Detecting Botnets Through Log Correlation

Botnets, which consist of thousands of compromised machines, can cause a significant threat to other systems by launching Distributed Denial of Service attacks, keylogging, and backdoors. In response to this threat, new effective techniques are needed to detect the presence of botnets. In this paper, we have used an interception technique to monitor Windows Application Programming Interface system calls made by communication applications. Existing approaches for botnet detection are based on finding bot traffic patterns. Our approach does not depend on finding patterns but rather monitors the change of behaviour in the system. In addition, we will present our idea of detecting botnet based on log correlations from different hosts.

Visualising security incidents through event aggregation

Extracting and aggregating the relevant event records relating to an identified security incident from the multitude of heterogeneous logs in an enterprise network is a difficult challenge. Presenting the information in a meaningful way is an additional challenge. This paper looks at solutions to this problem by first identifying three main transforms; log collection, correlation, and visual transformation. Having identified that the CEE project will address the first transform, this paper focuses on the second, while the third is left for future work. To aggregate by correlating event records we demonstrate the use of two correlation methods, simple and composite. These make use of a defined mapping schema and confidence values to dynamically query the normalised dataset and to constrain result events to within a time window. Doing so improves the quality of results, required for the iterative re-querying process being undertaken. Final results of the process are output as nodes and edges suitable for presentation as a network graph.

Two-photon excited red upconversion luminescence of thulium ions doped GeS2-In2S3-CsI glass

We report a novel phenomenon in GeS2-In2S3-CsI chalcohalide glass doped with Tm3+ ions. Under irradiation with an 808 nm laser diode, a bright red emission centered at 700 nm is observed for the first time in this glass. The log-log correlation between integrated emission intensity and pump power reveals that a two-photon absorption process is involved in the phenomenon, suggesting that the F-3(3,2) -> H-3(6) transition of Tm3+ ions is responsible for the appearance of the red emission. The results indicate that the indium (In) based chalcohalide glass containing Tm3+ ions is expected to find applications in visible lasers, high density optical storage and three-dimensional color displays. (C) 2009 Elsevier B.V. All rights reserved.

Imageamento da porosidade através de perfis geofísicos de poço

O imageamento da porosidade é uma representação gráfica da distribuição lateral da porosidade da rocha, estimada a partir de dados de perfis geofísicos de poço. Apresenta-se aqui uma metodologia para produzir esta imagem geológica, totalmente independente da intervenção do intérprete, através de um algoritmo, dito, interpretativo baseado em dois tipos de redes neurais artificiais. A primeira parte do algoritmo baseia-se em uma rede neural com camada competitiva e é construído para realizar uma interpretação automática do clássico gráfico o P_b - Φ_N, produzindo um zoneamento do perfil e a estimativa da porosidade. A segunda parte baseia-se em uma rede neural com função de base radial, projetado para realizar uma integração espacial dos dados, a qual pode ser dividida em duas etapas. A primeira etapa refere-se à correlação de perfis de poço e a segunda à produção de uma estimativa da distribuição lateral da porosidade. Esta metodologia ajudará o intérprete na definição do modelo geológico do reservatório e, talvez o mais importante, o ajudará a desenvolver de um modo mais eficiente as estratégias para o desenvolvimento dos campos de óleo e gás. Os resultados ou as imagens da porosidade são bastante similares às seções geológicas convencionais, especialmente em um ambiente deposicional simples dominado por clásticos, onde um mapa de cores, escalonado em unidades de porosidade aparente para as argilas e efetiva para os arenitos, mostra a variação da porosidade e a disposição geométrica das camadas geológicas ao longo da seção. Esta metodologia é aplicada em dados reais da Formação Lagunillas, na Bacia do Lago Maracaibo, Venezuela.

A study of the turbulence of the neutral medium in two nearby spiral galaxies

The width of the 21 cm line (HI) emitted by spiral galaxies depends on the physical processes that release energy in the Interstellar Medium (ISM). This quantity is called velocity dispersion (σ) and it is proportional first of all to the thermal kinetic energy of the gas. The accepted theoretical picture predicts that the neutral hydrogen component (HI) exists in the ISM in two stable phases: a cold one (CNM, with σ~0.8 km/s) and a warm one (WNM, with σ~8 km/s). However, this is called into question by the observation that the HI gas has usually larger velocity dispersions. This suggests the presence of turbulence in the ISM, although the energy sources remain unknown. In this thesis we want to shed new light on this topic. We have studied the HI line emission of two nearby galaxies: NGC6946 and M101. For the latter we used new deep observations obtained with the Westerbork radio interferometer. Through a gaussian fitting procedure, we produced dispersion maps of the two galaxies. For both of them, we compared the σ values measured in the spiral arms with those in the interarms. In NGC6946 we found that, in both arms and interarms, σ grows with the column density, while we obtained the opposite for M 101. Using a statistical analysis we did not find a significant difference between arm and interarm dispersion distributions. Producing star formation rate density maps (SFRD) of the galaxies, we studied their global and local relations with the HI kinetic energy, as inferred from the measured dispersions. For NGC6946 we obtained a good log-log correlation, in agreement with a simple model of supernova feedback driven turbulence. This shows that in this galaxy turbulent motions are mainly induced by the stellar activity. For M 101 we did not find an analogous correlation, since the gas kinetic energy appears constant with the SFRD. We think that this may indicate that in this galaxy turbulence is driven also by accretion of extragalactic material.

Susceptibility, density, iron and calcium concentrations of ODP holes 165-999B and 165-1001A

Pelagic sediments recording an extreme and short-lived global warming event, the Late Paleocene Thermal Maximum (LPTM), were recovered from Hole 999B (Colombian Basin) and Holes 1001A and 1001B (lower Nicaraguan Rise) in the Caribbean Sea during Ocean Drilling Program Leg 165. The LPTM consists of a 0.3-0.97 m calcareous claystone to claystone horizon. High-resolution downhole logging (Formation MicroScanner [FMS]), standard downhole logs (resistivity, velocity, density, natural gamma ray, and geochemical log), and non-destructive chemical and physical property (multisensor core logger [MSCL] and X-ray fluorescence [XRF] core scanner) data were used to identify composite sections from parallel holes and to record sedimentological and environmental changes associated with the LPTM. Downhole logging data indicate an abrupt and distinct difference in physical and chemical properties that extend for tens of meters above and below the LPTM. These observations indicate a rapid environmental change at the LPTM, which persists beyond the LPTM anomaly. Comparisons of gamma-ray attenuation porosity evaluator (GRAPE) densities from MSCL logging on split cores with FMS resistivity values allows core-to-log correlation with a high degree of accuracy. High-resolution magnetic susceptibility measurements of the cores are compared with elemental concentrations (e.g., Fe, Ca) analyzed by high-resolution XRF scanning. The high-resolution data obtained from several detailed core and downhole logging methods are the key to the construction of composite sections, the correlation of both adjacent holes and distant sites, and core-log integration. These continuous-depth series reveal the LPTM as a multiphase event with a nearly instantaneous onset, followed by a much different set of physical and chemical conditions of short duration, succeeded by a longer transition to a new, more permanent set of environmental circumstances. The estimated duration of these 'phases' are consistent with paleontological and isotopic studies of the LPTM

Correlation of phantom-based and log file patient-specific QA with complexity scores for VMAT

The motivation for this study was to reduce physics workload relating to patient- specific quality assurance (QA). VMAT plan delivery accuracy was determined from analysis of pre- and on-treatment trajectory log files and phantom-based ionization chamber array measurements. The correlation in this combination of measurements for patient-specific QA was investigated. The relationship between delivery errors and plan complexity was investigated as a potential method to further reduce patient-specific QA workload. Thirty VMAT plans from three treatment sites - prostate only, prostate and pelvic node (PPN), and head and neck (H&N) - were retrospectively analyzed in this work. The 2D fluence delivery reconstructed from pretreatment and on-treatment trajectory log files was compared with the planned fluence using gamma analysis. Pretreatment dose delivery verification was also car- ried out using gamma analysis of ionization chamber array measurements compared with calculated doses. Pearson correlations were used to explore any relationship between trajectory log file (pretreatment and on-treatment) and ionization chamber array gamma results (pretreatment). Plan complexity was assessed using the MU/ arc and the modulation complexity score (MCS), with Pearson correlations used to examine any relationships between complexity metrics and plan delivery accu- racy. Trajectory log files were also used to further explore the accuracy of MLC and gantry positions. Pretreatment 1%/1 mm gamma passing rates for trajectory log file analysis were 99.1% (98.7%-99.2%), 99.3% (99.1%-99.5%), and 98.4% (97.3%-98.8%) (median (IQR)) for prostate, PPN, and H&N, respectively, and were significantly correlated to on-treatment trajectory log file gamma results (R = 0.989, p < 0.001). Pretreatment ionization chamber array (2%/2 mm) gamma results were also significantly correlated with on-treatment trajectory log file gamma results (R = 0.623, p < 0.001). Furthermore, all gamma results displayed a significant correlation with MCS (R > 0.57, p < 0.001), but not with MU/arc. Average MLC position and gantry angle errors were 0.001 ± 0.002 mm and 0.025° ± 0.008° over all treatment sites and were not found to affect delivery accuracy. However, vari- ability in MLC speed was found to be directly related to MLC position accuracy. The accuracy of VMAT plan delivery assessed using pretreatment trajectory log file fluence delivery and ionization chamber array measurements were strongly correlated with on-treatment trajectory log file fluence delivery. The strong corre- lation between trajectory log file and phantom-based gamma results demonstrates potential to reduce our current patient-specific QA. Additionally, insight into MLC and gantry position accuracy through trajectory log file analysis and the strong cor- relation between gamma analysis results and the MCS could also provide further methodologies to both optimize the VMAT planning and QA process. 

Dynamic Site Characterization and Correlation of Shear Wave Velocity with Standard Penetration Test `N' Values for the City of Agartala, Tripura State, India

Seismic site characterization is the basic requirement for seismic microzonation and site response studies of an area. Site characterization helps to gauge the average dynamic properties of soil deposits and thus helps to evaluate the surface level response. This paper presents a seismic site characterization of Agartala city, the capital of Tripura state, in the northeast of India. Seismically, Agartala city is situated in the Bengal Basin zone which is classified as a highly active seismic zone, assigned by Indian seismic code BIS-1893, Indian Standard Criteria for Earthquake Resistant Design of Structures, Part-1 General Provisions and Buildings. According to the Bureau of Indian Standards, New Delhi (2002), it is the highest seismic level (zone-V) in the country. The city is very close to the Sylhet fault (Bangladesh) where two major earthquakes (M (w) > 7) have occurred in the past and affected severely this city and the whole of northeast India. In order to perform site response evaluation, a series of geophysical tests at 27 locations were conducted using the multichannel analysis of surface waves (MASW) technique, which is an advanced method for obtaining shear wave velocity (V (s)) profiles from in situ measurements. Similarly, standard penetration test (SPT-N) bore log data sets have been obtained from the Urban Development Department, Govt. of Tripura. In the collected data sets, out of 50 bore logs, 27 were selected which are close to the MASW test locations and used for further study. Both the data sets (V (s) profiles with depth and SPT-N bore log profiles) have been used to calculate the average shear wave velocity (V (s)30) and average SPT-N values for the upper 30 m depth of the subsurface soil profiles. These were used for site classification of the study area recommended by the National Earthquake Hazard Reduction Program (NEHRP) manual. The average V (s)30 and SPT-N classified the study area as seismic site class D and E categories, indicating that the city is susceptible to site effects and liquefaction. Further, the different data set combinations between V (s) and SPT-N (corrected and uncorrected) values have been used to develop site-specific correlation equations by statistical regression, as `V (s)' is a function of SPT-N value (corrected and uncorrected), considered with or without depth. However, after considering the data set pairs, a probabilistic approach has also been presented to develop a correlation using a quantile-quantile (Q-Q) plot. A comparison has also been made with the well known published correlations (for all soils) available in the literature. The present correlations closely agree with the other equations, but, comparatively, the correlation of shear wave velocity with the variation of depth and uncorrected SPT-N values provides a more suitable predicting model. Also the Q-Q plot agrees with all the other equations. In the absence of in situ measurements, the present correlations could be used to measure V (s) profiles of the study area for site response studies.

Correlation of cell numbers with catalase activities of pure strains of bacteria

An attempt was made to correlate the catalase production with the actual number of aerobic bacterial cells generating the enzyme: bacteria were obtained from the surface of marine fish. A linear correlation was found between the log of catalase activity and log of bacterial count in single culture.

Soil column chromatography for correlation between capacity factors and soil organic partition coefficients for eight pesticides

A soil column chromatographic method was developed to measure the capacity factors (k') of pesticides, in which soil acted as a stationary phase and methanol-water mixture as an eluent. The k' values of eight pesticides, including three insecticides (methiocarb, azinphos-methyl, fenthion), four fungicides (triadimenol, fuberidazole, tebuconazole, pencycuron), and one herbicide (atrazine), were found to be well fitted to a retention equation, ln k'=ln k(w)'-S-phi. Due to similar interactions of solutes with soil and solvent in both sorption determination and retention experiment, log k' has a good linear correlation with log K-oc for the eight pesticides from different classes, in contrast with poor correlation between log k' from C-18 column and log K-oc. So the method provides a tool for rapid estimation of K-oc from experimental k'. (C) 1999 Elsevier Science Ltd. All rights reserved.

On classical and other methods of discriminant analysis and estimation of log-odds

For two multinormal populations with equal covariance matrices the likelihood ratio discriminant function, an alternative allocation rule to the sample linear discriminant function when n1 ≠ n2 ,is studied analytically. With the assumption of a known covariance matrix its distribution is derived and the expectation of its actual and apparent error rates evaluated and compared with those of the sample linear discriminant function. This comparison indicates that the likelihood ratio allocation rule is robust to unequal sample sizes. The quadratic discriminant function is studied, its distribution reviewed and evaluation of its probabilities of misclassification discussed. For known covariance matrices the distribution of the sample quadratic discriminant function is derived. When the known covariance matrices are proportional exact expressions for the expectation of its actual and apparent error rates are obtained and evaluated. The effectiveness of the sample linear discriminant function for this case is also considered. Estimation of true log-odds for two multinormal populations with equal or unequal covariance matrices is studied. The estimative, Bayesian predictive and a kernel method are compared by evaluating their biases and mean square errors. Some algebraic expressions for these quantities are derived. With equal covariance matrices the predictive method is preferable. Where it derives this superiority is investigated by considering its performance for various levels of fixed true log-odds. It is also shown that the predictive method is sensitive to n1 ≠ n2. For unequal but proportional covariance matrices the unbiased estimative method is preferred. Product Normal kernel density estimates are used to give a kernel estimator of true log-odds. The effect of correlation in the variables with product kernels is considered. With equal covariance matrices the kernel and parametric estimators are compared by simulation. For moderately correlated variables and large dimension sizes the product kernel method is a good estimator of true log-odds.

La Mancha Triassic and Lower Lias Stratigraphy, a well log interpretation

La estratigrafía del intervalo sedimentario correspondiente al Keuper, Triásico, y al Lías basal ha atraído históricamente mucho menos interés que los sedimentos adyacentes del Muschelkalk y Buntsandstein, y del Lías Inferior y Medio. Se ha confeccionado una correlación de 12 sondeos profundos del área de La Mancha para mostrar la distribución de facies de estas formaciones, así como su ordenación en secuencias sedimentarias. Los datos de pozo muestran la existencia de secuencias evaporíticas complejas y multiepisódicas en la unidad inferior K1, de carácter más salino, y en la unidad superior K4-K5, relativamente más anhidrítica. El episodio clástico correspondiente a las unidades K2-K3 está extendido en toda la zona, con varias áreas preferenciales de acumulación de arenas. La unidad K6, la más alta del Keuper, constituye un excelente nivel guía. La sedimentación continúa en el Lías basal con otra potente unidad evaporítica, la Zona de Anhidrita, que muestra un episodio salino muy signifi cativo en la parte central de la correlación. Es de resaltar la buena correlación que existe entre los afl oramientos y las sondeos para estas formaciones.

A Correlation between the Dynamic Viscosity and Crystallisation of Felodipine from its Amorphous Polymer Solid Dispersion

Purpose Previously, it has been reported that molecular mobility determines the rate of molecular approach to crystal surfaces, while entropy relates to the probability of that approaching molecule having the desirable configuration for further growth of the existing crystal; and the free energy dictates the probability of that molecule not returning to the liquid phase1. If we plot the crystal growth rate and viscosity of a supercooled liquid in a log-log format, the relationship between the two is linear, indicating the influence viscosity has upon crystal growth rate. However, such approximation has been derived from pure drug compounds and it is apparent that further understanding of crystallization from drug-polymer solid dispersion is required in order to stabilise drugs embedded within amorphous polymeric solid dispersions. Methods Mixtures of felodipine and polymer (HPMCAS-HF, PVPK15 and Soluplus®) at specified compositions were prepared using a Restch MM200 ball mill. To examine crystal growth within amorphous solid dispersions, samples were prepared by melting 5-10 mg of ball milled mixture at 150°C for 3-5 minutes on a glass slip pre-cleaned with methanol and acetone. All prepared samples were confirmed to be crystal free by visual observation using a polarised light microscope (Olympus BX50). Prepared samples were stored at 0% RH (P2O5), inside desiccators, maintained in ovens at 80°C. For the dynamic viscosity measurement, approximately 100-200mg ball milled mixture was heated on the base plate of a rotational rheometer at 150°C for 5 minutes and the top plate was lowered to a defined gap to form a good contact with the material. The sandwiched amorphous material was heated to 80°C and the viscosity was measured. Results The equation was used to probe the correlation of viscosity to crystal growth rate. In comparison to the value of xi in log-log equation reported from pure drug compound, a value of 1.63 was obtained for FD-polymer solid dispersions irrespective of the polymer involved. &#8733 Conclusion The high xi value suggests stronger viscosity dependence may exist for amorphous FD once incorporated with amorphous polymer.