Role based behavior analysis

Tese de mestrado, Segurança Informática, Universidade de Lisboa, Faculdade de Ciências, 2009Nos nossos dias, o sucesso de uma empresa depende da sua agilidade e capacidade de se adaptar a condições que se alteram rapidamente. Dois requisitos para esse sucesso são trabalhadores proactivos e uma infra-estrutura ágil de Tecnologias de Informacão/Sistemas de Informação (TI/SI) que os consiga suportar. No entanto, isto nem sempre sucede. Os requisitos dos utilizadores ao nível da rede podem nao ser completamente conhecidos, o que causa atrasos nas mudanças de local e reorganizações. Além disso, se não houver um conhecimento preciso dos requisitos, a infraestrutura de TI/SI poderá ser utilizada de forma ineficiente, com excessos em algumas áreas e deficiências noutras. Finalmente, incentivar a proactividade não implica acesso completo e sem restrições, uma vez que pode deixar os sistemas vulneráveis a ameaças externas e internas. O objectivo do trabalho descrito nesta tese é desenvolver um sistema que consiga caracterizar o comportamento dos utilizadores do ponto de vista da rede. Propomos uma arquitectura de sistema modular para extrair informação de fluxos de rede etiquetados. O processo é iniciado com a criação de perfis de utilizador a partir da sua informação de fluxos de rede. Depois, perfis com características semelhantes são agrupados automaticamente, originando perfis de grupo. Finalmente, os perfis individuais são comprados com os perfis de grupo, e os que diferem significativamente são marcados como anomalias para análise detalhada posterior. Considerando esta arquitectura, propomos um modelo para descrever o comportamento de rede dos utilizadores e dos grupos. Propomos ainda métodos de visualização que permitem inspeccionar rapidamente toda a informação contida no modelo. O sistema e modelo foram avaliados utilizando um conjunto de dados reais obtidos de um operador de telecomunicações. Os resultados confirmam que os grupos projectam com precisão comportamento semelhante. Além disso, as anomalias foram as esperadas, considerando a população subjacente. Com a informação que este sistema consegue extrair dos dados em bruto, as necessidades de rede dos utilizadores podem sem supridas mais eficazmente, os utilizadores suspeitos são assinalados para posterior análise, conferindo uma vantagem competitiva a qualquer empresa que use este sistema.In our days, the success of a corporation hinges on its agility and ability to adapt to fast changing conditions. Proactive workers and an agile IT/IS infrastructure that can support them is a requirement for this success. Unfortunately, this is not always the case. The user’s network requirements may not be fully understood, which slows down relocation and reorganization. Also, if there is no grasp on the real requirements, the IT/IS infrastructure may not be efficiently used, with waste in some areas and deficiencies in others. Finally, enabling proactivity does not mean full unrestricted access, since this may leave the systems vulnerable to outsider and insider threats. The purpose of the work described on this thesis is to develop a system that can characterize user network behavior. We propose a modular system architecture to extract information from tagged network flows. The system process begins by creating user profiles from their network flows’ information. Then, similar profiles are automatically grouped into clusters, creating role profiles. Finally, the individual profiles are compared against the roles, and the ones that differ significantly are flagged as anomalies for further inspection. Considering this architecture, we propose a model to describe user and role network behavior. We also propose visualization methods to quickly inspect all the information contained in the model. The system and model were evaluated using a real dataset from a large telecommunications operator. The results confirm that the roles accurately map similar behavior. The anomaly results were also expected, considering the underlying population. With the knowledge that the system can extract from the raw data, the users network needs can be better fulfilled, the anomalous users flagged for inspection, giving an edge in agility for any company that uses it

A communication equilibrium in English auctions with discrete bidding

This paper analyses a model of a common value English auction with discrete bidding. In this model, we show that there exists a communication equilibrium in which the high signal bidder strategically chooses his first bid so as to maximise his expected utility. Straightforward bidding, or increasing the bid by the minimum amount possible, is the equilibrium strategy for both bidders in all other auction rounds. We relate this result to recent research on English auctions with discrete bidding and auctions where bidders may have noisy information about their opponent's signals.English Auctions, discrete bidding, communication equilibrium

An Ascending Auction in the Presence of Rationality and Herd Behaviour

In this paper we analyse a common value English auction. We argue that rational bidders attempt to estimate each other’s private signals, to take advantage of the additional information disclosed through the bids. If this happens, herd behaviour might arise, because a particular bidder may have an incentive to follow his estimate of some other bidder’s signal, thus dropping his own, and staying in the auction longer than previously optimal. Acting upon beliefs might take the auction to an inefficient outcome, where the bidder who most values the good ends up not getting the object for sale.English Auctions, Rationality, Herd Behaviour

Consumer Behavior: Product Characteristics and Quality Perception

Consumers rely on signals, both extrinsic and intrinsic attributes, to solve their asymmetric information problem regarding product quality. In this study an experiment is designed to evaluate how consumers assess quality perception in terms of specific product characteristics, namely colors and shapes in product labels. According to the cue consistency theory, the prediction is that multiple sources of information are more useful when they provide corroborating information than when they offer disparate conclusions. In this sense, particular colors and shapes combinations which are consistent are expected to enhance consumers´ product quality perception, while other combinations that are inconsistent will decrease it.Consumer, Behavior, Quality Perception, Label, Color, Shape

Management Quality Measurement: Using Data Envelopment Analysis (DEA) Estimation Approach for Banks in Brazil

While the quality of a bank's management is generally acknowledged to be a key contributor to a financial institutional failure, it is usually not calculated for lack of an objective measure. This paper presents a new paradigm approach for quantifying a bank's managerial efficiency, using a data envelopment analysis (DEA) model that combines multiple inputs and outputs to compute a scalar measure of efficiency and management quality. The analysis of the largest 50 Brazilian banks over a twelve-year period from 1995 to 2006 shows significant differences in management quality scores between institutions. Hence, this new metric provides an important, but previously missing, modelling element for the early identification of troubled banks and can be used as a tool for off-site bank supervision in Brazil.Data Envelopment Analysis, DEA, Banks, Brazil

The momentum for network separation: a guide for regulators

NGAs (Next Generation Access Networks) are a challenge to regulators and operators insofar as they require large investments, there is significant uncertainty about the ability to recover costs, and the choice of the appropriate regulatory regime is far from consensual. Regulatory authorities might want to seize the moment and reconsider the mandatory vertical separation of telecommunication firms, without jeopardizing incentives to innovation, investment and welfare. We provide a provocative but simple test for the adequacy of network separation as a regulatory remedy. We propose a decision tree procedure with four steps in order to assess whether network separation is an adequate regulatory response: [1] “Is there significant market power in the market for the provision of access services under NGAs?”; [2] “Are there few vertical complementarities between services along the supply chain?”; [3] “Is functional separation a better regulatory tool than any other alternative?”; and [4] “Is structural separation superior to functional separation?”. A positive answer to the first three questions implies that the regulator should consider functional network separation, whilst the fourth is needed for the structural alternative.Telecommunications networks, Functional separation, Structural separation

Experimental Evidence on English Auctions: Oral Outcry vs. Clock

This paper tests experimentally, in a common value setting, the equivalence between the Japanese English auction (or clock auction) and an open outcry auction, where bidders are allowed to call their own bids. We find that (i) bidding behaviour is different in each type of auction, but also that (ii) this difference in bidding behaviour does not affect significantly the auction prices. This lends some support to the equivalence between these two types of auction. The winner's curse is present: overbidding led to higher than expected prices (under Nash bidding strategies) in both types of auction.English auctions, discrete bidding, winner's curse

Economies of scale and scope in the provision of diagnostic techniques and therapeutic services in Portuguese hospitals

This paper analyses the provision of auxiliary clinical services that are typically carried out within the hospital. We estimate a flexible cost function for the three most important (cost- wise) diagnostic techniques and therapeutic services in Portuguese hospitals: Clinical Pathology, Medical Imaging and Physical Medicine and Rehabilitation. Our objective in carrying out this estimation is the evaluation of economies of scale and scope in the provision of these services. For all services, we find evidence of ray economies of scale and some evidence of economies of scope. These results have important policy implications and can be related to the ongoing discussion of where and how should hospitals provide these services.translog cost function, economies of scale, economies of scope, clinical services, hospitals