Time correlated anomaly detection based on inferences

Anomaly detection techniques are used to find the presence of anomalous activities in a network by comparing traffic data activities against a "normal" baseline. Although it has several advantages which include detection of "zero-day" attacks, the question surrounding absolute definition of systems deviations from its "normal" behaviour is important to reduce the number of false positives in the system. This study proposes a novel multi-agent network-based framework known as Statistical model for Correlation and Detection (SCoDe), an anomaly detection framework that looks for timecorrelated anomalies by leveraging statistical properties of a large network, monitoring the rate of events occurrence based on their intensity. SCoDe is an instantaneous learning-based anomaly detector, practically shifting away from the conventional technique of having a training phase prior to detection. It does acquire its training using the improved extension of Exponential Weighted Moving Average (EWMA) which is proposed in this study. SCoDe does not require any previous knowledge of the network traffic, or network administrators chosen reference window as normal but effectively builds upon the statistical properties from different attributes of the network traffic, to correlate undesirable deviations in order to identify abnormal patterns. The approach is generic as it can be easily modified to fit particular types of problems, with a predefined attribute, and it is highly robust because of the proposed statistical approach. The proposed framework was targeted to detect attacks that increase the number of activities on the network server, examples which include Distributed Denial of Service (DDoS) and, flood and flash-crowd events. This paper provides a mathematical foundation for SCoDe, describing the specific implementation and testing of the approach based on a network log file generated from the cyber range simulation experiment of the industrial partner of this project.

Validity of a wearable accelerometer device to measure average acceleration values during high speed running

The aim of this study was to determine the validity of an accelerometer to measure average acceleration values during high speed running. Thirteen subjects performed three sprint efforts over a 40 m distance (n = 39). Acceleration was measured using a 100 Hz tri-axial accelerometer integrated within a wearable tracking device (SPI-HPU, GPSports, Canberra). To provide a concurrent measure of acceleration, timing gates were positioned at 10 m intervals (0 m - 40 m). Accelerometer data collected during 0 m - 10 m and 10 m - 20 m provided a measure of average acceleration values. Accelerometer data was recorded as the raw output and filtered by applying a 3 point moving average and a 10 point moving average. The accelerometer could not measure average acceleration values during high speed running. The accelerometer significantly overestimated average acceleration values during both 0 m - 10 m and 10 m - 20 m, regardless of the data filtering technique (p < 0.001). Body mass significantly affected all accelerometer variables (p < 0.10, partial η = 0.091 - 0.219). Body mass and the absence of a gravity compensation formula affect the accuracy and practicality of accelerometers. Until GPSports integrated accelerometers incorporate a gravity compensation formula the usefulness of any accelerometer derived algorithms is questionable.

Forecasting Fiji's exports and imports, 2003-2020

Purpose – The purpose of this paper is to forecast Fiji's exports and imports for the period 2003-2020.

Design/methodology/approach – To achieve the goal of this paper, the autoregressive moving average with explanatory variables (ARMAX) model was applied. To this end, the paper drew on the published export demand model and the import demand model of Narayan and Narayan for Fiji.

Findings – The paper's main findings are: Fiji's imports will outperform exports over the 2003-2020 period; and current account deficits will escalate to be around F$934.4 million on average over the 2003-2020 period.

Originality/value – Exports and imports are crucial for macroeconomic policymaking. It measures the degree of openness of a country and it signals the trade balance and current account balances. This has implications for inflation and exchange rate. By forecasting Fiji's exports and imports, the paper provides policy makers with a set of information that will be useful for devising macroeconomic policies.

Stability and convergence analysis of transform-domain LMS adaptive filters with second-order autoregressive process

In this paper, the stability and convergence properties of the class of transform-domain least mean square (LMS) adaptive filters with second-order autoregressive (AR) process are investigated. It is well known that this class of adaptive filters improve convergence property of the standard LMS adaptive filters by applying the fixed data-independent orthogonal transforms and power normalization. However, the convergence performance of this class of adaptive filters can be quite different for various input processes, and it has not been fully explored. In this paper, we first discuss the mean-square stability and steady-state performance of this class of adaptive filters. We then analyze the effects of the transforms and power normalization performed in the various adaptive filters for both first-order and second-order AR processes. We derive the input asymptotic eigenvalue distributions and make comparisons on their convergence performance. Finally, computer simulations on AR process as well as moving-average (MA) process and autoregressive-moving-average (ARMA) process are demonstrated for the support of the analytical results.

The effect of smokefree policies on electronic gaming machine expenditure in Victoria, Australia

Objective: To examine the impact of smoke-free policies in Victorian gambling venues on electronic gaming machine (EGM) expenditure.

Method: Monthly EGM expenditure from July 1998 to December 2005, provided by the Victorian Commission for Gambling Regulation and the Office of the Liquor and Gambling Commissioner in South Australia, was analysed. The outcome measure was the ratio of monthly expenditure for Victoria to monthly expenditure in South Australia. Intervention analysis and autoregressive integrated moving average modelling were used to assess the impact of the smoke-free policy on expenditure.

Results: The smoke-free policy resulted in an abrupt, long-term decrease in the level of EGM expenditure. The mean level of monthly expenditure decreased by approximately 14%.

Conclusion: The smoke-free policy not only protects hospitality workers and patrons from exposure to secondhand smoke but has also had an impact on slowing gambling losses.

The effect of smoke-free policies on electronic gaming machine expenditure in Victoria, Australia

Objective: To examine the impact of smoke-free policies in Victorian gambling venues on electronic gaming machine (EGM) expenditure.

Method: Monthly EGM expenditure from July 1998 to December 2005, provided by the Victorian Commission for Gambling Regulation and the Office of the Liquor and Gambling Commissioner in South Australia, was analysed. The outcome measure was the ratio of monthly expenditure for Victoria to monthly expenditure in South Australia. Intervention analysis and autoregressive integrated moving average modelling were used to assess the impact of the smoke-free policy on expenditure.

Results: The smoke-free policy resulted in an abrupt, long-term decrease in the level of EGM expenditure. The mean level of monthly expenditure decreased by approximately 14%.

Conclusion: The smoke-free policy not only protects hospitality workers and patrons from exposure to secondhand smoke but has also had an impact on slowing gambling losses.

Predicting future intensive care demand in Australia

BACKGROUND: Predicting future demand for intensive care is vital to planning the allocation of resources.

METHOD: Mathematical modelling using the autoregressive integrated moving average (ARIMA) was applied to intensive care data from the Australian and New Zealand Intensive Care Society (ANZICS) Core Database and population projections from the Australian Bureau of Statistics to forecast future demand in Australian intensive care.

RESULTS: The model forecasts an increase in ICU demand of over 50% by 2020, with current total ICU bed-days (in 2007) of 471 358, predicted to increase to 643 160 by 2020. An increased rate of ICU use by patients older than 80 years was also noted, with the average bed-days per 10 000 population for this group increasing from 396 in 2006 to 741 in 2007.

CONCLUSION: An increase in demand of the forecast magnitude could not be accommodated within current ICU capacity. Significant action will be required.

Damage identification of civil infrastructure in the time domain using FEM calibrated ARMAX model

Due to environmental loads, mechanical damages, structural aging and human factors, civil infrastructure inevitably deteriorate during their service lives. Since their damage may claim human lives and cause significant economic losses, how to identify damages and assess structural conditions timely and accurately has drawn increasingly more attentions from structural engineering community worldwide. In this study, a fast and sensitive time domain damage identification method will be developed. First, a high quality finite element model is built and the structural responses are simulated under different damage scenarios. Based on the simulated data, an Auto Regressive Moving Average Exogenous (ARMAX) model is then developed and calibrated. The calibrated ARMAX model can be used to identify damage in different scenarios through model updating process using clonal selection algorithm (CSA). The identification results demonstrate the performance of the proposed methodology, which has the potential to be used for damage identification in practices.

FEM calibrated ARMAX model updating method for time domain damage identification

Due to environmental loads, mechanical damages, structural aging and human factors, civil infrastructure inevitably deteriorate during their service lives. Since their damage may claim human lives and cause significant economic losses, how to identify damages and assess structural conditions timely and accurately has drawn increasingly more attentions from structural engineering community worldwide. In this study, a fast and sensitive time domain damage identification method will be developed. To do this, a finite element model of a steel pipe laid on the soil is built and the structural responses are simulated under different damage scenarios. Based on the simulated data, an Auto Regressive Moving Average Exogenous (ARMAX) model is then built and calibrated. The calibrated ARMAX model is used to identify different damage scenarios through model updating process using clonal selection algorithm (CSA). The results demonstrate the application potential of the proposed method in identifying the pipeline conditions. To further verify its performance, laboratory tests of a steel pipe laid on the soil with and without soil support (free span damage) are carried out. The identification results of pipe-soil system show that the proposed method is capable of identifying damagein a complex structural system. Therefore, it can be applied to identifying pipeline conditions.

Recommendations for improved data processing from expired gas analysis indirect calorimetry

There is currently no universally recommended and accepted method of data processing within the science of indirect calorimetry for either mixing chamber or breath-by-breath systems of expired gas analysis. Exercise physiologists were first surveyed to determine methods used to process oxygen consumption ([OV0312]O 2) data, and current attitudes to data processing within the science of indirect calorimetry. Breath-by-breath datasets obtained from indirect calorimetry during incremental exercise were then used to demonstrate the consequences of commonly used time, breath and digital filter post-acquisition data processing strategies. Assessment of the variability in breath-by-breath data was determined using multiple regression based on the independent variables ventilation (VE), and the expired gas fractions for oxygen and carbon dioxide, FEO 2 and FECO2, respectively. Based on the results of explanation of variance of the breath-by-breath [OV0312]O2 data, methods of processing to remove variability were proposed for time-averaged, breath-averaged and digital filter applications. Among exercise physiologists, the strategy used to remove the variability in sequential [OV0312]O2 measurements varied widely, and consisted of time averages (30 sec [38%], 60 sec [18%], 20 sec [11%], 15 sec [8%]), a moving average of five to 11 breaths (10%), and the middle five of seven breaths (7%). Most respondents indicated that they used multiple criteria to establish maximum [OV0312]O 2 ([OV0312]O2max) including: the attainment of age-predicted maximum heart rate (HRmax) [53%], respiratory exchange ratio (RER) >1.10 (49%) or RER >1.15 (27%) and a rating of perceived exertion (RPE) of >17, 18 or 19 (20%). The reasons stated for these strategies included their own beliefs (32%), what they were taught (26%), what they read in research articles (22%), tradition (13%) and the influence of their colleagues (7%). The combination of VE, FEO 2 and FECO2 removed 96-98% of [OV0312]O2 breath-by-breath variability in incremental and steady-state exercise [OV0312]O2 data sets, respectively. Correction of residual error in [OV0312]O2 datasets to 10% of the raw variability results from application of a 30-second time average, 15-breath running average, or a 0.04 Hz low cut-off digital filter. Thus, we recommend that once these data processing strategies are used, the peak or maximal value becomes the highest processed datapoint. Exercise physiologists need to agree on, and continually refine through empirical research, a consistent process for analysing data from indirect calorimetry.

Changes in injury-related hospital emergency department presentations associated with the imposition of regulatory versus voluntary licensing conditions on licensed venues in two cities

Introduction and Aims
Regulatory and collaborative intervention strategies have been developed to reduce the harms associated with alcohol consumption on licensed venues around the world, but there remains little research evidence regarding their comparative effectiveness. This paper describes concurrent changes in the number of night-time injury-related hospital emergency department presentations in two cities that implemented either a collaborative voluntary approach to reducing harms associated with licensed premises (Geelong) or a regulatory approach (Newcastle).

Design and Methods
This paper reports findings from Dealing with Alcohol-Related problems in the Night-Time Economy project. Data were drawn from injury-specific International Classification of Disease, 10th Revision codes for injuries (S and T codes) presenting during high-alcohol risk times (midnight—5.59 am, Saturday and Sunday mornings) at the emergency departments in Geelong Hospital and Newcastle (John Hunter Hospital and the Calvary Mater Hospital), before and after the introduction of licensing conditions between the years of 2005 and 2011. Time-series, seasonal autoregressive integrated moving average analyses were conducted on the data obtained from patients' medical records.

Results
Significant reductions in injury-related presentations during high-alcohol risk times were found for Newcastle since the imposition of regulatory licensing conditions (344 attendances per year, P < 0.001). None of the interventions deployed in Geelong (e.g. identification scanners, police operations, radio networks or closed-circuit television) were associated with reductions in emergency department presentations.

Discussion and Conclusions
The data suggest that mandatory interventions based on trading hours restrictions were associated with reduced emergency department injury presentations in high-alcohol hours than voluntary interventions. [Miller P, Curtis A, Palmer D, Busija L, Tindall J, Droste N, Gillham K, Coomber K, Wiggers J. Changes in injury-related hospital emergency department presentations associated with the imposition of regulatory versus voluntary licensing conditions on licensed venues in two cities. Drug Alcohol Rev 2014]*

Structural damage identification based on self-fitting ARMAX model and multi-sensor data fusion

Statistical time series methods have proven to be a promising technique in structural health monitoring, since it provides a direct form of data analysis and eliminates the requirement for domain transformation. Latest research in structural health monitoring presents a number of statistical models that have been successfully used to construct quantified models of vibration response signals. Although a majority of these studies present viable results, the aspects of practical implementation, statistical model construction and decision-making procedures are often vaguely defined or omitted from presented work. In this article, a comprehensive methodology is developed, which essentially utilizes an auto-regressive moving average with exogenous input model to create quantified model estimates of experimentally acquired response signals. An iterative self-fitting algorithm is proposed to construct and fit the auto-regressive moving average with exogenous input model, which is capable of integrally finding an optimum set of auto-regressive moving average with exogenous input model parameters. After creating a dataset of quantified response signals, an unlabelled response signal can be identified according to a 'closest-fit' available in the dataset. A unique averaging method is proposed and implemented for multi-sensor data fusion to decrease the margin of error with sensors, thus increasing the reliability of global damage identification. To demonstrate the effectiveness of the developed methodology, a steel frame structure subjected to various bolt-connection damage scenarios is tested. Damage identification results from the experimental study suggest that the proposed methodology can be employed as an efficient and functional damage identification tool. © The Author(s) 2014.

Time series analysis of the impact of tobacco control policies on smoking prevalence among Australian adults, 2001–2011

Objective: To determine the impact of tobacco control policies and mass media campaigns on smoking prevalence in Australian adults.
Methods: Data for calculating the average monthly prevalence of smoking between January 2001 and June 2011 were obtained via structured interviews of randomly sampled adults aged 18 years or older from Australia’s five largest capital cities (monthly mean number of adults interviewed: 2375). The influence on smoking prevalence was estimated for increased tobacco taxes; strengthened smoke-free laws; increased monthly population exposure to televised tobacco control mass media campaigns and pharmaceutical company advertising for nicotine replacement therapy (NRT), using gross ratings points; monthly sales of NRT, bupropion and varenicline; and introduction of graphic health warnings on cigarette packs. Autoregressive integrated moving average (ARIMA) models were used to examine the influence of these interventions on smoking prevalence.
Findings: The mean smoking prevalence for the study period was 19.9% (standard deviation: 2.0%), with a drop from 23.6% (in January 2001) to 17.3% (in June 2011). The best-fitting model showed that stronger smoke-free laws, tobacco price increases and greater exposure to mass media campaigns independently explained 76% of the decrease in smoking prevalence from February 2002 to June 2011.
Conclusion: Increased tobacco taxation, more comprehensive smoke-free laws and increased investment in mass media campaigns played a substantial role in reducing smoking prevalence among Australian adults between 2001 and 2011.

The incidence of V˙O2 plateau at V˙O2max in a cardiac-diseased population

We sought to determine the incidence of V˙O(2) plateau at V˙O(2)max in a cardiovascular-diseased (CVD) population using 4 different sampling intervals (15-breath moving average, 15 s, 30 s, and 60 s) and 3 different V˙O(2) plateau criteria (≤50 mL · min(-1), ≤80 mL · min(-1), and ≤150 mL · min(-1)). A total of 69 people (62 ± 10 yrs.) with recently diagnosed CVD performed a maximal exercise test (10:07 ± 2:24 min) on a treadmill. The test was classified as maximal (n = 57, 2 430 ± 605 mL · min(-1)) if self-terminated due to fatigue or classified as symptom-limited (n = 12, 1 683 ± 438 mL · min(-1)) if symptoms presented. Chi-square analysis revealed a significant (p < 0.05) effect of sampling interval on incidence of V˙O(2) plateau at V˙O(2)max across all 3 V˙O(2) plateau criteria. The sampling interval had an increasingly stronger influence on the incidence of V˙O(2) plateau at V˙O(2)max with smaller criterion thresholds as evidenced by the Cramer's V statistics: [≤50 mL · min(-1) (Cramer's V = 0.548, p < 0.05], ≤80 mL · min(-1) [Cramer's V = 0.489, p < 0.05], ≤150 mL · min(-1) [Cramer's V = 0.214, p < 0.05]. Incidence of V˙O(2) plateau at V˙O(2)max in CVD individuals is significantly influenced by the sampling interval applied. Based on our findings we recommend a15 breath moving average and V˙O(2) plateau criterion of ≤50 mL · min(-1).