Intrusion alert prioritisation and attack detection using post-correlation analysis

Event Correlation used to be a widely used technique for interpreting alert logs and discovering network attacks. However, due to the scale and complexity of today's networks and attacks, alert logs produced by these modern networks are much larger in volume and difficult to analyse. In this research we show that adding post-correlation methods can be used alongside correlation to significantly improve the analysis of alert logs. We proposed a new framework titled A Comprehensive System for Analysing Intrusion Alerts (ACSAnIA). The post-correlation methods include a new prioritisation metric based on anomaly detection and a novel approach to clustering events using correlation knowledge. One of the key benefits of the framework is that it significantly reduces false-positive alerts and it adds contextual information to true-positive alerts. We evaluated the post-correlation methods of ACSAnIA using data from a 2012 cyber range experiment carried out by industrial partners of the British Telecom Security Practice Team. In one scenario, our results show that false-positives were successfully reduced by 97% and in another scenario, 16%. It also showed that clustering correlated alerts aided in attack detection. The proposed framework is also being developed and integrated into a pre-existing Visual Analytic tool developed by the British Telecom SATURN Research Team for the analysis of cyber security data

A New Metric for Prioritising Intrusion Alerts Using Correlation and Outlier Analysis

In a medium sized network, an Intrusion Detection System (IDS) could produce thousands of alerts a day many of which may be false positives. In the vast number of triggered intrusion alerts, identifying those to prioritise is highly challenging. Alert Correlation and prioritisation are both viable analytical methods which are commonly used to understand and prioritise alerts. However, to the author’s knowledge, very few dynamic prioritisation metrics exist. In this paper, a new prioritisation metric - OutMet, which is based on measuring the degree to which an alert belongs to anomalous behaviour is proposed. OutMet combines alert correlation and prioritisation analysis and in given attack scenarios, is capable of reducing false positives by upto 100%. The metric is tested and evaluated using the recently developed cyber-range dataset provided by Northrop Grumman

A survey of security issue in multi-agent systems

Multi-agent systems have attracted the attention of researchers because of agents' automatic, pro-active, and dynamic problem solving behaviors. Consequently, there has been a rapid development in agent technology which has enabled us to provide or receive useful and convenient services in a variety of areas such as banking, transportation, e-business, and healthcare. In many of these services, it is, however, necessary that security is guaranteed. Unless we guarantee the security services based on agent-based systems, these services will face significant deployment problems. In this paper, we survey existing work related to security in multi-agent systems, especially focused on access control and trust/reputation, and then present our analyses. We also present existing problems and discuss future research challenges. © Springer Science+Business Media B.V 2011

Mosque-based emotional support among young Muslim Americans

Despite a growing literature on social support networks in religious settings (i.e., church-based social support), little is known about mosque-based support among Muslims. This study investigates the demographic and religious behavior correlates of mosque-based social support among a multi-racial and ethnic sample of 231 young Muslims from southeast Michigan. Several dimensions of mosque-based support are examined including receiving emotional support, giving emotional support, anticipated emotional support and negative interactions with members of one’s mosque. Results indicated that women both received and antic- ipated receiving greater support than did men. Higher educational attainment was associated with receiving and giving less support compared to those with the lowest level of educational attainment. Moreover, highly educated members reported fewer negative interactions than less educated members. Mosque attendance and level of congregational involvement positively predicted receiving, giving, and anticipated emotional support from congregants, but was unrelated to negative interactions. Overall, the study results converge with previously established correlates of church- based emotional support.Peer Reviewedhttp://deepblue.lib.umich.edu/bitstream/2027.42/107410/1/art%3A10.1007%2Fs13644-013-0119-0(1).pd

INVESTIGATION THE BEHAVIOR OF MODIS OCEAN COLOR PRODUCTS UNDER THE 2008 RED TIDE IN THE EASTERN PERSIAN GULF

Biophysical properties of water undergo serious variations under red tide (RT) outbreak. During RT conditions, algal blooms spread out in the estuarine, marine and fresh waters due to different triggering factors such as nutrient loading, marine currents, and monsoonal winds. The Persian Gulf (PG) was a talent region subjected to different RTs in recent decade. A massive RT started from the Strait of Hormuz in October 2008 and extended towards the northern parts of the PG covering more than 1200 km of coastlines. The bloom of microorganism C. Polykrikoides was the main specie that generated large fish mortalities, and hampered marine industries, and water desalination appliances. Ocean color satellite data have many advantages to monitor and alarm RT occurrences, such as wide and continuous extent, short time of imagery, high accessibility, and appropriate estimation of ocean color parameters. Since 1999, MODerate Resolution Imaging Spectroradiometer (MODIS) satellite sensor has estimated satellite derived chlorophyll-a (Chl-a), normalized fluorescence line height (nFLH), and diffuse attenuation coefficient at 490nm (kd490). It provides a capability to study the behavior of these parameters during RT and normal conditions. This study monitors variations in satellite derived Chl-a, nFLH, and kd490 under both RT and normal conditions of the PG between 2002 and 2008. Up to now, daily and monthly variations in these products were no synchronously investigated under RT conditions in the PG. In doing so, the MODIS L1B products were provided from NASA data archive. They were corrected for Rayleigh scattering and gaseous absorption, and atmospheric interference in turbid coastal waters, and then converted to level 2 data. In addition, Enhanced Red Green Blue (ERGB) image was used to illustrate better water variations. ERGB image was built with three normalized leaving water radiance between 443 to 560nm. All the above data processes were applied by SeaDAS 7 software package. The Strait of Hormuz was selected as the study area in the eastern part of the PG. Images including high cloud coverage (>50%) over the study area were filtered out. The classification maps of the above products were shown during RT and normal periods. Monthly variations of mentioned products were calculated for the dates before, during, and after RT appearance. The results were demonstrated as time-series diagrams. All the above calculations and presentations were performed in Matlab 7 software package. The results show that MODIS Chl-a, nFLH, and kd490 increased during the 2008 RT. Based on the feedback of these parameters under RT conditions, hybrid ocean color index (HOCI) is defined. HOCI is able to display better water variations during RT outbreak. High values of HOCI show RT affected areas

Investigating the Correlation between Panoramic and CBCT of Roots of Posterior Upper Teeth with Maxillary Sinus Floor

Background: Understanding the anatomical and pathological relationship between posterior teeth or edentulous area with maxillary sinus is essential for diagnosis and treatment planning. This study aimed to assess the correlation between maxillary sinus floor topography and related root position of posterior teeth. Method: 55 panoramic images were selected through census. These images were chosen from sajad oral and maxillofacial radiology and Navab Azam oral and maxillofacial surgery clinic in yazd from 2001-2015. Totally, 440 first and second premolars, maxillary, first, and second molars(from each 110) were investigated. The interpretation of CBCT scans were performed by oral radiologist specialist and also panoramic radiography and the results were carried out by a trained senior dental student. The results were repeated two weeks later to investigate intra-observer. The collected data were analyzed using SPSS version 17 and, Anova, Chi square, Fisher, Exautts and t-test. Result: The agreement between the CBCT and panoramic radiographs in determining root form was measured with Kappa test and it was kappa=0.549, which was meaningful with P-value=0.0001. This meaned that CBCT and panoramic radiographs showed an agreement in determining the position of maxillary sinus floor and posterior teeth roots. According to the results of this study, it was recommended to establish the exact correlation between maxillary sinus floor and posterior teeth roots especially in classification 3(projected in panoramic radiographs)CBCT images were prepared for minimal damage and infection transmission

A Hybrid Approach to Supervising Multiple Co-Operant Autonomous Mobile Robots

UK Robotics Ltd. have for some time been working in the area of multiple co-operant autonomous mobile robots. While there are a number of applications in the nuclear, chemical and off-shore industries that would benefit from such technology, the required science and engineering is only just beginning to be realised. The key issues are firstly, how to control the interaction of these robots with themselves and their environment? and secondly, how to interact with this group of robots from the point of view of an operator? What has emerged is a novel hybrid architecture that contains a reflective planning agent which is capable of translating high level operator goals into low level behaviour missions that can be executed by multiple autonomous robots. Two real robots have been used as part of our studies and this paper details our hybrid approach and the results obtained so far

Many hands make light work? An investigation into behaviourally controlled co-operant autonomous mobile robots

The past ten years has seen a flurry of research activity into the behavioural control of autonomous mobile robots. Yet despite this effort, many researchers are of the opinion that behavioural robots are incapable of achieving tasks more complex than simple can collecting, box pushing, herding or moving in formation. If such robots are to gain industrial credibility, these criticisms must be addressed. To focus the research we have studied the application of multiple mobile robots to a complex nuclear plant decommissioning problem. We argue that it is possible for multiple mobile robots to co-operatively perform a complex task provided that solutions to a number of key issues are incorporated into a behavioural control architecture. These include: behaviour conflict resolution, behaviour adaptation and behaviour scheduling. Wehave designed behavioural control methods to address these issues and our work has resulted in the creation of a behaviour synthesis architecture..