon spectrometer volume for multi-particle vertices that originate from the decay of particles with long decay paths. The performance of the algorithm is evaluated using both a sample of simulated Higgs boson events, in which the Higgs boson decays to long-lived neutral particles that in turn decay to bbar b final states, and pp collision data at √s = 7 TeV collected with the ATLAS detector at the LHC during 2011

Measurements of Higgs boson production and couplings in diboson final states with the ATLAS detector at the LHC

Measurements are presented of production properties and couplings of the recently discovered Higgs boson using the decays into boson pairs, H →γ γ, H → Z Z∗ →4l and H →W W∗ →lνlν. The results are based on the complete pp collision data sample recorded by the ATLAS experiment at the CERN Large Hadron Collider at centre-of-mass energies of √s = 7 TeV and √s = 8 TeV, corresponding to an integrated luminosity of about 25 fb−1. Evidence for Higgs boson production through vector-boson fusion is reported. Results of combined fits probing Higgs boson couplings to fermions and bosons, as well as anomalous contributions to loop-induced production and decay modes, are presented. All measurements are consistent with expectations for the Standard Model Higgs boson

Measurement of the top quark-pair production cross section with ATLAS in pp collisions at \sqrt{s}=7\TeV

A measurement of the production cross-section for top quark pairs(\ttbar) in $pp$ collisions at \sqrt{s}=7 \TeV is presented using data recorded with the ATLAS detector at the Large Hadron Collider. Events are selected in two different topologies: single lepton (electron $e$ or muon $\mu$) with large missing transverse energy and at least four jets, and dilepton ($ee$, $\mu\mu$ or $e\mu$) with large missing transverse energy and at least two jets. In a data sample of 2.9 pb-1, 37 candidate events are observed in the single-lepton topology and 9 events in the dilepton topology. The corresponding expected backgrounds from non-\ttbar Standard Model processes are estimated using data-driven methods and determined to be $12.2 \pm 3.9$ events and $2.5 \pm 0.6$ events, respectively. The kinematic properties of the selected events are consistent with SM \ttbar production. The inclusive top quark pair production cross-section is measured to be \sigmattbar=145 \pm 31 ^{+42}_{-27} pb where the first uncertainty is statistical and the second systematic. The measurement agrees with perturbative QCD calculations.Comment: 30 pages plus author list (50 pages total), 9 figures, 11 tables, CERN-PH number and final journal adde

Measurement of the top quark pair cross section with ATLAS in pp collisions at √s=7 TeV using final states with an electron or a muon and a hadronically decaying τ lepton

A measurement of the cross section of top quark pair production in proton-proton collisions recorded with the ATLAS detector at the Large Hadron Collider at a centre-of-mass energy of 7 TeV is reported. The data sample used corresponds to an integrated luminosity of 2.05 fb -1. Events with an isolated electron or muon and a τ lepton decaying hadronically are used. In addition, a large missing transverse momentum and two or more energetic jets are required. At least one of the jets must be identified as originating from a b quark. The measured cross section, σtt-=186±13(stat.)±20(syst.)±7(lumi.) pb, is in good agreement with the Standard Model prediction

Hunt for new phenomena using large jet multiplicities and missing transverse momentum with ATLAS in 4.7 fb−1 of √s=7 TeV proton-proton collisions

Results are presented of a search for new particles decaying to large numbers of jets in association with missing transverse momentum, using 4.7 fb−1 of pp collision data at s√=7TeV collected by the ATLAS experiment at the Large Hadron Collider in 2011. The event selection requires missing transverse momentum, no isolated electrons or muons, and from ≥6 to ≥9 jets. No evidence is found for physics beyond the Standard Model. The results are interpreted in the context of a MSUGRA/CMSSM supersymmetric model, where, for large universal scalar mass m 0, gluino masses smaller than 840 GeV are excluded at the 95% confidence level, extending previously published limits. Within a simplified model containing only a gluino octet and a neutralino, gluino masses smaller than 870 GeV are similarly excluded for neutralino masses below 100 GeV

Measurement of the cross-section of high transverse momentum vector bosons reconstructed as single jets and studies of jet substructure in pp collisions at √s = 7 TeV with the ATLAS detector

This paper presents a measurement of the cross-section for high transverse momentum W and Z bosons produced in pp collisions and decaying to all-hadronic final states. The data used in the analysis were recorded by the ATLAS detector at the CERN Large Hadron Collider at a centre-of-mass energy of √s = 7 TeV;{\rm Te}{\rm V}$and correspond to an integrated luminosity of$4.6\;{\rm f}{{{\rm b}}^{-1}}$. The measurement is performed by reconstructing the boosted W or Z bosons in single jets. The reconstructed jet mass is used to identify the W and Z bosons, and a jet substructure method based on energy cluster information in the jet centre-of-mass frame is used to suppress the large multi-jet background. The cross-section for events with a hadronically decaying W or Z boson, with transverse momentum${{p}_{{\rm T}}}\gt 320\;{\rm Ge}{\rm V}$and pseudorapidity$|\eta |\lt 1.9$, is measured to be${{\sigma }_{W+Z}}=8.5\pm 1.7$ pb and is compared to next-to-leading-order calculations. The selected events are further used to study jet grooming techniques

Measurement of the inclusive and dijet cross-sections of b-jets in pp collisions at sqrt(s) = 7 TeV with the ATLAS detector

The inclusive and dijet production cross-sections have been measured for jets containing b-hadrons (b-jets) in proton-proton collisions at a centre-of-mass energy of sqrt(s) = 7 TeV, using the ATLAS detector at the LHC. The measurements use data corresponding to an integrated luminosity of 34 pb^-1. The b-jets are identified using either a lifetime-based method, where secondary decay vertices of b-hadrons in jets are reconstructed using information from the tracking detectors, or a muon-based method where the presence of a muon is used to identify semileptonic decays of b-hadrons inside jets. The inclusive b-jet cross-section is measured as a function of transverse momentum in the range 20 < pT < 400 GeV and rapidity in the range |y| < 2.1. The bbbar-dijet cross-section is measured as a function of the dijet invariant mass in the range 110 < m_jj < 760 GeV, the azimuthal angle difference between the two jets and the angular variable chi in two dijet mass regions. The results are compared with next-to-leading-order QCD predictions. Good agreement is observed between the measured cross-sections and the predictions obtained using POWHEG + Pythia. MC@NLO + Herwig shows good agreement with the measured bbbar-dijet cross-section. However, it does not reproduce the measured inclusive cross-section well, particularly for central b-jets with large transverse momenta.Comment: 10 pages plus author list (21 pages total), 8 figures, 1 table, final version published in European Physical Journal

Jet energy measurement with the ATLAS detector in proton-proton collisions at root s=7 TeV

The jet energy scale and its systematic uncertainty are determined for jets measured with the ATLAS detector at the LHC in proton-proton collision data at a centre-of-mass energy of √s = 7TeV corresponding to an integrated luminosity of 38 pb-1. Jets are reconstructed with the anti-kt algorithm with distance parameters R=0. 4 or R=0. 6. Jet energy and angle corrections are determined from Monte Carlo simulations to calibrate jets with transverse momenta pT≥20 GeV and pseudorapidities {pipe}η{pipe}<4. 5. The jet energy systematic uncertainty is estimated using the single isolated hadron response measured in situ and in test-beams, exploiting the transverse momentum balance between central and forward jets in events with dijet topologies and studying systematic variations in Monte Carlo simulations. The jet energy uncertainty is less than 2. 5 % in the central calorimeter region ({pipe}η{pipe}<0. 8) for jets with 60≤pT<800 GeV, and is maximally 14 % for pT<30 GeV in the most forward region 3. 2≤{pipe}η{pipe}<4. 5. The jet energy is validated for jet transverse momenta up to 1 TeV to the level of a few percent using several in situ techniques by comparing a well-known reference such as the recoiling photon pT, the sum of the transverse momenta of tracks associated to the jet, or a system of low-pT jets recoiling against a high-pT jet. More sophisticated jet calibration schemes are presented based on calorimeter cell energy density weighting or hadronic properties of jets, aiming for an improved jet energy resolution and a reduced flavour dependence of the jet response. The systematic uncertainty of the jet energy determined from a combination of in situ techniques is consistent with the one derived from single hadron response measurements over a wide kinematic range. The nominal corrections and uncertainties are derived for isolated jets in an inclusive sample of high-pT jets. Special cases such as event topologies with close-by jets, or selections of samples with an enhanced content of jets originating from light quarks, heavy quarks or gluons are also discussed and the corresponding uncertainties are determined. © 2013 CERN for the benefit of the ATLAS collaboration