Visualising security incidents through event aggregation

Extracting and aggregating the relevant event records relating to an identified security incident from the multitude of heterogeneous logs in an enterprise network is a difficult challenge. Presenting the information in a meaningful way is an additional challenge. This paper looks at solutions to this problem by first identifying three main transforms; log collection, correlation, and visual transformation. Having identified that the CEE project will address the first transform, this paper focuses on the second, while the third is left for future work. To aggregate by correlating event records we demonstrate the use of two correlation methods, simple and composite. These make use of a defined mapping schema and confidence values to dynamically query the normalised dataset and to constrain result events to within a time window. Doing so improves the quality of results, required for the iterative re-querying process being undertaken. Final results of the process are output as nodes and edges suitable for presentation as a network graph.

Profiling event logs to configure risk indicators for process delays

Risk identification is one of the most challenging stages in the risk management process. Conventional risk management approaches provide little guidance and companies often rely on the knowledge of experts for risk identification. In this paper we demonstrate how risk indicators can be used to predict process delays via a method for configuring so-called Process Risk Indicators(PRIs). The method learns suitable configurations from past process behaviour recorded in event logs. To validate the approach we have implemented it as a plug-in of the ProM process mining framework and have conducted experiments using various data sets from a major insurance company.

The responsibility to protect and the Arab Spring : Libya as the exception, Syria as the norm?

On March 17 2011 the UN Security Council passed resolution 1973 authorising the use of force for civilian protection purposes in Libya.1 This resolution was hailed by many supporters of the responsibility to protect (R2P) as a crucial step towards the consolidation of the concept’s normative standing.2 Gareth Evans described the intervention as ‘a textbook case of the R2P norm working exactly as it was supposed to’.3 For Lloyd Axworthy the Libya episode signalled a move towards a ‘more humane world’.4 UN Secretary-General Ban Ki-Moon declared that it ‘affirms, clearly and unequivocally, the international community’s determination to fulfil its responsibility to protect civilians from violence perpetrated by their own government.’5 At first glance, the Security Council’s rapid, decisive response to escalating violence in Libya might well have suggested a new willingness on the part of the international community to take collective action to avert intra-state humanitarian crises. However, a closer examination of the text of resolution 1973 and statements by Security Council member states reveals a less than complete endorsement of R2P. Disagreements between states over the scope of the mandate for the use of force in Libya quickly emerged. Long-standing fears among Russia, China and other non-Western states that R2P could be used as a pretext for regime change returned to the fore as the legality and legitimacy of NATO’s military action were called into question. This post-Libya backlash against R2P has been a central factor in the international community’s subsequent inability to agree on effective civilian protection measures in Syria. Much of the optimism that surrounded R2P in the immediate aftermath of resolution 1973 has given way to a sober realization that achieving international consensus on civilian protection measures will rarely be straightforward.

An isoviscous, isothermal model investigating the influence of hydrostatic recesses on a spring-supported tilting pad thrust bearing

Tilting-pad hydrodynamic thrust bearings are used in hydroelectric power stations around the world, reliably supporting turbines weighing hundreds of tonnes, over decades of service. Newer designs incorporate hydrostatic recesses machined into the sector-shaped pads to enhance oil film thickness at low rotational speeds. External pressurisation practically eliminates wear and enhances service life and reliability. It follows that older generating plants, lacking such assistance, stand to benefit from being retrofitted with hydrostatic lubrication systems. The design process is not trivial however. The need to increase the groove size to permit spontaneous lifting of the turbine under hydrostatic pressure, conflicts with the need to preserve performance of the original plane pad design. A haphazardly designed recess can induce a significant rise in bearing temperature concomitant with reduced mechanical efficiency and risk of thermal damage. In this work, a numerical study of a sector-shaped pad is undertaken to demonstrate how recess size and shape can affect the performance of a typical bearing.

Honesty about adverse event : more honoured in the breach than in the observance?

Part of the chapter: "Sale of Sperm, Health Records, Minimally Conscious States, and Duties of Candour" Although ethical obligations and good medical practice guidelines clearly contemplate open disclosure, there is a dearth of authority as to the nature and extent of a legal duty on Australian doctors to disclose adverse events to patients.

Modeling obligations with event-calculus

Time plays an important role in norms. In this paper we start from our previously proposed classification of obligations, and point out some shortcomings of Event Calculus (EC) to represent obligations. We proposed an extension of EC that avoids such shortcomings and we show how to use it to model the various types of obligations.

The Arab Spring and social media audiences : English and Arabic Twitter users and their networks

Although popular media narratives about the role of social media in driving the events of the 2011 “Arab Spring” are likely to overstate the impact of Facebook and Twitter on these uprisings, it is nonetheless true that protests and unrest in countries from Tunisia to Syria generated a substantial amount of social media activity. On Twitter alone, several millions of tweets containing the hashtags #libya or #egypt were generated during 2011, both by directly affected citizens of these countries and by onlookers from further afield. What remains unclear, though, is the extent to which there was any direct interaction between these two groups (especially considering potential language barriers between them). Building on hashtag data sets gathered between January and November 2011, this article compares patterns of Twitter usage during the popular revolution in Egypt and the civil war in Libya. Using custom-made tools for processing “big data,” we examine the volume of tweets sent by English-, Arabic-, and mixed-language Twitter users over time and examine the networks of interaction (variously through @replying, retweeting, or both) between these groups as they developed and shifted over the course of these uprisings. Examining @reply and retweet traffic, we identify general patterns of information flow between the English- and Arabic-speaking sides of the Twittersphere and highlight the roles played by users bridging both language spheres.

ADMRG @ MediaEval 2013 Social Event Detection

This paper elaborates the approach used by the Applied Data Mining Research Group (ADMRG) for the Social Event Detection (SED) Tasks of the 2013 MediaEval Benchmark. We extended the constrained clustering algorithm to apply to the first semi-supervised clustering task, and we compared several classifiers with Latent Dirichlet Allocation as feature selector in the second event classification task. The proposed approach focuses on scalability and efficient memory allocation when applied to a high dimensional data with large clusters. Results of the first task show the effectiveness of the proposed method. Results from task 2 indicate that attention on the imbalance categories distributions is needed.

Beliefs underlying the intention to donate again among first-time blood donors who experience a mild adverse event

Using the belief basis of the theory of planned behavior (TPB), the current study explored the rate of mild reactions reported by donors in relation to their first donation and the intention and beliefs of those donors with regard to returning to donate again. A high proportion of first-time donors indicated that they had experienced a reaction to blood donation. Further, donors who reacted were less likely to intend to return to donate. Regression analyses suggested that targeting different beliefs for those donors who had and had not reacted would yield most benefit in bolstering donors’ intentions to remain donating. The findings provide insight into those messages that could be communicated via the mass media or in targeted communications to retain first-time donors who have experienced a mild vasovagal reaction.

The ZomPoc Project. A Large Scale Public ARG Event

An experiment in large scale, live, game design and public performance, bringing together participants from across the creative arts to design, deliver and document a project that was both a cooperative learning experience and an experimental public performance. The four month project, funded by the Edge Digital Centre, culminated into a 24 hour ARG event involving over 100 participants in December 2012. Using the premise of a viral outbreak, young enthusiasts auditioned for the roles of Survivor, Zombie, Medic and Military. The main objective was for the Survivors to complete a series of challenges over 24 hours, while the other characters fulfilled their opposing objectives of interference and sabotage supported by both scripted and free-form scenarios staged in constructed scenes throughout the venues. The event was set in the State Library of Queensland and the Edge Digital Centre who granted the project full access, night and day to all areas including public, office and underground areas. These venues were transformed into cinematic settings full of interactive props and various audio-visual effects. The ZomPoc Project was an innovative experiment in writing and directing a large scale, live, public performance, bringing together participants from across the creative industries. In order to design such an event a number of innovative resources were developed exploiting techniques of game design, theatre, film, television and tangible media production. A series of workshops invited local artists, scientists, technicians and engineers to find new ways of collaborating to create networked artifacts, experimental digital works, robotic props, modular set designs, sound effects and unique costuming guided by an innovative multi-platform script developed by Deb Polson. The result of this collaboration was the creation of innovative game and set props, both atmospheric and interactive. Such works animated the space, presented story clues and facilitated interactions between strangers who found themselves sharing a unique experience in unexpected places.

Real-time video event detection in crowded scenes using MPEG derived features : a multiple instance learning approach

This paper presents an investigation into event detection in crowded scenes, where the event of interest co-occurs with other activities and only binary labels at the clip level are available. The proposed approach incorporates a fast feature descriptor from the MPEG domain, and a novel multiple instance learning (MIL) algorithm using sparse approximation and random sensing. MPEG motion vectors are used to build particle trajectories that represent the motion of objects in uniform video clips, and the MPEG DCT coefficients are used to compute a foreground map to remove background particles. Trajectories are transformed into the Fourier domain, and the Fourier representations are quantized into visual words using the K-Means algorithm. The proposed MIL algorithm models the scene as a linear combination of independent events, where each event is a distribution of visual words. Experimental results show that the proposed approaches achieve promising results for event detection compared to the state-of-the-art.

An evaluation of different features and learning models for anomalous event detection

The huge amount of CCTV footage available makes it very burdensome to process these videos manually through human operators. This has made automated processing of video footage through computer vision technologies necessary. During the past several years, there has been a large effort to detect abnormal activities through computer vision techniques. Typically, the problem is formulated as a novelty detection task where the system is trained on normal data and is required to detect events which do not fit the learned ‘normal’ model. There is no precise and exact definition for an abnormal activity; it is dependent on the context of the scene. Hence there is a requirement for different feature sets to detect different kinds of abnormal activities. In this work we evaluate the performance of different state of the art features to detect the presence of the abnormal objects in the scene. These include optical flow vectors to detect motion related anomalies, textures of optical flow and image textures to detect the presence of abnormal objects. These extracted features in different combinations are modeled using different state of the art models such as Gaussian mixture model(GMM) and Semi- 2D Hidden Markov model(HMM) to analyse the performances. Further we apply perspective normalization to the extracted features to compensate for perspective distortion due to the distance between the camera and objects of consideration. The proposed approach is evaluated using the publicly available UCSD datasets and we demonstrate improved performance compared to other state of the art methods.

Stored blood products augment inflammation in a two-event model of Transfusion Related Acute Lung Injury (TRALI)

Aim/Background TRALI is hypothesised to develop via a two-event mechanism involving both the patieint's underlying morbidity and blood product factors. The storage of cellular products has been implicated in cases of non-antibody mediated TRALI, however the pathophysiological mechanisms are undefined. We investigated blood product storage-related modulation of inflmmatory cells and medicators involved in TRALI. Methods In an in vitro mode, fresh human whole blood was mixed with culture media (control) or LPS as a 1st event and "transfused" with 10% (v/v) pooled supernatant (SN) from Day 1 (d1, n=75) or Day 42 (D42, n=113) packed red blood cells (PRBCs) as a 2nd event. Following 6hrs, culture SN was used to assess the overall inflammatory response (cytometric bead array) and a duplicate assay containing protein transport inhibitor was used to assess neutrophil- and monocyte-specific inflmamatory responses using multi-colour flow cytometry. Panels: IL-6, IL-8, IL-10, IL-12, IL-1, TNF, MCP-1, IP-10, MIP-1. One-way ANOVA 95% CI. Results In the absence of LPS, exposure to D1 or D42 PRBC-SN reduced monocyte expression of IL-6, IL-8 and Il-10. D42 PRBC-SN also reduced monocyte IP-10, and the overall IL-8 production was increased. In the presence of LPS, D1-PRBC SN only modified overall IP-10 levels which were reduced. However, cf LPS alone, the combination of LPS and D42 PRBC-SN resulted in increased neutrophil and monocyte productionof IL-1 and IL-8 as well as reduced monocyte TNF production. Additionally, LPS and D42 PRBC-SN resulted in overall inflmmatory changes: elevated IL-8, event mechanism of TRALI pathogenesis, and highlights blood product storage duration as a factor contributing to the development of inflmamatory responses in non-antibody mediated TRALI.