No abstract

No abstract

The massive volume of intrusion detection system (IDS) alarms generated on large networks, and the resulting need for laborintensive security analysis of the text-based IDS alarm logs, has recently brought into question the cost-effectiveness of IDSs. In particular, when host-based IDSs are used to monitor an organization's internal networks, the majority of the resulting alarms represent legitimate, automated system administration. Because of the absence of ground truth about known attacks, we propose an unsupervised, anomaly-based method for automatically distinguishing alarms that are potentially generated by malicious insider attacks, from the repetitive and temporally structured legitimate system-administration alarms. The majority of previous work in this area has used heuristic and statistical filtering techniques to discard a relatively large proportion of alarms in the final presentation to the security analyst, which is a potentially dangerous practice. Instead, we demonstrate the use of a typicality measure to visualize the apparent risk associated with alarms, while retaining information about the temporal context of the entire alarm stream for the analyst to view. The relevance of the statistical method is examined by comparing the results to a set of analyst-curated alarms from an operational environment.

Photographic methods of analyzing vehicles and scenes for the purpose of accident reconstruction have been well researched and documented. Photogrammetric analysis has appeared in various forms and levels of complexity over the years. Mathematical relationships have been researched and presented depicting the methods and bases of these techniques. This paper will present some new tools and methodologies in the process of photographic analysis. The PhotoModeler program will be utilized to demonstrate applications of digital photogrammetry in the field of accident reconstruction. Several different methodologies, including single and multiple photograph projects using calibrated and inverse cameras, will be evaluated and demonstrated. Additionally, comparisons to traditional methods of measurements will be presented. It will be demonstrated that the use of digital photogrammetry has advanced the science of accident reconstruction by employing computer and digital technology to achieve greater efficiency and improved accuracy.

No abstract