Data Reduction in Intrusion Alert Correlation

Network intrusion detection sensors are usually built around low level models of network traffic. This means that their output is of a similarly low level and as a consequence, is difficult to analyze. Intrusion alert correlation is the task of automating some of this analysis by grouping related alerts together. Attack graphs provide an intuitive model for such analysis. Unfortunately alert flooding attacks can still cause a loss of service on sensors, and when performing attack graph correlation, there can be a large number of extraneous alerts included in the output graph. This obscures the fine structure of genuine attacks and makes them more difficult for human operators to discern. This paper explores modified correlation algorithms which attempt to minimize the impact of this attack.

Neural fields with sigmoidal firing rates: approximate solutions

Many tissue level models of neural networks are written in the language of nonlinear integro-differential equations. Analytical solutions have only been obtained for the special case that the nonlinearity is a Heaviside function. Thus the pursuit of even approximate solutions to such models is of interest to the broad mathematical neuroscience community. Here we develop one such scheme, for stationary and travelling wave solutions, that can deal with a certain class of smoothed Heaviside functions. The distribution that smoothes the Heaviside is viewed as a fundamental object, and all expressions describing the scheme are constructed in terms of integrals over this distribution. The comparison of our scheme and results from direct numerical simulations is used to highlight the very good levels of approximation that can be achieved by iterating the process only a small number of times.