Behavior-Profile Clustering for False Alert Reduction in Anomaly Detection Sensors

Anomaly detection (AD) sensors compute behavior profiles to recognize malicious or anomalous activities. The behavior of a host is checked continuously by the AD sensor and an alert is raised when the behavior deviates from its behavior profile. Unfortunately, the majority of AD sensors suffer from high volumes of false alerts either maliciously crafted by the host or originating from insufficient training of the sensor. We present a cluster-based AD sensor that relies on clusters of behavior profiles to identify anomalous behavior. The behavior of a host raises an alert only when a group of host profiles with similar behavior (cluster of behavior profiles) detect the anomaly, rather than just relying on the host's own behavior profile to raise the alert (single-profile AD sensor). A cluster-based AD sensor significantly decreases the volume of false alerts by providing a more robust model of normal behavior based on clusters of behavior profiles. Additionally, we introduce an architecture designed for the deployment of cluster-based AD sensors. The behavior profile of each network host is computed by its closest switch that is also responsible for performing the anomaly detection for each of the hosts in its subnet. By placing the AD sensors at the switch, we eliminate the possibility of hosts crafting malicious alerts. Our experimental results based on wireless behavior profiles from users in the CRAWDAD dataset show that the volume of false alerts generated by cluster-based AD sensors is reduced by at least 50% compared to single-profile AD sensors

From mobile phone data to the spatial structure of cities

Pervasive infrastructures, such as cell phone networks, enable to capture large amounts of human behavioral data but also provide information about the structure of cities and their dynamical properties. In this article, we focus on these last aspects by studying phone data recorded during 55 days in 31 Spanish metropolitan areas. We first define an urban dilatation index which measures how the average distance between individuals evolves during the day, allowing us to highlight different types of city structure. We then focus on hotspots, the most crowded places in the city. We propose a parameter free method to detect them and to test the robustness of our results. The number of these hotspots scales sublinearly with the population size, a result in agreement with previous theoretical arguments and measures on employment datasets. We study the lifetime of these hotspots and show in particular that the hierarchy of permanent ones, which constitute the "heart" of the city, is very stable whatever the size of the city. The spatial structure of these hotspots is also of interest and allows us to distinguish different categories of cities, from monocentric and "segregated" where the spatial distribution is very dependent on land use, to polycentric where the spatial mixing between land uses is much more important. These results point towards the possibility of a new, quantitative classification of cities using high resolution spatio-temporal data.Comment: 14 pages, 15 figure

Uncovering the spatial structure of mobility networks

The extraction of a clear and simple footprint of the structure of large, weighted and directed networks is a general problem that has many applications. An important example is given by origin-destination matrices which contain the complete information on commuting flows, but are difficult to analyze and compare. We propose here a versatile method which extracts a coarse-grained signature of mobility networks, under the form of a $2\times 2$ matrix that separates the flows into four categories. We apply this method to origin-destination matrices extracted from mobile phone data recorded in thirty-one Spanish cities. We show that these cities essentially differ by their proportion of two types of flows: integrated (between residential and employment hotspots) and random flows, whose importance increases with city size. Finally the method allows to determine categories of networks, and in the mobility case to classify cities according to their commuting structure.Comment: 10 pages, 5 figures +Supplementary informatio

Stochastics theory of log-periodic patterns

We introduce an analytical model based on birth-death clustering processes to help understanding the empirical log-periodic corrections to power-law scaling and the finite-time singularity as reported in several domains including rupture, earthquakes, world population and financial systems. In our stochastics theory log-periodicities are a consequence of transient clusters induced by an entropy-like term that may reflect the amount of cooperative information carried by the state of a large system of different species. The clustering completion rates for the system are assumed to be given by a simple linear death process. The singularity at t_{o} is derived in terms of birth-death clustering coefficients.Comment: LaTeX, 1 ps figure - To appear J. Phys. A: Math & Ge

Vehicular Storage of Hydrogen in Insulated Pressure Vessels

This paper describes the development of an alternative technology for storing hydrogen fuel onboard automobiles. Insulated pressure vessels are cryogenic-capable pressure vessels that can accept cryogenic liquid fuel, cryogenic compressed gas or compressed gas at ambient temperature. Insulated pressure vessels offer advantages over conventional H{sub 2} storage approaches. Insulated pressure vessels are more compact and require less carbon fiber than GH{sub 2} vessels. They have lower evaporative losses than LH{sub 2} tanks, and are much lighter than metal hydrides. After outlining the advantages of hydrogen fuel and insulated pressure vessels, the paper describes the experimental and analytical work conducted to verify that insulated pressure vessels can be used safely for vehicular H{sub 2} storage. The paper describes tests that have been conducted to evaluate the safety of insulated pressure vessels. Insulated pressure vessels have successfully completed a series of DOT, ISO and SAE certification tests. A draft procedure for insulated pressure vessel certification has been generated to assist in a future commercialization of this technology. An insulated pressure vessel has been installed in a hydrogen fueled truck and it is currently being subjected to extensive testing

Spectrochimica Acta Part A 62 (2005) 176-180 Raman spectroscopy of halotrichite from Jaroso, Spain

Abstract Raman spectroscopy complimented with infrared ATR spectroscopy has been used to characterise a halotrichite FeSO 4 ·Al 2 (SO 4 ) 3 ·22H 2 O from The Jaroso Ravine, Almeria, Spain. Halotrichites form a continuous solid solution series with pickingerite and chemical analysis shows that the jarosite contains 6% Mg 2+ . Halotrichite is characterised by four infrared bands at 3569.5, 3485.7, 3371.4 and 3239.0 cm −1 . Using Libowitsky type relationships, hydrogen bond distances of 3.08, 2.876, 2.780 and 2.718Å were determined. Two intense Raman bands are observed at 987.7 and 984.4 cm −1 and are assigned to the ν 1 symmetric stretching vibrations of the sulphate bonded to the Fe 2+ and the water units in the structure. Three sulphate bands are observed at 77 K at 1000.0, 991.3 and 985.0 cm −1 suggesting further differentiation of the sulphate units. Raman spectrum of the ν 2 and ν 4 region of halotrichite at 298 K shows two bands at 445.1 and 466.9 cm −1 , and 624.2 and 605.5 cm −1 , respectively, confirming the reduction of symmetry of the sulphate in halotrichite

Diabetic fetopathy associated with bilateral adrenal hyperplasia and ambiguous genitalia: a case report

<p>Abstract</p> <p>Introduction</p> <p>Many fetal malformations can occur because of maternal diabetes. However, ambiguous genital organs have never been reported as an associated finding in the literature. This is the first report of associated ambiguous genital organ and bilateral adrenal hyperplasia in a case of diabetic fetopathy.</p> <p>Case presentation</p> <p>A 19-year-old Thai primigravida with familial history of diabetes mellitus (DM) was diagnosed as having gestational DM type 2, based on 100 g oral glucose tolerance test, and was poorly controlled with insulin injections. Delayed targeted ultrasonography at 28 weeks gestation revealed multiple fetal anomalies. The woman underwent low transverse cesarean section at 30 weeks gestation due to preterm labor and transverse lie. The newborn with ambiguous genitalia was delivered but expired after birth. Autopsy findings revealed alobar holoprosencephaly, a prominent forehead, hypotelorism, an absent nose, absent bilateral ears, median cleft lip and palate, preaxial polydactyly of the right hand, accessory spleens, single umbilical artery, markedly enlarged adrenal glands and ambiguous external genitalia The subsequent fetal chromosomal study revealed 46,XX.</p> <p>Conclusion</p> <p>We describe a case of diabetic fetopathy with classic facial malformation and preaxial hallucal polydactyly which has been proposed as a marker of diabetic embryopathy. Bilateral adrenal hyperplasia with ambiguous genitalia, an uncommon associated anomaly, was also identified. It is controversial whether adrenal hyperplasia can be a novel feature of diabetic fetopathy or just a coincidental finding. Further observation and adequate investigation are needed in such cases.</p