Thu, 24 Jul 2008 23:21:12 BST CiteULike: Tag anomaly http://www.citeulike.org/tag/anomaly CiteULike.org en-gb Copyright © 2004-2008 citeulike.org http://www.citeulike.org/user/wjfjin/article/422228 <i>Research in Security and Privacy, 1990. Proceedings., 1990 IEEE Computer Society Symposium on (1990), pp. 278-284.</i><br /><br />A time-based inductive learning approach to the problem of real-time anomaly detection is described. This approach uses sequential rules that characterize a user's behavior over time. A rulebase is used to store patterns of user activities, and anomalies are reported whenever a user's activity deviates significantly from those specified in the rules. The rules in the rulebase characterize either the sequential relationships between security audit records or the temporal properties of the records. The rules are created in two ways: they are either dynamically generated and modified by a time-based inductive engine in order to adapt to changes in a user's behavior, or they are specified by the security management to implement a site security policy. This approach allows the correlation between adjacent security events to be exploited for the purpose of greater sensitivity in anomaly detection against seemingly intractable (or erratic) activities using statistical approaches. Real-time detection of anomaly activities is possible Adaptive real-time anomaly detection using inductively generated sequential patterns HS Teng K Chen SC Lu doi:10.1109/RISP.1990.63857 Research in Security and Privacy, 1990. Proceedings., 1990 IEEE Computer Society Symposium on (1990), pp. 278-284. 2005-12-05T16:09:14-00:00 1990 Research in Security and Privacy, 1990. Proceedings., 1990 IEEE Computer Society Symposium on 278 284 anomaly http://www.citeulike.org/user/wjfjin/article/97954 <i>(2003), pp. 251-261.</i> Anomaly detection of web-based attacks Christopher Kruegel Giovanni Vigna doi:10.1145/948109.948144 (2003), pp. 251-261. 2005-02-18T10:18:06-00:00 2003 251 261 ACM Press anomaly http://www.citeulike.org/user/wjfjin/article/2946617 <i>Recent Advances in Intrusion Detection (2006), pp. 82-101.</i><br /><br />Intrusion detection systems are fundamentally passive and fail–open. Because their primary task is classification, they do nothing to prevent an attack from succeeding. An intrusion prevention system (IPS) adds protection mechanisms that provide fail–safe semantics, automatic response capabilities, and adaptive enforcement. We present FLIPS (Feedback Learning IPS), a hybrid approach to host security that prevents binary code injection attacks. It incorporates three major components: an anomaly-based classifier, a signature-based filtering scheme, and a supervision framework that employs Instruction Set Randomization (ISR). Since ISR prevents code injection attacks and can also precisely identify the injected code, we can tune the classifier and the filter via a learning mechanism based on this feedback. Capturing the injected code allows FLIPS to construct signatures for zero-day exploits. The filter can discard input that is anomalous or matches known malicious input, effectively protecting the application from additional instances of an attack – even zero-day attacks or attacks that are metamorphic in nature. FLIPS does not require a known user base and can be deployed transparently to clients and with minimal impact on servers. We describe a prototype that protects HTTP servers, but FLIPS can be applied to a variety of server and client applications. FLIPS: Hybrid Adaptive Intrusion Prevention Michael Locasto Ke Wang Angelos Keromytis Salvatore Stolfo doi:10.1007/11663812_5 Recent Advances in Intrusion Detection (2006), pp. 82-101. 2008-07-01T04:36:31-00:00 2006 Recent Advances in Intrusion Detection 82 101 anomaly http://www.citeulike.org/user/wjfjin/article/693871 <i>(2002), pp. 291-301.</i> Tracking down software bugs using automatic anomaly detection Sudheendra Hangal Monica Lam doi:10.1145/581339.581377 (2002), pp. 291-301. 2006-06-12T17:38:38-00:00 2002 291 301 ACM Press anomaly invariant http://www.citeulike.org/user/wjfjin/article/2946205 <i>Comput. Netw., Vol. 48, No. 5. (August 2005), pp. 717-738.</i> A multi-model approach to the detection of web-based attacks Christopher Kruegel Giovanni Vigna William Robertson doi:10.1016/j.comnet.2005.01.009 Comput. Netw., Vol. 48, No. 5. (August 2005), pp. 717-738. 2008-07-01T01:26:34-00:00 2005 Comput. Netw. 1389-1286 48 5 717 738 Elsevier North-Holland, Inc. anomaly http://www.citeulike.org/user/wjfjin/article/2946200 <i>Fuzzy Systems and Knowledge Discovery (2005), pp. 320-323.</i><br /><br />HTTP request exploitations take substantial portion of network-based attacks. This paper presents a novel anomaly detection framework, which uses data mining technologies to build four independent detection models. In the training phase, these models mine specialty of every web program using web server log files as data source, and in the detection phase, each model takes the HTTP requests upon detection as input and calculates at least one anomalous probability as output. All the four models totally generate eight anomalous probabilities, which are weighted and summed up to produce a final probability, and this probability is used to decide whether the request is malicious or not. Experiments prove that our detection framework achieves close to perfect detection rate under very few false positives. Data Mining Methods for Anomaly Detection of HTTP Request Exploitations Xiao-Feng Wang Jing-Li Zhou Sheng-Sheng Yu Long-Zheng Cai doi:10.1007/11540007_39 Fuzzy Systems and Knowledge Discovery (2005), pp. 320-323. 2008-07-01T01:25:14-00:00 2005 Fuzzy Systems and Knowledge Discovery 320 323 anomaly http://www.citeulike.org/user/wjfjin/article/2896122 <i>(2005), pp. 85-94.</i> Meta IDS Environments: An Event Message Anomaly Detection Approach Jens Tolle Marko Jahnke Michael Bussmann Sven Henkel doi:10.1109/IWIA.2005.13 (2005), pp. 85-94. 2008-06-15T11:50:40-00:00 2005 85 94 IEEE Computer Society anomaly http://www.citeulike.org/user/wjfjin/article/620969 <i>IMC '05, 2005 Internet Measurement Conference, pp. 331-344.</i><br /><br />In this work we develop an approach for anomaly detection for large scale networks such as that of an enterprize or an ISP. The traffic patterns we focus on for analysis are that of a network-wide view of the traffic state, called the traffic matrix. In the first step a Kalman filter is used to filter out the "normal" traffic. This is done by comparing our future predictions of the traffic matrix state to an inference of the actual traffic matrix that is made using more recent measurement data than those used for prediction. In the second step the residual filtered process is then examined for anomalies. We explain here how any anomaly detection method can be viewed as a problem in statistical hypothesis testing. We study and compare four different methods for analyzing residuals, two of which are new. These methods focus on different aspects of the traffic pattern change. One focuses on instantaneous behavior, another focuses on changes in the mean of the residual process, a third on changes in the variance behavior, and a fourth examines variance changes over multiple timescales. We evaluate and compare all of these methods using ROC curves that illustrate the full tradeoff between false positives and false negatives for the complete spectrum of decision thresholds. Combining Filtering and Statistical Methods for Anomaly Detection Augustin Soule Kavé IMC '05, 2005 Internet Measurement Conference, pp. 331-344. 2006-05-10T08:06:20-00:00 IMC '05, 2005 Internet Measurement Conference 331 344 anomaly filtering statistical http://www.citeulike.org/user/wjfjin/article/1082099 <i>ACM Trans. Inf. Syst. Secur., Vol. 2, No. 3. (August 1999), pp. 295-331.</i> Temporal sequence learning and data reduction for anomaly detection Terran Lane Carla Brodley doi:10.1145/322510.322526 ACM Trans. Inf. Syst. Secur., Vol. 2, No. 3. (August 1999), pp. 295-331. 2007-02-01T14:31:57-00:00 1999 ACM Trans. Inf. Syst. Secur. 1094-9224 2 3 295 331 ACM Press anomaly http://www.citeulike.org/user/wahmad/article/1310123 <i>(May 2001), pp. 130-143.</i><br /><br />Anomaly detection is an essential component of the protection mechanisms against novel attacks. In this paper, we propose to use several information-theoretic measures, namely, entropy, conditional entropy, relative conditional entropy, information gain, and information cost, for anomaly detection. These measures can be used to describe the characteristics of an audit data set, suggest the appropriate anomaly detection model(s) to be built, and explain the performance of the model(s). We use... Information-theoretic measures for anomaly detection Wenke Lee Dong Xiang (May 2001), pp. 130-143. 2007-05-20T04:06:01-00:00 2001 130 143 anomaly detection information theory http://www.citeulike.org/user/vialaq/article/1472310 <i></i><br /><br />A multi-sensor fusion system using wavelet based detection algorithm is proposed for network anomaly detection. The proposed approach is applied to monitor events in different network metrics of a Dial Internet Protocol service. The results show that the approach is able to identify the presence of abnormal behaviours in advance of reported network anomalies, and reduce the number of false alarms generated by each network metric. Multi-Sensor Fusion System Using Wavelet Based Detection Algorithm Applied to Network Monitoring Vicente Aquino Javier Barria 2007-07-22T00:37:39-00:00 anomaly detection fusion multi-sensor network transforms wavelet http://www.citeulike.org/user/vialaq/article/1472242 <i>Communications, IEE Proceedings-, Vol. 148, No. 6. (2001), pp. 355-362.</i><br /><br />An algorithm is proposed for network anomaly detection based on the undecimated discrete wavelet transform and Bayesian analysis. The proposed algorithm checks the wavelet coefficients across resolution levels, and locates smooth and abrupt changes in variance and frequency in the given time series, by using the wavelet coefficients at these levels. The unknown variance of the wavelet coefficients is considered as a stochastic nuisance parameter. Marginalisation is then used to remove this nuisance parameter by using three different priors: flat, Jeffreys' and the inverse Wishart distribution (scalar case). The different versions of the proposed algorithm are evaluated using synthetic data, and compared with autoregressive models and thresholding techniques. The proposed algorithm is applied to monitor events in a Dial Internet Protocol service. The results show that the proposed algorithm is able to identify the presence of abnormal network behaviour in advance of reported network anomalies Anomaly detection in communication networks using wavelets V Alarcon-Aquino JA Barria Communications, IEE Proceedings-, Vol. 148, No. 6. (2001), pp. 355-362. 2007-07-22T00:29:51-00:00 2001 Communications, IEE Proceedings- 148 6 355 362 anomaly detection distributions network prior transforms wavelet http://www.citeulike.org/user/vanhau/article/1082128 <i>(2000), pp. 623-630.</i> Benchmarking Anomaly-Based Detection Systems Roy Maxion Kymie Tan (2000), pp. 623-630. 2007-02-01T15:05:00-00:00 2000 623 630 IEEE Computer Society anomaly benchmarking detection system http://www.citeulike.org/user/sunniesheu/article/363240 <i>Intelligent Control and Automation, 2004. WCICA 2004. Fifth World Congress on, Vol. 5 (2004), pp. 4348-4351 Vol.5.</i><br /><br />Intrusion detection has emerged as an important approach to security problems. The existing techniques are analyzed, and then an effective anomaly detection method based on HMMs (hidden Markov models) is proposed to learn patterns of Unix processes. Fixed-length sequences of system calls were extracted from traces of programs to train and test models. The RP (relative probability) value, which uses short sequences as inputs, is computed to classify normal and abnormal behaviors. The algorithm is simple and can be directly applied. Experiments on sendmail and lpr traces demonstrate that the method can construct accurate and concise discriminator to detect intrusive actions. A hidden Markov models-based anomaly intrusion detection method Ye Du Huiqiang Wang Yonggang Pang Intelligent Control and Automation, 2004. WCICA 2004. Fifth World Congress on, Vol. 5 (2004), pp. 4348-4351 Vol.5. 2005-10-24T03:02:07-00:00 2004 Intelligent Control and Automation, 2004. WCICA 2004. Fifth World Congress on 5 4348 4351 Vol.5 anomaly intrusion_detection markov http://www.citeulike.org/user/route145/article/693619 <i>BMC Bioinformatics, Vol. 7 (12 June 2006), 294.</i> ROKU: a novel method for identification of tissue-specific genes Koji Kadota Jiazhen Ye Yuji Nakai Tohru Terada Kentaro Shimizu doi:10.1186/1471-2105-7-294 BMC Bioinformatics, Vol. 7 (12 June 2006), 294. 2006-06-12T10:47:30-00:00 2006 BMC Bioinformatics 1471-2105 7 294 anomaly data detection medical mining http://www.citeulike.org/user/missiongiraffe/article/1949931 <i>Self-Organizing Systems, Vol. 4725/2007 (26 August 2007), pp. 280-287.</i><br /><br />Today networks suffer from various challenges like distributed denial of service attacks or worms. Multiple different anomaly-based detection systems try to detect and counter such challenges. Anomaly-based systems, however, often show high false negative rates. One reason for this is that detection systems work as single instances that base their decisions on local knowledge only. In this paper we propose a collaboration of neighboring detection systems that enables receiving systems to search specifically for that attack which might have been missed by using local knowledge only. Once such attack information is received a decision process has to determine if a search for this attack should be started. The design of our system is based on several principles which guide this decision process. Finally, the attack information will be forwarded to the next neighbors increasing the area of collaborating systems. Collaborative Anomaly-Based Attack Detection Thomas Gamer Michael Scharf Marcus Schöller doi:10.1007/978-3-540-74917-2_23 Self-Organizing Systems, Vol. 4725/2007 (26 August 2007), pp. 280-287. 2007-11-21T10:47:53-00:00 2007 Self-Organizing Systems 4725/2007 280 287 anomaly attack-detection networks http://www.citeulike.org/user/marymcglo/article/611098 <i>SIGKDD Explor. Newsl., Vol. 7, No. 2. (December 2005), pp. 48-55.</i> Relevance search and anomaly detection in bipartite graphs Jimeng Sun Huiming Qu Deepayan Chakrabarti Christos Faloutsos doi:10.1145/1117454.1117461 SIGKDD Explor. Newsl., Vol. 7, No. 2. (December 2005), pp. 48-55. 2006-05-02T03:32:16-00:00 2005 SIGKDD Explor. Newsl. 1931-0145 7 2 48 55 ACM Press anomaly graphs search http://www.citeulike.org/user/ianturton/article/227033 <i>(2004), pp. 460-469.</i><br /><br />Moments before the launch of every space vehicle, engineering discipline specialists must make a critical go/no-go decision. The cost of a false positive, allowing a launch in spite of a fault, or a false negative, stopping a potentially successful launch, can be measured in the tens of millions of dollars, not including the cost in morale and other more intangible detriments. The Aerospace Corporation is responsible for providing engineering assessments critical to the go/no-go decision for every Department of Defense space vehicle. These assessments are made by constantly monitoring streaming telemetry data in the hours before launch. We will introduce VizTree, a novel time-series visualization tool to aid the Aerospace analysts who must make these engineering assessments. VizTree was developed at the University of California, Riverside and is unique in that the same tool is used for mining archival data and monitoring incoming live telemetry. The use of a single tool for both aspects of the task allows a natural and intuitive transfer of mined knowledge to the monitoring task. Our visualization approach works by transforming the time series into a symbolic representation, and encoding the data in a modified suffix tree in which the frequency and other properties of patterns are mapped onto colors and other visual properties. We demonstrate the utility of our system by comparing it with state-of-the-art batch algorithms on several real and synthetic datasets. Visually mining and monitoring massive time series Jessica Lin Eamonn Keogh Stefano Lonardi Jeffrey Lankford Donna Nystrom doi:10.1145/1014052.1014104 (2004), pp. 460-469. 2005-06-13T20:14:10-00:00 2004 460 469 ACM Press analysis anomaly data-mining discovery graph series time time-series visualization http://www.citeulike.org/user/Hoshichan/article/481251 <i>Journal of Geophysical Research, Vol. 110 (28 May 2005), E05011.</i><br /><br />Previous work has shown that the strongest concentrations of lunar crustal magnetic anomalies are located antipodal to four large, similarly aged impact basins (Orientale, Serenitatis, Imbrium, and Crisium). Here, we report results of a correlation study between magnetic anomaly clusters and geology in areas antipodal to Imbrium, Orientale, and Crisium. Unusual geologic terranes, interpreted to be of seismic or ejecta origin associated with the antipodal basins, have been mapped antipodal to both Orientale and Imbrium. All three antipode regions have many high-albedo swirl markings. Results indicate that both of the unusual antipode terranes and Mare Ingenii (antipodal to Imbrium) show a correlation with high-magnitude crustal magnetic anomalies. A statistical correlation between all geologic units and regions of medium to high magnetization when high-albedo features are present (antipodal to Orientale) may suggest a deep, possibly seismic origin to the anomalies. However, previous studies have provided strong evidence that basin ejecta units are the most likely sources of lunar crustal anomalies, and there is currently insufficient evidence to differentiate between an ejecta or seismic origin for the antipodal anomalies. Results indicate a strong correlation between the high-albedo markings and regions of high magnetization for the Imbrium, Orientale, and Crisium antipodes. Combined with growing evidence for an Imbrian age to the magnetic anomalies, this supports a solar wind deflection origin for the lunar swirls. Correlations between magnetic anomalies and surface geology antipodal to lunar impact basins NC Richmond LL Hood DL Mitchell RP Lin MH Acuña AB Binder doi:10.1029/2005JE002405 Journal of Geophysical Research, Vol. 110 (28 May 2005), E05011. 2006-01-26T05:49:28-00:00 2005 Journal of Geophysical Research 110 E05011 anomaly basin geology impact lunar magnetic moon http://www.citeulike.org/user/Hoshichan/article/481250 <i>Journal of Geophysical Research, Vol. 110 (28 April 2005), E04015.</i><br /><br />We have used maps of the OMAT optical maturity parameter, along with other Clementine UV-Vis image products, to study two interesting lunar features related to albedo and optical maturity. Examination of the region of a small crater whose formation has been suggested to be a candidate for the flash photographed in 1953 by Stuart demonstrates that the candidate crater is not unusually fresh compared to other small craters in the vicinity. Therefore it is unlikely that the formation of this impact crater generated the observed flash. An area of unusually high albedo in the Descartes highlands is also known to be a magnetic anomaly. It has been proposed that the presence of the magnetic anomaly has prevented the solar wind from reaching the surface for billions of years and therefore that the area has not undergone normal space weathering and preserved a high albedo. The high albedo is caused only by maturity differences with the surroundings, not by an exotic composition. The fact that the albedo anomaly has not darkened or reddened to the extent expected may be the result of the surface texture as revealed in 3.8-cm radar images. We suggest that the fresh appearance is largely caused by overlapping ejecta from two nearby craters and continual exposure of immature material by the erosion of 1- to 10-cm-sized fragments within the deposit. The magnetic shielding mechanism, if operative, probably plays only a minor role in producing the Descartes albedo anomaly. Lunar optical maturity investigations: A possible recent impact crater and a magnetic anomaly David Blewett Ray Hawke Paul Lucey doi:10.1029/2004JE002380 Journal of Geophysical Research, Vol. 110 (28 April 2005), E04015. 2006-01-26T05:48:38-00:00 2005 Journal of Geophysical Research 110 E04015 anomaly crater impact lunar magnetic moon http://www.citeulike.org/user/hmahmood/article/1156156 <i></i><br /><br />In this paper a comparison of outlier detection algorithms is presented, we present an overview on outlier detection methods and experimental results of six implemented methods. We applied these methods for the prediction of stellar populations parameters as well as on machine learning benchmark data, inserting artificial noise and outliers. We used kernel principal component analysis in order to reduce the dimensionality of the spectral data. Experiments on noisy and noiseless data were... A Comparison of Outlier Detection Algorithms for Machine Jair 2007-03-12T22:00:08-00:00 anomaly data detection mining outlier http://www.citeulike.org/user/hmahmood/article/1156152 <i>(FebruaryApril--FebruaryJuly~ 1998), pp. 392-403.</i><br /><br />This paper deals with finding outliers (exceptions) in large, multidimensional datasets. The identification of outliers can lead to the discovery of truly unexpected knowledge in areas such as electronic commerce, credit card fraud, and even the analysis of performance statistics of professional athletes. Existing methods that we have seen for finding outliers in large datasets can only deal efficiently with two dimensions/attributes of a dataset. Here, we study the notion of DB- (Distance-... Algorithms for Mining Distance-Based Outliers in Large Datasets Edwin Knorr Raymond Ng (FebruaryApril--FebruaryJuly~ 1998), pp. 392-403. 2007-03-12T21:58:17-00:00 1998 392 403 anomaly data detection mining outlier http://www.citeulike.org/user/hmahmood/article/1156150 <i>(2003)</i><br /><br />Outlier detection is an integral part of data mining and has attracted much attention recently [8, 15, 20]. In this paper, we propose a new method for evaluating outlier-ness, which we call the Local Correlation Integral (LOCI). As with the best previous methods, LOCI is highly effective for detecting outliers and groups of outliers (a.k.a. micro-clusters). In addition, it offers the following advantages and novelties: (a) It provides an automatic, data-dictated cut-off to determine whether a... LOCI: Fast outlier detection using the local correlation integral S Papadimitriou H Kitagawa P Gibbons C Faloutsos (2003) 2007-03-12T21:57:19-00:00 2003 anomaly data detection mining outlier http://www.citeulike.org/user/hmahmood/article/1156148 <i></i><br /><br />Outliers are objects that do not comply with the general behavior of the data. Applications such as exploration in science databases need fast interactive tools for outlier detection in data sets that have unknown distributions, are large in size, and are in high dimensional space. Existing algorithms for outlier detection are too slow for such applications. We present an algorithm based on an innovative use of k-d trees that doesn't assume any probability model and is linear in the number of... Very Fast Outlier Detection in Large Multidimensional Data Sets Amitabh Chaudhary Alexander Szalay Andrew Moore 2007-03-12T21:55:58-00:00 anomaly data detection mining outlier http://www.citeulike.org/user/hmahmood/article/802671 <i>(2001)</i><br /><br />The outlier detection problem has important applications in the field of fraud detection, network robustness analysis, and intrusion detection. Most such applications are high dimensional domains in which the data can contain hundreds of dimensions. Many recent algorithms use concepts of proximity in order to find outliers based on their relationship to the rest of the data. However, in high dimensional space, the data is sparse and the notion of proximity fails to retain its meaningfulness. In ... Outlier Detection for High Dimensional Data Charu Aggarwal Philip Yu (2001) 2006-08-16T12:15:00-00:00 2001 anomaly data detection mining outlier http://www.citeulike.org/user/hjmykt/article/1550945 <i>Eur J Med Genet, Vol. 48, No. 2. (n 2005), pp. 113-129.</i><br /><br />PURPOSE: To evaluate the prevalence of abnormalities of rib development in normal Caucasian children and patients with childhood cancer. MATERIALS AND METHODS: Chest radiographs of 881 Caucasian pediatric controls and 906 childhood cancer patients were reviewed, and independently scored by four blinded observers, using strict definitions. Prevalences of 6 major rib anomaly categories in controls were compared to their prevalence in the total group of childhood cancer patients, and the 12 individual larger tumor groups using Chi-square tests. RESULTS: Values in the control population were generated for the occurrence of six major rib anomaly categories; cervical rib anomalies were present in 6.1% of controls, aplasia of 12th ribs in 6.6%, lumbar ribs in 0.9%, bifurcations in 0.7%, synostosis-bridging in 0.3%, and segmentations were not found. The overall prevalence of total rib anomalies in cases and controls was equal (14.9% and 14.2%, respectively). Cervical rib anomalies were found significantly more often in cases (8.6%) compared to controls (p-value=0.047), three groups accounting for this higher prevalence: 12.1% of acute lymphoblastic leukemia patients (p=0.011), 18.2% of astrocytoma patients (p=0.023), and 14.7% of germ cell tumor patients (p=0.046) had a cervical rib anomaly. CONCLUSION: Prevalence figures for the presence and type of rib anomalies in a large group of normal Caucasian children were generated. In childhood cancer patients a significantly higher prevalence of cervical rib anomalies was demonstrated in patients with acute lymphoblastic leukemia, astrocytoma, and germ cell tumors. Prevalence of rib anomalies in normal Caucasian children and childhood cancer patients. JH Merks AM Smets RR Van Rijn J Kobes HN Caron M Maas RC Hennekam doi:10.1016/j.ejmg.2005.01.029 Eur J Med Genet, Vol. 48, No. 2. (n 2005), pp. 113-129. 2007-08-10T07:29:21-00:00 2005 Eur J Med Genet 1769-7212 48 2 113 129 anomaly rib http://www.citeulike.org/user/gseiler/article/2334714 <i>J Am Vet Med Assoc, Vol. 232, No. 3. (1 February 2008), pp. 399-404.</i><br /><br />Case Description-A 1-year-old female spayed Labrador Retriever was admitted for evaluation of a progressive gait disturbance characterized by tetraparesis and general proprioceptive ataxia in all limbs. Clinical Findings-Neurologic examination suggested a dysfunction of the C6-T2 spinal cord segments, which was slightly worse on the right side. Discomfort was suspected upon lateral flexion of the neck. Two magnetic resonance imaging (MRI) examinations at a 3-week interval revealed an intramedullary fluid-filled cavitary lesion adjacent to C7, containing a blood clot. Treatment and Outcome-Following unsuccessful initial conservative management, surgical marsupialization of the lesion was performed through a dorsal laminectomy, durotomy, and myelotomy at C6 and C7. Histologic evaluation including immunohistochemistry was diagnostic for a vascular anomaly. Initially, the dog was nonambulatory with tetraparesis and became tetraplegic after surgery; movement was regained 6 days later. Four weeks after the procedure, the dog was able to walk unassisted. One year after surgery, the dog was actively running and jumping, with mild residual ataxia in the pelvic limbs. Clinical Relevance-The intramedullary vascular anomaly in this dog was successfully treated with a surgical marsupialization technique. The combination of MRI, histologic eval-uation, and immunohistochemistry enabled lesion localization, evaluation of cavity content, and final diagnosis. Magnetic resonance imaging and marsupialization of a hemorrhagic intramedullary vascular anomaly in the cervical portion of the spinal cord of a dog. K Alexander L Huneault R Foster MA d'Anjou doi:10.2460/javma.232.3.399 J Am Vet Med Assoc, Vol. 232, No. 3. (1 February 2008), pp. 399-404. 2008-02-05T12:52:46-00:00 2008 J Am Vet Med Assoc 0003-1488 232 3 399 404 anomaly cervical cord dog intramedullary mri spinal vascular http://www.citeulike.org/group/48/article/1145853 <i>(28 Feb 2007)</i><br /><br />We estimate the main systematic effects relevant in a mission to test and characterize the Pioneer anomaly through the flight formation concept, by launching probing spheres from a mother spacecraft and tracking their motion via laser ranging. A mission to test the Pioneer anomaly: estimating the main systematic effects O Bertolami J Paramos (28 Feb 2007) 2007-03-07T16:46:56-00:00 2007 anomaly pioneer http://www.citeulike.org/group/48/article/1145851 <i>(2 Mar 2007)</i><br /><br />The Pioneer anomaly is explained very simply if we assume that somewhere between us and the aircraft, the scale factor has undergone a discrete jump from an expansion a(t) regime to a contraction 1/a(t) regime A discontinuity of the background explains the Pioneer anomaly Henry-Couannier (2 Mar 2007) 2007-03-07T16:45:46-00:00 2007 anomaly pioneer http://www.citeulike.org/group/48/article/489583 <i>(1 Feb 2006)</i><br /><br />We propose an explanation to the Pioneer Anomaly, the anomalous blueshift in the radio signals from the Pioneer 10/11 spacecrafts that remains unexplained 30 years after being discovered by a NASA team around 1975. It was detected as a Doppler shift that does not correspond to any known motion of the ships. In 1998, after many unsuccessful efforts to account for it, the discoverers suggested "the possibility that the origin of the anomalous signal is new physics". We show here that the phenomenon has the same observational footprint as an acceleration of the atomic clocks time with respect to the astronomical time. Surprisingly, this curious new idea turns out to be compatible with current physics; lacking a unified theory of quantum physics and gravitation, we cannot discard it a priori. We expound a mechanism that produces such an acceleration as a result of the coupling of the background gravitation and the quantum vacuum. This suggests a solution to the riddle, in which the velocity of a receding ship, as deduced from the Doppler effect, is smaller than the value predicted by the standard theory of gravitation. We conclude that the Pioneer Anomaly is probably the signature of the difference between the marches of the astronomical clock of the orbit and the atomic clock inside the ship. A model for the Pioneer Anomaly Antonio Ranada Alfredo Tiemblo (1 Feb 2006) 2006-02-02T13:55:28-00:00 2006 anomaly pioneer http://www.citeulike.org/group/48/article/403088 <i>(6 Nov 2005)</i><br /><br />A fully relativistic modified gravitational theory including a fifth force skew symmetric field is fitted to the Pioneer 10/11 anomalous acceleration. The theory allows for a variation with distance scales of the gravitational constant G, the fifth force skew symmetric field coupling strength omega and the mass of the skew symmetric field mu=1/lambda. A fit to the available anomalous acceleration data for the Pioneer 10/11 spacecraft is obtained for a phenomenological representation of the "running" constants and values of the associated parameters are shown to exist that are consistent with fifth force experimental bounds. The fit to the acceleration data is consistent with all current satellite, laser ranging and observations for the inner planets. Gravitational solution to the Pioneer 10/11 anomaly JR Brownstein JW Moffat (6 Nov 2005) 2005-11-21T16:05:55-00:00 2005 anomaly pioneer http://www.citeulike.org/group/2518/article/103679 <i>(2003), pp. 426-435.</i> Critical event prediction for proactive management in large-scale computer clusters RK Sahoo AJ Oliner I Rish M Gupta JE Moreira S Ma R Vilalta A Sivasubramaniam doi:10.1145/956750.956799 (2003), pp. 426-435. 2005-02-24T23:25:48-00:00 2003 426 435 ACM Press analysis anomaly data detection logging mining monitoring unix http://www.citeulike.org/group/2518/article/103678 <i>Dependable Systems and Networks, 2004 International Conference on (2004), pp. 772-781.</i><br /><br />The growing complexity of hardware and software mandates the recognition of fault occurrence in system deployment and management. While there are several techniques to prevent and/or handle faults, there continues to be a growing need for an in-depth understanding of system errors and failures and their empirical and statistical properties. This understanding can help evaluate the effectiveness of different techniques for improving system availability, in addition to developing new solutions. In this paper, we analyze the empirical and statistical properties of system errors and failures from a network of nearly 400 heterogeneous servers running a diverse workload over a year. While improvements in system robustness continue to limit the number of actual failures to a very small fraction of the recorded errors, the failure rates are significant and highly variable. Our results also show that the system error and failure patterns are comprised of time-varying behavior containing long stationary intervals. These stationary intervals exhibit various strong correlation structures and periodic patterns, which impact performance but also can be exploited to address such performance issues. Failure data analysis of a large-scale heterogeneous server environment R Sahoo M Squillante A Sivasubramaniam Yanyong Zhang Dependable Systems and Networks, 2004 International Conference on (2004), pp. 772-781. 2005-02-24T23:24:00-00:00 2004 Dependable Systems and Networks, 2004 International Conference on 772 781 analysis anomaly detection logging monitoring unix http://www.citeulike.org/group/2518/article/101967 <i>(1999), pp. 19-28.</i> An Eye on Network Intruder-Administrator Shootouts Luc Girardin (1999), pp. 19-28. 2005-02-23T20:12:12-00:00 1999 19 28 USENIX Association administration analysis anomaly detection intrusion logging monitoring security syslog systems unix http://www.citeulike.org/group/2518/article/679180 <i>Systems, Man and Cybernetics (SMC) Information Assurance Workshop, 2005. Proceedings from the Sixth Annual IEEE (2005), pp. 92-99.</i><br /><br />We present a novel paradigm for visual correlation of network alerts from disparate logs. This paradigm facilitates and promotes situational awareness in complex network environments. Our approach is based on the notion that, by definition, an alert must possess three attributes, namely: what, when, and where. This fundamental premise, which we term w/sup 3/, provides a vehicle for comparing between seemingly disparate events. We propose a concise and scalable representation of these three attributes, that leads to a flexible visualization tool that is also clear and intuitive to use. Within our system, alerts can be grouped and viewed hierarchically with respect to both their type, i.e., the what, and to their where attributes. Further understanding is gained by displaying the temporal distribution of alerts to reveal complex attack trends. Finally, we propose a set of visual metaphor extensions that augment the proposed paradigm and enhance users' situational awareness. These metaphors direct the attention of users to many-to-one correlations within the current display helping them detect abnormal network activity. A visualization paradigm for network intrusion detection Yarden Livnat J Agutter S Moon RF Erbacher S Foresti Systems, Man and Cybernetics (SMC) Information Assurance Workshop, 2005. Proceedings from the Sixth Annual IEEE (2005), pp. 92-99. 2006-06-01T05:45:10-00:00 2005 Systems, Man and Cybernetics (SMC) Information Assurance Workshop, 2005. Proceedings from the Sixth Annual IEEE 92 99 analysis anomaly detection event glyphs graphing interface monitoring networking visualization http://www.citeulike.org/group/2518/article/616821 <i>(2004), pp. 143-147.</i> SnortView: visualization system of snort logs Hideki Koike Kazuhiro Ohno doi:10.1145/1029208.1029232 (2004), pp. 143-147. 2006-05-07T18:57:51-00:00 2004 143 147 ACM Press analysis anomaly detection event graphing interface monitoring networking visualization http://www.citeulike.org/group/2518/article/235579 <i>Information Visualisation, 2002. Proceedings. Sixth International Conference on (2002), pp. 570-576.</i><br /><br />Computer security breaches are already a major problem in using computers. The most basic defense against it is to monitor and audit the computer logs. Computer logs, however have a huge amount of textual data. It is, therefore, almost impossible to inspect them manually using current systems. We propose a log visualization system called "Tudumi". Tudumi consists of several functions which assist system administrators to perform such tasks manually. These functions are information visualization, log summarization and reflecting known rules into the visualization method. Tudumi makes it easier to detect anomalous user activities, such as intrusion, from a huge amount of computer logs. Tudumi: information visualization system for monitoring and auditing computer logs T Takada H Koike Information Visualisation, 2002. Proceedings. Sixth International Conference on (2002), pp. 570-576. 2005-06-23T15:08:52-00:00 2002 Information Visualisation, 2002. Proceedings. Sixth International Conference on 570 576 anomaly detection intrusion logging networking syslog visualization http://www.citeulike.org/group/2518/article/232977 <i>(2002), pp. 133-144.</i><br /><br />System administration has become an increasingly important function, with the fundamental task being the inspection of computer log-files. It is not, however, easy to perform such tasks for two reasons. One is the high recognition load of log contents due to the massive amount of textual data. It is a tedious, time-consuming and often error-prone task to read through them. The other problem is the difficulty in extracting unusual messages from the log. If an administrator does not have the knowledge or experience, he or she cannot readily recognize unusual log messages. To help address these issues, we have developed a highly interactive visual log browser called "MieLog." MieLog uses two techniques for manual log inspection tasks: information visualization and statistical analysis. Information visualization is helpful in reducing the recognition load because it provides an alternative method of interpreting textual information without reading. Statistical analysis enables the extraction of unusual log messages without domain specific knowledge. We will give three examples that illustrate the ability of the MieLog system to isolate unusual messages more easily than before. MieLog: A Highly Interactive Visual Log Browser Using Information Visualization and Statistical Analysis (2002), pp. 133-144. 2005-06-20T22:59:31-00:00 2002 133 144 USENIX Association anomaly detection graphing intrusion logging monitoring visualization http://www.citeulike.org/group/2518/article/232976 <i>(1997)</i><br /><br />The increasing role of communication networks in today's society results in a demand for higher levels of network availability and reliability. At the same time, fault management is becoming more difficult due to the dynamic nature and heterogeneity of networks. We propose an intelligent monitoring system using adaptive statistical techniques. The system continually learns the normal behavior of the network and detects deviations from the norm. Within the monitoring system, the measurements are segmented, and features extracted from the segments are used to describe the behavior of the measurement variables. This information is combined in the structure of a Bayesian network. The proposed system is thereby able to detect unknown or unseen faults. Experimental results on real network data demonstrate that the proposed system can detect abnormal behavior before a fault actually occurs. Proactive Network Fault Detection Cynthia Hood Chuanyi Ji (1997) 2005-06-20T22:57:39-00:00 1997 IEEE Computer Society anomaly detection graphing logging monitoring networking visualization http://www.citeulike.org/group/2518/article/232975 <i>(1998), pp. 299-308.</i> A Visual Approach for Monitoring Logs Luc Girardin Dominique Brodbeck (1998), pp. 299-308. 2005-06-20T22:55:34-00:00 1998 299 308 USENIX Association analysis anomaly data detection graphing intrusion logging mining som sysadmin visualization http://www.citeulike.org/group/2518/article/232973 <i>(2000)</i> A Computer Host-Based User Anomaly Detection System Using the Self-Organizing Map Albert Höglund Antti Sorvari (2000) 2005-06-20T22:51:35-00:00 2000 IEEE Computer Society analysis anomaly data detection intrusion map mining monitoring organizing self som http://www.citeulike.org/group/2518/article/227030 <i>Lecture Notes in Computer Science, Vol. 3222 (January 2004), pp. 544-550.</i> Online Mining in Sensor Networks Xiuli Ma Dongqing Yang Shiwei Tang Qiong Luo Dehui Zhang Shuangfeng Li Lecture Notes in Computer Science, Vol. 3222 (January 2004), pp. 544-550. 2005-06-13T20:03:22-00:00 2004 Lecture Notes in Computer Science 3222 544 550 analysis anomaly data distributed mining motes sensor http://www.citeulike.org/group/2518/article/227029 <i>(2003)</i> Clustering of Time Series Subsequences is Meaningless: Implications for Previous and Future Research Eamonn Keogh Jessica Lin Wagner Truppel (2003) 2005-06-13T19:56:51-00:00 2003 IEEE Computer Society analysis anomaly detection monitoring series time http://www.citeulike.org/group/2518/article/213200 <i>(2001), pp. 100-107.</i><br /><br />Tools for filtering the World Wide Web exist, but they are hampered by the difficulty of capturing user preferences in such a dynamic environment. We explore the acquisition of user profiles by unobtrusive monitoring of browsing behaviour and application of supervised machine-learning techniques coupled with an ontological representation to extract user preferences. A multi-class approach to paper classification is used, allowing the paper topic taxonomy to be utilised during profile construction. The Quickstep recommender system is presented and two empirical studies evaluate it in a real work setting, measuring the effectiveness of using a hierarchical topic ontology compared with an extendable flat list. Capturing knowledge of user preferences: ontologies in recommender systems Stuart Middleton David De Roure Nigel Shadbolt doi:10.1145/500737.500755 (2001), pp. 100-107. 2005-05-27T20:36:57-00:00 2001 100 107 ACM Press anomaly data design evaluation interface mining user http://www.citeulike.org/group/1410/article/599379 <i>(2004), pp. 213-218.</i> BorderGuard: detecting cold potatoes from peers Nick Feamster Zhuoqing Mao Jennifer Rexford doi:10.1145/1028788.1028815 (2004), pp. 213-218. 2006-04-25T09:09:51-00:00 2004 213 218 ACM Press anomaly bgp detection http://www.citeulike.org/group/1410/article/599374 <i>(2005), pp. 219-220.</i> Learning-based anomaly detection in BGP updates Jian Zhang Jennifer Rexford Joan Feigenbaum doi:10.1145/1080173.1080189 (2005), pp. 219-220. 2006-04-25T08:47:55-00:00 2005 219 220 ACM Press anomaly bgp detection http://www.citeulike.org/group/1410/article/599365 <i>(2004), pp. 35-44.</i> Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP Soon Teoh Ke Zhang Shih-Ming Tseng Kwan-Liu Ma Felix Wu doi:10.1145/1029208.1029215 (2004), pp. 35-44. 2006-04-25T08:32:37-00:00 2004 35 44 ACM Press anomaly bgp detection http://www.citeulike.org/user/gameweld/article/83493 <i>(# may # 2002)</i><br /><br />This paper introduces DIDUCE, a practical and effective tool that aids programmers in detecting complex program errors and identifying their root causes. By instrumenting a program and observing its behavior as it runs, DIDUCE dynamically formulates hypotheses of invariants obeyed by the program. DIDUCE hypothesizes the strictest invariants at the beginning, and gradually relaxes the hypothesis as violations are detected to allow for new behavior. The violations reported help users to catch... Tracking Down Software Bugs Using Automatic Anomaly Detection Sudheendra Hangal Monica Lam (# may # 2002) 2005-01-25T18:43:31-00:00 anomaly defect http://www.citeulike.org/user/cekay/article/365317 <i>(1993), pp. 107-150.</i><br /><br />It has been pointed out that inheritance and synchronization constraints in concurrent object systems often conflict with each other, resulting in inheritance anomaly where re-definitions of inherited methods are necessary in order to maintain the integrity of concurrent objects. The anomaly is serious, as it could nullify the benefits of inheritance altogether. Several proposals have been made for resolving the anomaly; however, we argue that those proposals suffer from the incompleteness... Analysis of Inheritance Anomaly in Object-Oriented Concurrent Programming Languages Satoshi Matsuoka Akinori Yonezawa (1993), pp. 107-150. 2005-10-26T08:40:59-00:00 1993 107 150 MIT Press anomaly inheritance object-oriented http://www.citeulike.org/user/bigbossman/article/611097 <i>SIGKDD Explor. Newsl., Vol. 7, No. 2. (December 2005), pp. 41-47.</i> The case for anomalous link discovery Matthew Rattigan David Jensen doi:10.1145/1117454.1117460 SIGKDD Explor. Newsl., Vol. 7, No. 2. (December 2005), pp. 41-47. 2006-05-02T03:31:46-00:00 2005 SIGKDD Explor. Newsl. 1931-0145 7 2 41 47 ACM Press anomaly discover link mining