A New Statistical Approach to Network Anomaly Detection


 Jocelin Poole
 2 years ago
 Views:
Transcription
1 A New Statistica Approach to Network Anomay Detection Christian Caegari, Sandrine Vaton 2, and Michee Pagano Dept of Information Engineering, University of Pisa, ITALY Emai: 2 Dept of Computer Science, ENST Bretagne, FRANCE Emai: Abstract In the ast few years, the number and impact of security attacks over the Internet have been continuousy increasing To face this issue, the use of Intrusion Detection Systems (IDSs) has emerged as a key eement in network security In this paper we address the probem considering a nove statistica technique for detecting network anomaies Our approach is based on the use of different famiies of Markovian modes (namey high order and non homogeneous Markov chains) for modeing network traffic running over TCP The performance resuts shown in the paper, justify the proposed method and highight the improvements over commony used statistica techniques Index Terms Intrusion Detection System, High Order Markov Chain, Mixture Transition Mode, NonHomogeneous Markov Chain I INTRODUCTION In the ast few years Internet has experienced an exposive growth Aong with the wide proiferation of new services, the quantity and impact of attacks have been continuousy increasing The number of computer systems and their vunerabiities have been rising, whie the eve of sophistication and knowedge required to carry out an attack have been decreasing, as much technica attack knowhow is readiy avaiabe on Web sites a over the word Recent advances in encryption, pubic key exchange, digita signature, and the deveopment of reated standards have set a foundation for network security However, security on a network goes beyond these issues Indeed it must incude security of computer systems and networks, at a eves, top to bottom Since it seems impossibe to guarantee compete protection to a system by means of prevention mechanisms (eg authentication techniques), the use of an Intrusion Detection System (IDS) is of primary importance to revea intrusions in a network or in a system IDSs are usuay cassified on the basis of severa criteria [] State of the art in the fied of intrusion detection is mosty represented by misuse based IDSs Considering that most attacks are reaized with known toos, avaiabe on the Internet, a signature based IDS coud seem a good soution Nevertheess hackers continuousy come up with new ideas for the attacks, that a misuse based IDS is not abe to bock This is the main reason why our work has focused on the deveopment of an anomay based IDS In particuar our goa is to revea intrusions carried out expoiting TCP bugs, by using Markovian modes (high order and non homogeneous Markov chains) to describe the behavior of network traffic The use of first order homogeneous Markov chain is a weknown approach to detect two distinct kinds of anomaies : masqueraders (anayzing the command stream of a host) and intruders (anayzing the evoution of TCP fows in the network traffic) [2] Vardi and Ju in [3] describe the use of high order Markov chains to detect masqueraders at the host eve, and in [4][5] the authors compare performance of first order modes and generic high order modes After an extensive survey, to the best of our knowedge, there is no work directy reated neither to the use of high order Markov chains to detect anomaies in the TCP traffic nor to the appication of nonhomogeneous Markov chains to anomay detection in genera Moreover no study at a compares the performance achievabe with Markov chains of different orders and with a simpe independent mode The paper is structured as foows: next section provides a detaied description of the impemented system, whie the subsequent section presents the experimenta resuts Finay section 4 concudes the paper with some fina remarks II SYSTEM DESIGN In this section we provide a detaied description of the proposed anomay based NIDS The aim of our work is to perform a comparison between severa statistica modes, which can be used to describe the behavior of TCP connections More in detai we take into account the use of: first order homogeneous Markov chains first order nonhomogeneous Markov chains high order homogeneous Markov chains stationary ECDF (Empirica Cumuative Distribution Function) nonstationary ECDF Next subsections describe the training phase and the detection phase of our IDS A Training Phase To buid the mode which represents the norma behavior of the network, the system needs a training phase during which
2 2 it anayzes some network traffic, supposed to be attack free The system anayzes raw traffic traces in ibpcap format, the standard used by pubicy avaiabe packet sniffer software, as Tcpdump or Etherea First of a the IDS performs a fitering phase so that ony TCP packets are passed as input to the detection bocks The IDS ony considers some fieds of the packet headers, more precisey the IP source address, the IP destination address, the source port number, the destination port number, and the TCP fags The IP addresses and the port numbers are used to identify a connection, whie the vaue of the fags is used to buid the profie Experimenta resuts have shown that the stochastic modes associated to the different appications strongy differ one from the other Thus, before constructing the mode, the system isoates the different services, on the basis of the server port number, and the foowing procedure is reaized once per each appication After that the IDS reconstructs the singe connections on the basis of the 5tupe (source and destination addresses, source and destination ports, and protoco) A vaue s i is associated to each packet, according to the configuration of the TCP fags: which grows exponentiay with the order, according to the rue K (K ) This entais the need of a parsimonious representation of the transition probabiities The approach used in this paper is the Mixture Transition Distribution (MTD) mode, first proposed in [6] Under the MTD mode, the transition probabiities of an th order Markov chain can be expressed as foows: P(C t = s i C t = s i,c t 2 = s i2,,c t = s i ) = j= λ jr(s i s i j ) where C t represents the state of the chain at step t and the quantities R = {r(s i s j ); i, j =,2,,K} Λ = {λ j ; j =,2,,} satisfy to the foowing constraints: r(s i s j ) ; i, j =,2,,K K s i = r(s i s j ) = j =,2,,K (2) (3) (4) s i = syn+2 ack+4 psh+8 rst+6 urg+32 fin () Thus each monodirectiona connection is represented by a sequence of symbos s i, which are integers in {,,,63} The training phase, as we as the detection phase, varies according to the stochastic mode we are taking into account ) ECDF: In the case of the stationary ECDF the training phase simpy consists of evauating the probabiities P(s i ) that the TCP fags assume the vaue s i, independenty of the position of the packet in the TCP connection For the nonstationary ECDF the system has to compute the probabiities P j (s i ) that the TCP fags of the j th packet of the connection assume the vaue s i Taking into account the nature of the security attacks, for reducing the compexity of the system, we have decided to evauate such probabiities ony for the first packets of a connection, ie j =,2,, 2) Markov Chains: In the case of Markovian modes the symbos s i are considered as the states of a hidden discrete time finite state Markov chain Since not a the TCP fags configurations are observabe in rea traffic, the system ony considers the states observed in the training phase Moreover, to take into account the possibiity that some new fags configurations coud be observed during the detection phase, a rare state is added This procedure aows us to reduce the cardinaity of the state space from 64 (a the possibe configurations of the six TCP fags bits) to a number K, usuay smaer than ten Then the system estimates the transition probabiities of the Markov chain Since the computation of such probabiities is quite straightforward in the case of first order Markov chains (homogeneous and nonhomogeneous), in the foowing we consider a Markov chain of order The main probem reated to this kind of modes is the exposion of the number of parameters, λ j ; j =,2,, and j= λ j = (5) A consequence of the use of the MTD mode is the reduction of the number of parameters from K (K ) to K(K )+ To take into account the presence of the rare state (abeed K), we have to fix the foowing quantities: r(rare s i ) = ε, i =,2,,K and ε sma (ε = 6 ) r(s i rare) = ( ε)/(k ), i =,2,,K According to the MTD mode the ogikeihood of a sequence (c,c 2,,c T ) of ength T is LL(c,c 2,,c T )( = ) K i = K i = N(s i,s i,,s i )og (7) j= λ jr(s i s i j ) where N(s i,s i,,s i ) represents the number of times the transition s i s i s i is observed Maximum ikeihood estimation (MLE) of the chain parameters requires to maximize the right hand side of eq (7), with respect to R and Λ, taking into account the constraints (4) and (5) Since the origina soution [7] seems to be too much computationay demanding, we have appied the procedure proposed in [3], which consists in an aternate maximization with respect to R and to Λ This process eads to a goba maximum, since LL is concave in R and Λ For the part when R is fixed, we maximize LL with respect to Λ, and viceversa In the first step (estimation of Λ) we have used the sequentia quadratic programming, whie the second maximization step (estimation of R) is a inear inverse probem with positivity constraints (LININPOS) that we have soved appying the expectation maximization (EM) agorithm [8] Since the first maximization step is quite trivia, in what foows we discuss (6)
3 3 the second step, ie the estimation of the matrix R, with the vector Λ fixed First of a we have reindexed the ogikeihood in the foowing way: φ(s i,s i,,s i ) = + which takes to j= N(s i,s i,,s i ) a k and (s i j )K j k (8) j= λ j r(s i s i j ) b k (9) Thus, at first we estimate the quantities b k (MLE) and then we sove the inear system are the unknowns, r(s i s j ) = r i+k( j ), and N = N(s,s,,s ) N(s,s,,s 2 ) N(s,s,,s K ) N(s K,s K,,s ) N(s K,s K,,s K ) = N N 2 N K N K+K + N K + where N(s,s,,s ) = N i, i = φ(s i,s i2,,s i ) (7) b k = j= λ j r(s i s i j ) () which is a LININPOS probem At this point, the ogikeihood can be expressed as: A = {a i j } K + K 2 where a i j = k= λ ki[ j = i + K(i k )], (i,,i ) = φ (i) The matrix B ooks ike: (8) where [3] k + a k = T and k= k + a k ogb k () k= k + b k = K (2) k= Thus a simpe Lagrange method argument shows that the ogikeihood is maximized when ˆb k = a k or, equivaenty, when j= k a k k b k = a k T K, k (3) λ j r(s i s i j ) = K T N(s i,s i,,s i ), (i,,i ) (4) Thus, if we consider these equations as a inear system subject to the constraints (4), we obtain a LININPOS probem, which can be soved, in the sense of the minimum Kuback Leiber distance, using the EM agorithm More in detai we have [9] where ( A B ) ( R = K T N R T = (r(s s ),r(s 2 s ),,r(s K s ),,r(s K s K )) = (r,r 2,,r K 2) ) (5) (6),,,,,,,,,,,, B =,,,,,,,,, K K 2 At this point the EM iteration step is the foowing: K (9) r j a j ˆr j (A, a j + b j T N,R)+ b j ˆr j (B,,R) (2) a j + b j where ˆr j (W,u,v) v j w j i w i j u i, j =,2,,K 2 (2) k w ik v k for matrix W = {w i j } and vectors u = {u i },v = {v i }, and a j = i a i j = = = (i,,i )=φ (i) k= k= k= λ k I[ j = i + K(i k )] λ k i i I[ j = i + K(i k )] λ k K = K (22) and b j = i b i j = The choice of the initia vaues for R and Λ is a key point Experimenta tests have shown that good resuts are obtained choosing λ i = /, i =,2,, and setting R to the first order transition probabiities
4 4 x 7 Log ikeihood Function Number of Packets x 4 Fig Logikeihood function of a norma connection ( ) Maxv u L(c,c 2,,c T Λ v,r v ) T X = (25) L(c,c 2,,c T Λ u,r u ) where the vector (Λ u,r u ) represents the parameters corresponding to the mode computed during the training phase (hypothesis H ) and the component T is introduced to take into account that each observed sequence is characterized by a different ength T It is worth noticing that this test is equivaent to decide on the basis of the KubackLeiber divergence between the mode associated to H and the one computed for the observed sequence Log ikeihood Function Fig Anomay Number of Packets Logikeihood function of an anomaous connection B Detection Phase Once the training phase has been performed, the IDS has a mode of the norma behavior of the network, represented by the computed profie As for the training phase, the input is given by raw traffic traces in ibpcap format, which are processed so as to extract sequences of TCP fags configurations Thus, given an observed sequence (c,c 2,,c T ), the system has to decide between the two hypotheses: H : {(c,c 2,,c T ) computed mode} H : {anomay} (23) The probem is to choose between a singe hypothesis H, which is associated to the estimated stochastic mode, and the composite hypothesis H, which represents a the other possibiities No optima resut is presented in the iterature about this decision theory probem, thus the best soution is represented by the use of the Generaized Likeihood Ratio (GLR) test [] Since the probem is quite straightforward for ECDF, in the foowing we ony consider the case of Markovian modes, for which the GLR test is defined as foows: { H i f X < ξ H(X) = H i f X > ξ (24) where the threshod ξ is set by means of MonteCaro simuations and the quantity X is given by: III EXPERIMENTAL RESULTS In this section we compare the performance of the different statistica modes over the 999 DARPA evauation project [] data set For sake of brevity, in the foowing we ony present the resuts reated to the Tenet traffic, since they appear to be representative of the overa performance To test the correctness of the computed modes we have cacuated the ogikeihood function of some sequences Figure corresponds to a norma connection As expected from the theory, the function decreases amost ineary with the number of packets; its sope is equa to the entropy of the mode, which, for first order Markov chain, is defined as: H (MC) = i π(i)p(s j s i ) ogp(s j s i ) j where π(i) is the stationary distribution of the Markov chain The given definition can be easiy extended for higher order Markov chains On the other hand the effect of an anomay is an abrupt jump in the ogikeihood function, as highighted by figure 2 Both these figures refer to a first order mode, but the behavior of the ogikeihood function does not significanty vary with the order of the Markov chain To evauate the performance we have used a Receiver Operating Characteristic (ROC) curve, which pots detection rate vs fase positive rate, obtained varying the vaue of the threshod ξ Figure 3 shows the ROC curves for Markov chains of different orders We have considered Markov chains of order up to 4, since higher orders impy a heavy processing time, not suitabe for onine detection Since the resuts obtained using a mode based on a Markov chain of order are aready very good for these traffic traces, it is not easy to reaize that we achieve some improvements with high order modes To be noted that the ROC curves are amost idea, since we have a detection rate cose to % with a negigeabe fase aarm rate Nevertheess the zoomed area inside the figure shows that with the mode of order 4 we are abe to achieve the best resuts, obtaining a detection rate of 53% with a fase aarm rate which is about one haf of that reated to the Markov chain of order The foowing figure shows the performance of the ECDF, whie figure 5 presents a comparison between the first order
5 5 Markov chains and the time dependent modes described in the paper Since a detection performed anayzing ony the first packets of each connection is obviousy worse than the one based on the entire connections, aso the time independent mode has been computed ony considering the first ten packets of each connection It is easy to concude that the homogeneous Markov chain achieves a detection rate amost % bigger than the other two modes This apparent paradox can be justified by the fact that the nonhomogeneous modes have been computed with a reativey short, and so incompete, training phase Indeed, on one side the whoe training data set has been used to compute ony one homogeneous mode, whie on the other side, the same quantity of data is partitioned into ten subsets corresponding to the first ten steps in the time evoution of each connection In particuar this can ead to amost deterministic probabiities for the first steps of the non homogeneous modes, thus a singe fag configuration at step i, present in the training data set ony at steps j i (and hence captured by the time independent mode), may generate a fase aarm Finay, we have taken into account that an intrusion shoud be detected as soon as the anomay appears Thus, in figure 6, we show the performance of the homogeneous Markov chain mode as a function of the number of anayzed packets for each connection (both for buiding the mode and for the detection phase) The resuts highight that good performance are achieved with a sma number of packets, demonstrating that such statistica modes are suitabe for on ine anomay detection REFERENCES [] Kemmerer, RA, Vigna, G, Intrusion Detection: a Brief History and Overview, IEEE Security and Privacy (suppement to Computer, vo 35, no 4) pp 273, Apri 22 [2] Ye, N, Yebin Zhang, Y, and Borror, CM, Robustness of the Markov Chain for CyberAttack Detection, IEEE Transactions on Reiabiity, Vo 53, no, pp 623, March 24 [3] Ju, WH and Vardi, Y, A Hybrid Highorder Markov Chain Mode for Computer Intrusion Detection, NISS, Technica Report Number 92, February 999 [4] Schonau, M, et a, Computer Intrusion: Detecting Masquerades, NISS, Technica Report Number 95, March 999 [5] Ye, N, Ehiabor, T, and Zhanget, Y, Firstorder Versus Highorder Stochastic Modes for Computer Intrusion Detection, Quaity and Reiabiity Engineering Internationa, 8:24325, 22 [6] Raftery, AE, A mode for highorder Markov chains, Journa of the Roya Statistica Society, series B, 47, , 985 [7] Raftery, AE and Tavare, S Estimation and modeing repeated patterns in highorder Markov chains with the mixture transition distribution (MTD) mode, Journa of the Roya Statistica Society, series C  Appied Statistics, 43, 792, 994 [8] Vardi, Y and Lee, D, From Image deburring to Optima investments: Maximum Likeihood Soutions for Positive Linear Inverse Probem, Journa of the Roya Statistica Society, series B, 55, , 993 [9] Iusem, AN and Svaiter, BF, A New SmoothingReguarization Approach for a MaximumLikeihood Estimation Probem, Appied Mathematics and Optimization, 29:22524, 994 [] Mood, AM, Graybi, FA, and D C Boes, DC, Introduction to the Theory of Statistics 3rd ed Tokyo, Japan: McGrawHi, 974 [] Lippmann, R, et a, The 999 DARPA OffLine Intrusion Detection Evauation, Computer Networks Voume 34, Issue 4, October 2, Pages IV CONCLUSIONS In this paper we have presented an anomay based network intrusion detection system, which detects anomaies using statistica characterizations of the TCP traffic We have compared severa stochastic modes, such as first order homogeneous and nonhomogeneous Markov chains, high order homogeneous Markov chains, and stationary and nonstationary ECDF We have detaied the estimation of the parameters of the modes and we have shown the resuts obtained with the DARPA 999 data set The performance anaysis has highighted that the best resuts are obtained with the use of homogeneous Markov chains and that some improvements can be achieved using high order Markovian modes: for instance, 4th order Markov chains ead to the same detection rate of first order modes, with amost one haf of fase aarms Moreover, we have shown that, since ony a sma quantity of packets is sufficient to revea intrusions in the TCP traffic, this kind of approach is suitabe for on ine detection V ACKNOWLEDGMENTS This work was partiay supported by the EuroNGI Network of Exceence funded by the European Commission and party by the RECIPE project funded by MIUR
6 6 Fig 3 Performance of Markovian modes of different orders Detection Rate Fase Aarm Rate Fig 4 Performance of ECDF mode
7 Detection Rate Non Stationary ECDF Non Homogeneous MC Homogeneous MC Fase Aarm Rate Fig 5 Performance comparison of the anayzed time dependent modes ( packets ony) Detection Rate packets packets 5 packets 2 packets Fase Aarm Rate Fig 6 Performance of the homogeneous Markov chain mode, as a function of the number of processed packets
Secure Network Coding with a Cost Criterion
Secure Network Coding with a Cost Criterion Jianong Tan, Murie Médard Laboratory for Information and Decision Systems Massachusetts Institute of Technoogy Cambridge, MA 0239, USA Emai: {jianong, medard}@mit.edu
More informationFast Robust Hashing. ) [7] will be remapped (and therefore discarded), due to the loadbalancing property of hashing.
Fast Robust Hashing Manue Urueña, David Larrabeiti and Pabo Serrano Universidad Caros III de Madrid E89 Leganés (Madrid), Spain Emai: {muruenya,darra,pabo}@it.uc3m.es Abstract As statefu fowaware services
More informationNetwork/Communicational Vulnerability
Automated teer machines (ATMs) are a part of most of our ives. The major appea of these machines is convenience The ATM environment is changing and that change has serious ramifications for the security
More informationTCP/IP Gateways and Firewalls
Gateways and Firewas 1 Gateways and Firewas Prof. JeanYves Le Boudec Prof. Andrzej Duda ICA, EPFL CH1015 Ecubens http://cawww.epf.ch Gateways and Firewas Firewas 2 o architecture separates hosts and
More informationArt of Java Web Development By Neal Ford 624 pages US$44.95 Manning Publications, 2004 ISBN: 1932394060
IEEE DISTRIBUTED SYSTEMS ONLINE 15414922 2005 Pubished by the IEEE Computer Society Vo. 6, No. 5; May 2005 Editor: Marcin Paprzycki, http://www.cs.okstate.edu/%7emarcin/ Book Reviews: Java Toos and Frameworks
More informationTest Adequacy Assessment using Control Flow and Data Flow
CSE592 Advanced Topics in Computer Science Software Engineering Test Adequacy Assessment using Contro Fow and Data Fow Lecture 14 Conditions Any expression that evauates to true or fase constitutes a condition.
More informationONE of the most challenging problems addressed by the
IEEE TRANSACTIONS ON GEOSCIENCE AND REMOTE SENSING, VOL. 44, NO. 9, SEPTEMBER 2006 2587 A Mutieve ContextBased System for Cassification of Very High Spatia Resoution Images Lorenzo Bruzzone, Senior Member,
More informationMath: Fundamentals 100
Math: Fundamentas 100 Wecome to the Tooing University. This course is designed to be used in conjunction with the onine version of this cass. The onine version can be found at http://www.tooingu.com. We
More informationSimultaneous Routing and Power Allocation in CDMA Wireless Data Networks
Simutaneous Routing and Power Aocation in CDMA Wireess Data Networks Mikae Johansson *,LinXiao and Stephen Boyd * Department of Signas, Sensors and Systems Roya Institute of Technoogy, SE 00 Stockhom,
More informationArtificial neural networks and deep learning
February 20, 2015 1 Introduction Artificia Neura Networks (ANNs) are a set of statistica modeing toos originay inspired by studies of bioogica neura networks in animas, for exampe the brain and the centra
More informationCERTIFICATE COURSE ON CLIMATE CHANGE AND SUSTAINABILITY. Course Offered By: Indian Environmental Society
CERTIFICATE COURSE ON CLIMATE CHANGE AND SUSTAINABILITY Course Offered By: Indian Environmenta Society INTRODUCTION The Indian Environmenta Society (IES) a dynamic and fexibe organization with a goba vision
More informationComputing the depth of an arrangement of axisaligned rectangles in parallel
Computing the depth of an arrangement of axisaigned rectanges in parae Hemut At Ludmia Scharf Abstract We consider the probem of computing the depth of the arrangement of n axisaigned rectanges in the
More informationCOMPARISON OF DIFFUSION MODELS IN ASTRONOMICAL OBJECT LOCALIZATION
COMPARISON OF DIFFUSION MODELS IN ASTRONOMICAL OBJECT LOCALIZATION Františe Mojžíš Department of Computing and Contro Engineering, ICT Prague, Technicá, 8 Prague frantise.mojzis@vscht.cz Abstract This
More informationBetting Strategies, Market Selection, and the Wisdom of Crowds
Betting Strategies, Market Seection, and the Wisdom of Crowds Wiemien Kets Northwestern University wkets@keogg.northwestern.edu David M. Pennock Microsoft Research New York City dpennock@microsoft.com
More informationHYBRID FUZZY LOGIC PID CONTROLLER. Abstract
HYBRID FUZZY LOGIC PID CONTROLLER Thomas Brehm and Kudip S. Rattan Department of Eectrica Engineering Wright State University Dayton, OH 45435 Abstract This paper investigates two fuzzy ogic PID controers
More informationTeamwork. Abstract. 2.1 Overview
2 Teamwork Abstract This chapter presents one of the basic eements of software projects teamwork. It addresses how to buid teams in a way that promotes team members accountabiity and responsibiity, and
More informationChapter 2 Traditional Software Development
Chapter 2 Traditiona Software Deveopment 2.1 History of Project Management Large projects from the past must aready have had some sort of project management, such the Pyramid of Giza or Pyramid of Cheops,
More informationTraffic classificationbased spam filter
Traffic cassificationbased spam fiter Ni Zhang 1,2, Yu Jiang 3, Binxing Fang 1, Xueqi Cheng 1, Li Guo 1 1 Software Division, Institute of Computing Technoogy, Chinese Academy of Sciences, 100080, Beijing,
More informationFace Hallucination and Recognition
Face Haucination and Recognition Xiaogang Wang and Xiaoou Tang Department of Information Engineering, The Chinese University of Hong Kong {xgwang1, xtang}@ie.cuhk.edu.hk http://mmab.ie.cuhk.edu.hk Abstract.
More informationNormalization of Database Tables. Functional Dependency. Examples of Functional Dependencies: So Now what is Normalization? Transitive Dependencies
ISM 602 Dr. Hamid Nemati Objectives The idea Dependencies Attributes and Design Understand concepts normaization (HigherLeve Norma Forms) Learn how to normaize tabes Understand normaization and database
More informationAustralian Bureau of Statistics Management of Business Providers
Purpose Austraian Bureau of Statistics Management of Business Providers 1 The principa objective of the Austraian Bureau of Statistics (ABS) in respect of business providers is to impose the owest oad
More informationCLOUD service providers manage an enterpriseclass
IEEE TRANSACTIONS ON XXXXXX, VOL X, NO X, XXXX 201X 1 Oruta: PrivacyPreserving Pubic Auditing for Shared Data in the Coud Boyang Wang, Baochun Li, Member, IEEE, and Hui Li, Member, IEEE Abstract With
More informationVirtual trunk simulation
Virtua trunk simuation Samui Aato * Laboratory of Teecommunications Technoogy Hesinki University of Technoogy Sivia Giordano Laboratoire de Reseaux de Communication Ecoe Poytechnique Federae de Lausanne
More informationComparison of Traditional and OpenAccess Appointment Scheduling for Exponentially Distributed Service Time
Journa of Heathcare Engineering Vo. 6 No. 3 Page 34 376 34 Comparison of Traditiona and OpenAccess Appointment Scheduing for Exponentiay Distributed Service Chongjun Yan, PhD; Jiafu Tang *, PhD; Bowen
More informationVendor Performance Measurement Using Fuzzy Logic Controller
The Journa of Mathematics and Computer Science Avaiabe onine at http://www.tjmcs.com The Journa of Mathematics and Computer Science Vo.2 No.2 (2011) 311318 Performance Measurement Using Fuzzy Logic Controer
More informationAdvanced ColdFusion 4.0 Application Development  3  Server Clustering Using Bright Tiger
Advanced CodFusion 4.0 Appication Deveopment  CH 3  Server Custering Using Bri.. Page 1 of 7 [Figures are not incuded in this sampe chapter] Advanced CodFusion 4.0 Appication Deveopment  3  Server
More informationA Supplier Evaluation System for Automotive Industry According To Iso/Ts 16949 Requirements
A Suppier Evauation System for Automotive Industry According To Iso/Ts 16949 Requirements DILEK PINAR ÖZTOP 1, ASLI AKSOY 2,*, NURSEL ÖZTÜRK 2 1 HONDA TR Purchasing Department, 41480, Çayırova  Gebze,
More informationMultiRobot Task Scheduling
Proc of IEEE Internationa Conference on Robotics and Automation, Karsruhe, Germany, 013 MutiRobot Tas Scheduing Yu Zhang and Lynne E Parer Abstract The scheduing probem has been studied extensivey in
More informationCONTRIBUTION OF INTERNAL AUDITING IN THE VALUE OF A NURSING UNIT WITHIN THREE YEARS
Dehi Business Review X Vo. 4, No. 2, Juy  December 2003 CONTRIBUTION OF INTERNAL AUDITING IN THE VALUE OF A NURSING UNIT WITHIN THREE YEARS John N.. Var arvatsouakis atsouakis DURING the present time,
More informationSELECTING THE SUITABLE ERP SYSTEM: A FUZZY AHP APPROACH. Ufuk Cebeci
SELECTING THE SUITABLE ERP SYSTEM: A FUZZY AHP APPROACH Ufuk Cebeci Department of Industria Engineering, Istanbu Technica University, Macka, Istanbu, Turkey  ufuk_cebeci@yahoo.com Abstract An Enterprise
More informationA Latent Variable Pairwise Classification Model of a Clustering Ensemble
A atent Variabe Pairwise Cassification Mode of a Custering Ensembe Vadimir Berikov Soboev Institute of mathematics, Novosibirsk State University, Russia berikov@math.nsc.ru http://www.math.nsc.ru Abstract.
More informationInsertion and deletion correcting DNA barcodes based on watermarks
Kracht and Schober BMC Bioinformatics (2015) 16:50 DOI 10.1186/s1285901504827 METHODOLOGY ARTICLE Open Access Insertion and deetion correcting DNA barcodes based on watermarks David Kracht * and Steffen
More informationExperiment #11 BJT filtering
Jonathan Roderick Hakan Durmus Experiment #11 BJT fitering Introduction: Now that the BJT has bn expored in static and dynamic operation, the BJT, combined with what has bn aready presented, may be used
More informationDetermining the User Intent of ChineseEnglish Mixed Language Queries Based On Search Logs
Determining the User Intent of ChineseEngish Mixed Language Queries Based On Search Logs Hengyi Fu, Forida State University, City University of New York Abstract With the increasing number of mutiingua
More informationChapter 1 Structural Mechanics
Chapter Structura echanics Introduction There are many different types of structures a around us. Each structure has a specific purpose or function. Some structures are simpe, whie others are compex; however
More informationSNMP Reference Guide for Avaya Communication Manager
SNMP Reference Guide for Avaya Communication Manager 03602013 Issue 1.0 Feburary 2007 2006 Avaya Inc. A Rights Reserved. Notice Whie reasonabe efforts were made to ensure that the information in this
More informationLeakage detection in water pipe networks using a Bayesian probabilistic framework
Probabiistic Engineering Mechanics 18 (2003) 315 327 www.esevier.com/ocate/probengmech Leakage detection in water pipe networks using a Bayesian probabiistic framework Z. Pouakis, D. Vaougeorgis, C. Papadimitriou*
More informationPricing Internet Services With Multiple Providers
Pricing Internet Services With Mutipe Providers Linhai He and Jean Warand Dept. of Eectrica Engineering and Computer Science University of Caifornia at Berkeey Berkeey, CA 94709 inhai, wr@eecs.berkeey.edu
More informationChapter 3: ebusiness Integration Patterns
Chapter 3: ebusiness Integration Patterns Page 1 of 9 Chapter 3: ebusiness Integration Patterns "Consistency is the ast refuge of the unimaginative." Oscar Wide In This Chapter What Are Integration Patterns?
More information3.3 SOFTWARE RISK MANAGEMENT (SRM)
93 3.3 SOFTWARE RISK MANAGEMENT (SRM) Fig. 3.2 SRM is a process buit in five steps. The steps are: Identify Anayse Pan Track Resove The process is continuous in nature and handed dynamicay throughout ifecyce
More informationAutomatic Structure Discovery for Large Source Code
Automatic Structure Discovery for Large Source Code By Sarge Rogatch Master Thesis Universiteit van Amsterdam, Artificia Inteigence, 2010 Automatic Structure Discovery for Large Source Code Page 1 of 130
More informationFRAME BASED TEXTURE CLASSIFICATION BY CONSIDERING VARIOUS SPATIAL NEIGHBORHOODS. Karl Skretting and John Håkon Husøy
FRAME BASED TEXTURE CLASSIFICATION BY CONSIDERING VARIOUS SPATIAL NEIGHBORHOODS Kar Skretting and John Håkon Husøy University of Stavanger, Department of Eectrica and Computer Engineering N4036 Stavanger,
More informationRestoration of blue scratches in digital image sequences
Avaiabe onine at www.sciencedirect.com Image and Vision Computing 26 (2008) 1314 1326 www.esevier.com/ocate/imavis Restoration of bue scratches in digita image sequences Lucia Maddaena a, *, Afredo Petrosino
More informationDesign Considerations
Chapter 2: Basic Virtua Private Network Depoyment Page 1 of 12 Chapter 2: Basic Virtua Private Network Depoyment Before discussing the features of Windows 2000 tunneing technoogy, it is important to estabish
More informationComparison of Misspecification Tests Designed for Nonlinear Time Series Models
ömmföäfsäafaäsfassfassfas fffffffffffffffffffffffffffffffffff Discussion Papers Comparison of Misspecification Tests Designed for Noninear Time Series Modes Leena Kaiovirta University of Hesinki and HECER
More informationPROPAGATION OF SURGE WAVES ON NONHOMOGENEOUS TRANSMISSION LINES INDUCED BY LIGHTNING STROKE
Advances in Eectrica and Eectronic Engineering 98 PROPAGATION OF SRGE WAVES ON NONHOMOGENEOS TRANSMISSION LINES INDCED BY LIGHTNING STROKE Z. Benešová, V. Kotan WB Pisen, Facuty of Eectrica Engineering,
More informationBiteSize Steps to ITIL Success
7 BiteSize Steps to ITIL Success Pus making a Business Case for ITIL! Do you want to impement ITIL but don t know where to start? 7 BiteSize Steps to ITIL Success can hep you to decide whether ITIL can
More informationSketchbased Networkwide Traffic Anomaly Detection
Sketchbased Networkwide Traffic Anomay Detection Yang Liu, Linfeng Zhang, and Yong Guan Department of Eectrica and Computer Engineering Iowa State University, Ames, Iowa 500 Emai: {yang, zhangf, guan}@iastate.edu
More informationIntroduction to XSL. Max Froumentin  W3C
Introduction to XSL Max Froumentin  W3C Introduction to XSL XML Documents Stying XML Documents XSL Exampe I: Hamet Exampe II: Mixed Writing Modes Exampe III: database Other Exampes How do they do that?
More informationOverview of Health and Safety in China
Overview of Heath and Safety in China Hongyuan Wei 1, Leping Dang 1, and Mark Hoye 2 1 Schoo of Chemica Engineering, Tianjin University, Tianjin 300072, P R China, Emai: david.wei@tju.edu.cn 2 AstraZeneca
More informationSorting, Merge Sort and the DivideandConquer Technique
Inf2B gorithms and Data Structures Note 7 Sorting, Merge Sort and the DivideandConquer Technique This and a subsequent next ecture wi mainy be concerned with sorting agorithms. Sorting is an extremey
More informationA Similarity Search Scheme over Encrypted Cloud Images based on Secure Transformation
A Simiarity Search Scheme over Encrypted Coud Images based on Secure Transormation Zhihua Xia, Yi Zhu, Xingming Sun, and Jin Wang Jiangsu Engineering Center o Network Monitoring, Nanjing University o Inormation
More informationModeling a Scenariobased Distribution Network Design Problem in a Physical Internetenabled open Logistics Web
4 th Internationa conference on Information Systems, Logistics and Suppy Chain Quebec City August 2629, 2012 Modeing a Scenariobased Distribution Network Design Probem in a Physica Internetenabed open
More informationMaintenance activities planning and grouping for complex structure systems
Maintenance activities panning and grouping for compex structure systems Hai Canh u, Phuc Do an, Anne Barros, Christophe Berenguer To cite this version: Hai Canh u, Phuc Do an, Anne Barros, Christophe
More informationGREEN: An Active Queue Management Algorithm for a Self Managed Internet
: An Active Queue Management Agorithm for a Sef Managed Internet Bartek Wydrowski and Moshe Zukerman ARC Specia Research Centre for UtraBroadband Information Networks, EEE Department, The University of
More informationLearning framework for NNs. Introduction to Neural Networks. Learning goal: Inputs/outputs. x 1 x 2. y 1 y 2
Introduction to Neura Networks Learning framework for NNs What are neura networks? Noninear function approimators How do they reate to pattern recognition/cassification? Noninear discriminant functions
More informationProbabilistic Systems Analysis Autumn 2016 Tse Lecture Note 12
EE 178 Probabiistic Systems Anaysis Autumn 2016 Tse Lecture Note 12 Continuous random variabes Up to now we have focused excusivey on discrete random variabes, which take on ony a finite (or countaby infinite)
More informationBetting on the Real Line
Betting on the Rea Line Xi Gao 1, Yiing Chen 1,, and David M. Pennock 2 1 Harvard University, {xagao,yiing}@eecs.harvard.edu 2 Yahoo! Research, pennockd@yahooinc.com Abstract. We study the probem of designing
More informationEE 178/278A Probabilistic Systems Analysis. Spring 2014 Tse/Hussami Lecture 11. A Brief Introduction to Continuous Probability
EE 178/278A Probabiistic Systems Anaysis Spring 2014 Tse/Hussami Lecture 11 A Brief Introduction to Continuous Probabiity Up to now we have focused excusivey on discrete probabiity spaces Ω, where the
More informationEarly access to FAS payments for members in poor health
Financia Assistance Scheme Eary access to FAS payments for members in poor heath Pension Protection Fund Protecting Peope s Futures The Financia Assistance Scheme is administered by the Pension Protection
More informationThe Whys of the LOIS: Credit Risk and Refinancing Rate Volatility
The Whys of the LOIS: Credit Risk and Refinancing Rate Voatiity Stéphane Crépey 1, and Raphaë Douady 2 1 Laboratoire Anayse et Probabiités Université d Évry Va d Essonne 9137 Évry, France 2 Centre d économie
More informationRestoration of blue scratches in digital image sequences
Consigio Nazionae dee Ricerche Istituto di Cacoo e Reti ad Ate Prestazioni Restoration of bue scratches in digita image sequences Lucia Maddaena, Afredo Petrosino RTICARNA052 December 2005 Consigio
More informationLecture 5: Solution Method for Beam Deflections
Structura Mechanics.080 Lecture 5 Semester Yr Lecture 5: Soution Method for Beam Defections 5.1 Governing Equations So far we have estabished three groups of equations fuy characterizing the response of
More informationHuman Capital & Human Resources Certificate Programs
MANAGEMENT CONCEPTS Human Capita & Human Resources Certificate Programs Programs to deveop functiona and strategic skis in: Human Capita // Human Resources ENROLL TODAY! Contract Hoder Contract GS02F0010J
More informationeg Enterprise vs. a Big 4 Monitoring Soution: Comparing Tota Cost of Ownership Restricted Rights Legend The information contained in this document is confidentia and subject to change without notice. No
More informationRisk Margin for a NonLife Insurance RunOff
Risk Margin for a NonLife Insurance RunOff Mario V. Wüthrich, Pau Embrechts, Andreas Tsanakas February 2, 2011 Abstract For sovency purposes insurance companies need to cacuate socaed bestestimate
More informationLogics preserving degrees of truth from varieties of residuated lattices
Corrigendum Logics preserving degrees of truth from varieties of residuated attices FÉLIX BOU and FRANCESC ESTEVA, Artificia Inteigence Research Institute IIIA  CSIC), Beaterra, Spain. Emai: fbou@iiia.csic.es;
More informationENERGY AND BOLTZMANN DISTRIBUTIONS
MISN159 NRGY AND BOLTZMANN DISTRIBUTIONS NRGY AND BOLTZMANN DISTRIBUTIONS by J. S. Kovacs and O. McHarris Michigan State University 1. Introduction.............................................. 1 2.
More informationMeasuring operational risk in financial institutions
Measuring operationa risk in financia institutions Operationa risk is now seen as a major risk for financia institutions. This paper considers the various methods avaiabe to measure operationa risk, and
More informationThis paper considers an inventory system with an assembly structure. In addition to uncertain customer
MANAGEMENT SCIENCE Vo. 51, No. 8, August 2005, pp. 1250 1265 issn 00251909 eissn 15265501 05 5108 1250 informs doi 10.1287/mnsc.1050.0394 2005 INFORMS Inventory Management for an Assemby System wh Product
More informationREAL TIME IMPLEMANTATION OF LMS BEAMFORMER FOR cdma2000 3G SYSTEM USING TI TMS320C6701 DSP
REAL TIME IMPLEMANTATION OF LMS BEAMFORMER FOR cdma2000 3G SYSTEM USING TI TMS320C6701 DSP Kerem Küçük, Mustafa Karakoç, and Adnan Kavak + Kocaei University + Kocaei University Eectronics and Computer
More informationOlder people s assets: using housing equity to pay for health and aged care
Key words: aged care; retirement savings; reverse mortgage; financia innovation; financia panning Oder peope s assets: using housing equity to pay for heath and aged care The research agenda on the ageing
More informationA quantum model for the stock market
A quantum mode for the stock market Authors: Chao Zhang a,, Lu Huang b Affiiations: a Schoo of Physics and Engineering, Sun Yatsen University, Guangzhou 5175, China b Schoo of Economics and Business Administration,
More informationLet s get usable! Usability studies for indexes. Susan C. Olason. Study plan
Let s get usabe! Usabiity studies for indexes Susan C. Oason The artice discusses a series of usabiity studies on indexes from a systems engineering and human factors perspective. The purpose of these
More informationOligopoly in Insurance Markets
Oigopoy in Insurance Markets June 3, 2008 Abstract We consider an oigopoistic insurance market with individuas who differ in their degrees of accident probabiities. Insurers compete in coverage and premium.
More informationSABRe B2.1: Design & Development. Supplier Briefing Pack.
SABRe B2.1: Design & Deveopment. Suppier Briefing Pack. 2013 RosRoyce pc The information in this document is the property of RosRoyce pc and may not be copied or communicated to a third party, or used
More informationAvailable online Journal of Scientific and Engineering Research, 2016, 3(2): Research Article
Avaiabe onine www.jsaer.com Journa of Scientific and Engineering Research, 016, ():1 Research Artice ISSN: 960 CODEN(USA): JSERBR A simpe design of a aboratory testing rig for the experimenta demonstration
More informationHybrid Process Algebra
Hybrid Process Agebra P.J.L. Cuijpers M.A. Reniers Eindhoven University of Technoogy (TU/e) Den Doech 2 5600 MB Eindhoven, The Netherands Abstract We deveop an agebraic theory, caed hybrid process agebra
More informationFinance 360 Problem Set #6 Solutions
Finance 360 Probem Set #6 Soutions 1) Suppose that you are the manager of an opera house. You have a constant margina cost of production equa to $50 (i.e. each additiona person in the theatre raises your
More informationThe Computation of the Inverse of a Square Polynomial Matrix
The Computation of the Inverse of a Square Poynomia Matrix Ky M. Vu, PhD. AuLac Technoogies Inc. c 2008 Emai: kymvu@auactechnoogies.com Abstract An approach to cacuate the inverse of a square poynomia
More informationWHITE PAPER BEsT PRAcTIcEs: PusHIng ExcEl BEyond ITs limits WITH InfoRmATIon optimization
Best Practices: Pushing Exce Beyond Its Limits with Information Optimization WHITE Best Practices: Pushing Exce Beyond Its Limits with Information Optimization Executive Overview Microsoft Exce is the
More informationLife Contingencies Study Note for CAS Exam S. Tom Struppeck
Life Contingencies Study Note for CAS Eam S Tom Struppeck (Revised 9/19/2015) Introduction Life contingencies is a term used to describe surviva modes for human ives and resuting cash fows that start or
More informationIntroduction the pressure for efficiency the Estates opportunity
Heathy Savings? A study of the proportion of NHS Trusts with an inhouse Buidings Repair and Maintenance workforce, and a discussion of eary experiences of Suppies efficiency initiatives Management Summary
More informationThe Domain Name System (DNS)
D 1 The Domain Name System (D) Prof. JeanYves Le Boudec Prof. ndrzej Duda IC, EPFL CH1015 Ecubens http://cawww.epf.ch o o Domain Name System: D Objective of D support user friendy naming of resources:
More informationNCH Software FlexiServer
NCH Software FexiServer This user guide has been created for use with FexiServer Version 1.xx NCH Software Technica Support If you have difficuties using FexiServer pease read the appicabe topic before
More informationMarket Design & Analysis for a P2P Backup System
Market Design & Anaysis for a P2P Backup System Sven Seuken Schoo of Engineering & Appied Sciences Harvard University, Cambridge, MA seuken@eecs.harvard.edu Denis Chares, Max Chickering, Sidd Puri Microsoft
More informationACO and SVM Selection Feature Weighting of Network Intrusion Detection Method
, pp. 129270 http://dx.doi.org/10.14257/ijsia.2015.9.4.24 ACO and SVM Seection Feature Weighting of Network Intrusion Detection Method Wang Xingzhu Furong Coege Hunan, University of Arts and Science,
More informationBusiness schools are the academic setting where. The current crisis has highlighted the need to redefine the role of senior managers in organizations.
c r o s os r oi a d s REDISCOVERING THE ROLE OF BUSINESS SCHOOLS The current crisis has highighted the need to redefine the roe of senior managers in organizations. JORDI CANALS Professor and Dean, IESE
More informationDynamic Pricing Trade Market for Shared Resources in IIU Federated Cloud
Dynamic Pricing Trade Market or Shared Resources in IIU Federated Coud Tongrang Fan 1, Jian Liu 1, Feng Gao 1 1Schoo o Inormation Science and Technoogy, Shiiazhuang Tiedao University, Shiiazhuang, 543,
More informationUncertain Bequest Needs and LongTerm Insurance Contracts 1
Uncertain Bequest Needs and LongTerm Insurance Contracts 1 Wenan Fei (Hartford Life Insurance) Caude Fuet (Université du Québec à Montréa and CIRPEE) Harris Schesinger (University of Aabama) Apri 22,
More informationWith the arrival of Java 2 Micro Edition (J2ME) and its industry
Knowedgebased Autonomous Agents for Pervasive Computing Using AgentLight Fernando L. Koch and JohnJues C. Meyer Utrecht University Project AgentLight is a mutiagent systembuiding framework targeting
More informationPracticing Reference... Learning from Library Science *
Practicing Reference... Learning from Library Science * Mary Whisner ** Ms. Whisner describes the method and some of the resuts reported in a recenty pubished book about the reference interview written
More informationIntegrating Risk into your Plant Lifecycle A next generation software architecture for risk based
Integrating Risk into your Pant Lifecyce A next generation software architecture for risk based operations Dr Nic Cavanagh 1, Dr Jeremy Linn 2 and Coin Hickey 3 1 Head of Safeti Product Management, DNV
More information2.5. Type 90. MediaManagement system the modern handling of hazardous substances
2.5 MMS System 192 2.5 Type 90 MediaManagement system the modern handing of hazardous substances 193 The MediaManagement System (MMS) is a diverse, mutifunctiona and highquaity soution for modern aboratory
More informationPricing and Revenue Sharing Strategies for Internet Service Providers
Pricing and Revenue Sharing Strategies for Internet Service Providers Linhai He and Jean Warand Department of Eectrica Engineering and Computer Sciences University of Caifornia at Berkeey {inhai,wr}@eecs.berkeey.edu
More informationThe Web Insider... The Best Tool for Building a Web Site *
The Web Insider... The Best Too for Buiding a Web Site * Anna Bee Leiserson ** Ms. Leiserson describes the types of Webauthoring systems that are avaiabe for buiding a site and then discusses the various
More informationLearning from evaluations Processes and instruments used by GIZ as a learning organisation and their contribution to interorganisational learning
Monitoring and Evauation Unit Learning from evauations Processes and instruments used by GIZ as a earning organisation and their contribution to interorganisationa earning Contents 1.3Learning from evauations
More informationICAP CREDIT RISK SERVICES. Your Business Partner
ICAP CREDIT RISK SERVICES Your Business Partner ABOUT ICAP GROUP ICAP Group with 56 miion revenues for 2008 and 1,000 empoyees is the argest Business Services Group in Greece. In addition to its Greek
More informationFixed income managers: evolution or revolution
Fixed income managers: evoution or revoution Traditiona approaches to managing fixed interest funds rey on benchmarks that may not represent optima risk and return outcomes. New techniques based on separate
More informationRicoh Healthcare. Process Optimized. Healthcare Simplified.
Ricoh Heathcare Process Optimized. Heathcare Simpified. Rather than a destination that concudes with the eimination of a paper, the Paperess Maturity Roadmap is a continuous journey to strategicay remove
More information