Usefulness of DARPA dataset for intrusion detection system evaluation

The MIT Lincoln Laboratory IDS evaluation methodology is a practical solution in terms of evaluating the performance of Intrusion Detection Systems, which has contributed tremendously to the research progress in that field. The DARPA IDS evaluation dataset has been criticized and considered by many as a very outdated dataset, unable to accommodate the latest trend in attacks. Then naturally the question arises as to whether the detection systems have improved beyond detecting these old level of attacks. If not, is it worth thinking of this dataset as obsolete? The paper presented here tries to provide supporting facts for the use of the DARPA IDS evaluation dataset. The two commonly used signature-based IDSs, Snort and Cisco IDS, and two anomaly detectors, the PHAD and the ALAD, are made use of for this evaluation purpose and the results support the usefulness of DARPA dataset for IDS evaluation.

Eye movements and road hazard detection: Effects of blur and distractors

Purpose To examine the effects of optical blur, auditory distractors and age on eye movement patterns while performing a driving hazard perception test (HPT). Methods Twenty young (mean age 27.1 ± 4.6 years) and 20 older (73.3 ± 5.7 years) drivers with normal vision completed a HPT in a repeated-measures counterbalanced design while their eye movements were recorded. Testing was performed under two visual (best-corrected vision and with +2.00DS blur) and two distractor (with and without auditory distraction) conditions. Participants were required to respond to road hazards appearing in the HPT videos of real-world driving scenes and their hazard response times were recorded. Results Blur and distractors each significantly delayed hazard response time, by 0.42 and 0.76s respectively (p<0.05). A significant interaction between age and distractors indicated that older drivers were more affected by distractors than young drivers (response with distractors delayed by 0.96 and 0.60s respectively). There were no other two- or three-way interaction effect on response time. With blur, both groups fixated significantly longer on hazards before responding compared to best-corrected vision. In the presence of distractors, both groups exhibited delayed first fixation on the hazards and spent less time fixating on the hazards. There were also significant differences in eye movement characteristics between groups, where older drivers exhibited smaller saccades, delayed first fixation on hazards, and shorter fixation duration on hazards compared to the young drivers. Conclusions Collectively, the findings of delayed hazard response times and alterations in eye movement patterns with blur and distractors provide further evidence that visual impairment and distractors are independently detrimental to driving safety given that delayed hazard response times are linked to increased crash risk.

Towards a typology of hashtag publics: A large-scale comparative study of user engagement across trending topics

Twitter’s hashtag functionality is now used for a very wide variety of purposes, from covering crises and other breaking news events through gathering an instant community around shared media texts (such as sporting events and TV broadcasts) to signalling emotive states from amusement to despair. These divergent uses of the hashtag are increasingly recognised in the literature, with attention paid especially to the ability for hashtags to facilitate the creation of ad hoc or hashtag publics. A more comprehensive understanding of these different uses of hashtags has yet to be developed, however. Previous research has explored the potential for a systematic analysis of the quantitative metrics that could be generated from processing a series of hashtag datasets. Such research found, for example, that crisis-related hashtags exhibited a significantly larger incidence of retweets and tweets containing URLs than hashtags relating to televised events, and on this basis hypothesised that the information-seeking and -sharing behaviours of Twitter users in such different contexts were substantially divergent. This article updates such study and their methodology by examining the communicative metrics of a considerably larger and more diverse number of hashtag datasets, compiled over the past five years. This provides an opportunity both to confirm earlier findings, as well as to explore whether hashtag use practices may have shifted subsequently as Twitter’s userbase has developed further; it also enables the identification of further hashtag types beyond the “crisis” and “mainstream media event” types outlined to date. The article also explores the presence of such patterns beyond recognised hashtags, by incorporating an analysis of a number of keyword-based datasets. This large-scale, comparative approach contributes towards the establishment of a more comprehensive typology of hashtags and their publics, and the metrics it describes will also be able to be used to classify new hashtags emerging in the future. In turn, this may enable researchers to develop systems for automatically distinguishing newly trending topics into a number of event types, which may be useful for example for the automatic detection of acute crises and other breaking news events.

Detection of alpha(2u)-globulin and its bound putative pheromones in the preputial gland of the Indian commensal rat (Rattus rattus) using mass spectrometry

The role of pheromones and pheromone-binding proteins in the laboratory rat has been extensively investigated. However, we have previously reported that the preputial gland of the Indian commensal rat produces a variety of pheromonal molecules and preputial glands would seem to be the predominant source for pheromonal communication. The presence of pheromone-binding proteins has not yet been identified in the preputial gland of the Indian commensal rat; therefore, the experiments were designed to unravel the alpha(2u)-globulin (alpha 2u) and its bound volatiles in the commensal rat. Total preputial glandular proteins were first fractionated by sodium dodecyl sulfate/polyacrylamide gel electrophoresis (SDS-PAGE) and subsequently analyzed by mass spectrometry. Further, we purified alpha 2u and screened for the presence of bound pheromonal molecules with the aid of gas chromatography/mass spectrometry (GC/MS). A novel alpha 2u was identified with a high score and this protein has not been previously described as present in the preputial gland of Indian commensal rats.This novel alpha 2u was then characterized by tandem mass spectrometry (MS/MS). Peptides with m/z values of 969, 1192, 1303 and 1876 were further fragmented with the aid of MS/MS and generated de novo sequences which provided additional evidence for the presence of alpha 2u in the preputial gland. Finally, we identified the presence of farnesol 1 and 2 bound to alpha 2u. The present investigation confirms the presence of alpha 2u (18.54 kDa) in the preputial gland of the Indian commensal rat and identifies farnesol 1 and 2 as probably involved in chemo-communication by the Indian commensal rat.Copyright (C) 2010 John Wiley & Sons, Ltd.

Vibration characteristics and damage detection in a suspension bridge

Suspension bridges are flexible and vibration sensitive structures that exhibit complex and multi-modal vibration. Due to this, the usual vibration based methods could face a challenge when used for damage detection in these structures. This paper develops and applies a mode shape component specific damage index (DI) to detect and locate damage in a suspension bridge with pre-tensioned cables. This is important as suspension bridges are large structures and damage in them during their long service lives could easily go un-noticed. The capability of the proposed vibration based DI is demonstrated through its application to detect and locate single and multiple damages with varied locations and severity in the cables of the suspension bridge. The outcome of this research will enhance the safety and performance of these bridges which play an important role in the transport network.

Detection of recently discovered human polyomaviruses in a longitudinal kidney transplant cohort

A large number of human polyomaviruses have been discovered in the last 7 years. However, little is known about the clinical impact on vulnerable immunosuppressed patient populations. Blood, urine, and respiratory swabs collected from a prospective, longitudinal adult kidney transplant cohort (n = 167) generally pre-operatively, at day 4, months 1, 3, and 6 posttransplant, and at BK viremic episodes within the first year were screened for 12 human polyomaviruses using real-time polymerase chain reaction. Newly discovered polyomaviruses were most commonly detected in the respiratory tract, with persistent shedding seen for up to 6 months posttransplant. Merkel cell polyomavirus was the most common detection, but was not associated with clinical symptoms or subsequent development of skin cancer or other skin abnormalities. In contrast, KI polyomavirus was associated with respiratory disease in a subset of patients. Human polyomavirus 9, Malawi polyomavirus, and human polyomavirus 12 were not detected in any patient samples.

Selection of intrusion detection system threshold bounds for effective sensor fusion

The motivation behind the fusion of Intrusion Detection Systems was the realization that with the increasing traffic and increasing complexity of attacks, none of the present day stand-alone Intrusion Detection Systems can meet the high demand for a very high detection rate and an extremely low false positive rate. Multi-sensor fusion can be used to meet these requirements by a refinement of the combined response of different Intrusion Detection Systems. In this paper, we show the design technique of sensor fusion to best utilize the useful response from multiple sensors by an appropriate adjustment of the fusion threshold. The threshold is generally chosen according to the past experiences or by an expert system. In this paper, we show that the choice of the threshold bounds according to the Chebyshev inequality principle performs better. This approach also helps to solve the problem of scalability and has the advantage of failsafe capability. This paper theoretically models the fusion of Intrusion Detection Systems for the purpose of proving the improvement in performance, supplemented with the empirical evaluation. The combination of complementary sensors is shown to detect more attacks than the individual components. Since the individual sensors chosen detect sufficiently different attacks, their result can be merged for improved performance. The combination is done in different ways like (i) taking all the alarms from each system and avoiding duplications, (ii) taking alarms from each system by fixing threshold bounds, and (iii) rule-based fusion with a priori knowledge of the individual sensor performance. A number of evaluation metrics are used, and the results indicate that there is an overall enhancement in the performance of the combined detector using sensor fusion incorporating the threshold bounds and significantly better performance using simple rule-based fusion.

Local structure in LaMnO3 and CaMnO3 perovskites: A quantitative structural refinement of mn K-edge XANES data

Hole-doped perovskites such as La1-xCaxMnO3 present special magnetic and magnetotransport properties, and it is commonly accepted that the local atomic structure around Mn ions plays a crucial role in determining these peculiar features. Therefore experimental techniques directly probing the local atomic structure, like x-ray absorption spectroscopy (XAS), have been widely exploited to deeply understand the physics of these compounds. Quantitative XAS analysis usually concerns the extended region [extended x-ray absorption fine structure (EXAFS)] of the absorption spectra. The near-edge region [x-ray absorption near-edge spectroscopy (XANES)] of XAS spectra can provide detailed complementary information on the electronic structure and local atomic topology around the absorber. However, the complexity of the XANES analysis usually prevents a quantitative understanding of the data. This work exploits the recently developed MXAN code to achieve a quantitative structural refinement of the Mn K-edge XANES of LaMnO3 and CaMnO3 compounds; they are the end compounds of the doped manganite series LaxCa1-xMnO3. The results derived from the EXAFS and XANES analyses are in good agreement, demonstrating that a quantitative picture of the local structure can be obtained from XANES in these crystalline compounds. Moreover, the quantitative XANES analysis provides topological information not directly achievable from EXAFS data analysis. This work demonstrates that combining the analysis of extended and near-edge regions of Mn K-edge XAS spectra could provide a complete and accurate description of Mn local atomic environment in these compounds.

Detection,amplification and sequence homology of sodC in clinical isolates of Salmonella sp

Background & objectives: Periplasmic copper and zinc superoxide dismutase (Cu,Zn-SOD or SodC) is an important component of the antioxidant shield which protects bacteria from the phagocytic oxidative burst. Cu,Zn-SODs protect Gram-negative bacteria against oxygen damage which have also been shown to contribute to the pathogenicity of these bacterial species. We report the presence of SodC in drug resistant Salmonella sp. isolated from patients suffering from enteric fever. Further sodC was amplified, cloned into Escherichia coli and the nucleotide sequence and amino acid sequence homology were compared with the standard strain Salmonella Typhimurium 14028. Methods: Salmonella enterica serovar Typhi (S. Typhi) and Salmonellaenterica serovar Paratyphi (S. Paratyphi) were isolated and identified from blood samples of the patients. The isolates were screened for the presence of Cu, Zn-SOD by PAGE using KCN as inhibitor of Cu,Zn-SOD. The gene (sodC) was amplified by PCR, cloned and sequenced. The nucleotide and amino acid sequences of sodC were compared using CLUSTAL X.Results: SodC was detected in 35 per cent of the Salmonella isolates. Amplification of the genomic DNA of S. Typhi and S. Paratyphi with sodC specific primers resulted in 519 and 515 bp amplicons respectively. Single mutational difference at position 489 was observed between thesodC of S. Typhi and S. Paratyphi while they differed at 6 positions with the sodC of S. Typhimurium 14028. The SodC amino acid sequences of the two isolates were homologous but 3 amino acid difference was observed with that of standard strain S. Typhimurium 14028.Interpretation & conclusions: The presence of SodC in pathogenic bacteria could be a novel candidate as phylogenetic marker.

Detection of multiple source locations using a glowworm metaphor with applications to collective robotics

This paper presents a glowworm swarm based algorithm that finds solutions to optimization of multiple optima continuous functions. The algorithm is a variant of a well known ant-colony optimization (ACO) technique, but with several significant modifications. Similar to how each moving region in the ACO technique is associated with a pheromone value, the agents in our algorithm carry a luminescence quantity along with them. Agents are thought of as glowworms that emit a light whose intensity is proportional to the associated luminescence and have a circular sensor range. The glowworms depend on a local-decision domain to compute their movements. Simulations demonstrate the efficacy of the proposed glowworm based algorithm in capturing multiple optima of a multimodal function. The above optimization scenario solves problems where a collection of autonomous robots is used to form a mobile sensor network. In particular, we address the problem of detecting multiple sources of a general nutrient profile that is distributed spatially on a two dimensional workspace using multiple robots.

Detection of a periodic structure hidden in random background: the role of signal amplitude in the matched filter detection method

The matched filter method for detecting a periodic structure on a surface hidden behind randomness is known to detect up to (r(0)/Lambda) gt;= 0.11, where r(0) is the coherence length of light on scattering from the rough part and 3 is the wavelength of the periodic part of the surface-the above limit being much lower than what is allowed by conventional detection methods. The primary goal of this technique is the detection and characterization of the periodic structure hidden behind randomness without the use of any complicated experimental or computational procedures. This paper examines this detection procedure for various values of the amplitude a of the periodic part beginning from a = 0 to small finite values of a. We thus address the importance of the following quantities: `(a)lambda) `, which scales the amplitude of the periodic part with the wavelength of light, and (r(0))Lambda),in determining the detectability of the intensity peaks.

Essays on Risk Modeling. Applications to Portfolio and Risk Management (summary section only)

In this thesis we deal with the concept of risk. The objective is to bring together and conclude on some normative information regarding quantitative portfolio management and risk assessment. The first essay concentrates on return dependency. We propose an algorithm for classifying markets into rising and falling. Given the algorithm, we derive a statistic: the Trend Switch Probability, for detection of long-term return dependency in the first moment. The empirical results suggest that the Trend Switch Probability is robust over various volatility specifications. The serial dependency in bear and bull markets behaves however differently. It is strongly positive in rising market whereas in bear markets it is closer to a random walk. Realized volatility, a technique for estimating volatility from high frequency data, is investigated in essays two and three. In the second essay we find, when measuring realized variance on a set of German stocks, that the second moment dependency structure is highly unstable and changes randomly. Results also suggest that volatility is non-stationary from time to time. In the third essay we examine the impact from market microstructure on the error between estimated realized volatility and the volatility of the underlying process. With simulation-based techniques we show that autocorrelation in returns leads to biased variance estimates and that lower sampling frequency and non-constant volatility increases the error variation between the estimated variance and the variance of the underlying process. From these essays we can conclude that volatility is not easily estimated, even from high frequency data. It is neither very well behaved in terms of stability nor dependency over time. Based on these observations, we would recommend the use of simple, transparent methods that are likely to be more robust over differing volatility regimes than models with a complex parameter universe. In analyzing long-term return dependency in the first moment we find that the Trend Switch Probability is a robust estimator. This is an interesting area for further research, with important implications for active asset allocation.

A Wavelet based Teager Energy Operator for Spike Detection in Microelectrode Array Recordings

Spike detection in neural recordings is the initial step in the creation of brain machine interfaces. The Teager energy operator (TEO) treats a spike as an increase in the `local' energy and detects this increase. The performance of TEO in detecting action potential spikes suffers due to its sensitivity to the frequency of spikes in the presence of noise which is present in microelectrode array (MEA) recordings. The multiresolution TEO (mTEO) method overcomes this shortcoming of the TEO by tuning the parameter k to an optimal value m so as to match to frequency of the spike. In this paper, we present an algorithm for the mTEO using the multiresolution structure of wavelets along with inbuilt lowpass filtering of the subband signals. The algorithm is efficient and can be implemented for real-time processing of neural signals for spike detection. The performance of the algorithm is tested on a simulated neural signal with 10 spike templates obtained from [14]. The background noise is modeled as a colored Gaussian random process. Using the noise standard deviation and autocorrelation functions obtained from recorded data, background noise was simulated by an autoregressive (AR(5)) filter. The simulations show a spike detection accuracy of 90%and above with less than 5% false positives at an SNR of 2.35 dB as compared to 80% accuracy and 10% false positives reported [6] on simulated neural signals.