Anomalous Payload-Based Network Intrusion Detection

We present a payload-based anomaly detector, we call PAYL, for intrusion detection. PAYL models the normal application payload of network traffic in a fully automatic, unsupervised and very efficient fashion. We first compute during a training phase a profile byte frequency distribution and their standard deviation of the application payload flowing to a single host and port. We then use Mahalanobis distance during the detection phase to calculate the similarity of new data against the pre-computed profile. The detector compares this measure against a threshold and generates an alert when the distance of the new input exceeds this threshold. We demonstrate the surprising effectiveness of the method on the 1999 DARPA IDS dataset and a live dataset we collected on the Columbia CS department network. In once case nearly 100% accuracy is achieved with 0.1% false positive rate for port 80 traffic

The Elusive p-air Cross Section

For the \pbar p and $pp$ systems, we have used all of the extensive data of the Particle Data Group[K. Hagiwara {\em et al.} (Particle Data Group), Phys. Rev. D 66, 010001 (2002).]. We then subject these data to a screening process, the ``Sieve'' algorithm[M. M. Block, physics/0506010.], in order to eliminate ``outliers'' that can skew a $\chi^2$ fit. With the ``Sieve'' algorithm, a robust fit using a Lorentzian distribution is first made to all of the data to sieve out abnormally high \delchi, the individual i$^{\rm th}$ point's contribution to the total $\chi^2$. The $\chi^2$ fits are then made to the sieved data. We demonstrate that we cleanly discriminate between asymptotic $\ln s$ and $\ln^2s$ behavior of total hadronic cross sections when we require that these amplitudes {\em also} describe, on average, low energy data dominated by resonances. We simultaneously fit real analytic amplitudes to the ``sieved'' high energy measurements of $\bar p p$ and $pp$ total cross sections and $\rho$-values for $\sqrt s\ge 6$ GeV, while requiring that their asymptotic fits smoothly join the the $\sigma_{\bar p p}$ and $\sigma_{pp}$ total cross sections at $\sqrt s=$4.0 GeV--again {\em both} in magnitude and slope. Our results strongly favor a high energy $\ln^2s$ fit, basically excluding a $\ln s$ fit. Finally, we make a screened Glauber fit for the p-air cross section, using as input our precisely-determined $pp$ cross sections at cosmic ray energies.Comment: 15 pages, 6 figures, 2 table,Paper delivered at c2cr2005 Conference, Prague, September 7-13, 2005. Fig. 2 was missing from V1. V3 fixes all figure

A Behavior-Based Approach To Securing Email Systems

The Malicious Email Tracking (MET) system, reported in a prior publication, is a behavior-based security system for email services. The Email Mining Toolkit (EMT) presented in this paper is an offline email archive data mining analysis system that is designed to assist computing models of malicious email behavior for deployment in an online MET system. EMT includes a variety of behavior models for email attachments, user accounts and groups of accounts. Each model computed is used to detect anomalous and errant email behaviors. We report on the set of features implemented in the current version of EMT, and describe tests of the system and our plans for extensions to the set of models

Evolving rules for document classification

We describe a novel method for using Genetic Programming to create compact classification rules based on combinations of N-Grams (character strings). Genetic programs acquire fitness by producing rules that are effective classifiers in terms of precision and recall when evaluated against a set of training documents. We describe a set of functions and terminals and provide results from a classification task using the Reuters 21578 dataset. We also suggest that because the induced rules are meaningful to a human analyst they may have a number of other uses beyond classification and provide a basis for text mining applications

Higher Order Polarizabilities of the Proton

Compton scattering results are used to probe proton structure via measurement of higher order polarizabilities. Values for $\alpha_{E2}^p,\beta_{E2}^p,\alpha_{E\nu}^p,$ $\beta_{E\nu}^p$ determined via dispersion relations are compared to predictions based upon chiral symmetry and from the constituent quark model. Extensions to spin-polarizabilities are also discussed.Comment: 18 pages, revised version with one reference adde

Electromagnetic Polarizabilities of Nucleons bound in 40^{40}Ca, 16^{16}O and 4^4He

Differential cross sections for elastic scattering of photons have been measured for $^{40}$Ca at energies of 58 and 74 MeV and for $^{16}$O and $^4$He at 61 MeV, in the angular range from 45$^o$ to 150$^o$. Evidence is obtained that there are no significant in-medium modifications of the electromagnetic polarizabilities except for those originating from meson exchange currents.Comment: 20 pages including 5 Figure

Aspects of Nucleon Compton Scattering

We consider the spin-averaged nucleon forward Compton scattering amplitude in heavy baryon chiral perturbation theory including all terms to order ${\cal O} (q^4)$. The chiral prediction for the spin-averaged forward Compton scattering amplitude is in good agreement with the data for photon energies $\omega \le 110$ MeV. We also evaluate the nucleon electric and magnetic Compton polarizabilities to this order and discuss the uncertainties of the various counter terms entering the chiral expansion of these quantities.Comment: 17 pp, TeX, 7 figures available from the authors, preprint CRN-93/5

Measurement of the Electric and Magnetic Polarizabilities of the Proton

The Compton scattering cross section on the proton has been measured at laboratory angles of 90$^\circ$ and 135$^\circ$ using tagged photons in the energy range 70--100 MeV and simultaneously using untagged photons in the range 100--148~MeV. With the aid of dispersion relations, these cross sections were used to extract the electric and magnetic polarizabilities, $\bar{\alpha}$ and $\bar{\beta}$ respectively, of the proton. We find $$\bar{\alpha}+\bar{\beta} = ( 15.0 \pm 2.9 \pm 1.1 \pm 0.4 ) \times 10^{-4} \: {\rm fm}^3,$$ in agreement with a model-independent dispersion sum rule, and $$\bar{\alpha}-\bar{\beta} = ( 10.8 \pm 1.1 \pm 1.4 \pm 1.0 ) \times 10^{-4} \: {\rm fm}^3,$$ where the errors shown are statistical, systematic, and model-dependent, respectively. A comparison with previous experiments is given and global values for the polarizabilities are extracted.Comment: 35 pages, 11 PostScript figures, uses RevTex 3.

Compton Scattering on the Deuteron in Baryon Chiral Perturbation Theory

Compton scattering on the deuteron is studied in the framework of baryon chiral perturbation theory to third order in small momenta, for photon energies of order the pion mass. The scattering amplitude is a sum of one- and two-nucleon mechanisms with no undetermined parameters. Our results are in good agreement with existing experimental data, and a prediction is made for higher-energy data being analyzed at SAL.Comment: 39 pages LaTeX, 19 figures (uses epsf

Fixed-t subtracted dispersion relations for Compton scattering off the nucleon

We present fixed-$t$ subtracted dispersion relations for Compton scattering off the nucleon at energies $E_\gamma \leq$ 500 MeV, as a formalism to extract the nucleon polarizabilities with a minimum of model dependence. The subtracted dispersion integrals are mainly saturated by $\pi N$ intermediate states in the $s$-channel $\gamma N \to \pi N \to \gamma N$ and $\pi \pi$ intermediate states in the $t$-channel $\gamma \gamma \to \pi \pi \to N \bar N$. For the subprocess $\gamma \gamma \to \pi \pi$, we construct a unitarized amplitude and find a good description of the available data. We show results for Compton scattering using the subtracted dispersion relations and display the sensitivity on the scalar polarizability difference $\alpha - \beta$ and the backward spin polarizability $\gamma_\pi$, which enter directly as fit parameters in the present formalism