Search

Host-based threats such as Program Attack, Malware Implantation, and Advanced Persistent Threats (APT), are commonly adopted by modern attackers. Recent studies propose leveraging the rich contextual information in data provenance to detect threats in a host. Data provenance is a directed acyclic graph constructed from system audit data. Nodes in a provenance graph represent system entities (e.g., $processes$ and $files$) and edges represent system calls in the direction of information flow. However, previous studies, which extract features of the provenance graph, are not sensitive to the small quantity of threat-related entities and thus result in low performance when hunting stealthy threats. We present THREATRACE, an anomaly-based detector that detects host-based threats at system entity level without prior knowledge of attack patterns. We tailor GraphSAGE, an inductive graph neural network, to learn every benign entity’s role in a provenance graph. THREATRACE is a real-time system, which is scalable of monitoring a long-term running host and capable of detecting host-based intrusion in their early phase. We evaluate THREATRACE on five public datasets. The results show that THREATRACE outperforms seven state-of-the-art host intrusion detection systems. [ABSTRACT FROM AUTHOR]

Conceptual uncertainty is considered one of the major sources of uncertainty in groundwater flow modeling. Hypothesis testing is essential to increase system understanding by analyzing and refuting alternative conceptual models. We present a systematic approach to conceptual model testing aimed at finding an ensemble of conceptual understandings consistent with prior knowledge and observational data. This differs from the traditional approach of tuning the parameters of a single conceptual model to conform with the data through inversion. We apply this approach to a simplified hydrogeological characterization of the Wildman River area (Northern Territory, Australia) and evaluate the connectivity of sinkhole‐type depressions to groundwater. Alternative models are developed representing the process structure (i.e., different fluxes representing interactions between surface water and groundwater) and physical structure (i.e., different lithologies underlying the depressions) of the conceptual model of the depressions. Remote sensing data are used to test the process structure, while geophysical data are used to test the physical structure. Both data types are used to remove inconsistent models from an ensemble of 16 models and to update the probability of the remaining alternative conceptual models. Three out of five depressions that are used as a test case are conditionally confirmed to act as conduits for recharge, while for the last two depressions, the data are inconclusive. Although the framework is not directly prediction oriented, the testing of plausible conceptual models will ultimately lead to increased confidence of any groundwater model based on accepted posterior conceptualizations. Key Points: Increasing confidence in conceptual models through an exploratory systematic testing framework based on Popper‐Bayes philosophyA general framework for transparent and reproducible development and testing of hydrogeological conceptual models is appliedRefraction seismic data and satellite imagery tests the conceptualization of sinkhole‐like depressions as conduits of recharge [ABSTRACT FROM AUTHOR]

We consider modeling approaches to characterize solute transport in porous media, integrating them into a unique theoretical and experimental framework for model evaluation and data interpretation. To date, development of (conservative and reactive chemical) transport models and formulation of model calibration methods grounded on sensitivity-based collection of measurements have been pursued in parallel. Key questions that remain include: For a given set of measurements, which conceptual picture of the transport processes, as embodied in a mathematical model or models, is most appropriate? What are the most valuable space-time locations for solute concentration measurements, depending on the model selected? How is model parameter uncertainty propagated to model output, and how does this propagation affect model calibration? We address these questions by merging parallel streams of research-model formulation, reduction, calibration, sensitivity analysis, and discrimination-offering our view on an emerging framework that guides (i) selection of an appropriate number and location of time-dependent concentration measurements given a transport model and (ii) assessment (through discrimination criteria) of the relative benefit of applying any particular model from a set of several models. Our strategy is to employ metrics to quantify the relative contribution of each uncertain model parameter to the variability of the model output. We evaluate these metrics through construction of a surrogate (or 'meta') transport model that has the additional benefit of enabling sensitivity analysis and model calibration at a highly reduced computational cost. We demonstrate the applicability of this framework, focusing on transport of reactive chemicals in laboratory-scale porous media. [ABSTRACT FROM AUTHOR]

Much effort has been invested in developing snow models over several decades, resulting in a wide variety of empirical and physically based snow models. For the most part, these models are built on similar principles. The greatest differences are found in how each model parameterizes individual processes (e.g., surface albedo and snow compaction). Parameterization choices naturally span a wide range of complexities. In this study, we evaluate the performance of different snow model parameterizations for hydrological applications using an existing multimodel energy-balance framework and data from two well-instrumented alpine sites with seasonal snow cover. We also include two temperature-index snow models and an intensive, physically based multilayer snow model in our analyses. Our results show that snow mass observations provide useful information for evaluating the ability of a model to predict snowpack runoff, whereas snow depth data alone are not. For snow mass and runoff, the energy-balance models appear transferable between our two study sites, a behavior which is not observed for snow surface temperature predictions due to site-specificity of turbulent heat transfer formulations. Errors in the input and validation data, rather than model formulation, seem to be the greatest factor affecting model performance. The three model types provide similar ability to reproduce daily observed snowpack runoff when appropriate model structures are chosen. Model complexity was not a determinant for predicting daily snowpack mass and runoff reliably. Our study shows the usefulness of the multimodel framework for identifying appropriate models under given constraints such as data availability, properties of interest and computational cost. [ABSTRACT FROM AUTHOR]

ABSTRACT Software process improvement (SPI) initiatives are facing complex environments where stakeholders need to integrate different reference models in their organizations. There are several approaches to multimodel environments defining some steps or activities that should be carried out for implementing it efficiently inside organizations. This paper presents a report on the use of a multimodel framework integrating three quality reference models in 47 SPI initiatives. Basically, this report is based on statistical data extracted from industrial assessments. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]