Strategic Alert Throttling for Intrusion Detection Systems

Network intrusion detection systems are themselves becoming targets of attackers. Alert flood attacks may be used to conceal malicious activity by hiding it among a deluge of false alerts sent by the attacker. Although these types of attacks are very hard to stop completely, our aim is to present techniques that improve alert throughput and capacity to such an extent that the resources required to successfully mount the attack become prohibitive. The key idea presented is to combine a token bucket filter with a realtime correlation algorithm. The proposed algorithm throttles alert output from the IDS when an attack is detected. The attack graph used in the correlation algorithm is used to make sure that alerts crucial to forming strategies are not discarded by throttling.

Strategic Alert Throttling for Intrusion Detection Systems

Network intrusion detection systems are themselves becoming targets of attackers. Alert flood attacks may be used to conceal malicious activity by hiding it among a deluge of false alerts sent by the attacker. Although these types of attacks are very hard to stop completely, our aim is to present techniques that improve alert throughput and capacity to such an extent that the resources required to successfully mount the attack become prohibitive. The key idea presented is to combine a token bucket filter with a realtime correlation algorithm. The proposed algorithm throttles alert output from the IDS when an attack is detected. The attack graph used in the correlation algorithm is used to make sure that alerts crucial to forming strategies are not discarded by throttling.

Real-time alert correlation with type graphs

The premise of automated alert correlation is to accept that false alerts from a low level intrusion detection system are inevitable and use attack models to explain the output in an understandable way. Several algorithms exist for this purpose which use attack graphs to model the ways in which attacks can be combined. These algorithms can be classified in to two broad categories namely scenario-graph approaches, which create an attack model starting from a vulnerability assessment and type-graph approaches which rely on an abstract model of the relations between attack types. Some research in to improving the efficiency of type-graph correlation has been carried out but this research has ignored the hypothesizing of missing alerts. Our work is to present a novel type-graph algorithm which unifies correlation and hypothesizing in to a single operation. Our experimental results indicate that the approach is extremely efficient in the face of intensive alerts and produces compact output graphs comparable to other techniques.

Consumer alert

The South Carolina Department of Consumer Affairs publishes Consumer Alerts to alert the public, businesses, and government agencies about scams, product recalls and consumer education.

Consumer alert

The South Carolina Department of Consumer Affairs publishes Consumer Alerts to alert the public, businesses, and government agencies about scams, product recalls and consumer education.

Consumer alert

The South Carolina Department of Consumer Affairs publishes Consumer Alerts to alert the public, businesses, and government agencies about scams, product recalls and consumer education.

Consumer alert

The South Carolina Department of Consumer Affairs publishes Consumer Alerts to alert the public, businesses, and government agencies about scams, product recalls and consumer education.

Consumer alert

The South Carolina Department of Consumer Affairs publishes Consumer Alerts to alert the public, businesses, and government agencies about scams, product recalls and consumer education.

Ecologia de Anopheles (Nyssorhynchus) darlingi Root em área de implantação de empreendimento hidrelétrico, na divisa dos Estados do Mato Grosso do Sul e São Paulo

INTRODUÇÃO: Hidrelétricas alteram o fluxo das águas e provocam impactos sobre a composição de mosquitos, justificando-se essa pesquisa. O objetivo da pesquisa foi estudar anofelinos de área sob a influência de um novo lago e avaliar a vulnerabilidade relativa à malária. MÉTODOS: Foram feitas coletas de Anopheles nas margens da Represa Porto Primavera, durante as fases do alagamento até sua cota máxima. Utilizaram-se as técnicas: atrativa humana, de armadilha de Shannon e concha entomológica. Os indicadores Riqueza e Diversidade foram utilizados para medir o impacto. A análise das distribuições temporais foi realizada pelo teste Mann-Whitney, considerando localidade, cota e método de captura como variáveis independentes (α=0,05). RESULTADOS: A densidade de Anopheles darlingi oscilou entre as localidades A, B e C, sendo que os maiores picos foram para B e C. Com a estabilidade do lago, no último nível, evidenciou-se a tendência de redução da densidade de Anopheles darlingi. CONCLUSÕES: Sugere-se que o risco de autoctonia de malária nas proximidades do lago permanece inalterado, ficando o alerta para esporádicas infecções humanas.

Registro de Aedes albopictus em áreas epizoóticas de febre amarela das Regiões Sudeste e Sul do Brasil (Díptera:Culicidae)

Durante estudo biológico e ecológico sobre mosquitos levado a cabo em área com registro de epidemia de febre amarela silvestre e epizootia em macacos, foram encontrados adultos de Aedes Albopictus. A tendência da espécie para invadir ambiente extradomiciliar potencializa a chance de infecção natural, ao tempo em que evolui para formar um elo entre focos naturais de vírus e o ambiente urbano. Esta Nota Técnica representa um alerta aos gestores dos três poderes públicos sobre perspectivas de mudanças no perfil epidemiológico atual da febre amarela no Brasil

Parasites in Drosophila embryos

We wish to alert people studying early embryonic development in the fruit-fly Drosophila melanogaster of the possible presence of commensal parasites in some stocks.

Death and readmission in the year after hospital admission with cardiovascular disease: the Hunter Area Heart and Stroke Register

Objectives: To compare outcomes one year after hospital admission for patients initially discharged with a diagnosis of acute myocardial infarction (AMI), other ischaemic heart disease (other IHD), congestive heart failure (CHF) or stroke. Design: Cohort study. Setting: Hunter Area Heart and Stroke Register, which registers all patients admitted with heart disease or stroke to any of the 22 hospitals in the Hunter Area Health Service in New South Wales. Patients: 4981 patients with AMI, other IHD, CHF or stroke admitted to hospital as an emergency between 1 July 1995 and 30 June 1997 and followed for at least one year. Main outcome measures: Death from any cause or emergency hospital readmission for cardiovascular disease. Results: In-hospital mortality varied from 1% of those with other IHD to 22% of those with stroke. Almost a third of all patients discharged alive (and 38% of those aged 70 or more) had died or been readmitted within one year. This varied from 22% of those with stroke to 49% of those with CHF. The causes of death and readmission were from a spectrum of cardiovascular disease, regardless of the cause of the original hospital admission. Conclusions: Data from this population register show the poor outcome, especially with increasing age, among patients admitted to hospital with cardiovascular disease. This should alert us to determine whether optimal secondary prevention strategies are being adopted among such patients.

Regarding "Edema and leg volume: Methods of assessment" (Letters to the Editor)

I noted with interest the article by Drs Perrin and Guex, entitled &dquo;Edema and leg volume: Methods of assessment,&dquo; published in Angiology 51:9-12, 2000. This was a timely and comprehensive review of the various methods in clinical use for the assessment of peripheral edema, notably in the leg. I would like to take this opportunity to alert readers to a further technique useful for this purpose, namely, bioelectrical impedance analysis. An early reportl described its use for the measurement of edema in the leg, but other than its successful use for the assessment of edema in the arm following masteCtoMy,2,1 the potential of the method remains to be fully realized. This is unfortunate since the method directly and quantifiably measures edema.

Smart Alerts: Development of Software to Optimize Data Monitoring

Dherte PM, Negrao MPG, Mori Neto S, Holzhacker R, Shimada V, Taberner P, Carmona MJC - Smart Alerts: Development of a Software to Optimize Data Monitoring. Background and objectives: Monitoring is useful for vital follow-ups and prevention, diagnosis, and treatment of several events in anesthesia. Although alarms can be useful in monitoring they can cause dangerous user`s desensitization. The objective of this study was to describe the development of specific software to integrate intraoperative monitoring parameters generating ""smart alerts"" that can help decision making, besides indicating possible diagnosis and treatment. Methods: A system that allowed flexibility in the definition of alerts, combining individual alarms of the parameters monitored to generate a more elaborated alert system was designed. After investigating a set of smart alerts, considered relevant in the surgical environment, a prototype was designed and evaluated, and additional suggestions were implemented in the final product. To verify the occurrence of smart alerts, the system underwent testing with data previously obtained during intraoperative monitoring of 64 patients. The system allows continuous analysis of monitored parameters, verifying the occurrence of smart alerts defined in the user interface. Results: With this system a potential 92% reduction in alarms was observed. We observed that in most situations that did not generate alerts individual alarms did not represent risk to the patient. Conclusions: Implementation of software can allow integration of the data monitored and generate information, such as possible diagnosis or interventions. An expressive potential reduction in the amount of alarms during surgery was observed. Information displayed by the system can be oftentimes more useful than analysis of isolated parameters.

Risk factors for Chagas` disease reactivation after heart transplantation

Background: Chagas` disease is the illness caused by the protozoan Trypanosoma cruzi and it is still endemic in Latin America. Heart transplantation is a therapeutic option for patients with end-stage Chagas` cardiomyopathy. Nevertheless, reactivation may occur after transplantation, leading to higher morbidity and graft dysfunction. This study aimed to identify risk factors for Chagas` disease reactivation episodes. Methods: This investigation is a retrospective cohort study of all Chagas` disease heart transplant recipients from September 1985 through September 2004. Clinical, microbiologic and histopathologic data were reviewed. Statistical analysis was performed with SPSS (version 13) software. Results: Sixty-four (21.9%) patients with chronic Chagas` disease underwent heart transplantation during the study period. Seventeen patients (26.5%) had at least one episode of Chagas` disease reactivation, and univariate analysis identified number of rejection episodes (p = 0.013) and development of neoplasms (p = 0.040) as factors associated with Chagas` disease reactivation episodes. Multivariate analysis showed that number of rejection episodes (hazard ratio = 1.31; 95% confidence interval [CI]: 1.06 to 1.62; p = 0.011), neoplasms (hazard ratio = 5.07; 95% CI: 1.49 to 17.20; p = 0.009) and use of mycophenolate mofetil (hazard ratio = 3.14; 95% CI: 1.00 to 9.84; p = 0.049) are independent determinants for reactivation after transplantation. Age (p = 0.88), male gender (p = 0.15), presence of rejection (p = 0.17), cytomegalovirus infection (p = 0.79) and mortality after hospital discharge (p = 0.15) showed no statistically significant difference. Conclusions: Our data suggest that events resulting in greater immunosuppression status contribute to Chagas` disease reactivation episodes after heart transplantation and should alert physicians to make an early diagnosis and perform pre-emptive therapy. Although reactivation led to a high rate of morbidity, a low mortality risk was observed.