False Positive Alarms Research Articles

Advancing the Fork detector for quantitative spent nuclear fuel verification

The Fork detector is widely used by the safeguards inspectorate of the European Atomic Energy Community (EURATOM) and the International Atomic Energy Agency (IAEA) to verify spent nuclear fuel. Fork measurements are routinely performed for safeguards prior to dry storage cask loading. Additionally, spent fuel verification will be required at the facilities where encapsulation is performed for acceptance in the final repositories planned in Sweden and Finland. The use of the Fork detector as a quantitative instrument has not been prevalent due to the complexity of correlating the measured neutron and gamma ray signals with fuel inventories and operator declarations. A spent fuel data analysis module based on the ORIGEN burnup code was recently implemented to provide automated real-time analysis of Fork detector data. This module allows quantitative predictions of expected neutron count rates and gamma units as measured by the Fork detectors using safeguards declarations and available reactor operating data. This paper describes field testing of the Fork data analysis module using data acquired from 339 assemblies measured during routine dry cask loading inspection campaigns in Europe. Assemblies include both uranium oxide and mixed-oxide fuel assemblies. More recent measurements of 50 spent fuel assemblies at the Swedish Central Interim Storage Facility for Spent Nuclear Fuel are also analyzed. An evaluation of uncertainties in the Fork measurement data is performed to quantify the ability of the data analysis module to verify operator declarations and to develop quantitative go/no-go criteria for safeguards verification measurements during cask loading or encapsulation operations. The goal of this approach is to provide safeguards inspectors with reliable real-time data analysis tools to rapidly identify discrepancies in operator declarations and to detect potential partial defects in spent fuel assemblies with improved reliability and minimal false positive alarms. The results are summarized, and sources and magnitudes of uncertainties are identified, and the impact of analysis uncertainties on the ability to confirm operator declarations is quantified.

An anomaly-based network intrusion detection system using ensemble clustering

The numbers of hacking and intrusion incidents are high due to the increasing use of internet services and computer application. Therefore, intrusion detection systems (IDS) are inevitable in today's scenario (Koruba et al., 2017). In this paper, an unsupervised technique based on hybrid clustering algorithms is used for Anomaly detection. Incremental support vector machine (ISVM) and C means (FCM) algorithms are applied to preprocess the data set and detect the anomalies respectively. Further, the processed data is fed to the DBSCAN algorithm for further detection of anomalies. The results of the detection system are communicated to the intrusion prevention system (IPS). The proposed hybrid algorithm is applied for KDD Cup 1999 dataset and Gure Kdd Cup data base (2008) and the results show high detection rates and low false positive alarms. Further, the proposed technique performs well with a real time data in detecting anomalies with enhanced true positive rate.

Survey on Updating IDSs’ Signatures Databases

With the rapid development and growth of the internet and networking, greater numbers of attacks are arising that threaten networks and information security alike. Thus, different types of intrusion detection systems (IDSs) have been introduced: either signature-based IDSs, anomaly-based IDSs, or a hybrid of both. Many IDSs that have adopted the signature-based method suffer from many challenges, one of these challenges is how to detect a new attack in the incoming traffic that its signature doesn’t stored in the known signatures database, while at the same time keeping the rate of false-positive alarms low. Many IDSs update their signatures databases from time to time through the internet or by relying on the network administrator to manually update the database with new attack signatures. Manual updating is a labour-intensive process, can be prone to errors, and is not always practical. This is a survey paper on the various studies regarding the updating process for known IDSs’ signatures databases over time.

Behavioral Analysis Approach for Likelihood Determination in Cloud IDS: Implementation Architecture

Cyberattacks present a ubiquitous threat to an enterprise's information in Cloud Computing assets and must be properly controlled. The use of the current generation of IDS have various limitations on their performance making them not effective for cloud computing security and could generate a huge number of false-positive alarms. Analyzing intrusion based on attack patterns and risk assessment has demonstrated its efficiency in reducing the number of false alarms and optimizing the IDS performances. However, the use of the same value of likelihood makes the approach lack a real risk value determination. This article intends to present a new probabilistic and behavioral approach for likelihood determination to quantify attacks in cloud environment. With the main task to increase the efficiency of IDS and decrease the number of alarms. Experimental results show that the approach is superior to the state-of-the-art approach for intrusion detection in the cloud.

Proposed Network Intrusion Detection System Based on Fuzzy c Mean Algorithm in Cloud Computing Environment

Nowadays cloud computing had become is an integral part of IT industry, cloud computing provides Working environment allow a user of environmental to share data and resources over the internet. Where cloud computing its virtual grouping of resources offered over the internet, this lead to different matters related to the security and privacy in cloud computing. And therefore, create intrusion detection very important to detect outsider and insider intruders of cloud computing with high detection rate and low false positive alarm in the cloud environment. This work proposed network intrusion detection module using fuzzy c mean algorithm. The kdd99 dataset used for experiments .the proposed system characterized by a high detection rate with low false positive alarm.

Detecting TCP SYNC Flood DDos Attack Using Modified Dendritic Cell Algorithm

TCP SYNC flood DDoS attack is one of the commonly used attack in the computer network system. One of the novel method to detect the DDoS attack is the Dendritic Cell Algorithm (DCA). DCA is a kind of artificial immune system in the evolutionary algorithm that can be used is an anomaly detection. Artificial immune systems (AIS) are adaptive systems, inspired by theoretical immunology and observed immune functions, principles and models, which are applied to problem solving. The AIS suggest a multilayered protection structure for protecting the computer networks against the unauthorized attacks. The DCA is also designed to solve the problems in network intrusion detection system. The DCA is a population based algorithm, in which each agent in the system is represented as 'artificial DC'. Each DC has the ability to combine multiple data streams and can add context to data suspected as anomalous. The DCA shares the properties with certain filtering techniques. It provides information representing how anomalous a group of antigen is, not simply if a data item is anomalous or not. This can be achieved through the generation of an anomaly coefficient value, termed the Mature Context Antigen Value (MCAV). The main objectives of DCA are to improve the correlation factor, to minimized the false positive and false negative alarm generation and, to increase the rate of detection of intrusion.

Evaluation of ECG algorithms designed to improve detect of transient myocardial ischemia to minimize false alarms in patients with suspected acute coronary syndrome

BackgroundPatients hospitalized for suspected acute coronary syndrome (ACS) are at risk for transient myocardial ischemia. During the “rule-out” phase, continuous ECG ST-segment monitoring can identify transient myocardial ischemia, even when asymptomatic. However, current ST-segment monitoring software is vastly underutilized due to false positive alarms, with resultant alarm fatigue. Current ST algorithms may contribute to alarm fatigue because; (1) they are not designed with a delay (minutes), rather alarm to brief spikes (i.e., turning, heart rate changes), and (2) alarm to changes in a single ECG lead, rather than contiguous leads. PurposeThis study was designed to determine sensitivity, and specificity, of ST algorithms when accounting for; ST magnitude (100μV vs 200μV), duration, and changes in contiguous ECG leads (i.e., aVL, I, − aVR, II, aVF, III; V1, V2, V3, V4, V5, V6, V6, I). MethodsThis was a secondary analysis from the COMPARE Study, which assessed occurrence rates for transient myocardial ischemia in hospitalized patients with suspected ACS using 12-lead Holter. Transient myocardial ischemia was identified from Holter using >100μV ST-segment ↑ or ↓, in >1 ECG lead, >1min. Algorithms tested against Holter transient myocardial ischemia were done using the University of California San Francisco (UCSF) ECG algorithm and included: (1)100μV vs 200μV any lead during a 5-min ST average; (2)100μV vs 200μV any lead >5min, (3) 100μV vs 200μV any lead during a 5-min ST average in contiguous leads, and (4) 100μV vs 200μV>5min in contiguous leads (Table below). ResultsIn 361 patients; mean age 63+12years, 63% male, 56% prior CAD, 43 (11%) had transient myocardial ischemia. Of the 43 patients with transient myocardial ischemia, 17 (40%) had ST-segment elevation events, and 26 (60%) ST-segment depression events. A higher proportion of patients with ST segment depression has missed ischemic events.Table shows sensitivity and specificity for the four algorithms tested.Image 1Alarms tested100mV ST deviation (↓ or ↑)200mV ST deviation (↓ or ↑)SensitivitySpecificitySensitivitySpecificity1. ST-segment change any ECG lead 5min average76.7%47.8%46.5%74.2%2. ST-segment change any ECG lead >5min76.7%54.4%46.5%77.4%3. ST-segment change contiguous leads 5min average69.8%67.9%27.9%83.6%4. ST-segment change contiguous leads >5min62.8%73.0%20.9%86.8% ConclusionsSensitivity was highly variable, due to the ST threshold selected, with the 100μV measurement point being superior to the 200μV amplitude threshold. Of all the algorithms tested, there was moderate sensitivity and specificity (70% and 68%) using the 100μV ST-segment threshold, integrated ST-segment changes in contiguous leads during a 5-min average.

Performance comparison of intrusion detection systems and application of machine learning to Snort system

This study investigates the performance of two open source intrusion detection systems (IDSs) namely Snort and Suricata for accurately detecting the malicious traffic on computer networks. Snort and Suricata were installed on two different but identical computers and the performance was evaluated at 10 Gbps network speed. It was noted that Suricata could process a higher speed of network traffic than Snort with lower packet drop rate but it consumed higher computational resources. Snort had higher detection accuracy and was thus selected for further experiments. It was observed that the Snort triggered a high rate of false positive alarms. To solve this problem a Snort adaptive plug-in was developed. To select the best performing algorithm for Snort adaptive plug-in, an empirical study was carried out with different learning algorithms and Support Vector Machine (SVM) was selected. A hybrid version of SVM and Fuzzy logic produced a better detection accuracy. But the best result was achieved using an optimised SVM with firefly algorithm with FPR (false positive rate) as 8.6% and FNR (false negative rate) as 2.2%, which is a good result. The novelty of this work is the performance comparison of two IDSs at 10 Gbps and the application of hybrid and optimised machine learning algorithms to Snort.

Construction and evaluation of a hermetically sealed accurate ion mobility instrument

Ion mobility spectrometry (IMS) is widely used to detect and identify chemical warfare agents, narcotics, and explosives in the field based on their reduced mobility (K 0 ) values. Current detection windows for these analytes can only be as narrow as ±2% of the K 0 values for the analyte being sought. These wide detection windows cause false positive alarms when an interferent with a similar reduced mobility falls within the detection window and triggers an alarm. This results in the loss of time and money as resources are diverted to verify the alarm. A high rate of false positive alarms is caused by a discrepancy in the reported K 0 values across the literature that is, at best, ± 2% of the average available values. By accurately and precisely measuring the variables affecting an ion’s K 0 value, an accurate K 0 value can be produced and the detection windows widths that are established using these reference values can be reduced. Components for accurate analyses have been assembled in the past and here the construction of an accurate ion mobility spectrometry drift tube is described that is accurate to 0.1% of the calculated K 0 value and can be hermetically sealed without inserting the drift tube into a large vacuum chamber. Having a pressure sealed accurate ion mobility spectrometer will allow for the control of the pressure variable within the K 0 equation and the safe analysis of hazardous chemicals. Here the construction of an inexpensive and easily reparable sealed drift tube is described.

Cracks and welds detection approach in solar receiver tubes employing electromagnetic acoustic transducers

There is a significant rising in development of new concentrated solar plants due to global energy demands. Concentrated solar plant requires to improve the operational and maintainability in this industry. This article presents a new approach to identify defects in the solar receiver tubes and welds employing a simple electromagnetic acoustic transducer. The absorber tubes in normal working conditions must withstand high temperatures, which can cause the tubes to deteriorate in areas such as welding, or it can cause hot spots due to defects or corrosion. A proper predictive maintenance program for the absorber pipes is required to detect defects in the tubes at an early stage, reducing corrective maintenance costs and increasing the reliability, availability, and safety of the concentrated solar plant. This article presents a novel approach based on signal processing and pattern recognition for predictive maintenance employing electromagnetic acoustic transducers. Hilbert transform is used to obtain the envelope of the signal that is smoothed by wavelet transform. It reduces the probability of detecting false-positive alarms. The algorithm uses the distance of the sensors from the edges to perform a self-identification of signal events. The events are located using two possible ways of ultrasound propagation, forward and reverse, and the time of flight of each echo. The algorithm correlates the theoretical events with events found experimentally. These echoes could come from different paths due to the electromagnetic acoustic transducer that generates forward and reverse shear waves. The main novelty in this approach is that the detection and location of the defect is determined considering two echoes that come from the same defect, but they arrive at the sensor flowing by different paths. The results are obtained with a double validation by matching the echoes that meet certain conditions. It increases the accuracy of the inspection and reduces false alarms. The approach has been tested and validated in an experimental platform that simulates the concentrated solar plants.

EVA: Visual Analytics to Identify Fraudulent Events.

Financial institutions are interested in ensuring security and quality for their customers. Banks, for instance, need to identify and stop harmful transactions in a timely manner. In order to detect fraudulent operations, data mining techniques and customer profile analysis are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. Visual Analytics techniques have potential to considerably enhance the knowledge discovery process and increase the detection and prediction accuracy of financial fraud detection systems. Thus, we propose EVA, a Visual Analytics approach for supporting fraud investigation, fine-tuning fraud detection algorithms, and thus, reducing false positive alarms.

Anomaly-based network IDS false alarm filter using cluster-based alarm classification approach

Anomaly-based network intrusion detection systems A-NIDS are an important and essential defence mechanism against network attacks. However, they generate a high volume of alarms that can be mixed with false-positive alarms, which poses a major challenge for these systems. Large amounts of false alarms prevent correct detection and make an immediate response impossible for intrusion detection system IDS. To mitigate this issue, this paper presents a strategy for filtering these alarms to reduce the rate of false-positive alarms of A-NIDS. This paper presents a new semi-supervised alarm classification method that does not require predefined knowledge of attack signatures or security personal feedback.

Обзор подходов к улучшению качества результатов статического анализа программ

In the present day, software development industry for different classes of computing devices grows at an extremely high speed. Continuously growing power of computational systems presents new opportunities to create powerful, often parallel, programs and software systems. This leads to the growth of complexity of software intended to manage these computational systems. The process of quality assurance calls for new approaches and methods both to check correctness and satisfiability of requirements for software as well as for check software for critical runtime defects and security vulnerabilities. Program analysis is one of the methods intended to assure software quality. The static and dynamic analysis tool industry has been evolving aggressively since the first decade of 2000 th . Nowadays there are many academic research and industrial tools for program analysis. But, due to fundamental limitations and engineering compromises for the sake of performance and scalability, static analysis tools cannot avoid false positive alarms. At the same time, reviewing static analysis tool alarms can take significant time of an experienced software engineer or a software quality assurance specialist. Hence, the task of automating refinement of static analysis tool results becomes more important. This survey covers approaches for static analysis tools result refinement. Approaches, which combine static and dynamic analysis of programs form the principal concern of this paper.

Active IR System for Projectile Detection and Tracking

Reliable detection and tracking of high-speed projectiles is crucial in providing modern battlefield protection or to be used as a forensic tool. Subsonic projectiles fired from silenced weapons are difficult to detect, whereas reliable tracking of the projectile trajectory is hard to accomplish. Contemporary radar based counter-battery systems showed to be valuable in detection of incoming artillery fire, but are unable to provide detection at close ranges. In this paper, an active IR system is proposed that aims to detect and track incoming projectiles at close ranges. Proposed system is able to reconstruct projectile’s trajectory in space, predict impact location and estimate direction of projectile origin. Active detector system is based on a pair of high- speed cameras in stereo-configuration synced with computer and IR illuminator that emits coded IR light bursts. Innovative IR light coding enables automated detection and tracking of a nearby projectile and elimination of false positive alarms caused by distant objects.

Anomaly Detection for Aviation Safety Based on an Improved KPCA Algorithm

Thousands of flights datasets should be analyzed per day for a moderate sized fleet; therefore, flight datasets are very large. In this paper, an improved kernel principal component analysis (KPCA) method is proposed to search for signatures of anomalies in flight datasets through the squared prediction error statistics, in which the number of principal components and the confidence for the confidence limit are automatically determined by OpenMP-based K-fold cross-validation algorithm and the parameter in the radial basis function (RBF) is optimized by GPU-based kernel learning method. Performed on Nvidia GeForce GTX 660, the computation of the proposed GPU-based RBF parameter is 112.9 times (average 82.6 times) faster than that of sequential CPU task execution. The OpenMP-based K-fold cross-validation process for training KPCA anomaly detection model becomes 2.4 times (average 1.5 times) faster than that of sequential CPU task execution. Experiments show that the proposed approach can effectively detect the anomalies with the accuracy of 93.57% and false positive alarm rate of 1.11%.

A Distributed Networked Approach for Fault Detection of Large-Scale Systems

Networked systems present some key new challenges in the development of fault-diagnosis architectures. This paper proposes a novel distributed networked fault detection methodology for large-scale interconnected systems. The proposed formulation incorporates a synchronization methodology with a filtering approach in order to reduce the effect of measurement noise and time delays on the fault detection performance. The proposed approach allows the monitoring of multirate systems, where asynchronous and delayed measurements are available. This is achieved through the development of a virtual sensor scheme with a model-based resynchronization algorithm and a delay compensation strategy for distributed fault-diagnostic units. The monitoring architecture exploits an adaptive approximator with learning capabilities for handling uncertainties in the interconnection dynamics. A consensus-based estimator with time-varying weights is introduced, for improving fault detectability in the case of variables shared among more than one subsystem. Furthermore, time-varying threshold functions are designed to prevent false-positive alarms. Analytical fault detectability sufficient conditions are derived, and extensive simulation results are presented to illustrate the effectiveness of the distributed fault detection technique.

Gross total resection rates of grade II/III intramedullary ependymomas using the surgical strategy of en-bloc resection without intra-operative neurophysiological monitoring

Introduction: Grade II and III intramedullary ependymomas [IME] are circumscribed with a plane of cleavage that should facilitate high gross total resection rates (GTR). Gross total resection of grade II/III IME is superior to subtotal resection (STR) and radiotherapy (RTx) for progression-free and overall survival. We sought to compare our GTR with other series that have utilised standard intraoperative monitoring techniques and we explored factors that may influence rates of resection.Materials and methods: Database search and retrospective chart and radiological review of all grade II or III spinal ependymomas over a 10-year period from the senior authors practice. Comprehensive PubMed search to identify similar series that identified histology, McCormick Function scores (MCC) preoperatively and post-operatively, surgical strategy and use of intraoperative monitoring. Standard statistical analysis was performed.Results: Seventeen patients were identified: 16 grade II and one grade 3. GTR was 94.12%. Factors that correlated with a decline in MCC were longitudinal extension of the tumour (p = 0.0238) and presentation with motor signs and symptoms (p = 0.0223). There was no statistical difference between preoperative factors that influence post-operative outcomes in the current study when compared with other published series. There was no statistical difference between preoperative and postoperative MCC scores between our series and other published series.Discussion: The current series with a GTR of 94.12% compares favourably with other published series with GTRs of 55.8–84% with no significant difference in functional outcomes. Series with low GTRs should examine their operative strategy or false-positive alarm rates which may lead to higher STRs. This series should be viewed as a unique opportunity to benchmark GTRs of circumscribed intramedullary tumours.

A Novel Anti-Spam Solution to Minimize False Positive Alarm Rate in Bulk Spam

A Novel Anti-Spam Solution to Minimize False Positive Alarm Rate in Bulk Spam

False alarm reduction in signature‐based IDS: game theory approach

AbstractSignature‐based intrusion detection systems (IDSs) are employed to monitor computer networks for signs of network intrusions. However, they produce a large number of false positive alarms when operated with default settings without considering the underlying network environment. Inundation of false alarms is the Achilles heel of IDS technology, which could render the IDS ineffective in detecting network attacks. Several false alarm minimization approaches have been proposed in the literature. However, there are many drawbacks associated with these works, namely, modification of well‐established attack signatures; heavy dependence on the attack signatures' reference numbers, which might not always be available; and non‐consideration of the underlying network context information. In this paper, we propose an efficient game theory‐based false alarm minimization scheme for signature‐based IDS. The proposed scheme uses a game theory‐based correlation engine to correlate IDS alarms with network vulnerabilities to minimize the overall false positive alarm rate of the IDS. Experimental results and comparison analysis of the proposed false alarm minimization framework with other frameworks on the benchmark DARPA intrusion detection evaluation dataset and an in‐house IIT Guwahati Lab dataset show that the proposed scheme achieves the highest accuracy among all the frameworks under consideration without degrading the overall detection rate of the IDS. Copyright © 2016 John Wiley & Sons, Ltd.

Implementation of a novel postoperative monitoring system using automated Modified Early Warning Scores (MEWS) incorporating end-tidal capnography.

Modified Early Warning Scores (MEWS) provide real-time vital sign (VS) trending and reduce ICU admissions in post-operative patients. These early warning calculations classically incorporate oxygen saturation, heart rate, respiratory rate, systolic blood pressure, and temperature but have not previously included end-tidal CO2 (EtCO2), more recently identified as an independent predictor of critical illness. These systems may be subject to failure when physiologic data is incorrectly measured, leading to false alarms and increased workload. This study investigates whether the implementation of automated devices that utilize ongoing vital signs monitoring and MEWS calculations, inclusive of a score for end-tidal CO2 (EtCO2), can be feasibly implemented on the general care hospital floor and effectively identify derangements in a post-operative patient's condition while limiting the amount of false alarms that would serve to increase provider workload. From July to November 2014, post-operative patients meeting the inclusion criteria (BMI>30kg/m2, history of obstructive sleep apnea, or the use of patient-controlled analgesia (PCA) or epidural narcotics) were monitored using automated devices that record minute-by-minute VS included in classic MEWS calculations as well as EtCO2. Automated messages via pagers were sent to providers for instances when the device measured elevated MEWS, abnormal EtCO2, and oxygen desaturations below 85%. Data, including alarm and message details from the first 133 patients, were recorded and analyzed. Overall, 3.3 alarms and pages sounded per hour of monitoring. Device-only alarms sounded 2.7 times per hour-21% were technical alarms. The remaining device-only alarms for concerning VS sounded 2.0/h, 70% for falsely recorded VS. Pages for abnormal EtCO2 sounded 0.4/h (82% false recordings) while pages for low blood oxygen saturation sounded 0.1/h (55% false alarms). 143 times (0.1 pages/h) the devices calculated a MEWS warranting a page (rise in MEWS by 2 or 5 or greater)-62% were false scores inclusive of falsely recorded VS. An abnormal EtCO2 value resulted in or added to an elevated MEWS score in 29% of notifications, but 50% of these included a falsely abnormal EtCO2 value. To date, no adverse events have occurred. There were no statistically significant demographic, post-operative condition, or pre-existing comorbidity differences between patients who had a majority of true alarms from those who had mostly false-positive alarms. Although not statistically significant, the group of patients in whom automated MEWS suggested greater utility included those with a history of hypertension (p=0.072) and renal disease (p=0.084). EtCO2 monitoring was more likely to be useful in patients with a history of type 2 diabetes, coronary artery disease, and obstructive sleep apnea (p<0.05). These patients were also more likely to have been on a PCA post-operatively (p<0.05). Overall, non-invasive physiologic monitoring incorporating an automated MEWS system, modified to include end-tidal CO2 can be feasibly implemented in a hospital ward. Further study is needed to evaluate its clinical utility, including an end-tidal CO2 score, is feasibly implemented and can be useful in monitoring select post-operative patients for derangements in physiologic metrics. Like any other monitoring system, false alarms may occur at high rates. While further study is needed to determine the additive utility of EtCO2 in MEWS calculations, this study suggests utility of EtCO2 in select post-operative patients.