An Alternative Approach To Computer System Security Monitoring And Enhancement Through System Call Sequence Analysis

Modern computer systems are plagued with stability and security problems: applications lose data, web servers are hacked, and systems crash under heavy load. Many of these problems or anomalies arise from rare program behavior caused by attacks or errors. A substantial percentage of the web-based attacks are due to buffer overflows. Many methods have been devised to detect and prevent anomalous situations that arise from buffer overflows. The current state-of-art of anomaly detection systems is relatively primitive and mainly depend on static code checking to take care of buffer overflow attacks. For protection, Stack Guards and I-leap Guards are also used in wide varieties.This dissertation proposes an anomaly detection system, based on frequencies of system calls in the system call trace. System call traces represented as frequency sequences are profiled using sequence sets. A sequence set is identified by the starting sequence and frequencies of specific system calls. The deviations of the current input sequence from the corresponding normal profile in the frequency pattern of system calls is computed and expressed as an anomaly score. A simple Bayesian model is used for an accurate detection.Experimental results are reported which show that frequency of system calls represented using sequence sets, captures the normal behavior of programs under normal conditions of usage. This captured behavior allows the system to detect anomalies with a low rate of false positives. Data are presented which show that Bayesian Network on frequency variations responds effectively to induced buffer overflows. It can also help administrators to detect deviations in program flow introduced due to errors.

Micro-electromechanical structural design and optimization of vertical cavity photonic devices with wide continuous tuning

Diese Arbeit umfaßt das elektromechanische Design und die Designoptimierung von weit durchstimmbaren optischen multimembranbasierten Bauelementen, mit vertikal orientierten Kavitäten, basierend auf der Finiten Element Methode (FEM). Ein multimembran InP/Luft Fabry-Pérot optischer Filter wird dargestellt und umfassend analysiert. In dieser Arbeit wird ein systematisches strukturelles Designverfahren dargestellt. Genaue analytische elektromechanischer Modelle für die Bauelemente sind abgeleitet worden. Diese können unschätzbare Werkzeuge sein, um am Anfang der Designphase schnell einen klaren Einblick zur Verfügung zu stellen. Mittels des FEM Programms ist der durch die nicht-lineare Verspannung hervorgerufene versteifende Effekt nachgeforscht und sein Effekt auf die Verlängerung der mechanischen Durchstimmungsstrecke der Bauelemente demonstriert worden. Interessant war auch die Beobachtung, dass die normierte Relation zwischen Ablenkung und Spannung ein unveränderliches Profil hat. Die Deformation der Membranflächen der in dieser Arbeit dargestellten Bauelementformen erwies sich als ein unerwünschter, jedoch manchmal unvermeidbarer Effekt. Es zeigt sich aber, dass die Wahl der Größe der strukturellen Dimensionen den Grad der Membrandeformation im Falle der Aktuation beeinflusst. Diese Arbeit stellt ein elektromechanisches in FEMLAB implementierte quasi-3D Modell, das allgemein für die Modellierung dünner Strukturen angewendet werden kann, dar; und zwar indem man diese als 2D-Objekte betrachtet und die dritte Dimension als eine konstante Größe (z.B. die Schichtdicke) oder eine Größe, welche eine mathematische Funktion ist, annimmt. Diese Annahme verringert drastisch die Berechnungszeit sowie den erforderlichen Arbeitsspeicherbedarf. Weiter ist es für die Nachforschung des Effekts der Skalierung der durchstimmbaren Bauelemente verwendet worden. Eine neuartige Skalierungstechnik wurde abgeleitet und verwendet. Die Ergebnisse belegen, dass das daraus resultierende, skalierte Bauelement fast genau die gleiche mechanische Durchstimmung wie das unskalierte zeigt. Die Einbeziehung des Einflusses von axialen Verspannungen und Gradientenverspannungen in die Berechnungen erforderte die Änderung der Standardimplementierung des 3D Mechanikberechnungsmodus, der mit der benutzten FEM Software geliefert wurde. Die Ergebnisse dieser Studie zeigen einen großen Einfluss der Verspannung auf die Durchstimmungseigenschaften der untersuchten Bauelemente. Ferner stimmten die Ergebnisse der theoretischen Modellrechnung mit den experimentellen Resultaten sehr gut überein.

A Theory of Quantitative Inference Applied to a Mechanical Design Compiler

This thesis presents the ideas underlying a computer program that takes as input a schematic of a mechanical or hydraulic power transmission system, plus specifications and a utility function, and returns catalog numbers from predefined catalogs for the optimal selection of components implementing the design. Unlike programs for designing single components or systems, the program provides the designer with a high level "language" in which to compose new designs. It then performs some of the detailed design process. The process of "compilation" is based on a formalization of quantitative inferences about hierarchically organized sets of artifacts and operating conditions. This allows the design compilation without the exhaustive enumeration of alternatives.

Electrical Design: A Problem for Artificial Intelligence Research

This report outlines the problem of intelligent failure recovery in a problem-solver for electrical design. We want our problem solver to learn as much as it can from its mistakes. Thus we cast the engineering design process on terms of Problem Solving by Debugging Almost-Right Plans, a paradigm for automatic problem solving based on the belief that creation and removal of "bugs" is an unavoidable part of the process of solving a complex problem. The process of localization and removal of bugs called for by the PSBDARP theory requires an approach to engineering analysis in which every result has a justification which describes the exact set of assumptions it depends upon. We have developed a program based on Analysis by Propagation of Constraints which can explain the basis of its deductions. In addition to being useful to a PSBDARP designer, these justifications are used in Dependency-Directed Backtracking to limit the combinatorial search in the analysis routines. Although the research we will describe is explicitly about electrical circuits, we believe that similar principles and methods are employed by other kinds of engineers, including computer programmers.

An Interpolative Analytical Cache Model with Application to Performance-Power Design Space Exploration

Caches are known to consume up to half of all system power in embedded processors. Co-optimizing performance and power of the cache subsystems is therefore an important step in the design of embedded systems, especially those employing application specific instruction processors. In this project, we propose an analytical cache model that succinctly captures the miss performance of an application over the entire cache parameter space. Unlike exhaustive trace driven simulation, our model requires that the program be simulated once so that a few key characteristics can be obtained. Using these application-dependent characteristics, the model can span the entire cache parameter space consisting of cache sizes, associativity and cache block sizes. In our unified model, we are able to cater for direct-mapped, set and fully associative instruction, data and unified caches. Validation against full trace-driven simulations shows that our model has a high degree of fidelity. Finally, we show how the model can be coupled with a power model for caches such that one can very quickly decide on pareto-optimal performance-power design points for rapid design space exploration.

Presión arterial en preescolares de la localidad de Usaquén en Bogotá

Introducción: La hipertensión arterial es un problema de salud pública tanto en países industrializados como en vía de desarrollo. Su prevalencia en la infancia viene en aumento por lo que es relevante determinarla en niños preescolares a nivel local. Objetivo: Determinar la prevalencia de hipertensión arterial en niños de tres a cinco años de una cohorte de 14 hogares infantiles del ICBF de la localidad de Usaquén en Bogotá. Materiales y métodos: Se realizó un estudio de corte transversal analítico, utilizando la base de datos de un ensayo aleatorizado y controlado del año 200913, y se evaluaron las cifras de tensión arterial de acuerdo a sexo, edad, talla y su correlación con el IMC con un nivel de confianza del 95% y precisión del 1%. Se calcularon las medias, desviaciones estándar, percentiles y prevalencia. Resultados: Se obtuvo una muestra de 1035 casos, encontrándose una prevalencia de 4,5% de HTA sistólica, 10,4% de diastólica, ambas en estadio I; teniendo en cuenta tanto sistólica como diastólica, fue de 11,6% en estadio I. Se determinaron los valores de presión arterial sistólica y diastólica en cuartiles de acuerdo a edad, sexo y talla. El coeficiente de correlación entre el IMC y los niveles de presión arterial sistólica y diastólica fueron de 0.0992 y 0.0362 respectivamente. Conclusión: La prevalencia de HTA general fue de 11,6%, predominando la diastólica en estadio I en niños preescolares. No se encontró correlación entre el IMC y las cifras de tensión arterial sistólica y diastólica.

Modification of personality variables through application of a psycho-educational program of full consciousness (mindfulness) in university students

This study examines the effects in university students of a psycho-educational program in full awareness (mindfulness) on certain personality variables. A quasi-experimental (group comparison) design with pretest and postest measurements was employed in an experimental (n = 26) and a control group (n = 27). Barratt impulsiveness Scale (BiS- 11), Acceptance and Action Questionnaire (AAQ), Social Avoidance and Distress Scale (SAD), and the Profile of Mood States (POMS) were applied to experimental and control groups. The results show statistically significant changes in impulsivity variables, experiential avoidance, social avoidance, social anxiety, tension and fatigue when comparing the posttest mean scores of the groups.

Academic stress in master’s students and its modulatory variables: a between-groups design

The present investigation tries to establish the descriptive profile of the academic stress of the students of the masters in education and to identify which sociodemographic and situational variables play a modulator role. This investigation is based on the Person-Surroundings Research Program and the systemical cognitive model of academic stress. The study can be characterized as transectional, correlational and non experimental. The collection of the information was made through the SISCO inventory of Academic Stress which was applied to 152 students. The main results suggest that 95% of the master students report having felt academic stress a few times but with medium-high intensity. Variables gender, civil state, attending masters and institutional support of the attending masters act as modulators in academic stress.

On the design of education conditional cash transfer programs and non education outcomes: the case of teenage pregnancy

We investigate the effect of education Conditional Cash Transfer programs (CCTs) on teenage pregnancy. Our main concern is with how the size and sign of the effect may depend on the design of the program. Using a simple model we show that an education CCT that conditions renewal on school performance reduces teenage pregnancy; the program can increase teenage pregnancy if it does not condition on school performance. Then, using an original data base, we estimate the causal impact on teenage pregnancy of two education CCTs implemented in Bogot´a (Subsidio Educativo, SE, and Familias en Acci´on, FA); both programs differ particularly on whether school success is a condition for renewal or not. We show that SE has negative average effect on teenage pregnancy while FA has a null average effect. We also find that SE has either null or no effect for adolescents in all age and grade groups while FA has positive, null or negative effects for adolescents in different age and grade groups. Since SE conditions renewal on school success and FA does not, we can argue that the empirical results are consistent with the predictions of our model and that conditioning renewal of the subsidy on school success crucially determines the effect of the subsidy on teenage pregnancy

Reintroduction of the Eurasian otter (Lutra lutra) in Muga and Fluvià basins (north-eastern Spain): viability, development, monitoring and trends of the new population

Aquesta tesi es basa en el programa de reintroducció de la llúdriga eurasiàtica (Lutra lutra) a les conques dels rius Muga i Fluvià (Catalunya) durant la segona meitat dels 1990s. Els objectius de la tesi foren demostrar la viabilitat de la reintroducció, demostrar l'èxit de la mateixa, estudiar aspectes ecològics i etològics de l'espècie, aprofitant l'oportunitat única de gaudir d'una població "de disseny" i determinar les probabilitats de supervivència de la població a llarg termini. La reintroducció de la llúdriga a les conques dels rius Muga i Fluvià va reeixir, doncs l'àrea geogràfica ocupada efectivament es va incrementar fins a un 64% d'estacions positives a l'hivern 2001-02. La troballa de tres exemplars adults nascuts a l'àrea de reintroducció és una altra prova que valida l'èxit del programa. La densitat d'exemplars calculada a través dels censos visuals ha resultat baixa (0.04-0.11 llúdrigues/km), però s'aproxima al que hom pot esperar en els primers estadis d'una població reintroduïda, encara poc nombrosa però distribuïda en una gran àrea. La mortalitat post-alliberament va ser del 22% un any després de l'alliberament, similar o inferior a la d'altres programes de reintroducció de llúdrigues reeixits. La mortalitat va ser deguda principalment a atropellaments (56%). El patró d'activitat de les llúdrigues reintroduïdes va esdevenir principalment nocturn i crepuscular, amb una escassa activitat diürna. Les seves àrees vitals van ser del mateix ordre (34,2 km) que les calculades en d'altres estudis realitzats a Europa. La longitud mitjana de riu recorreguda per una llúdriga durant 24 hores va ser de 4,2 km per les femelles i 7,6 km pels mascles. Durant el període de radioseguiment dues femelles van criar i els seus moviments van poder ser estudiats amb deteniment. La resposta de la nova població de llúdrigues a les fluctuacions estacionals en la disponibilitat d'aigua, habitual a les regions mediterrànies, va consistir en la concentració en una àrea menor durant el període de sequera estival, a causa de l'increment de trams secs, inhabitables per la llúdriga per la manca d'aliment, fet que va provocar expansions i contraccions periòdiques en l'àrea de distribució. La persistència a llarg termini de la població reintroduïda va ser estudiada mitjançant una Anàlisi de Viabilitat Poblacional (PVA). El resultat va ser un baix risc d'extinció de la població en els propers 100 anys i la majoria dels escenaris simulats (65%) van assolir el criteri d'un mínim de 90% de probabilitat de supervivència. Del model poblacional construït es dedueix que un punt clau per assegurar la viabilitat de la població reintroduïda és la reducció de la mortalitat accidental. A l'àrea d'estudi, els atropellaments causen més del 50% de la mortalitat i aquesta pot ser reduïda mitjançant la construcció de passos de fauna, el tancament lateral d'alguns trams de carretera perillosos i el control de la velocitat en algunes vies. El projecte de reintroducció ha posat a punt un protocol per a la captura, maneig i alliberament de llúdrigues salvatges, que pot contenir informació útil per a programes similars. També ha suposat una oportunitat única d'estudiar una població dissenyada artificialment i poder comparar diversos mètodes per estimar la distribució i la densitat de poblacions de llúdrigues. Per últim, la reintroducció portada a terme a les conques dels rius Muga i Fluvià ha aconseguit crear una nova població de llúdrigues, que persisteix en el temps, que es reprodueix regularment i que es dispersa progressivament, fins i tot a noves conques fluvials.

Components of an oral program that can be implemented with culturally and linguistically diverse deaf and hard of hearing children and their families

This study examined oral education components that could be successfully implemented with culturally and linguistically diverse deaf and hard of hearing (DHH) children and their families. A literature review of oral program strategies used with culturally diverse families and their children with special needs, and federal guidelines related to programs serving DHH children were conducted. Recent statistics of children in programs for DHH students who are from racially and linguistically diverse backgrounds were discussed. Additional data sources included classroom observations and multidisciplinary interviews. The data obtained was utilized to design a framework for oral programs to support culturally and linguistically diverse DHH children and their families.

Birding 2.0: Citizen Science and Effective Monitoring in the Web 2.0 World

The amateur birding community has a long and proud tradition of contributing to bird surveys and bird atlases. Coordinated activities such as Breeding Bird Atlases and the Christmas Bird Count are examples of "citizen science" projects. With the advent of technology, Web 2.0 sites such as eBird have been developed to facilitate online sharing of data and thus increase the potential for real-time monitoring. However, as recently articulated in an editorial in this journal and elsewhere, monitoring is best served when based on a priori hypotheses. Harnessing citizen scientists to collect data following a hypothetico-deductive approach carries challenges. Moreover, the use of citizen science in scientific and monitoring studies has raised issues of data accuracy and quality. These issues are compounded when data collection moves into the Web 2.0 world. An examination of the literature from social geography on the concept of "citizen sensors" and volunteered geographic information (VGI) yields thoughtful reflections on the challenges of data quality/data accuracy when applying information from citizen sensors to research and management questions. VGI has been harnessed in a number of contexts, including for environmental and ecological monitoring activities. Here, I argue that conceptualizing a monitoring project as an experiment following the scientific method can further contribute to the use of VGI. I show how principles of experimental design can be applied to monitoring projects to better control for data quality of VGI. This includes suggestions for how citizen sensors can be harnessed to address issues of experimental controls and how to design monitoring projects to increase randomization and replication of sampled data, hence increasing scientific reliability and statistical power.

Running Climate Models On The NERC Cluster Grid Using G-Rex

Compute grids are used widely in many areas of environmental science, but there has been limited uptake of grid computing by the climate modelling community, partly because the characteristics of many climate models make them difficult to use with popular grid middleware systems. In particular, climate models usually produce large volumes of output data, and running them usually involves complicated workflows implemented as shell scripts. For example, NEMO (Smith et al. 2008) is a state-of-the-art ocean model that is used currently for operational ocean forecasting in France, and will soon be used in the UK for both ocean forecasting and climate modelling. On a typical modern cluster, a particular one year global ocean simulation at 1-degree resolution takes about three hours when running on 40 processors, and produces roughly 20 GB of output as 50000 separate files. 50-year simulations are common, during which the model is resubmitted as a new job after each year. Running NEMO relies on a set of complicated shell scripts and command utilities for data pre-processing and post-processing prior to job resubmission. Grid Remote Execution (G-Rex) is a pure Java grid middleware system that allows scientific applications to be deployed as Web services on remote computer systems, and then launched and controlled as if they are running on the user's own computer. Although G-Rex is general purpose middleware it has two key features that make it particularly suitable for remote execution of climate models: (1) Output from the model is transferred back to the user while the run is in progress to prevent it from accumulating on the remote system and to allow the user to monitor the model; (2) The client component is a command-line program that can easily be incorporated into existing model work-flow scripts. G-Rex has a REST (Fielding, 2000) architectural style, which allows client programs to be very simple and lightweight and allows users to interact with model runs using only a basic HTTP client (such as a Web browser or the curl utility) if they wish. This design also allows for new client interfaces to be developed in other programming languages with relatively little effort. The G-Rex server is a standard Web application that runs inside a servlet container such as Apache Tomcat and is therefore easy to install and maintain by system administrators. G-Rex is employed as the middleware for the NERC1 Cluster Grid, a small grid of HPC2 clusters belonging to collaborating NERC research institutes. Currently the NEMO (Smith et al. 2008) and POLCOMS (Holt et al, 2008) ocean models are installed, and there are plans to install the Hadley Centre’s HadCM3 model for use in the decadal climate prediction project GCEP (Haines et al., 2008). The science projects involving NEMO on the Grid have a particular focus on data assimilation (Smith et al. 2008), a technique that involves constraining model simulations with observations. The POLCOMS model will play an important part in the GCOMS project (Holt et al, 2008), which aims to simulate the world’s coastal oceans. A typical use of G-Rex by a scientist to run a climate model on the NERC Cluster Grid proceeds as follows :(1) The scientist prepares input files on his or her local machine. (2) Using information provided by the Grid’s Ganglia3 monitoring system, the scientist selects an appropriate compute resource. (3) The scientist runs the relevant workflow script on his or her local machine. This is unmodified except that calls to run the model (e.g. with “mpirun”) are simply replaced with calls to "GRexRun" (4) The G-Rex middleware automatically handles the uploading of input files to the remote resource, and the downloading of output files back to the user, including their deletion from the remote system, during the run. (5) The scientist monitors the output files, using familiar analysis and visualization tools on his or her own local machine. G-Rex is well suited to climate modelling because it addresses many of the middleware usability issues that have led to limited uptake of grid computing by climate scientists. It is a lightweight, low-impact and easy-to-install solution that is currently designed for use in relatively small grids such as the NERC Cluster Grid. A current topic of research is the use of G-Rex as an easy-to-use front-end to larger-scale Grid resources such as the UK National Grid service.

Design and disposition of infrared optical multilayer coatings for the Improved Stratospheric and Mesospheric Sounder (ISAMS)

The Improved Stratospheric and Mesospheric Sounder (ISAMS) is designed to measure the Earths middle atmosphere in the range of 4.6 to 16.6 micorns. This paper considers all the coated optical elements in two radiometric test channels. (Analysis of the spectral response will be presented as a seperate paper at this symposium, see Sheppard et al). Comparisons between the compued spectral performance and measurements from actual coatings will be discussed: These will include substrate absorption simulations. The results of environmental testing (durability and stability) are included, together with details of coating deposition and monitoring conditions.

Non-intrusive monitoring of atmospheric CO2 in analogue models of terrestrial carbon cycle

1. Closed Ecological Systems (CES) are small manmade ecosystems which do not have any material exchange with the surrounding environment. Recent ecological and technological advances enable successful establishment and maintenance of CES, making them a suitable tool for detecting and measuring subtle feedbacks and mechanisms. 2. As a part of an analogue (physical) C cycle modelling experiment, we developed a non-intrusive methodology to control the internal environment and to monitor atmospheric CO2 concentration inside 16 replicated CES. Whilst maintaining an air-tight seal of all CES, this approach allowed for access to the CO2 measuring equipment for periodic re-calibration and repairs. 3. To ensure reliable cross-comparison of CO2 observations between individual CES units and to minimise the cost of the system, only one CO2 sampling unit was used. An ADC BioScientific OP-2 (open-path) analyser mounted on a swinging arm was passing over a set of 16 measuring cells. Each cell was connected to an individual CES with air continuously circulating between them. 4. Using this setup, we were able to continuously measure several environmental variables and CO2 concentration within each closed system, allowing us to study minute effects of changing temperature on C fluxes within each CES. The CES and the measuring cells showed minimal air leakage during an experimental run lasting, on average, 3 months. The CO2 analyser assembly performed reliably for over 2 years, however an early iteration of the present design proved to be sensitive to positioning errors. 5. We indicate how the methodology can be further improved and suggest possible avenues where future CES based research could be applied.