Login Research Articles

Combating Insider Threat in the Open-World Environments: Identification, Monitoring, and Data Augmentation

Recent years have witnessed a dramatic increase in a class of security threats known as "insider threats". These threats occur when individuals with authorized access to an organization's network engage in harmful activities, potentially leading to the disclosure of vital information or adversely affecting the organization's systems (e.g., financial loss, system crashes, and national security challenges). Distinct from other types of terror attacks, combating insider threats exhibits several unique challenges, including (1) rarity, (2) non-separability, (3) label scarcity, (4) dynamics, and (5) heterogeneity, making themselves extremely difficult to identify and mitigate. We target the challenging problem of combating insider threats in open-world environments by leveraging a variety of data sources (e.g., internal system logs, employee networks, human trafficking, and smuggling networks). To effectively combat these intricate threats, we introduce an interactive learning mechanism that is composed of three mutually beneficial learning modules: insider identification, insider monitoring, and data augmentation. Each module plays a crucial role in enhancing our ability to detect and mitigate insider threats, thereby contributing to a more secure and resilient organizational environment.

Exploring the factors and outcomes of collaborative information monitoring: Findings of a cross‐case analysis

AbstractCollaborative information monitoring (CIM) involves intentional information monitoring activities pursued by a group and could help researchers keep up to date. This paper reports findings of a cross‐case analysis aimed to explore the perceived factors and outcomes of CIM. Seven cases were included in the study, representing 11 members of patient‐oriented research communities (i.e., researchers, trainees, clinicians, research professionals, managers), who have implemented projects in a dedicated CIM system called eSRAP. Data were collected with semistructured interviews, verified with system logs and CIM project documents. Data were analyzed using a deductive/inductive thematic analysis. Cross‐case analysis revealed four types of cases, those that engaged in CIM with eSRAP, without eSRAP, used eSRAP individually (i.e., did not collaborate), or did not collaborate and did not use eSRAP. Analysis confirmed theory‐based types of factors (personal, group, organizational, environmental, information sources, system, task) and outcomes (performance, behavioral, cognitive, affective, relational) and generated new subtypes. The factor specific to cases that engaged in CIM (with or without eSRAP) was group leadership. Specific outcomes were motivation and discussion. Our findings contribute to conceptualizing CIM and can inform practice by providing actionable recommendations for supporting and sustaining CIM projects.

Accountability as a service for robotics: Performance assessment of different accountability strategies for autonomous robots

Abstract An essential requirement for increasing human confidence in computer systems is knowing an event’s origin. Therefore, it is necessary to have an efficient method to record such information. It is especially challenging in robotics, where unexpected behaviours can have unpredictable consequences, endangering the interests of people or even their safety. Furthermore, to analyse an incident’s cause or anticipate future behaviours, we must identify the events that cause a specific action. Although it is common to use logging systems for such purposes, issues such as partial recording of events, unhelpful data or the impact on robot performance suggest conceiving new accountability solutions that assist when determining the responsible entities or the provenance of specific information. This paper presents a general-purpose approach to developing an accountability system for autonomous robots. It consists of four main components: a system event logger, a message producer, a distributed event streaming platform and a database. Our proposal is completely decoupled from the monitored system and allows real-time analysis, improving flexibility, besides system protection and transparency. Finally, the need to reduce the impact of the audit process and logging tasks on robot performance has promoted the development of different assessment scenarios to determine the best strategy for providing accounting services.

LogETA: Time-aware cross-system log-based anomaly detection with inter-class boundary optimization

Log-based anomaly detection is of vital importance for maintaining the stability and security of software systems. Cross-system log-based anomaly detection methods are proposed to solve the problem of limited anomalous logs in newly deployed software systems, transferring knowledge from rich logs to the newly deployed system logs. However, previous methods have difficulty modeling implicit time interval information in log sequences, hindering the identification of anomalous logs with changing time intervals. Moreover, there is a lack of inter-class measurement when transferring knowledge, which fails to effectively align the same class distributions of the source and target domains, resulting in poor anomaly detection results. In this paper, we propose a novel cross-system log-based anomaly detection method called LogETA. First, time-aware self-attention is used to extract similar contextual information containing log semantic and temporal features. Second, the inter-class boundary optimization method is designed to expand the difference in sample distributions between classes while narrowing the domain discrepancy, optimizing the inter-class boundary to reduce misclassification. The experimental results show that LogETA achieves state-of-the-art results. LogETA adapts to cross-system time-related anomalies automatically and adjusts the classification boundary to fit the newly deployed system log distribution, demonstrating excellent adaptability on both source and target systems.

User journey games: automating user-centric analysis

The servitization of business is moving industry to business models driven by customer demand. Customer satisfaction is connected with financial rewards, forcing companies to invest in their users’ experience. User journeys describe how users maneuver through a service. Today, user journeys are typically modeled graphically, and lack formalization and analysis support. This paper proposes a formalization of user journeys as weighted games between the user and the service provider and a systematic data-driven method to derive these user journey games from system logs, using process mining techniques. As the derived games may contain cycles, we define an algorithm to transform user journeys games with cycles into acyclic weighted games, which can be model checked using to uncover potential challenges in a company’s interactions with its users and derive company strategies to guide users through their journeys. Finally, we propose a user journey sliding-window analysis to detect changes in the user journey over time by model checking a sequence of generated games. Our analysis pipeline has been evaluated on an industrial case study; it revealed design challenges within the studied service and could be used to derive actionable recommendations for improvement.

An Effective and Affordable Internet of Things (IoT) Scale System to Measure Crop Water Use

Scales are widely used in many agricultural applications, ranging from weighing crops at harvest to determine crop yields to regularly weighing animals to determine growth rate. In agricultural research applications, there is a long history of measuring crop water use (evapotranspiration [ET]) using a particular type of scale called weighing lysimeters. Typically, weighing lysimeters require very accurate data logging systems that tend to be expensive. Recent developments in open-source technologies, such as micro-controllers and Internet of Things (IoT) platforms, have created opportunities for developing effective and affordable ways to monitor crop water use and transmit the data to the Internet in near real-time. Therefore, this study aimed to create an affordable Internet of Things (IoT) scale system to measure crop ET. A scale system to monitor crop ET was developed using an Arduino-compatible microcontroller with cell phone communication, electronic load cells, an Inter-Integrated Circuit (I2C) multiplexer, and analog-to-digital converters (ADCs). The system was powered by a LiPo battery, charged by a small (6 W) solar panel. The IoT scale system was programmed to collect data from the load cells at regular time intervals and send the data to the ThingSpeak IoT platform. The system performed successfully during indoor and outdoor experiments conducted in 2023 at the Clemson University Edisto Research and Education Center, Blackville, SC. Calibrations relating the measured output of the scale load cells to changes in mass resulted in excellent linear relationships during the indoor (r2 = 1.0) and outdoor experiments (r2 = 0.9994). The results of the outdoor experiments showed that the IoT scale system could accurately measure changes in lysimeter mass during several months (Feb to Jun) without failure in data collection or transmission. The changes in lysimeter mass measured during that period reflected the same trend as concurrent soil moisture data measured at a nearby weather station. The changes in lysimeter mass measured with the IoT scale system during the outdoor experiment were accurate enough to derive daily and hourly crop ET and even detect what appeared to be dew formation during the morning hours. The IoT scale system can be built using open-source, off-the-shelf electronic components which can be purchased online and easily replaced or substituted. The system can also be developed at a fraction of the cost of data logging, communication, and visualization systems typically used for lysimeter and scale applications.

Fabrication and performance test of a multipurpose ohmic heating apparatus with a real-time data logging system based on low-cost sensors

Fabrication and performance test of a multipurpose ohmic heating apparatus with a real-time data logging system based on low-cost sensors

Semi-supervised log anomaly detection based on bidirectional temporal convolution network

System logs record system operation status and important event information. They are the important basis for debugging system failures and cause analysis. Due to the low accuracy of log parsing and insufficient labeled samples, anomaly detection precision is low. Therefore, we propose a new log-based semi-supervised anomaly detection method named BTCNLog. Firstly, the improved log parsing method with the dictionary keeps part of the parameter information in the log event. So, it can improve the utilization rate of log information and the accuracy of log parsing. Then, BERT is used to encode the semantic information to obtain the semantic vector of the log for the template. What's more, the clustering method is applied to estimate the tag to deal with insufficient data tagging problems. Therefore, it can improve the ability to detect unstable data for the model. Finally, a bidirectional temporal convolution network (Bi-TCN) with residual blocks is introduced to capture contextual information from two directions to improve the accuracy and efficiency of anomaly detection. To evaluate the performance of the proposed method, BTCNLog is compared with six baselines on two datasets. The final experimental results show that, compared with the latest three benchmark models, LogBERT, PLELog, and LogEncoder, the proposed method showed an average improvement of 7%, 14.1%, and 8.04% in F1 values.

Research on network intrusion detection based on XGBoost algorithm and multiple machine learning algorithms

Network intrusion detection refers to monitoring and analysing network traffic, system logs and other information to identify abnormal behaviours and attacks in the network, and take timely and appropriate countermeasures to protect the security and stability of the network. This paper investigates the application of seven machine learning methods in network intrusion detection, and evaluates each model by indicators such as precision, accuracy, recall and F1 score. The results show that XGBoost, Random Forest and Decision Tree models have the best prediction results, while Support Vector Machines and Plain Bayes models have poor prediction results. XGBoost, Random Forest and Decision Tree models all belong to the category of integrated learning, which have strong generalisation ability and robustness, can handle high-dimensional and complex datasets and are not prone to overfitting. In addition, they are able to handle non-linear relationships and are suitable for complex classification problems. Catboost and logistic regression models have better prediction results, but their prediction results are also affected by feature engineering. They may under- or over-fit when dealing with high-dimensional, complex datasets. Support Vector Machines and Plain Bayesian Models have poorer prediction results, which is related to their limitations. Support vector machines may experience computational difficulties when dealing with high-dimensional, complex datasets and are weak in dealing with non-linear relationships. The plain Bayesian model assumes that the features are independent of each other, which may not hold true in practical applications, thus affecting the prediction results. The conclusions of this paper are instructive for research and application in the field of network security, and can provide reference and inspiration for research in related fields.

Analysis of Allowable Payload according to Key Factors in Cable Logging Systems

Analysis of Allowable Payload according to Key Factors in Cable Logging Systems

Evaluation of Success and Failure Factors for Maternal and Child Health in Integrated Healthcare Center Information Systems (IHCIS) Using the HOT-Fit Method

Background: Maternal and child health in Integrated Healthcare Center Information Systems (IHCIS) has been implemented in several community health centers. Some have been implemented successfully, but others have failed. Many factors influence the success and failure of IHCIS implementation. Thus, knowing these factors can be used to assist the decision-making process in implementing IHCIS. Objective: This research aims to determine the factors affecting the success and failure of IHCIS for maternal and child health using the HOT-Fit (Human, Organization, Technology, and Fit) model. Methods: This research begins with preliminary research to identify the problem, determine research variables, and collect data. It uses quantitative and qualitative approaches. A quantitative approach is conducted at locations that have successfully implemented IHCIS. The data collection instrument uses a questionnaire. A qualitative approach was conducted in locations that were still experiencing failure in implementing IHCIS. Data collection techniques through direct interviews. Results: Organizational factors do not fully determine the success or failure of the information system. Factors supporting the success of IHCIS are human (user satisfaction and system use) and technological factors (quality of information and the quality of service). However, technology (system quality and information quality) is the main factor in the failure of IHCIS implementation. Problems with system quality include the system login, limited access to the internet, and an information system that is not in accordance with requirements. The perceived information obstacle is that the system is not yet integrated, and the information produced is incomplete. Conclusion: To satisfy requirements, the information and system qualities must be enhanced. Implementing IHCIS requires an appropriate strategy according to local circumstances and conditions. This approach involves human, organizational, and technological factors. Keywords: Community Health Workers, Evaluation, HOT-Fit, Integrated Healthcare Center Information Systems, Success Factors

How Use of an mHealth App Explains Antiretroviral Medication Adherence among People with HIV and Substance Use Disorders: Modeling System Logs and Weekly Check-Ins (Preprint)

How Use of an mHealth App Explains Antiretroviral Medication Adherence among People with HIV and Substance Use Disorders: Modeling System Logs and Weekly Check-Ins (Preprint)

A Novel Design of a Low-Cost SCADA System for Monitoring Standalone Photovoltaic Systems

Standalone photovoltaic (PV) systems are pivotal in the global transition towards sustainable energy, offering reductions in fossil fuel dependence and helping homes and businesses lower electricity costs. Key to optimizing the performance and efficiency of standalone systems are supervisory control and data logging (SCADA) systems. They monitor and record operational data such as power output, facilitating early detection of potential issues. This paper introduced a novel design for both the Human-Machine Interface (HMI) and data storage in a SCADA system for standalone PV systems, addressing two crucial aspects: real-time monitoring and efficient data retrieval, both at very low cost. The proposed design utilized Bluetooth Low Energy technology to transmit voltage and current data from the PV panel to a mobile application, marking a departure from traditional HMI approaches. This method enabled historical data analysis for trend identification. Additionally, the system intermittently transferred collected data to a cost-effective cloud storage service via Wi-Fi, allowing for substantial data storage at no cost. Remote data storage, another key feature of this design, simplifies data retrieval, which is particularly beneficial for systems in rural areas. Emphasizing open-source development, this design ensured flexibility and customization options. To demonstrate its practical effectiveness of the design, a one-day power curve of the PV system and the battery voltage data are presented, showcasing the design's capability in handling extensive and remote data storage.

Web-based Academic Information System Security

Web-based Academic Information System (SIA) has been used by all students of the Faculty of Information Technology KH. A. Wahab Unwaha Jombang University. Because all student academic records are stored through the campus network, it is necessary to conduct research on security so that a secure system is obtained. This research was conducted with steps including analysis and testing of installed systems, analyzing needs, designing problem solutions, making repair modules, installing modules and retesting repair modules. From the results of the research conducted, it can be concluded that there are weaknesses in the login system. The weaknesses include the use of the Student Identification Number (NIM) as the default username and password, username and password data is not encrypted before being sent to the server over the network, traces of usernames and passwords left in the browser as a cache or in the password manager can be seen as unencrypted plaintext. From the security analysis results, the SIA login system can be improved by applying HMAC MD5 encryption technology and Challenge Handshake Authentication Protocol (CHAP). Challenge is generated by the server randomly and used as a key in the HMAC MD5 encryption process. With the use of challenge passwords sent in the form of hash values will always be different in each session. Javascript on the client side is used to perform encryption so that the data before being sent to the server is already in an encrypted state.

Optimizing AUV Navigation Using Factor Graphs with Side-Scan Sonar Integration

For seabed mapping, the prevalence of autonomous underwater vehicles (AUVs) employing side-scan sonar (SSS) necessitates robust navigation solutions. However, the positioning errors of traditional strapdown inertial navigation system (SINS) and Doppler velocity log (DVL) systems accumulated significantly, further exacerbated by DVL’s susceptibility to failure in complex underwater conditions. This research proposes an integrated navigation approach that utilizes factor graph optimization (FGO) along with an improved pre-integration technique integrating SSS-derived position measurements. Firstly, the reliability of SSS image registration in the presence of strong noise and feature-poor environments is improved by replacing the feature-based methods with a Fourier-based method. Moreover, the high-precision inertial measurement unit (IMU) pre-integration method could correct the heading errors of SINS significantly by considering the Earth’s rotation. Finally, the AUV’s marine experimental results demonstrated that the proposed integration method not only offers improved SSS image registration and corrects initial heading discrepancies but also delivers greater system stability, particularly in instances of DVL data loss.

Predicting Representations of Information Needs from Digital Activity Context

Information retrieval systems often consider search-session and immediately preceding web-browsing history as the context for predicting users’ present information needs. However, such context is only available when a user’s information needs originate from web context or when users have issued preceding queries in the search session. Here, we study the effect of more extensive context information recorded from users’ everyday digital activities by monitoring all information interacted with and communicated using personal computers. Twenty individuals were recruited for 14 days of 24/7 continuous monitoring of their digital activities, including screen contents, clicks, and operating system logs on Web and non-Web applications. Using this data, a transformer architecture is applied to model the digital activity context and predict representations of personalized information needs. Subsequently, the representations of information needs are used for query prediction, query auto-completion, selected search result prediction, and Web search re-ranking. The predictions of the models are evaluated against the ground truth data obtained from the activity recordings. The results reveal that the models accurately predict representations of information needs improving over the conventional search session and web-browsing contexts. The results indicate that the present practice for utilizing users’ contextual information is limited and can be significantly extended to achieve improved search interaction support and performance.

Log‐based anomaly detection for distributed systems: State of the art, industry experience, and open issues

AbstractDistributed systems have been widely used in many safety‐critical areas. Any abnormalities (e.g., service interruption or service quality degradation) could lead to application crashes or decrease user satisfaction. These things may cause serious economic losses. Among the various quality assurance approaches for distributed systems, log‐based anomaly detection (LAD) has become a popular research topic. Its popularity relates to system logs being able to record and reveal important run‐time information. This paper presents a general LAD framework for distributed systems. Log grouping and feature‐pattern mining are two crucial LAD components that impact on the anomaly‐detection effectiveness. We also present a systematic survey of techniques in these two directions; propose classification frameworks for log grouping and feature patterns; and summarize four log‐grouping techniques and five feature patterns (which refer to invariant relationships among logs that can be used for anomaly detection). To evaluate their applicability, we report on the findings when applying existing techniques to Ray, a popular industrial distributed system. Based on these findings, several open issues are identified, which provide potential guidance for future research and development.

UAV-Based Secure Data Communication: Multilevel Authentication Perspective

An Internet of Things (IoT) system for managing and coordinating unmanned aerial vehicles (UAVs) has revolutionized the industrial sector. The largest issue with the design of the Internet of UAVs (IoUAV) is security. Conspicuously, the novel contribution of the proposed work is to develop a layered authentication approach to facilitate safe IoUAV communication. Specifically, four modules, including the pre-deployment module, user registration module, login module, and authentication module, form the basis of security analysis. In the proposed technique, UAVs are added to the IoUAV registry. The next step is the user registration module, where people are registered with the UAV so they may access the information in real time. In the login module, the user connects with the server for data transmission. Finally, in the authentication module, all entities, including users, servers, and UAVs, are authenticated to ensure secure data communication. The proposed method achieves peak performance as compared to the state-of-the-art techniques in terms of statistical parameters of latency (3.255s), throughput (90.15%), and packet loss (8.854%).

A new lattice-based password authenticated key exchange scheme with anonymity and reusable key.

In this article, we propose a novel bilateral generalization inhomogenous short integer solution (BiGISIS)-based password-authenticated key exchange (PAKE) scheme for post-quantum era security. The hardness assumption of the constructed PAKE is based on newly proposed hard lattice problem, BiGISIS. The main aim of this article is to provide a solution for the post-quantum secure PAKE scheme, which is one of the open problems in the literature. The proposed PAKE is the first BiGISIS-based PAKE that satisfies anonymity and reusable key features. The bilateral-pasteurization (BiP) approach is used to obtain the reusable key, and anonymity is achieved thanks to the additional identity components and hash functions. The reusable key structure reduces the time in the key generation, and anonymity prevents illegal user login attempts. The security analysis is done by following the real-or-random (RoR) model assumptions. As a result of security examinations, perfect forward secrecy (PFS) and integrity are satisfied, and the resistance against eavesdropping, manipulation-based attack (MBA), hash function simulation, impersonation, signal leakage attack (SLA), man-in-the-middle (MitM), known-key security (KKS), and offline password dictionary attack (PDA) is captured. According to the comparison analysis, the proposed PAKE is the first SLA-resistant lattice-based PAKE with reusable key and anonymity properties.

Temperature measurement of molten glass under batch feeding process by means of electrical resistance tomography

Electrical Resistance Tomography stands out as a powerful tool applicable to opaque environments, particularly in scenarios involving highly contaminated flows, gas–liquid two-phase flows with elevated void fractions, and electrically-conductive fields. The semi-conductive nature of high-temperature molten glass renders resistance tomography suitable for determining temperature distributions within such optically opaque mediums. This study aims to extend the application of the tomography technique to the spatial measurement of temperature in high-temperature molten glass. In order to verify the effectiveness of the developed system, a preliminary test was conducted by using an electrolyte solution in water to explore the overall system capabilities. Following the confirmation of the effective resolution of the proposed system, the measurement apparatus was employed for the actual temperature measurement of molten glass. The developed equipment featured sixteen independent electrodes, a low-impedance multiplexer, amplifier, rectifier, and a oscillating signal generator. Electrical potentials of the electrodes were recorded using a high-impedance amplifier as well as a data logging system. Upon collecting the electrical potential dataset, reconstruction computations were executed using the software. The measurement results show that the developed measurement system facilitates the acquisition of quantitative temperature distributions, as evidenced by the injection of a batch of low-temperature glass beads.