50,523 research outputs found

    Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection

    Full text link
    The need for countering Advanced Persistent Threat (APT) attacks has led to the solutions that ubiquitously monitor system activities in each enterprise host, and perform timely abnormal system behavior detection over the stream of monitoring data. However, existing stream-based solutions lack explicit language constructs for expressing anomaly models that capture abnormal system behaviors, thus facing challenges in incorporating expert knowledge to perform timely anomaly detection over the large-scale monitoring data. To address these limitations, we build SAQL, a novel stream-based query system that takes as input, a real-time event feed aggregated from multiple hosts in an enterprise, and provides an anomaly query engine that queries the event feed to identify abnormal behaviors based on the specified anomaly models. SAQL provides a domain-specific query language, Stream-based Anomaly Query Language (SAQL), that uniquely integrates critical primitives for expressing major types of anomaly models. In the demo, we aim to show the complete usage scenario of SAQL by (1) performing an APT attack in a controlled environment, and (2) using SAQL to detect the abnormal behaviors in real time by querying the collected stream of system monitoring data that contains the attack traces. The audience will have the option to interact with the system and detect the attack footprints in real time via issuing queries and checking the query results through a command-line UI.Comment: Accepted paper at ICDE 2020 demonstrations track. arXiv admin note: text overlap with arXiv:1806.0933

    Predicting the thickness of sand strata in a sand-shale interbed reservoir based on seismic facies analysis

    Get PDF
    Seismic facies analysis is of great significance for the detection of residual oil in a sand-shale interbed reservoir. In this study, we propose to predict spatial distribution of sand thickness over a reservoir, based on seismic facies analysis. The target reservoir is a thin sand-shale interbed layer, and the layer thickness varies between 2 and 10 m. The thickness of sand strata within the reservoir layer appears to have a fragmentary distribution in lateral space. Thin thickness and fragmentary distribution are two factors that cause difficulty in sand thickness prediction. To tackle this problem, this study adopted a three-stage strategy. First, the reservoir over the entire study area was classified into five different lithofacies, following sedimentary microfacies analysis against the characteristics of gamma-ray logging data, and the corresponding seismic responses were meticulously depicted. Then, exploiting these seismic responses, or seismic facies, the spatial distribution of the gamma-ray values was evaluated within the thin sand-shale interbed reservoir. Finally, the spatial distribution of the sand thickness was predicted according to the spatial distribution of the gamma-ray values. The prediction was conducted independently for each seismic facies, rather than in a non-discriminatory manner. Comparing the prediction to the actual evaluation derived from well-logging data demonstrated that the thickness distribution resulting from seismic data has a high accuracy, because of the facies-based analysis

    Superhumps in a Peculiar SU UMa-Type Dwarf Nova ER Ursae Majoris

    Get PDF
    We report the photometry of a peculiar SU UMa-type dwarf nova - ER UMa for ten nights during 1998 December and 1999 March covering a complete rise to the supermaximum and a normal outburst cycle. Superhumps have been found during the rise to the superoutburst. A negative superhump appeared in Dec.22 light curve, while the superhump on the next night became positive and had large amplitude and distinct waveform from that of the previous night. In the normal outburst we captured, superhumps with larger or smaller amplitudes seem to always exist, although it is not necessarily true for every normal outburst. These results show great resemblance with V1159 Ori (Patterson et al. 1995). It is more likely that superhumps occasionally exist at essentially all phases of the eruption cycles of ER UMa stars, which should be considered in modeling.Comment: 4 pages, 5 figures, Accepted by ApJ Letter
    • …
    corecore