SEQUIN: a grammar inference framework for analyzing malicious system behavior

Open access articleTargeted attacks on IT systems are a rising threat to the confidentiality of sensitive data and the availability of critical systems. The emergence of Advanced Persistent Threats (APTs) made it paramount to fully understand the particulars of such attacks in order to improve or devise effective defense mechanisms. Grammar inference paired with visual analytics (VA) techniques offers a powerful foundation for the automated extraction of behavioral patterns from sequential event traces. To facilitate the interpretation and analysis of APTs, we present SEQUIN, a grammar inference system based on the Sequitur compression algorithm that constructs a context-free grammar (CFG) from string-based input data. In addition to recursive rule extraction, we expanded the procedure through automated assessment routines capable of dealing with multiple input sources and types. This automated assessment enables the accurate identification of interesting frequent or anomalous patterns in sequential corpora of arbitrary quantity and origin. On the formal side, we extended the CFG with attributes that help describe the extracted (malicious) actions. Discovery-focused pattern visualization of the output is provided by our dedicated KAMAS VA prototype

Overview of the TCV tokamak experimental programme

The tokamak a configuration variable (TCV) continues to leverage its unique shaping capabilities, flexible heating systems and modern control system to address critical issues in preparation for ITER and a fusion power plant. For the 2019-20 campaign its configurational flexibility has been enhanced with the installation of removable divertor gas baffles, its diagnostic capabilities with an extensive set of upgrades and its heating systems with new dual frequency gyrotrons. The gas baffles reduce coupling between the divertor and the main chamber and allow for detailed investigations on the role of fuelling in general and, together with upgraded boundary diagnostics, test divertor and edge models in particular. The increased heating capabilities broaden the operational regime to include T (e)/T (i) similar to 1 and have stimulated refocussing studies from L-mode to H-mode across a range of research topics. ITER baseline parameters were reached in type-I ELMy H-modes and alternative regimes with \u27small\u27 (or no) ELMs explored. Most prominently, negative triangularity was investigated in detail and confirmed as an attractive scenario with H-mode level core confinement but an L-mode edge. Emphasis was also placed on control, where an increased number of observers, actuators and control solutions became available and are now integrated into a generic control framework as will be needed in future devices. The quantity and quality of results of the 2019-20 TCV campaign are a testament to its successful integration within the European research effort alongside a vibrant domestic programme and international collaborations

Overview of the TCV tokamak experimental programme

The tokamak a configuration variable (TCV) continues to leverage its unique shaping capabilities, flexible heating systems and modern control system to address critical issues in preparation for ITER and a fusion power plant. For the 2019-20 campaign its configurational flexibility has been enhanced with the installation of removable divertor gas baffles, its diagnostic capabilities with an extensive set of upgrades and its heating systems with new dual frequency gyrotrons. The gas baffles reduce coupling between the divertor and the main chamber and allow for detailed investigations on the role of fuelling in general and, together with upgraded boundary diagnostics, test divertor and edge models in particular. The increased heating capabilities broaden the operational regime to include T (e)/T (i) similar to 1 and have stimulated refocussing studies from L-mode to H-mode across a range of research topics. ITER baseline parameters were reached in type-I ELMy H-modes and alternative regimes with `small' (or no) ELMs explored. Most prominently, negative triangularity was investigated in detail and confirmed as an attractive scenario with H-mode level core confinement but an L-mode edge. Emphasis was also placed on control, where an increased number of observers, actuators and control solutions became available and are now integrated into a generic control framework as will be needed in future devices. The quantity and quality of results of the 2019-20 TCV campaign are a testament to its successful integration within the European research effort alongside a vibrant domestic programme and international collaborations