Measuring inconsistency in network intrusion rules

In this preliminary case study, we investigate how inconsistency in a network intrusion detection rule set can be measured. To achieve this, we first examine the structure of these rules which incorporate regular expression (Regex) pattern matching. We then identify primitive elements in these rules in order to translate the rules into their (equivalent) logical forms and to establish connections between them. Additional rules from background knowledge are also introduced to make the correlations among rules more explicit. Finally, we measure the degree of inconsistency in formulae of such a rule set (using the Scoring function, Shapley inconsistency values and Blame measure for prioritized knowledge) and compare the informativeness of these measures. We conclude that such measures are useful for the network intrusion domain assuming that incorporating domain knowledge for correlation of rules is feasible.

A Syntax-based approach to measuring the degree of inconsistency for belief bases

Measuring the degree of inconsistency of a belief base is an important issue in many real world applications. It has been increasingly recognized that deriving syntax sensitive inconsistency measures for a belief base from its minimal inconsistent subsets is a natural way forward. Most of the current proposals along this line do not take the impact of the size of each minimal inconsistent subset into account. However, as illustrated by the well-known Lottery Paradox, as the size of a minimal inconsistent subset increases, the degree of its inconsistency decreases. Another lack in current studies in this area is about the role of free formulas of a belief base in measuring the degree of inconsistency. This has not yet been characterized well. Adding free formulas to a belief base can enlarge the set of consistent subsets of that base. However, consistent subsets of a belief base also have an impact on the syntax sensitive normalized measures of the degree of inconsistency, the reason for this is that each consistent subset can be considered as a distinctive plausible perspective reflected by that belief base,whilst eachminimal inconsistent subset projects a distinctive viewof the inconsistency. To address these two issues,we propose a normalized framework formeasuring the degree of inconsistency of a belief base which unifies the impact of both consistent subsets and minimal inconsistent subsets. We also show that this normalized framework satisfies all the properties deemed necessary by common consent to characterize an intuitively satisfactory measure of the degree of inconsistency for belief bases. Finally, we use a simple but explanatory example in equirements engineering to illustrate the application of the normalized framework.

Measuring workforce segregation: religious composition of private-sector employees at individual sites in Northern Ireland

In this paper I examine the scope of publicly available information on the religious composition of employees in private-sector companies in Northern Ireland. I highlight the unavailability of certain types of monitoring data and the impact of data aggregation at company as opposed to site level. Both oversights lead to underestimates of the extent of workplace segregation in Northern Ireland. The ability to provide more-coherent data on workplace segregation, by religion, in Northern Ireland is crucial in terms of advancing equality and other social-justice agendas. I argue that a more-accurate monitoring of religious composition of workplaces is part of an overall need to develop a spatial approach in which the importance of ethnically territorialised spaces in the reproduction of ethnosectarian disputation is understood.

Comparing large graphs efficiently by margins of feature vectors

Measuring the structural similarity of graphs is a challenging and outstanding problem. Most of the classical approaches of the so-called exact graph matching methods are based on graph or subgraph isomorphic relations of the underlying graphs. In contrast to these methods in this paper we introduce a novel approach to measure the structural similarity of directed and undirected graphs that is mainly based on margins of feature vectors representing graphs. We introduce novel graph similarity and dissimilarity measures, provide some properties and analyze their algorithmic complexity. We find that the computational complexity of our measures is polynomial in the graph size and, hence, significantly better than classical methods from, e.g. exact graph matching which are NP-complete. Numerically, we provide some examples of our measure and compare the results with the well-known graph edit distance. (c) 2006 Elsevier Inc. All rights reserved.

Measuring Inconsistency in a Network Intrusion Detection Rule Set Based on Snort

In this preliminary study, we investigate how inconsistency in a network intrusion detection rule set can be measured. To achieve this, we first examine the structure of these rules which are based on Snort and incorporate regular expression (Regex) pattern matching. We then identify primitive elements in these rules in order to translate the rules into their (equivalent) logical forms and to establish connections between them. Additional rules from background knowledge are also introduced to make the correlations among rules more explicit. We measure the degree of inconsistency in formulae of such a rule set (using the Scoring function, Shapley inconsistency values and Blame measure for prioritized knowledge) and compare the informativeness of these measures. Finally, we propose a new measure of inconsistency for prioritized knowledge which incorporates the normalized number of atoms in a language involved in inconsistency to provide a deeper inspection of inconsistent formulae. We conclude that such measures are useful for the network intrusion domain assuming that introducing expert knowledge for correlation of rules is feasible.

Measuring the blame of each formula for inconsistent prioritized knowledge bases.

It is increasingly recognized that identifying the degree of blame or responsibility of each formula for inconsistency of a knowledge base (i.e. a set of formulas) is useful for making rational decisions to resolve inconsistency in that knowledge base. Most current techniques for measuring the blame of each formula with regard to an inconsistent knowledge base focus on classical knowledge bases only. Proposals for measuring the blames of formulas with regard to an inconsistent prioritized knowledge base have not yet been given much consideration. However, the notion of priority is important in inconsistency-tolerant reasoning. This article investigates this issue and presents a family of measurements for the degree of blame of each formula in an inconsistent prioritized knowledge base by using the minimal inconsistent subsets of that knowledge base. First of all, we present a set of intuitive postulates as general criteria to characterize rational measurements for the blames of formulas of an inconsistent prioritized knowledge base. Then we present a family of measurements for the blame of each formula in an inconsistent prioritized knowledge base under the guidance of the principle of proportionality, one of the intuitive postulates. We also demonstrate that each of these measurements possesses the properties that it ought to have. Finally, we use a simple but explanatory example in requirements engineering to illustrate the application of these measurements. Compared to the related works, the postulates presented in this article consider the special characteristics of minimal inconsistent subsets as well as the priority levels of formulas. This makes them more appropriate to characterizing the inconsistency measures defined from minimal inconsistent subsets for prioritized knowledge bases as well as classical knowledge bases. Correspondingly, the measures guided by these postulates can intuitively capture the inconsistency for prioritized knowledge bases.

Short distance phase shifts revisited: tracking clock-shifted homing pigeons (Rock Dove Columba livia) close to the loft

Clock-shifted homing pigeons (Rock Dove Columba livia) were tracked from familiar release sites using a direction recorder. At relatively short distances from the home loft (

Distance limits to intermediate- and high-velocity clouds

We present optical spectra of 403 stars and quasi-stellar objects in order to obtain distance limits towards intermediate- and high-velocity clouds (IHVCs), including new Fibre-fed Extended Range Optical Spectrograph (FEROS) observations plus archival ELODIE, FEROS, High Resolution Echelle Spectrometer (HIRES) and Ultraviolet and Visual Echelle Spectrograph (UVES) data. The non-detection of Ca II K interstellar (IS) absorption at a velocity of −130 to −60 km s−1 towards HDE 248894 (d ∼ 3 kpc) and HDE 256725 (d ∼ 8 kpc) in data at signal-to-noise ratio (S/N) > 450 provides a new firm lower distance limit of 8 kpc for the anti-centre shell HVC. Similarly, the non-detection of Ca II K IS absorption towards HD 86248 at S/N ∼ 500 places a lower distance limit of 7.6 kpc for Complex EP, unsurprising since this feature is probably related to the Magellanic System. The lack of detection of Na I D at S/N = 35 towards Mrk 595 puts an improved upper limit for the Na I column density of log (NNaD <) 10.95 cm−2 towards this part of the Cohen Stream where Ca II was detected by Wakker et al. Absorption at ∼ −40 km s−1 is detected in Na I D towards the Galactic star PG 0039+049 at S/N = 75, placing a firm upper distance limit of 1 kpc for the intermediate-velocity cloud south (IVS), where a tentative detection had previously been obtained by Centurion et al. Ca ´ II K and Na I D absorption is detected at −53 km s−1 towards HD 93521, which confirms the upper distance limit of 2.4 kpc for part of the IV arch complex obtained using the International Ultraviolet Explorer (IUE) data by Danly. Towards HD 216411 in Complex H a non-detection in Na D towards gas with log(NH I) = 20.69 cm−2 puts a lower distance limit of 6.6 kpc towards this HVC complex. Additionally, Na I D absorption is detected at −43.7 km s−1 in the star HD 218915 at a distance of 5.0 kpc in gas in the same region of the sky as Complex H. Finally, the Na I/Ca II and Ca II/H I ratios of the current sample are found to lie in the range observed for previous studies of IHVCs.

Analysis of pharmacists attitudes toward a distance learning initiative on health screening

A questionnaire was developed to investigate pharmacists' attitudes to distance learning (DL) as a vehicle for continuing education (CE). It was included in each of a two part DL course on Health Screening. Part One was mailed to all community pharmacists in England (16,400) and returns were received from 1487. The questionnaire in Part Two was returned by 436 pharmacists. Attitude statements were scored using a five-point Likert scale. The mean response to all attitude statements was positive. Participants were significantly more satisfied than non-participants with DL in general and the DL course studied (P less than or equal to 0.05). Over 80 percent of respondents completing the course found DL to be enjoyable and more suitable than other CE methods. More females and less males than expected (based on registration statistics) requested (P less than or equal to 0.001) and completed the course (P less than or equal to 0.001). Pharmacists of all ages participated, although those recently qualified showed greater interest.