The increased use of botnets as an attack tool and the awareness attackers have of blocking lists leads to the question of whether we can effectively predict future bot locations. To that end, we introduce a network quality that we term uncleanliness: an indicator of the propensity for hosts in a network to be compromised by outside parties.

Scanning activity is a common activity on the Internet today, representing malicious activity such as information gathering by a motivated adversary or automated tools searching for vulnerable hosts (e.g., worms). Many scan detection techniques have been developed; however, their focus has been on smaller networks where packet-level information is available, or where internal characteristics of the network are known. For large networks, such as those of ISPs, large corporations or government organizations, this information might not be available. This paper presents a model of scans that can be used given only unidirectional flow data. The model uses a Bayesian logistic regression, which was developed using a combination of expert opinion and manually-classified training data. It is shown to have a detection rate of 95.5% with a false positive rate of 0.4% overall when tested against a set of 300 TCP events.

We introduce two indices for the degree of incoherence in a set of lower and upper previsions: maximizing the rate of loss the incoherent bookmaker experiences in a Dutch Book, or maximizing the rate of profit the gambler achieves who makes Dutch Book against the incoherent bookmaker. We report how efficient bookmaking is achieved against these two indices in the case of incoherent previsions for events on a finite partition, and for incoherent previsions that include also a simple random variable. We relate the epsilon-contamination model to efficient bookmaking in the case of the rate of profit.

When observations can be made without noise, it is known that adaptive information is no more powerful than nonadaptive information for approximation of linear problems with Gaussian measure. When the noise is additive, independent of the true value, and normal, once again adaption does not help (Theorem 1 in Section 4). However, when those conditions are not satisfied, Examples 1 and 2 of Section 4 show that adaptive information can be much more powerful than nonadaptive information. Finally if orthogonal observations are used with the sample size as well as the number of repetitions fixed, and only the directions of observations are chosen adaptively, then once again adaption does not help (Theorem 2 in Section 5). The issue is analogous to whether sequential designs are more powerful than fixed sample size designs in Bayesian statistics.