Detection of rare or previously unseen attacks in cyber security presents a central challenge: how does one search for a sufficiently wide variety of types of anomalies and yet allow the process to scale to increasingly complex data? In particular, creating each anomaly detector manually and training each one separately presents untenable strains on both human and computer resources. In this paper we propose a systematic method for constructing a potentially very large number of complementary anomaly detectors from a single probabilistic model of the data. Only one model needs to be trained, but numerous detectors can then be implemented. This approach promises to scale better than manual methods to the complex heterogeneity of real-life data. As an example, we develop a Latent Dirichlet Allocation probability model of TCP connections entering Oak Ridge National Laboratory. We show that several detectors can be automatically constructed from the model and will provide anomaly detection at flow, sub-flow, and host (both server and client) levels. This demonstrates how the fundamental connection between anomaly detection and probabilistic modeling can be exploited to develop more robust operational solutions.

This work experimentally examines different notions of stability of the behavior of individuals and groups in a network of blogs. Our experiments are conducted on data collected from LiveJournal. All stability notions aim to locate stable behavior within an individual's area, which is defined in a variety of manners. Our experiments confirm an earlier observation of the highly dynamic nature of the network. Roughly 70% of the communication of a typical week was not observed in the previous week. Depending on the definition of stability and area used, we find small, but highly stable, sets of individuals with stable behavior in the network.

In this work, we present the software library graphOnt. The purpose of this library is to automate the process of dynamically extracting ldquointerestingrdquo graphs from semantic networks. Instructions on the extraction are fed into the library via an ontological language specification custom built for this application. A set of SPARQL queries are used to define vertices and edges in the constructed graph. Extracted graphs are returned using the JUNG framework, which offers many algorithmic and visualization options. This work allows a set of individuals analyzing the same semantic network to extract and analyze dynamically created graphs using sophisticated, specific algorithmic tools without needing to manually construct classical graphs from the data.

In this paper, we present a novel model for the evolution dynamics of social networks which supports public communication (communication which is visible to all members of the network). Though our model is general, it is particularly applicable to blog-networks, which is the domain we use for testing. We use a directed graph, the blogograph, to represent the communication activity in the Blogosphere. Our model is based on three fundamental principles for describing evolution dynamics in social networks.

We present an extended version of a software system SIGHTS (statistical identification of groups hidden in time and space), which can be used for the discovery, analysis, and knowledge visualization of social coalitions in communication networks such as Blog-networks. The evolution of social groups reflects information flow and social dynamics in social networks. Our system discovers such groups by analyzing communication patterns. The goal of SIGHTS is to be an assistant to an analyst in identifying relevant information. The functionality of SIGHTS includes: discovery of coalitions (clusters) and their leaders; finding hidden groups using communication persistence techniques; discovering hidden groups in communication streams; matching topics of the blogs and detecting sentiments; tracking the evolution of clusters; visualization of collections of individual clusters.

Article Free Access Share on MOCHA: a database middleware system featuring automatic deployment of application-specific functionality Authors: Manuel Rodríguez-Martínez Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College Park Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College ParkView Profile , Nick Roussopoulos Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College Park Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College ParkView Profile , John M. McGann Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College Park Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College ParkView Profile , Stephen Kelley Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College Park Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College ParkView Profile , Vadim Katz Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College Park Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College ParkView Profile , Zhexuan Song Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College Park Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College ParkView Profile , Joseph JáJá Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College Park Institute for Advanced Computer Studies and Department of Computer Science, University of Maryland, College ParkView Profile Authors Info & Claims SIGMOD '00: Proceedings of the 2000 ACM SIGMOD international conference on Management of dataMay 2000 https://doi.org/10.1145/342009.336575Published:16 May 2000Publication History 5citation34DownloadsMetricsTotal Citations5Total Downloads34Last 12 Months11Last 6 weeks1 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

In many modern database applications, there is an emerging need for interactive environments where users directly manipulate the contents of the database. Graphical user interfaces (GUIs) display images of the database which must reflect a consistent up-to-date state of the data with minimum perceivable delay to the user. Moreover, the possibility of several applications concurrently displaying different views of the same database increases the overall system complexity. In this paper, we show how design, performance and concurrency issues can be addressed by adapting existing database techniques. We propose the use of suitable display schemas whose instances compose active views of the database, an extended client caching scheme which is expected to yield significant performance benefits, and a locking mechanism that maintains consistency between the GUIs and the database.

A frequently encountered type of query in Geographic Information Systems is to find the k nearest neighbor objects to a given point in space. Processing such queries requires substantially different search algorithms than those for location or range queries. In this paper we present an efficient branch-and-bound R-tree traversal algorithm to find the nearest neighbor object to a point, and then generalize it to finding the k nearest neighbors. We also discuss metrics for an optimistic and a pessimistic search ordering strategy as well as for pruning. Finally, we present the results of several experiments obtained using the implementation of our algorithm and examine the behavior of the metrics and the scalability of the algorithm.