Detecting Botnets Through Log Correlation

Botnets, which consist of thousands of compromised machines, can cause a significant threat to other systems by launching Distributed Denial of Service attacks, keylogging, and backdoors. In response to this threat, new effective techniques are needed to detect the presence of botnets. In this paper, we have used an interception technique to monitor Windows Application Programming Interface system calls made by communication applications. Existing approaches for botnet detection are based on finding bot traffic patterns. Our approach does not depend on finding patterns but rather monitors the change of behaviour in the system. In addition, we will present our idea of detecting botnet based on log correlations from different hosts.

Imageamento da porosidade através de perfis geofísicos de poço

O imageamento da porosidade é uma representação gráfica da distribuição lateral da porosidade da rocha, estimada a partir de dados de perfis geofísicos de poço. Apresenta-se aqui uma metodologia para produzir esta imagem geológica, totalmente independente da intervenção do intérprete, através de um algoritmo, dito, interpretativo baseado em dois tipos de redes neurais artificiais. A primeira parte do algoritmo baseia-se em uma rede neural com camada competitiva e é construído para realizar uma interpretação automática do clássico gráfico o P_b - Φ_N, produzindo um zoneamento do perfil e a estimativa da porosidade. A segunda parte baseia-se em uma rede neural com função de base radial, projetado para realizar uma integração espacial dos dados, a qual pode ser dividida em duas etapas. A primeira etapa refere-se à correlação de perfis de poço e a segunda à produção de uma estimativa da distribuição lateral da porosidade. Esta metodologia ajudará o intérprete na definição do modelo geológico do reservatório e, talvez o mais importante, o ajudará a desenvolver de um modo mais eficiente as estratégias para o desenvolvimento dos campos de óleo e gás. Os resultados ou as imagens da porosidade são bastante similares às seções geológicas convencionais, especialmente em um ambiente deposicional simples dominado por clásticos, onde um mapa de cores, escalonado em unidades de porosidade aparente para as argilas e efetiva para os arenitos, mostra a variação da porosidade e a disposição geométrica das camadas geológicas ao longo da seção. Esta metodologia é aplicada em dados reais da Formação Lagunillas, na Bacia do Lago Maracaibo, Venezuela.

A study of the turbulence of the neutral medium in two nearby spiral galaxies

The width of the 21 cm line (HI) emitted by spiral galaxies depends on the physical processes that release energy in the Interstellar Medium (ISM). This quantity is called velocity dispersion (σ) and it is proportional first of all to the thermal kinetic energy of the gas. The accepted theoretical picture predicts that the neutral hydrogen component (HI) exists in the ISM in two stable phases: a cold one (CNM, with σ~0.8 km/s) and a warm one (WNM, with σ~8 km/s). However, this is called into question by the observation that the HI gas has usually larger velocity dispersions. This suggests the presence of turbulence in the ISM, although the energy sources remain unknown. In this thesis we want to shed new light on this topic. We have studied the HI line emission of two nearby galaxies: NGC6946 and M101. For the latter we used new deep observations obtained with the Westerbork radio interferometer. Through a gaussian fitting procedure, we produced dispersion maps of the two galaxies. For both of them, we compared the σ values measured in the spiral arms with those in the interarms. In NGC6946 we found that, in both arms and interarms, σ grows with the column density, while we obtained the opposite for M 101. Using a statistical analysis we did not find a significant difference between arm and interarm dispersion distributions. Producing star formation rate density maps (SFRD) of the galaxies, we studied their global and local relations with the HI kinetic energy, as inferred from the measured dispersions. For NGC6946 we obtained a good log-log correlation, in agreement with a simple model of supernova feedback driven turbulence. This shows that in this galaxy turbulent motions are mainly induced by the stellar activity. For M 101 we did not find an analogous correlation, since the gas kinetic energy appears constant with the SFRD. We think that this may indicate that in this galaxy turbulence is driven also by accretion of extragalactic material.

Susceptibility, density, iron and calcium concentrations of ODP holes 165-999B and 165-1001A

Pelagic sediments recording an extreme and short-lived global warming event, the Late Paleocene Thermal Maximum (LPTM), were recovered from Hole 999B (Colombian Basin) and Holes 1001A and 1001B (lower Nicaraguan Rise) in the Caribbean Sea during Ocean Drilling Program Leg 165. The LPTM consists of a 0.3-0.97 m calcareous claystone to claystone horizon. High-resolution downhole logging (Formation MicroScanner [FMS]), standard downhole logs (resistivity, velocity, density, natural gamma ray, and geochemical log), and non-destructive chemical and physical property (multisensor core logger [MSCL] and X-ray fluorescence [XRF] core scanner) data were used to identify composite sections from parallel holes and to record sedimentological and environmental changes associated with the LPTM. Downhole logging data indicate an abrupt and distinct difference in physical and chemical properties that extend for tens of meters above and below the LPTM. These observations indicate a rapid environmental change at the LPTM, which persists beyond the LPTM anomaly. Comparisons of gamma-ray attenuation porosity evaluator (GRAPE) densities from MSCL logging on split cores with FMS resistivity values allows core-to-log correlation with a high degree of accuracy. High-resolution magnetic susceptibility measurements of the cores are compared with elemental concentrations (e.g., Fe, Ca) analyzed by high-resolution XRF scanning. The high-resolution data obtained from several detailed core and downhole logging methods are the key to the construction of composite sections, the correlation of both adjacent holes and distant sites, and core-log integration. These continuous-depth series reveal the LPTM as a multiphase event with a nearly instantaneous onset, followed by a much different set of physical and chemical conditions of short duration, succeeded by a longer transition to a new, more permanent set of environmental circumstances. The estimated duration of these 'phases' are consistent with paleontological and isotopic studies of the LPTM

Correlation between mastitis occurrence and the count of microorganisms in bulk raw milk of bovine dairy herds in four selective culture media

Milk is the normal secretion of the mammary gland, practically free of colostrum and obtained by the complete milking of oil(? or more healthy animals. Mastitis is all inflammatory process of the mammary gland and it may cause alterations in the milk. The present work aimed to verify whether it is possible, by means of the counts of microorganism in the bulk raw milk ill four selective culture media, to establish a correlation with the occurrence of mastitis and therefore, to monitor this disease in bovine dairy herds. The following selective culture media were Used: KF Streptococcus Agar, Edwards Agar, Baird-Parker Agar, Blood Agar plus potassium tellurite. Spearman`s correlation coefficient was calculated in order to compare the Occurrence of mastitis (percentage) in each herd with respective selective culture media counts of microorganisms in bulk raw milk. Thirty-six possibilities were analysed (Tamis and CMT-positive rates were compared with the log-transformed count in four selective Culture media) and there was a negative correlation between Tamis 3 and the Baird-Parker Agar plate count. The total results of microbiological tests showed that there were three correlations of the counts in selective culture media. Fifty-two possibilities were analysed and there was a negative correlation between no-bacteria I-growth mastitis rates and log(10) of KF Streptoccocus Agar plate Count and there were two positive correlations between coagulase-positive staphylococci and log(10) of Baird-Parker Agar plate count and Blood Agar plus potassium tellurite plate count.

Stratigraphic interpretation of Well-Log data of the Athabasca Oil Sands of Alberta Canada through Pattern recognition and Artificial Intelligence

Dissertation submitted in partial fulfillment of the requirements for the Degree of Master of Science in Geospatial Technologies.

Correlation of wear in vivo and six laboratory wear methods.

OBJECTIVE: We examined the correlation between clinical wear rates of restorative materials and enamel (TRAC Research Foundation, Provo, USA) and the results of six laboratory test methods (ACTA, Alabama (generalized, localized), Ivoclar (vertical, volumetric), Munich, OHSU (abrasion, attrition), Zurich). METHODS: Individual clinical wear data were available from clinical trials that were conducted by TRAC Research Foundation (formerly CRA) together with general practitioners. For each of the n=28 materials (21 composite resins for intra-coronal restorations [20 direct and 1 indirect], 5 resin materials for crowns, 1 amalgam, enamel) a minimum of 30 restorations had been placed in posterior teeth, mainly molars. The recall intervals were up to 5 years with the majority of materials (n=27) being monitored, however, only for up to 2 years. For the laboratory data, the databases MEDLINE and IADR abstracts were searched for wear data on materials which were also clinically tested by TRAC Research Foundation. Only those data for which the same test parameters (e.g. number of cycles, loading force, type of antagonist) had been published were included in the study. A different quantity of data was available for each laboratory method: Ivoclar (n=22), Zurich (n=20), Alabama (n=17), OHSU and ACTA (n=12), Munich (n=7). The clinical results were summed up in an index and a linear mixed model was fitted to the log wear measurements including the following factors: material, time (0.5, 1, 2 and 3 years), tooth (premolar/molar) and gender (male/female) as fixed effects, and patient as random effect. Relative ranks were created for each material and method; the same was performed with the clinical results. RESULTS: The mean age of the subjects was 40 (±12) years. The materials had been mostly applied in molars (81%) and 95% of the intracoronal restorations were Class II restorations. The mean number of individual wear data per material was 25 (range 14-42). The mean coefficient of variation of clinical wear data was 53%. The only significant correlation was reached by OHSU (abrasion) with a Spearman r of 0.86 (p=0.001). Zurich, ACTA, Alabama generalized wear and Ivoclar (volume) had correlation coefficients between 0.3 and 0.4. For Zurich, Alabama generalized wear and Munich, the correlation coefficient improved if only composites for direct use were taken into consideration. The combination of different laboratory methods did not significantly improve the correlation. SIGNIFICANCE: The clinical wear of composite resins is mainly dependent on differences between patients and less on the differences between materials. Laboratory methods to test conventional resins for wear are therefore less important, especially since most of them do not reflect the clinical wear.

Antiviral therapy against chronic hepatitis B in Brazil: high rates of lamivudine resistance mutations and correlation with HBV genotypes

The effectiveness of antiviral treatments of chronic hepatitis B has been poorly studied in Brazil. Here, hepatitis B virus (HBV) DNA positivity, drug resistance mutations and their association with HBV genotypes were evaluated in chronically HBV-infected patients under different drug regimens in Brazil. The study involved 129 patients under interferon or nucleos(t)ide analogue therapy for a median treatment time of 12 months. One hundred and five (81%) of these patients were treated with lamivudine (LAM), either in monotherapy or in combination with newer drugs, such as entecavir (ETV) or tenofovir (TDF). High (37.5-100%) rates of HBV DNA positivity were observed with all but one drug regimen (LAM + ETV). However, patients that were treated with ETV alone, TDF alone or with LAM combination therapies had a mean viral load that was 3-4 log lower than patients treated with LAM monotherapy. Of the patients treated with LAM, 47% developed resistance mutations. HBV genotypes A (59.1%), D (30.3%) and F (9.1%) were found. There was no association between the presence of LAM resistance mutations and genotypes, HBeAg status or treatment duration. Nevertheless, the rtM204V mutation was observed more frequently (12/13, 92%) in genotype A than in the others (p = 0.023). Six out of nine isolates that contained the rtM204I mutation belonged to genotype D and half of them displayed a single mutation. Genotype D isolates with the rtM204V variant preferentially displayed a triple mutation, while genotype A preferentially displayed a double mutation (p = 0.04).

Linkage disequilibrium assessment via log-linear modeling of SNP haplotype frequencies

Analyses of high-density single-nucleotide polymorphism (SNP) data, such as genetic mapping and linkage disequilibrium (LD) studies, require phase-known haplotypes to allow for the correlation between tightly linked loci. However, current SNP genotyping technology cannot determine phase, which must be inferred statistically. In this paper, we present a new Bayesian Markov chain Monte Carlo (MCMC) algorithm for population haplotype frequency estimation, particulary in the context of LD assessment. The novel feature of the method is the incorporation of a log-linear prior model for population haplotype frequencies. We present simulations to suggest that 1) the log-linear prior model is more appropriate than the standard coalescent process in the presence of recombination (>0.02cM between adjacent loci), and 2) there is substantial inflation in measures of LD obtained by a "two-stage" approach to the analysis by treating the "best" haplotype configuration as correct, without regard to uncertainty in the recombination process. Genet Epidemiol 25:106-114, 2003. (C) 2003 Wiley-Liss, Inc.

Correlation-type structure activity relationships for the kinetics of gas-phase RO2 self-reactions and reaction with HO2

Structure activity relationships (SARs) are presented for the gas-phase reactions of RO2 with HO2, and the self- and cross-reactions of RO2. For RO2+HO2 the SAR is based upon a correlation between the logarithm of the measured rate coefficient and a calculated ionisation potential for the molecule R-CH=CH2, R being the same group in both the radical and molecular analogue. The correlation observed is strong and only for one RO2 species does the measured rate coefficient deviate by more than a factor of two from the linear least-squares regression line. For the self- and cross-reactions of RO2 radicals, the SAR is based upon a correlation between the logarithm of the measured rate coefficient and the calculated electrostatic potential (ESP) at the equivalent carbon atom in the RH molecule to which oxygen is attached in RO2, again R being the same group in the molecule and the radical. For cases where R is a simple alkyl-group, a strong linear correlation observed. For RO2 radicals which contain lone pair-bearing substituents and for which the calculated ESP<-0.05 self-reaction rate coefficients appear to be insensitive to the value of the ESP. For RO2 of this type with ESP>-0.05 a linear relationship between log k and the ESP is again observed. Using the relationships, 84 out of the 85 rate coefficients used to develop the SARs are predicted to within a factor of three of their measured values. A relationship is also presented that allows the prediction of the Arrhenius parameters for the self-reactions of simple alkyl RO2 radicals. On the basis of the correlations, predictions of room-temperature rate coefficients are made for a number of atmospherically important peroxyl-peroxyl radical reactions. (C) 2003 Elsevier Ltd. All rights reserved.

Correlation between Clinical/Radiographic Features and Inflammatory Cytokine Networks Produced by Macrophages Stimulated with Endodontic Content

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

Stratigraphic correlation of ODP Site 199-1218 and 199-1219

During Ocean Drilling Program Leg 199 a high-resolution (~1-2 cm/k.y.) biogenic sediment record from the late Paleocene to the early Miocene was recovered, containing an uninterrupted set of geomagnetic chrons as well as a detailed record of calcareous and siliceous biostratigraphic datum events. Shipboard lithologic proxy measurements and shore-based determinations of CaCO3 revealed regular cycles that can be attributed to climatic forcing. Discovering drill sites with well defined magneto- and biostratigraphic records that also show clear lithologic cycles is rare and valuable and creates the opportunity to develop a detailed stratigraphic intersite correlation, providing the basis to study paleoceanographic processes and mass accumulation rates at high resolution. Here we present extensive postcruise work that extends the shipboard composite depth stratigraphy by providing a high-resolution revised meters composite depth (rmcd) scale to compensate for depth distortion within individual cores. The depth-aligned data were then used to generate stacked records of lithologic proxy measurements. Making use of the increased signal-to-noise ratio in the stacked records, we then proceeded to generate a detailed site-to-site correlation between Sites 1218 and 1219 in order to decrease the depth uncertainty for magneto- and biostratigraphic datums. Stacked lithologic proxy records in combination with discrete measurements of CaCO3 were then exploited to calculate high-resolution carbonate concentration curves by regression of the multisensor track data with discrete measurements. By matching correlative features between the cores and wireline logging data, we also rescaled our core rmcd back to in situ depths. Our study identifies lithology-dependent core expansion due to unloading as the mechanism of varying stratigraphic thicknesses between cores.

A nova família de distribuições odd log-logística: teoria e aplicações

Neste trabalho, foi proposta uma nova família de distribuições, a qual permite modelar dados de sobrevivência quando a função de risco tem formas unimodal e U (banheira). Ainda, foram consideradas as modificações das distribuições Weibull, Fréchet, half-normal generalizada, log-logística e lognormal. Tomando dados não-censurados e censurados, considerou-se os estimadores de máxima verossimilhança para o modelo proposto, a fim de verificar a flexibilidade da nova família. Além disso, um modelo de regressão locação-escala foi utilizado para verificar a influência de covariáveis nos tempos de sobrevida. Adicionalmente, conduziu-se uma análise de resíduos baseada nos resíduos deviance modificada. Estudos de simulação, utilizando-se de diferentes atribuições dos parâmetros, porcentagens de censura e tamanhos amostrais, foram conduzidos com o objetivo de verificar a distribuição empírica dos resíduos tipo martingale e deviance modificada. Para detectar observações influentes, foram utilizadas medidas de influência local, que são medidas de diagnóstico baseadas em pequenas perturbações nos dados ou no modelo proposto. Podem ocorrer situações em que a suposição de independência entre os tempos de falha e censura não seja válida. Assim, outro objetivo desse trabalho é considerar o mecanismo de censura informativa, baseado na verossimilhança marginal, considerando a distribuição log-odd log-logística Weibull na modelagem. Por fim, as metodologias descritas são aplicadas a conjuntos de dados reais.

Statnote 35: are the data log-normal?

In many of the Statnotes described in this series, the statistical tests assume the data are a random sample from a normal distribution These Statnotes include most of the familiar statistical tests such as the ‘t’ test, analysis of variance (ANOVA), and Pearson’s correlation coefficient (‘r’). Nevertheless, many variables exhibit a more or less ‘skewed’ distribution. A skewed distribution is asymmetrical and the mean is displaced either to the left (positive skew) or to the right (negative skew). If the mean of the distribution is low, the degree of variation large, and when values can only be positive, a positively skewed distribution is usually the result. Many distributions have potentially a low mean and high variance including that of the abundance of bacterial species on plants, the latent period of an infectious disease, and the sensitivity of certain fungi to fungicides. These positively skewed distributions are often fitted successfully by a variant of the normal distribution called the log-normal distribution. This statnote describes fitting the log-normal distribution with reference to two scenarios: (1) the frequency distribution of bacterial numbers isolated from cloths in a domestic environment and (2), the sizes of lichenised ‘areolae’ growing on the hypothalus of Rhizocarpon geographicum (L.) DC.