Introduction to Security Onion

Security Onion is a Network Security Manager (NSM) platform that provides multiple Intrusion Detection Systems (IDS) including Host IDS (HIDS) and Network IDS (NIDS). Many types of data can be acquired using Security Onion for analysis. This includes data related to: Host, Network, Session, Asset, Alert and Protocols. Security Onion can be implemented as a standalone deployment with server and sensor included or with a master server and multiple sensors allowing for the system to be scaled as required. Many interfaces and tools are available for management of the system and analysis of data such as Sguil, Snorby, Squert and Enterprise Log Search and Archive (ELSA). These interfaces can be used for analysis of alerts and captured events and then can be further exported for analysis in Network Forensic Analysis Tools (NFAT) such as NetworkMiner, CapME or Xplico. The Security Onion platform also provides various methods of management such as Secure SHell (SSH) for management of server and sensors and Web client remote access. All of this with the ability to replay and analyse example malicious traffic makes the Security Onion a suitable low cost alternative for Network Security Management. In this paper, we have a feature and functionality review for the Security Onion in terms of: types of data, configuration, interface, tools and system management.

‘‘Model age-based” and ‘‘copy when uncertain” biases in children’s social learning of a novel task

Theoretical models of social learning predict that individuals can benefit from using strategies that specify when and whom to copy. Here the interaction of two social learning strategies, model age-based biased copying and copy when uncertain, was investigated. Uncertainty was created via a systematic manipulation of demonstration efficacy (completeness) and efficiency (causal relevance of some actions). The participants, 4- to 6-year-old children (N = 140), viewed both an adult model and a child model, each of whom used a different tool on a novel task. They did so in a complete condition, a near-complete condition, a partial demonstration condition, or a no-demonstration condition. Half of the demonstrations in each condition incorporated causally irrelevant actions by the models. Social transmission was assessed by first responses but also through children’s continued fidelity, the hallmark of social traditions. Results revealed a bias to copy the child model both on first response and in continued interactions. Demonstration efficacy and efficiency did not affect choice of model at first response but did influence solution exploration across trials, with demonstrations containing causally irrelevant actions decreasing exploration of alternative methods. These results imply that uncertain environments can result in canalized social learning from specific classes of mode