Correlation Rules Research Articles

Providing SIEM systems with self-adaptation

Security information and event management (SIEM) is considered to be a promising paradigm to reconcile traditional intrusion detection processes along with most recent advances on artificial intelligence techniques in providing automatic and self-adaptive systems. However, classic management-related flaws still persist, e.g. the fusion of large amounts of security events reported from many heterogeneous systems, whilst novel intriguing challenges arise specially when dealing with the adaptation to newly encountered and multi-step attacks. In this article, we provide SIEM correlation with self-adaptation capabilities to optimize and significantly reduce the intervention of operators. In particular, our enhanced correlation engine automatically learns and produces correlation rules based on the context for different types of multi-step attacks using genetic programming. The context is considered as the knowledge and reasoning, not only acquired by a human expert but also inferred by our system, which assist in the identification and fusion of events. In this regard, a number of artificial neural networks are trained to classify events according to the corresponding context established for the attack. Experimentation is conducted on a real deployment within OSSIM to validate our proposal.

Derivation of the Wigner–Witmer rules in terms of N-electron exchange

We give an organized derivation of the Wigner–Witmer correlation rules in the case when a diatomic term is built by like atoms in the same term. What relates the inversion symmetry with the spin multiplicity is apparently shown to be the symmetric property for N-electron exchange, which means the exchange of all electrons of one atom for those of the other atom. We simplified the derivation, discussing the transformation properties of the total electronic state, the spin part and the orbital part, separately. Furthermore, the numbers of constructed terms are summarized in simple tables.

Message Correlation Analysis Tool for NOvA

A complex running system, such as the NOvA online data acquisition, consists of a large number of distributed but closely interacting components. This paper describes a generic real-time correlation analysis and event identification engine, named Message Analyzer. Its purpose is to capture run time abnormalities and recognize system failures based on log messages from participating components. The initial design of analysis engine is driven by the data acquisition (DAQ) of the NOvA experiment. The Message Analyzer performs filtering and pattern recognition on the log messages and reacts to system failures identified by associated triggering rules. The tool helps the system maintain a healthy running state and to minimize data corruption. This paper also describes a domain specific language that allows the recognition patterns and correlation rules to be specified in a clear and flexible way. In addition, the engine provides a plugin mechanism for users to implement specialized patterns or rules in generic languages such as C++.

Super-Heater Tube Wall Temperature Measurement Test and Analysis of 600MW Boiler

In order to precisely monitor the inner-flue tube wall temperature of the boiler platen super-heater, the temperature measurement test of inner-flue and outer-flue tube wall has been carried out. And the data of inner-flue and outer-flue tube wall temperature was acquired in real time. According to the experimental data, the correlative rule about inner-outer flue tube wall temperature was analyzed and researched. Moreover, the data was analyzed to get the relationship of wall temperature, load, water-coal ratio, main stream temperature between the inner-flue and outer-flue furnace. So the correlative formula which was based on the relation between inner-flue tube wall temperature and outer-flue tube wall temperature was built up and checked.

Breathing mode of two-dimensional atomic Fermi gases in harmonic traps

For two-dimensional (2D) atomic Fermi gases in harmonic traps, the SO(2,1) symmetry is broken by the interatomic interaction explicitly via the contact correlation operator. Consequently, the frequency of the breathing mode ${\ensuremath{\omega}}_{B}$ of the 2D Fermi gas can be different from $2{\ensuremath{\omega}}_{0}$, with ${\ensuremath{\omega}}_{0}$ the trapping frequency of harmonic potentials. At zero temperature, we use the sum rules of density correlation functions to yield upper bounds for ${\ensuremath{\omega}}_{B}$. We further calculate ${\ensuremath{\omega}}_{B}$ through the Euler equations in the hydrodynamic regime. The obtained value of ${\ensuremath{\omega}}_{B}$ satisfies the upper bounds and shows deviation from $2{\ensuremath{\omega}}_{0}$, which can be as large as about $8%$.

A Strategic Study of Mining Fuzzy Association Rules Using Fuzzy Multiple Correlation Measues

Two different data variables may behave very similarly. Correlation is the problem of determining how much alike the two variables actually are and association rules are used just to show the relationships between data items. Mining fuzzy association rules is the job of finding the fuzzy item-sets which frequently occur together in large fuzzy data set, where the presence of one fuzzy item-set in a record does not necessarily imply the presence of the other one in the same record. In this paper a new method of discovering fuzzy association rules using fuzzy correlation rules is proposed, because the fuzzy support and confidence measures are insufficient at filtering out uninteresting fuzzy correlation rules. To tackle this weakness, a fuzzy correlation measure for fuzzy numbers, is used to augment the fuzzy support-confidence framework for fuzzy association rules. We have extended the Apriori algorithm to fuzzy multiple correlation analysis, which is the new approach presented in this paper comparing to most of the previous works. A practical study over the academic behaviour of a particular school is done and some valuable suggestions are given, based on the results obtained.

Strong correlations between incoherent vortices

We establish a correlation rule of which the value of the topological charge obtained in intensity correlation between two coherence vortices is such that this value is bounded by the topological charge of each coherence vortex. The original phase information is scrambled in each speckle pattern and unveiled using numerical intensity correlation. According to this rule, it is also possible to obtain a coherence vortex stable, an integer vortex, even when each incoherent vortex beam is instable, non-integer vortex.

Experimental Research on the Performance of Fiber Reinforced Plasterboard Filled with Concrete under Eccentric Axial Load

In this paper, the performances of the fiber reinforced plasterboard filled with concrete under eccentric axial load have been tested. There are three kind of test specimens filled with concrete every one, two or three holes separately. Some helpful performances and correlation rules are got, such as the cracking load, damage load, damaging character, relation of load-displacement and curve of load-strain. These could provide reference experimental data for the next theoretical analysis and engineering design.

DDoS detection with non-iterative Apriori algorithm

An improved non-iterative Apriori algorithm was proposed to detect Distributed Denail of Service(DDoS) attacks.An one-step intersection operation was used to process network packets within the specific time range,and the strong correlation rules of the packets were studied so as to achieve the quick detection of DDoS atttacks.In comparison with current algorithms,it shows better performance in efficiency and storage space in detection of DDoS attacks.Experimental results on DARPA data-sets show the algorithm is able to detect DDoS effectively.

Discovering Correlated Parameters in Semiconductor Manufacturing Processes: A Data Mining Approach

Data mining tools are nowadays becoming more and more popular in the semiconductor manufacturing industry, and especially in yield-oriented enhancement techniques. This is because conventional approaches fail to extract hidden relationships between numerous complex process control parameters. In order to highlight correlations between such parameters, we propose in this paper a complete knowledge discovery in databases (KDD) model. The mining heart of the model uses a new method derived from association rules programming, and is based on two concepts: decision correlation rules and contingency vectors. The first concept results from a cross fertilization between correlation and decision rules. It enables relevant links to be highlighted between sets of values of a relation and the values of sets of targets belonging to the same relation. Decision correlation rules are built on the twofold basis of the chi-squared measure and of the support of the extracted values. Due to the very nature of the problem, levelwise algorithms only allow extraction of results with long execution times and huge memory occupation. To offset these two problems, we propose an algorithm based both on the lectic order and contingency vectors, an alternate representation of contingency tables. This algorithm is the basis of our KDD model software, called MineCor. An overall presentation of its other functions, of some significant experimental results, and of associated performances are provided and discussed.

A study on a novel method of mining fuzzy association using fuzzy correlation analysis

Two different data variables may behave very similarly. Correlation is the problem of determining how much alike the two variables actually are and association rules are used just to show the relationships between data items. Mining fuzzy association rules is the job of finding the fuzzy item-sets which frequently occur together in large fuzzy data set, where the presence of one fuzzy item-set in a record does not necessarily imply the presence of the other one in the same record. In this paper a new method of discovering fuzzy association rules using fuzzy correlation rules is proposed, because the fuzzy support and confidence measures are insufficient at filtering out uninteresting fuzzy correlation rules. To tackle this weakness, a fuzzy correlation measure for fuzzy numbers, is used to augment the fuzzy support-confidence framework for fuzzy association rules. A practical study over the academic behaviour of a particular school is done and some valuable suggestions are given, based on the results obtained. Key words: Fuzzy association rules, fuzzy item-sets, fuzzy data sets, fuzzy support-confidence, fuzzy correlation measure.

Relevance of the stochastic stratigraphic well correlation approach for the study of complex carbonate settings: application to the Malampaya buildup (Offshore Palawan, Philippines)

Abstract The stochastic stratigraphic well correlation method considers the stratigraphic correlation of well data as a set of possible models to sample and manage uncertainty in subsurface studies. This method was applied to the Malampaya buildup (a well documented offshore gas field located NW of the Palawan Island, Philippines), aged upper Eocene to lower Miocene. Previous studies highlight that rock petrophysical properties are mainly controlled by diagenesis. Correlation rules are thus developed in order to adapt the stochastic stratigraphic well correlation method to the study of diagenetic units. These rules are based on wireline log shape and diagenetic units types. Four stratigraphic correlation models are generated using the proposed correlation method: a deterministic one corresponding to the most probable model considering only well data and three stochastic ones. These correlation models are bound with geostatistical methods to build static reservoir models. Synthetic seismic profiles are computed from facies models conditioned to acoustic impedance models. It leads to comparable seismic amplitude images, highlighting the importance of considering several well correlation models for one given seismic survey. Stochastic stratigraphic correlations are shown to have a first-order impact on reservoir unit characterization, rock volumes and fluid flow response on the reservoir model.

Operations support systems for mission critical public safety communication networks

Mission critical communication networks for public safety have very specific operating requirements. The main objective is to maximize system availability and reliability in cases of disaster or large-scale unplanned events. Based on its experience in communications network operations and the unique requirements of public safety communications, Alcatel-Lucent has developed a new solution concept to support public safety communication network operations. The solution focuses on the different user roles and work processes of a public safety network operator. Supported by intelligent fault handling, evolving correlation rules, enhanced help system, end-to-end work process integration, extended test functionalities, real time status and performance views, and other key functionalities, the solution increases usability and applicability for operations organizations. Open interfaces allow future extensions. The basic principles for the technical implementation are the use of commercial off-the-shelf (COTS) software applications in combination with reference to frameworks such as the enhanced Telecom Operations Map (eTOM) and Information Technology Infrastructure Library (ITIL). Successful reference projects have shown that operations organizations can increase their effectiveness by increasing the amount of information they have available. This, in turn, leads to cost savings and better network performance.

Paradigms and paradoxes: what are the 54 electron affinities of O2?

Only one electron affinity of oxygen, 43(1) kJ mol−1 is generally cited since the molecular orbital theory anion bond order [3/4] gives an electron affinity, 14 kJ mol−1. However, electron correlation rules predict 27 bonding and 27 antibonding spin orbital coupling states. The relative bond orders (RBOs), 12/13 to [1/4] and the 13 valence electrons of superoxide are used to calculate electron affinities 103 to −243 kJ mol−1 consistent with experimental and theoretical values. These are used to construct 54 ionic Morse potentials.

The international dystrophic epidermolysis bullosa patient registry: An online database of dystrophic epidermolysis bullosa patients and their COL7A1 mutations

Dystrophic epidermolysis bullosa (DEB) is a heritable blistering disorder that can be inherited autosomal dominantly (DDEB) or recessively (RDEB) and covers a group of several distinctive phenotypes. A large number of unique COL7A1 mutations have been shown to underlie DEB. Although general genotype-phenotype correlation rules have emerged, many exceptions to these rules exist, compromising disease diagnosing and genetic counseling. We therefore constructed the International DEB Patient Registry (http://www.deb-central.org), aimed at worldwide collection and sharing of phenotypic and genotypic information on DEB. As of May 2011, this MOLGENIS-based registry contains detailed information on 508 published and 71 unpublished patients and their 388 unique COL7A1 mutations, and includes all combinations of mutations. The current registry RDEB versus DDEB ratio of 4:1, if compared to prevalence figures, suggests underreporting of DDEB in the literature. Thirty-eight percent of mutations stored introduce a premature termination codon (PTC) and 43% an amino acid change. Submission wizards allow users to quickly and easily share novel information. This registry will be of great help in disease diagnosing and genetic counseling and will lead to novel insights, especially in the rare phenotypes of which there is often lack of understanding. Altogether, this registry will greatly benefit the DEB patients.

The semantics of alarm definitions: enabling systematic reasoning about alarms

The development and integration of an alarm interface between network elements and a network management system is a costly process, largely because of the informal way in which alarm interfaces are expressed and communicated. Low-quality alarm documentation and confusion around fundamental concepts like alarm states and alarm types are typical consequences of current practices. If alarm interfaces were expressed in a more formal manner, costs could be reduced and more advanced analysis and automation would be enabled. We present a novel approach to alarm interfaces by providing a formal alarm model together with a domain-specific language that allows us to specify both the alarm models and the constraints placed on the alarm models in a consistent manner. This means that we can verify the consistency of an alarm interface and automatically generate artifacts such as alarm correlation rules or alarm documentation based only on the model. Copyright © 2011 John Wiley & Sons, Ltd.

Studying infant mortality rate: a data mining approach

The World Health Organization (WHO) uses a large number of health predicators to measure a country’s overall health status. Among many, Infant Mortality Rate (IMR) is considered to be one important. Current literature describes the importance of these predictors in a much segregated manner. Also, its interrelationships are underexplored. This paper describes a framework for mining the hidden relationships of some predictors, such as (i) Population Annual Growth Rate (PAG), (ii) Total Fertility Rate (TFR), (iii) General Government Expenditure (GGE), (iv) Social Security Expenditure (SSE), (v) Total Expenditure on Health (THE), (vi) Access of Drinking Water (ADW), and (vii) Access to Basic Sanitation (ABS) with IMR with the help of Quantitative Association Rule (QAR) mining technique. Public database of WHO has been accessed to gather the required data region and country-wise and then normalized [0, 1]. Association and correlation rules considering the pair-wise influences of the predictors on IMR and vice versa have been engineered. The quality of each association has been measured using the concept of ‘leverage’. While, the term ‘lift’ interprets a correlation. The study finally reveals that rules showing association correlations of PAG, GGE, TFR and ADW positively predict for IMR status.

Nonlinear Analysis of Flexural Members of GFRP SR Concrete

To investigate further the bearing capacity of flexural members of GFRP（Glass Fiber Reinforced Polymer）SR(steel-reinforced concrete) under symmetric monotonic loading, a full range nonlinear analysis is made. Flexural capacity computing program of GFRP-Reinforced structures is put out, according to structure reinforcing theory and correlative rules through the finite ribbon method based on flat section assumption. The moment-curvature relative curves and the influence curves of the fiber winding angle and pipe wall thickness to load-deformation are obtained by the computer programming. The test specimen’s flexural capacity increases obviously with the increasing of steel ribs models. The slope of curve decreasing in monotonic loading latterly showed that the ductility of component improves. The changes of concrete strength had little effect on initial stiffness and capacity of GFRP SR concrete.

Mining Target-Oriented Fuzzy Correlation Rules to Optimize Telecom Service Management

To optimize telecom service management, it is necessary that information about telecom services is highly related to the most popular telecom service. To this end, we propose an algorithm for mining target-oriented fuzzy correlation rules. In this paper, we show that by using the fuzzy statistics analysis and the data mining technology, the target-oriented fuzzy correlation rules can be obtained from a given database. We conduct an experiment by using a sample database from a telecom service provider in Taiwan. Our work can be used to assist the telecom service provider in providing the appropriate services to the customers for better customer relationship management.

Reasoning support for risk prediction and prevention in independent living

AbstractIn recent years there has been a growing interest in solutions for the delivery of clinical care for the elderly because of the large increase in aging population. Monitoring a patient in his home environment is necessary to ensure continuity of care in home settings, but, to be useful, this activity must not be too invasive for patients and a burden for caregivers. We prototyped a system called Secure and INDependent lIving (SINDI), focused on (a) collecting a limited amount of data about the person and the environment through Wireless Sensor Networks (WSN), and (b) inferring from these data enough information to support caregivers in understanding patients' well-being and in predicting possible evolutions of their health. Our hierarchical logic-based model of health combines data from different sources, sensor data, tests results, common-sense knowledge and patient's clinical profile at the lower level, and correlation rules between health conditions across upper levels. The logical formalization and the reasoning process are based on Answer Set Programming. The expressive power of this logic programming paradigm makes it possible to reason about health evolution even when the available information is incomplete and potentially incoherent, while declarativity simplifies rules specification by caregivers and allows automatic encoding of knowledge. This paper describes how these issues have been targeted in the application scenario of the SINDI system.