D. Schales, Mihai Christodorescu, Xin Hu, Jiyong Jang, J. Rao, R. Sailer, M. Stoecklin, W. Venema, Ting Wang
{"title":"Stream computing for large-scale, multi-channel cyber threat analytics","authors":"D. Schales, Mihai Christodorescu, Xin Hu, Jiyong Jang, J. Rao, R. Sailer, M. Stoecklin, W. Venema, Ting Wang","doi":"10.1109/IRI.2014.7051865","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051865","url":null,"abstract":"The cyber threat landscape, controlled by organized crime and nation states, is evolving rapidly towards evasive, multi-channel attacks, as impressively shown by malicious operations such as GhostNet, Aurora, Stuxnet, Night Dragon, or APT1. As threats blend across diverse data channels, their detection requires scalable distributed monitoring and cross-correlation with a substantial amount of contextual information. With threats evolving more rapidly, the classical defense life cycle of post-mortem detection, analysis, and signature creation becomes less effective. In this paper, we present a highly-scalable, dynamic cybersecurity analytics platform extensible at runtime. It is specifically designed and implemented to deliver generic capabilities as a basis for future cybersecurity analytics that effectively detect threats across multiple data channels while recording relevant context information, and that support automated learning and mining for new and evolving malware behaviors. Our implementation is based on stream computing middleware that has proven high scalability, and that enables cross-correlation and analysis of millions of events per second with millisecond latency. We report the lessons we have learned from applying stream computing to monitoring malicious activity across multiple data channels (e.g., DNS, NetFlow, ARP, DHCP, HTTP) in a production network of about fifteen thousand nodes.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"61 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126500593","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Automatic evaluation of medical doctors' performances while using a cricothyrotomy simulator","authors":"D. D’Auria, Fabio Persia","doi":"10.1109/IRI.2014.7051932","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051932","url":null,"abstract":"Cricothyrotomy is a life-saving procedure performed when an airway cannot be established through less invasive techniques. One of the main challenges of the research community in this area consists in designing and building a low-cost simulator that teaches essential anatomy, and providing a method of data collection for performance evaluation and guided instruction as well. In this paper, we present a Cyber Physical System designed and developed for activity detection in the medical context. In more detail, we first acquire data in real time from a cricothyrotomy simulator, when used by medical doctors, then we store the acquired data into a scientific database and finally we use an Activity Detection Engine for finding expected activities, in order to automatically evaluate the medical doctors' performances when using the simulator. Some preliminary experiments using real data show the approach efficiency and effectiveness. Eventually, we also received positive feedbacks by the medical personnel who used our prototype.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127647236","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards model driven crowdsourcing: First experiments, methodology and transformation","authors":"S. Vale","doi":"10.1109/IRI.2014.7051892","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051892","url":null,"abstract":"In collaborative development environments, people collaborate on sharing development activities that represent different concerns or parts of a system. Separation of concerns is one of the most important advantages provided by model driven approaches. In the Model Driven Engineering approach, business logic and architectural details have been modeled and by transformation techniques transformed from high abstraction level to source codes. Regarding separation of concerns, we propose a Model Driven Crowdsourcing approach that aims to provide a methodology and a specialized transformation technique for developing model driven applications in a collaborative and crowdsourced environment. We apply to the domain of context-awareness allowing business logic to be developed away from context-aware one.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131778944","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Tegjyot Singh Sethi, M. Kantardzic, Elaheh Arabmakki, Hanqing Hu
{"title":"An ensemble classification approach for handling spatio-temporal drifts in partially labeled data streams","authors":"Tegjyot Singh Sethi, M. Kantardzic, Elaheh Arabmakki, Hanqing Hu","doi":"10.1109/IRI.2014.7051961","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051961","url":null,"abstract":"The classification of streaming data requires learning in an environment where the distribution of the incoming data might change continuously. Stream classification methodologies need to adapt to these changes under limitations of time and memory resources. As such, it is not possible to expect all the samples in the stream to be labeled, as labeling is often time consuming and expensive. In this paper a new ensemble classification approach is proposed, which can handle Spatio-Temporal drifts in streams even when the labeling is limited. The proposed methodology uses a grid density clustering approach to track drifts in the spatial configuration of the data, and maintains a set of classifier models local to each cluster, to track its evolution over time. Structured weighted aggregation of the models across all clusters is performed to produce an overall effective prediction on a new sample. Additionally, a uniform sampling approach amenable to the grid representation of the clusters is proposed, which selects samples to be labeled while preserving the grid density information of the stream. This provides for better selection of representative samples to be labeled, for improved drift detection and handling, while maintaining the labeling budget. Experimental comparison with state of the art drift handling systems shows that the proposed methodology is able to give a high classification performance, with a manageable ensemble size and with only 10% of the samples labeled.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"447 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115100835","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
M. Barbareschi, Ermanno Battista, A. Mazzeo, S. Venkatesan
{"title":"Advancing WSN physical security adopting TPM-based architectures","authors":"M. Barbareschi, Ermanno Battista, A. Mazzeo, S. Venkatesan","doi":"10.1109/IRI.2014.7051916","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051916","url":null,"abstract":"Cyber Physical Systems typically operate unattended in hostile outdoor environments. A lot of effort has has been made to protect the communication between sensing nodes and the processing infrastructure. However, with regards to physical protection of a node, assessing the integrity of its hardware/software is a challenging issue. In this paper, we propose and evaluate a node architecture which makes use of Trusted Platform Module (TPM) to perform cryptographic operations in a trustworthy manner. TPM builds a chain of trust which enforces a trustability relationship among the node's components. In such context, the node will function only if all the hardware and software configurations have been verified by means of cryptographic operations. Moreover, using tamper resistant hardware we will ensure that the cryptographic keys do not leave a secure perimeter.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"128 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114647072","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A peer-to-peer network architecture for emerging applications","authors":"Khondkar R. Islam","doi":"10.1109/IRI.2014.7051933","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051933","url":null,"abstract":"There has been a noticeable rise in machine-to-machine (M2M) and vehicle-to-vehicle (V2V) communications during the past decade. This has been mostly prompted by the increase in the number of unmanned aerial vehicles (UAVs) and research in autonomous cars. Additionally, information security and privacy issues are becoming more critical with the rapid growth and complexity of network attached devices. As we depend more on the Internet, we become more vulnerable to security breaches. The rise in communication is also placing a huge toll on the Internet because most of these applications use the traditional client-server network infrastructure where the clients are served by the central server(s). This network model is also vulnerable to single point of failure, not ensuring high availability that is critical for sensitive applications. This paper presents a novel network architecture that leverages peer-to-peer (P2P) systems, which communicate via overlay networks to ensure high availability and efficient Internet bandwidth usage.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115801220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Wubai Zhou, Chao Shen, Tao Li, Shu‐Ching Chen, Ning Xie
{"title":"Generating textual storyline to improve situation awareness in disaster management","authors":"Wubai Zhou, Chao Shen, Tao Li, Shu‐Ching Chen, Ning Xie","doi":"10.1109/IRI.2014.7051942","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051942","url":null,"abstract":"Hurricane Sandy affected the east coast of U.S. in 2012 and posed immense threats to businesses, human lives and properties. In order to minimize the consequent loss of a catastrophe like this, a critical task in disaster management is to understand situation updates about the disaster from a large number of disaster-related documents, and obtain a big picture of the disaster's trends and how it affects different areas. In this paper, we present a two-layer storyline generation framework which generates an overall or a global storyline of the disaster events in the first layer, and provides condensed information about specific regions affected by the disaster (i.e., a location-specific storyline) in the second layer. To generate the overall storyline of a disaster, we consider both temporal and spatial factors, which are encoded using integer linear programming. While for location-specific storylines, we employ a Steiner tree based method. Compared with the previous work of storyline generation, which generates flat storylines without considering spatial information, our framework is more suitable for large-scale disaster events. We further demonstrate the efficacy of our proposed framework through the evaluation on the datasets of three major hurricane disasters.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115120977","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Uncertainty reasoning for the \"big data\" semantic web","authors":"Loukia Karanikola, Isambo Karali, S. McClean","doi":"10.1109/IRI.2014.7051884","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051884","url":null,"abstract":"The Semantic Web introduces the concept of machine-oriented information, i.e. information that can be processed by machines or agents without human intervention. In order to achieve this, web information should be represented in a way that its semantics is understandable by agents. Defining semantics for web information is not an easy process, as the web information is not always clear-cut. For example, a web search for comfortable hotels introduces the vague concept comfortable. So, semantics are always related to some kind of vagueness. Moreover, the source of web information is always characterized by a notion of uncertainty, e.g Ninety percent of four star hotels have a swimming pool. Uncertainty and vagueness can be strongly related and this relation demands an extension of any representation scheme in order to capture imperfect concepts. Towards this notion we propose an ontology as well as a reasoning method suitable for imperfect data.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123519812","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"SOA-GovMM: A meta model for a comprehensive SOA governance repository","authors":"Jan Konigsberger, S. Silcher, B. Mitschang","doi":"10.1109/IRI.2014.7051889","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051889","url":null,"abstract":"In recent years, the paradigm of service-oriented architecture (SOA) has more and more found its way into many organizations. The SOA principles of loosely coupled and reusable services has convinced decision makers in many organizations to start SOA initiatives. Yet, the lack of proper governance mechanisms has doomed many projects to fail. Although some SOA governance frameworks exist, they differ highly in scope and none of them covers the whole spectrum necessary to properly govern a SOA. In this paper we identify and discuss eleven core areas the governance of a SOA has to cover in order to realize the intended benefit in flexibility and agility. We then analyze and evaluate existing SOA governance frameworks with regard to those requirements. Subsequently, we present a meta model composed of four parts: Service Provider, Service Consumer, Organizational Structure and Business Object. We show, that those four parts cover all requirements for a comprehensive SOA governance repository. This allows an organization to leverage the information integrated in the repository to better govern their SOA and therefore improve the chances of its success.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122677650","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Henry M. Kim, M. Laskowski, S. Moghadas, Amirehsan Sajad, Maaz Asif
{"title":"A framework for comparing early warning systems across domains: A step toward a data-integrated public health EWS","authors":"Henry M. Kim, M. Laskowski, S. Moghadas, Amirehsan Sajad, Maaz Asif","doi":"10.1109/IRI.2014.7051875","DOIUrl":"https://doi.org/10.1109/IRI.2014.7051875","url":null,"abstract":"Early Warning Systems (EWS) are crucial tools for public health, providing time for agencies to devise and enact control and mitigation measures in the face of emerging health threats. EWS offer similar benefits to agencies that manage other domains such as natural disasters or financial markets. After surveying various EWS, we develop a novel framework for characterizing EWS across domains. Key to this framework is the characterization of an Early Warning System's domain and focal event; whether its aim is prediction, detection, or warning, whether its focus is model, systems, or infrastructure; the extent of human intervention required; and its input data. We believe this framework is quite novel, but more importantly, it serves as a reference to chart future projects. We use it to verify that an opportunity exists in developing public health EWS that integrate a spectrum of inputs from Web 2.0 and social media data, data from sensors, data from, say, electronic health records, as well as human opinions and behaviors.","PeriodicalId":360013,"journal":{"name":"Proceedings of the 2014 IEEE 15th International Conference on Information Reuse and Integration (IEEE IRI 2014)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125359775","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}