A scalable SIEM correlation engine and its application to the Olympic Games IT infrastructure

The security event correlation scalability has become a major concern for security analysts and IT administrators when considering complex IT infrastructures that need to handle gargantuan amounts of events or wide correlation window spans. The current correlation capabilities of Security Information and Event Management (SIEM), based on a single node in centralized servers, have proved to be insufficient to process large event streams. This paper introduces a step forward in the current state of the art to address the aforementioned problems. The proposed model takes into account the two main aspects of this ?eld: distributed correlation and query parallelization. We present a case study of a multiple-step attack on the Olympic Games IT infrastructure to illustrate the applicability of our approach.

Sistema de correlação de eventos e notificações - SCEN

Mestrado em Engenharia Electrotécnica e de Computadores

Lake level reconstructions at Laguna Potrok Aike (southern Patagonia, Argentina) for the last 49 ka

Four seismic surveys and a stratigraphic record from southernmost Patagonia (Argentina) based on 51 AMS-14C dates obtained in the framework of ICDP expedition 5022 "Potrok Aike Maar Lake Sediment Archive Drilling Project" (PASADO) provide a database to compare the 106 m composite profile from the lake centre with piston cores from the littoral and outcrops in the catchment area. Based on event correlation using distinct volcanic ash layers with unique geochemical composition and optically stimulated luminescence (OSL) dates on feldspars, sediment records are firmly linked. This approach allows to match the sediment record with water levels during the past ca. 49 ka providing evidence for lake level variations. Reconstructed lake levels were 20 m higher than today during the last Glacial until the early Holocene. With the migration of the Southern Hemispheric Westerlies over this site the lake level dropped ca. 55 m for a period of two millennia. Thereupon the water balance was more positive again causing a stepwise rise of the lake level until the maximum was reached during the Little Ice Age with a subsequent lowering since the 20th century. We suggest that the mid- to late-Holocene lake level variation is caused by intensity changes of the Southern Hemispheric Westerlies.

Sensoriamento automático e participativo em cidades.

As cidades estão a seu tempo e a seu modo, modernizando os serviços prestados à população. Entre os diversos fatores que estão contribuindo para esta evolução estão a diversificação e proliferação de sensores, nos diversos domínios de serviços das cidades, e os novos canais de comunicação com os munícipes, entre eles, as redes sociais e mais recentemente os sistemas crowdsensing, motivados pelos anseios sociais, por melhores serviços públicos e pela popularização dos dispositivos móveis. Nesta direção, a eficiência administrativa é um fator essencial, uma vez que as cidades estão se mostrando mais complexas na medida em que cresce a população nas áreas urbanas. A utilização de técnicas de sistemas distribuídos para que múltiplos domínios de serviços usufruam da mesma infraestrutura computacional, pode auxiliar na eficiência das cidades, evitando gastos administrativos duplicados e até mesmo, possibilitando a correlação de eventos entre os serviços, favorecendo a identificação de fatores de causalidades e assim, a tomada de decisões administrativas mais objetivas e precisas. Neste contexto, este trabalho concentra-se na análise de um middleware direcionado à gestão de cidades para coleta, integração e interpretação dos dados de sensores, pertencentes aos serviços disponíveis da própria cidade, junto com os dados do sensoriamento colaborado pelos cidadãos. Para avaliação do conceito foi investigado o cenário de monitoração da conservação de vias públicas. Após 3 meses de coletas de dados por um sistema de sensoriamento automático, totalizando mais de 360 mil pontos e também mais de 90 relatórios pelo sensoriamento participativo, verificou-se que um sistema distribuído pode realizar a interpretação de séries históricas, engajar os munícipes apoiar a manutenção dos serviços da cidade e também indicar objetivamente aos gestores públicos os pontos que devem ser prioritariamente atendidos. Aliar ferramentas pelas quais o cidadão pode, de acordo com sua necessidade, convicção e altruísmo, exercer influência nos gestores públicos com o suporte de informação contínua e critérios objetivos das redes de sensores, pode estimular a continua excelência dos serviços públicos.

Event-related FMRI analysis with maximum correlation modelling

Functional magnetic resonance imaging (FMRI) analysis methods can be quite generally divided into hypothesis-driven and data-driven approaches. The former are utilised in the majority of FMRI studies, where a specific haemodynamic response is modelled utilising knowledge of event timing during the scan, and is tested against the data using a t test or a correlation analysis. These approaches often lack the flexibility to account for variability in haemodynamic response across subjects and brain regions which is of specific interest in high-temporal resolution event-related studies. Current data-driven approaches attempt to identify components of interest in the data, but currently do not utilise any physiological information for the discrimination of these components. Here we present a hypothesis-driven approach that is an extension of Friman's maximum correlation modelling method (Neurolmage 16, 454-464, 2002) specifically focused on discriminating the temporal characteristics of event-related haemodynamic activity. Test analyses, on both simulated and real event-related FMRI data, will be presented.

An epistemic event -based correlation scheme for pervasive network management

Computer networks produce tremendous amounts of event-based data that can be collected and managed to support an increasing number of new classes of pervasive applications. Examples of such applications are network monitoring and crisis management. Although the problem of distributed event-based management has been addressed in the non-pervasive settings such as the Internet, the domain of pervasive networks has its own characteristics that make these results non-applicable. Many of these applications are based on time-series data that possess the form of time-ordered series of events. Such applications also embody the need to handle large volumes of unexpected events, often modified on-the-fly, containing conflicting information, and dealing with rapidly changing contexts while producing results with low-latency. Correlating events across contextual dimensions holds the key to expanding the capabilities and improving the performance of these applications. This dissertation addresses this critical challenge. It establishes an effective scheme for complex-event semantic correlation. The scheme examines epistemic uncertainty in computer networks by fusing event synchronization concepts with belief theory. Because of the distributed nature of the event detection, time-delays are considered. Events are no longer instantaneous, but duration is associated with them. Existing algorithms for synchronizing time are split into two classes, one of which is asserted to provide a faster means for converging time and hence better suited for pervasive network management. Besides the temporal dimension, the scheme considers imprecision and uncertainty when an event is detected. A belief value is therefore associated with the semantics and the detection of composite events. This belief value is generated by a consensus among participating entities in a computer network. The scheme taps into in-network processing capabilities of pervasive computer networks and can withstand missing or conflicting information gathered from multiple participating entities. Thus, this dissertation advances knowledge in the field of network management by facilitating the full utilization of characteristics offered by pervasive, distributed and wireless technologies in contemporary and future computer networks.

An Epistemic Event-based Correlation Scheme for Pervasive Network Management

Computer networks produce tremendous amounts of event-based data that can be collected and managed to support an increasing number of new classes of pervasive applications. Examples of such applications are network monitoring and crisis management. Although the problem of distributed event-based management has been addressed in the non-pervasive settings such as the Internet, the domain of pervasive networks has its own characteristics that make these results non-applicable. Many of these applications are based on time-series data that possess the form of time-ordered series of events. Such applications also embody the need to handle large volumes of unexpected events, often modified on-the-fly, containing conflicting information, and dealing with rapidly changing contexts while producing results with low-latency. Correlating events across contextual dimensions holds the key to expanding the capabilities and improving the performance of these applications. This dissertation addresses this critical challenge. It establishes an effective scheme for complex-event semantic correlation. The scheme examines epistemic uncertainty in computer networks by fusing event synchronization concepts with belief theory. Because of the distributed nature of the event detection, time-delays are considered. Events are no longer instantaneous, but duration is associated with them. Existing algorithms for synchronizing time are split into two classes, one of which is asserted to provide a faster means for converging time and hence better suited for pervasive network management. Besides the temporal dimension, the scheme considers imprecision and uncertainty when an event is detected. A belief value is therefore associated with the semantics and the detection of composite events. This belief value is generated by a consensus among participating entities in a computer network. The scheme taps into in-network processing capabilities of pervasive computer networks and can withstand missing or conflicting information gathered from multiple participating entities. Thus, this dissertation advances knowledge in the field of network management by facilitating the full utilization of characteristics offered by pervasive, distributed and wireless technologies in contemporary and future computer networks.

Directed flow at midrapidity in event-by-event hydrodynamics

Fluctuations in the initial geometry of a nucleus-nucleus collision have been recently shown to result in a new type of directed flow (v(1)) that, unlike the usual directed flow, is also present at midrapidity. We compute this new v(1) versus transverse momentum and centrality for Au-Au collisions at RHIC using the hydrodynamic code NeXSPheRIO. We find that the event plane of v(1) is correlated with the angle of the initial dipole of the distribution, as predicted, though with a large dispersion. It is uncorrelated with the reaction plane. Our results are in excellent agreement with results inferred from STAR correlation data.

Three-Particle Coincidence of the Long Range Pseudorapidity Correlation in High Energy Nucleus-Nucleus Collisions

We report the first three-particle coincidence measurement in pseudorapidity (Delta eta) between a high transverse momentum (p(perpendicular to)) trigger particle and two lower p(perpendicular to) associated particles within azimuth |Delta phi| < 0.7 in root s(NN) = 200 GeV d + Au and Au + Au collisions. Charge ordering properties are exploited to separate the jetlike component and the ridge (long range Delta eta correlation). The results indicate that the correlation of ridge particles are uniform not only with respect to the trigger particle but also between themselves event by event in our measured Delta eta. In addition, the production of the ridge appears to be uncorrelated to the presence of the narrow jetlike component.

Correlation of habitual physical activity levels with flow mediated dilation of the brachial artery in 5-10 year old children

Endothelial dysfunction is an early key event of atherogenesis. Both fitness level and exercise intervention have been shown to positively influence endothelial function. In a cross-sectional study of 47 children, the relationship between habitual physical activity and flow-mediated dilation (FMD) of the brachial artery was explored. Habitual physical activity levels (PALs) were assessed using a validated stable isotope technique, and FMD of the brachial artery was measured via high-resolution ultrasound. The results showed that habitual physical activity significantly correlated with FMD (r=0.39, P=0.007), and remained the most influential variable on dilation in multivariate analysis. Although both fitness level and exercise intervention have previously been shown to positively influence FMD, this is the first time that a relationship with normal PALs has been investigated, especially, at such a young age. These data support the concept that physical activity exerts its protective effect on cardiovascular health via the endothelium and add further emphasis to the importance of physical activity in childhood.

An event-related fMRI study of cognitive deficits in Huntington's disease

The BOLD contrast signal history determined by lagged Unear correlation has a significant contribution to functional connectivity in activation data sets. It has been demonstrated that in resting state fMRI data, the major contribution to synchronous correlation between functionally connected areas arises from low frequency contributions (

Histoplasma capsulatum Cell Wall beta-Glucan Induces Lipid Body Formation through CD18, TLR2, and Dectin-1 Receptors: Correlation with Leukotriene B(4) Generation and Role in HIV-1 Infection

Histoplasma capsulatum (Hc) is a facultative, intracellular parasite of worldwide significance. Infection with Hc produces a broad spectrum of diseases and may progress to a life-threatening systemic disease, particularly in individuals with HIV infection. Resolution of histoplasmosis is associated with the activation of cell-mediated immunity, and leukotriene B(4) plays an important role in this event. Lipid bodies (LBs) are increasingly being recognized as multifunctional organelles with roles in inflammation and infection. In this study, we investigated LB formation in histoplasmosis and its putative function in innate immunity. LB formation in leukocytes harvested from Hc-infected C57BL/6 mice peaks on day 2 postinfection and correlates with enhanced generation of lipid mediators, including leukotriene B(4) and PGE(2). Pretreatment of leukocytes with platelet-activating factor and BLT1 receptor antagonists showed that both lipid mediators are involved in cell signaling for LB formation. Alveolar leukocytes cultured with live or dead Hc also presented an increase in LB numbers. The yeast alkali-insoluble fraction 1, which contains mainly beta-glucan isolated from the Hc cell wall, induced a dose- and time-dependent increase in LB numbers, indicating that beta-glucan plays a signaling role in LB formation. In agreement with this hypothesis, beta-glucan-elicited LB formation was inhibited in leukocytes from 5-LO(-/-), CD18(low) and TLR2(-/-) mice, as well as in leukocytes pretreated with anti-Dectin-1 Ab. Interestingly, human monocytes from HIV-1-infected patients failed to produce LBs after beta-glucan stimulation. These results demonstrate that Hc induces LB formation, an event correlated with eicosanoid production, and suggest a role for these lipid-enriched organelles in host defense during fungal infection. The Journal of Immunology, 2009, 182: 4025-4035.

The beliefs of nurses who were involved in a whistleblowing event

Background. Nursing codes of ethics bind nurses to the role of patient advocate and compel them to take action when the rights or safety of a patient are jeopardized. Reporting misconduct is known as whistleblowing and studies indicate that there are personal and professional risks involved in blowing the whistle. Aim. The aim of this study was to explore the beliefs of nurses who wrestled with this ethical dilemma. Design. A descriptive survey design was used to examine the beliefs of nurses in Western Australia who reported misconduct (whistleblowers) and of those who did not report misconduct (nonwhistleblowers). Methods. The instrument listed statements from current ethical codes, statements from traditional views on nursing and statements of beliefs related to the participant's whistleblowing experience. Respondents were asked to rate each item on a five-point Likert format which ranged from strongly agree to strongly disagree. Data were analysed using a Pearson's correlation matrix and one-way ANOVA. To further explore the data, a factor analysis was run with varimax rotation. Results. Results indicated that whistleblowers supported the beliefs inherent in patient advocacy, while nonwhistleblowers retained a belief in the traditional role of nursing. Participants who reported misconduct (whistleblowers) supported the belief that nurses were primarily responsible to the patient and should protect a patient from incompetent or unethical people. Participants who did not report misconduct (nonwhistleblowers) supported the belief that nurses are obligated to follow a physician's order at all times and that nurses are equally responsible to the patient, the physician and the employer. Conclusion. These findings indicate that nurses may respond to ethical dilemmas based on different belief systems.

Stress correlation function evolution in lattice solid elasto-dynamic models of shear and fracture zones and earthquake prediction

It has been argued that power-law time-to-failure fits for cumulative Benioff strain and an evolution in size-frequency statistics in the lead-up to large earthquakes are evidence that the crust behaves as a Critical Point (CP) system. If so, intermediate-term earthquake prediction is possible. However, this hypothesis has not been proven. If the crust does behave as a CP system, stress correlation lengths should grow in the lead-up to large events through the action of small to moderate ruptures and drop sharply once a large event occurs. However this evolution in stress correlation lengths cannot be observed directly. Here we show, using the lattice solid model to describe discontinuous elasto-dynamic systems subjected to shear and compression, that it is for possible correlation lengths to exhibit CP-type evolution. In the case of a granular system subjected to shear, this evolution occurs in the lead-up to the largest event and is accompanied by an increasing rate of moderate-sized events and power-law acceleration of Benioff strain release. In the case of an intact sample system subjected to compression, the evolution occurs only after a mature fracture system has developed. The results support the existence of a physical mechanism for intermediate-term earthquake forecasting and suggest this mechanism is fault-system dependent. This offers an explanation of why accelerating Benioff strain release is not observed prior to all large earthquakes. The results prove the existence of an underlying evolution in discontinuous elasto-dynamic, systems which is capable of providing a basis for forecasting catastrophic failure and earthquakes.

Poor correlation of mid-femoral measurements by CT and hip measurements by DXA in the elderly

Background and aims: Hip fracture is a devastating event in terms of outcome in the elderly, and the best predictor of hip fracture risk is hip bone density, usually measured by dual X-ray absorptiometry (DXA). However, bone density can also be ascertained from computerized tomography (CT) scans, and mid-thigh scans are frequently employed to assess the muscle and fat composition of the lower limb. Therefore, we examined if it was possible to predict hip bone density using mid-femoral bone density. Methods: Subjects were 803 ambulatory white and black women and men, aged 70-79 years, participating in the Health, Aging and Body Composition (Health ABC) Study. Bone mineral content (BMC, g) and volumetric bone mineral density (vBMD, mg/cm(3)) of the mid-femur were obtained by CT, whereas BMC and areal bone mineral density (aBMD, g/cm(2)) of the hip (femoral neck and trochanter) were derived from DXA. Results: In regression analyses stratified by race and sex, the coefficient of determination was low with mid-femoral BMC, explaining 6-27% of the variance in hip BMC, with a standard error of estimate (SEE) ranging from 16 to 22% of the mean. For mid-femur vBMD, the variance explained in hip aBMD was 2-17% with a SEE ranging from 15 to 18%. Adjusting aBMD to approximate volumetric density did not improve the relationships. In addition, the utility of fracture prediction was examined. Forty-eight subjects had one or more fractures (various sites) during a mean follow-up of 4.07 years. In logistic regression analysis, there was no association between mid-femoral vBMD and fracture (all fractures), whereas a 1 SD increase in hip BMD was associated with reduced odds for fracture of similar to60%. Conclusions: These results do not support the use of CT-derived mid-femoral vBMD or BMC to predict DXA-measured hip bone mineral status, irrespective of race or sex in older adults. Further, in contrast to femoral neck and trochanter BMD, mid-femur vBMD was not able to predict fracture (all fractures). (C) 2003, Editrice Kurtis.