Visualising security incidents through event aggregation

Extracting and aggregating the relevant event records relating to an identified security incident from the multitude of heterogeneous logs in an enterprise network is a difficult challenge. Presenting the information in a meaningful way is an additional challenge. This paper looks at solutions to this problem by first identifying three main transforms; log collection, correlation, and visual transformation. Having identified that the CEE project will address the first transform, this paper focuses on the second, while the third is left for future work. To aggregate by correlating event records we demonstrate the use of two correlation methods, simple and composite. These make use of a defined mapping schema and confidence values to dynamically query the normalised dataset and to constrain result events to within a time window. Doing so improves the quality of results, required for the iterative re-querying process being undertaken. Final results of the process are output as nodes and edges suitable for presentation as a network graph.

Geant4 Hadronic Cascade Models and CMS Data Analysis : Computational Challenges in the LHC era

This work belongs to the field of computational high-energy physics (HEP). The key methods used in this thesis work to meet the challenges raised by the Large Hadron Collider (LHC) era experiments are object-orientation with software engineering, Monte Carlo simulation, the computer technology of clusters, and artificial neural networks. The first aspect discussed is the development of hadronic cascade models, used for the accurate simulation of medium-energy hadron-nucleus reactions, up to 10 GeV. These models are typically needed in hadronic calorimeter studies and in the estimation of radiation backgrounds. Various applications outside HEP include the medical field (such as hadron treatment simulations), space science (satellite shielding), and nuclear physics (spallation studies). Validation results are presented for several significant improvements released in Geant4 simulation tool, and the significance of the new models for computing in the Large Hadron Collider era is estimated. In particular, we estimate the ability of the Bertini cascade to simulate Compact Muon Solenoid (CMS) hadron calorimeter HCAL. LHC test beam activity has a tightly coupled cycle of simulation-to-data analysis. Typically, a Geant4 computer experiment is used to understand test beam measurements. Thus an another aspect of this thesis is a description of studies related to developing new CMS H2 test beam data analysis tools and performing data analysis on the basis of CMS Monte Carlo events. These events have been simulated in detail using Geant4 physics models, full CMS detector description, and event reconstruction. Using the ROOT data analysis framework we have developed an offline ANN-based approach to tag b-jets associated with heavy neutral Higgs particles, and we show that this kind of NN methodology can be successfully used to separate the Higgs signal from the background in the CMS experiment.

The International Large Detector: Letter of Intent

The International Large Detector (ILD) is a concept for a detector at the International Linear Collider, ILC. The ILC will collide electrons and positrons at energies of initially 500 GeV, upgradeable to 1 TeV. The ILC has an ambitious physics program, which will extend and complement that of the Large Hadron Collider (LHC). A hallmark of physics at the ILC is precision. The clean initial state and the comparatively benign environment of a lepton collider are ideally suited to high precision measurements. To take full advantage of the physics potential of ILC places great demands on the detector performance. The design of ILD is driven by these requirements. Excellent calorimetry and tracking are combined to obtain the best possible overall event reconstruction, including the capability to reconstruct individual particles within jets for particle ow calorimetry. This requires excellent spatial resolution for all detector systems. A highly granular calorimeter system is combined with a central tracker which stresses redundancy and efficiency. In addition, efficient reconstruction of secondary vertices and excellent momentum resolution for charged particles are essential for an ILC detector. The interaction region of the ILC is designed to host two detectors, which can be moved into the beam position with a push-pull scheme. The mechanical design of ILD and the overall integration of subdetectors takes these operational conditions into account.

Study of multi-muon events produced in p\bar{p} interactions at \sqrt{s}=1.96 TeV

We report the results of a study of multi-muon events produced at the Fermilab Tevatron collider and acquired with the CDF II detector using a dedicated dimuon trigger. The production cross section and kinematics of events in which both muon candidates are produced inside the beam pipe of radius 1.5 cm are successfully modeled by known processes which include heavy flavor production. In contrast, we are presently unable to fully account for the number and properties of the remaining events, in which at least one muon candidate is produced outside of the beam pipe, in terms of the same understanding of the CDF II detector, trigger, and event reconstruction.

Estudo da produção de multijatos em colisões próton-próton com √s= 7 TeV no detector CMS/LHC

O Compact Muon Solenoid (CMS) é um dos principais detectores instalados no LHC que possibilita o estudo de diferentes aspectos da Física, indo do Modelo Padrão à matéria escura. Esse detector de propósito geral, foi construído para ser capaz de medir múons com uma grande precisão e todos os seus subdetectores foram construídos com uma alta granularidade, tornando possível identificar e caracterizar as propriedades cinemáticas das partículas finais da colisão. O algoritmo de reconstrução de eventos inclui a identificação de jatos, ou seja, é possível identificar a assinatura da produção de pártons na colisão e a medida de seções de choque da produção de muitos jatos é um dos métodos para se explorar as contribuições da Cromodinâmica Quântica (Quantum Chromodynamics - QCD) perturbativa, permitindo avaliar as previsões implementadas nas simulações de eventos. Tendo em vista a caracterização de processos relacionados com a QCD em colisões de próton-próton a uma energia do centro de massa de 7 TeV, é apresentada a medida da seção de choque da produção inclusiva de multijatos no CMS. Para realizar essa medida foram utilizados dados reais coletados em 2010, onde não se apresentava muitas colisões por cruzamento de pacote, com uma luminosidade integrada de L = 2,869 pb-1 e utilizando jatos que estão em quase todo o espaço de fase acessível em pseudorapidez |n|≤ 4,8 e momentum transverso pT ≥ 30 GeV/ c2. Desse resultado foram removidos os efeitos de detecção comparado com predições simuladas.

Fast simulation of the forward tracking detector of HPLUS

The necessity of installing a forward tracking detector stack is discussed for the Hadron Physics LanzhoU Spectrometer(HPLUS). A local tracker is developed to solve the multi-track finding problem. The track candidates are searched iteratively via Hough Transform. The fake tracks are removed by a least square fitting process. With this tracker we have studied the feasibility of pp -> pp + phi(-> K+K-), a typical physical channel proposed on HPLUS. The single track momentum resolution due to the uncertainty of the positioning in FTD is 1.3%. The multiple scattering effect contributes about 20% to the momentum resolution in the FTD coverage. The width and the signal-to-background ratio of the reconstructed phi are 1.51 MeV and 4.36, respectively, taking into account the direct Kaon channel pp -> pp + K+K- as background. The geometry coverage of FTD for phi events is about 85.4%. Based on the current fast simulation and estimation, the geometrical configuration of FTD meets the physical requirement of HPLUS under the current luminosity and multiplicity conditions. The tracker is applicable in the full simulation coming next and is extendable to other tracking component of HPLUS.

Relación de las organizaciones con el medio y marketing

La relación que tienen las empresas mayoristas con los consumidores se hace un tema de suma importancia en la actualidad, su adelanto y progreso en la economía y en la sociedad están atados a que las estrategias que brinden sean no solo suficientes si no útiles para los clientes; y estos al mismo tiempo formar las llamadas estrategias de consumo para el cliente final que es quien definitivamente interviene y maneja toda la industria de consumo.

The rapid atmospheric monitoring system of the Pierre Auger Observatory

The Pierre Auger Observatory is a facility built to detect air showers produced by cosmic rays above 10(17) eV. During clear nights with a low illuminated moon fraction, the UV fluorescence light produced by air showers is recorded by optical telescopes at the Observatory. To correct the observations for variations in atmospheric conditions, atmospheric monitoring is performed at regular intervals ranging from several minutes (for cloud identification) to several hours (for aerosol conditions) to several days (for vertical profiles of temperature, pressure, and humidity). In 2009, the monitoring program was upgraded to allow for additional targeted measurements of atmospheric conditions shortly after the detection of air showers of special interest, e. g., showers produced by very high-energy cosmic rays or showers with atypical longitudinal profiles. The former events are of particular importance for the determination of the energy scale of the Observatory, and the latter are characteristic of unusual air shower physics or exotic primary particle types. The purpose of targeted (or "rapid") monitoring is to improve the resolution of the atmospheric measurements for such events. In this paper, we report on the implementation of the rapid monitoring program and its current status. The rapid monitoring data have been analyzed and applied to the reconstruction of air showers of high interest, and indicate that the air fluorescence measurements affected by clouds and aerosols are effectively corrected using measurements from the regular atmospheric monitoring program. We find that the rapid monitoring program has potential for supporting dedicated physics analyses beyond the standard event reconstruction.

Da Laodice I a Laodice III: l'orizzonte politico delle regine seleucidi

Questo studio indaga la tradizione storiografica sulle regine seleucidi di III secolo a.C. - da Laodice I fino all’ascesa al trono di Laodice III - alla luce delle testimonianze documentarie. L’intento è stabilire l’orizzonte politico dell’azione delle regine nel momento meno conosciuto e più buio della storia del regno di Siria. Il III secolo seleucidico è infatti un periodo caratterizzato da incertezza nella ricostruzione evenemenziale e nell’analisi delle dinamiche sociopolitiche, soprattutto a causa dell’interesse relativo e limitato delle fonti storiografiche antiche a noi giunte relativamente alle vicende della monarchia seleucidica precedenti l’avvento di Antioco III il Grande. In questo panorama rappresenta un’eccezione il caso di Laodice I, che è al centro di un rilevante numero di testimonianze. Tenendo conto della differente natura delle fonti e della complessità del contesto evenemenziale, non sempre ricostruibile, è stata studiata la figura di Laodice I nell’intento di comprendere il paradigma di regalità femminile stabilito dalle azioni della regina, e quindi l’influenza di tale paradigma sulla generazione seleucide successiva. La ricerca si articola in tre sezioni, legate agli eventi principali del III secolo seleucide che vedono coinvolta la regina. La prima parte è dedicata all’attività di Laodice I dopo il secondo matrimonio di Antioco II con la tolemaica Berenice. La seconda parte riguarda il ruolo di Laodice nei complessi eventi che seguirono la morte del marito Antioco II nel 246 e nella Terza Guerra Siriaca, che vide la regina a fianco del figlio Seleuco II contrapporsi a Tolemeo III e Berenice Sira. La terza sezione si occupa dell’azione di Laodice I nella Guerra Fraterna al fianco di Antioco Ierace contro Seleuco II e Laodice II. Nella conclusione si riflette sull’influenza delle azioni politiche di Laodice I sulla scelta di Antioco III di sposare la cugina Laodice III, prima principessa del Ponto entrata nella dinastia regnante.

Fast frontend electronics for high rate particle detectors

Future experiments in nuclear and particle physics are moving towards the high luminosity regime in order to access rare processes. In this framework, particle detectors require high rate capability together with excellent timing resolution for precise event reconstruction. In order to achieve this, the development of dedicated FrontEnd Electronics (FEE) for detectors has become increasingly challenging and expensive. Thus, a current trend in R&D is towards flexible FEE that can be easily adapted to a great variety of detectors, without impairing the required high performance. This thesis reports on a novel FEE for two different detector types: imaging Cherenkov counters and plastic scintillator arrays. The former requires high sensitivity and precision for detection of single photon signals, while the latter is characterized by slower and larger signals typical of scintillation processes. The FEE design was developed using high-bandwidth preamplifiers and fast discriminators which provide Time-over-Threshold (ToT). The use of discriminators allowed for low power consumption, minimal dead-times and self-triggering capabilities, all fundamental aspects for high rate applications. The output signals of the FEE are readout by a high precision TDC system based on FPGA. The performed full characterization of the analogue signals under realistic conditions proved that the ToT information can be used in a novel way for charge measurements or walk corrections, thus improving the obtainable timing resolution. Detailed laboratory investigations proved the feasibility of the ToT method. The full readout chain was investigated in test experiments at the Mainz Microtron: high counting rates per channel of several MHz were achieved, and a timing resolution of better than 100 ps after walk correction based on ToT was obtained. Ongoing applications to fast Time-of-Flight counters and future developments of FEE have been also recently investigated.

Dynamic texture reconstruction from sparse codes for unusual event detection in crowded scenes

Unusual event detection in crowded scenes remains challenging because of the diversity of events and noise. In this paper, we present a novel approach for unusual event detection via sparse reconstruction of dynamic textures over an overcomplete basis set, with the dynamic texture described by local binary patterns from three orthogonal planes (LBPTOP). The overcomplete basis set is learnt from the training data where only the normal items observed. In the detection process, given a new observation, we compute the sparse coefficients using the Dantzig Selector algorithm which was proposed in the literature of compressed sensing. Then the reconstruction errors are computed, based on which we detect the abnormal items. Our application can be used to detect both local and global abnormal events. We evaluate our algorithm on UCSD Abnormality Datasets for local anomaly detection, which is shown to outperform current state-of-the-art approaches, and we also get promising results for rapid escape detection using the PETS2009 dataset.

Event-triggered Sampling and Reconstruction of Sparse Real-valued Trigonometric Polynomials

We propose data acquisition from continuous-time signals belonging to the class of real-valued trigonometric polynomials using an event-triggered sampling paradigm. The sampling schemes proposed are: level crossing (LC), close to extrema LC, and extrema sampling. Analysis of robustness of these schemes to jitter, and bandpass additive gaussian noise is presented. In general these sampling schemes will result in non-uniformly spaced sample instants. We address the issue of signal reconstruction from the acquired data-set by imposing structure of sparsity on the signal model to circumvent the problem of gap and density constraints. The recovery performance is contrasted amongst the various schemes and with random sampling scheme. In the proposed approach, both sampling and reconstruction are non-linear operations, and in contrast to random sampling methodologies proposed in compressive sensing these techniques may be implemented in practice with low-power circuitry.

Measurement of event background fluctuations for charged particle jet reconstruction in Pb-Pb collisions at root s(NN)=2.76 TeV

The effect of event background fluctuations on charged particle jet reconstruction in Pb-Pb collisions at root s(NN) = 2.76 TeV has been measured with the ALICE experiment. The main sources of non-statistical fluctuations are characterized based purely on experimental data with an unbiased method, as well as by using single high p(t) particles and simulated jets embedded into real Pb-Pb events and reconstructed with the anti-k(t) jet finder. The influence of a low transverse momentum cut-off on particles used in the jet reconstruction is quantified by varying the minimum track p(t) between 0.15 GeV/c and 2 GeV/c. For embedded jets reconstructed from charged particles with p(t) > 0.15 GeV/c, the uncertainty in the reconstructed jet transverse momentum due to the heavy-ion background is measured to be 11.3 GeV/c (standard deviation) for the 10% most central Pb-Pb collisions, slightly larger than the value of 11.0 GeV/c measured using the unbiased method. For a higher particle transverse momentum threshold of 2 GeV/c, which will generate a stronger bias towards hard fragmentation in the jet finding process, the standard deviation of the fluctuations in the reconstructed jet transverse momentum is reduced to 4.8-5.0 GeV/c for the 10% most central events. A non-Gaussian tail of the momentum uncertainty is observed and its impact on the reconstructed jet spectrum is evaluated for varying particle momentum thresholds, by folding the measured fluctuations with steeply falling spectra.