Detection of intrusions in information systems by sequential change-point methods

Sequential multi-chart detection procedures for detecting changes in multichannel sensor systems are developed. In the case of complete information on pre-change and post-change distributions, the detection algorithm represents a likelihood ratio-based multichannel generalization of Page’s cumulative sum (CUSUM) test that is applied to general stochastic models that may include correlated and nonstationary observations. There are many potential application areas where it is necessary to consider multichannel generalizations and general statistical models. In this paper our main motivation for doing so is network security: rapid anomaly detection for an early detection of attacks in computer networks that lead to changes in network traffic. Moreover, this kind of application encourages the development of a nonparametric multichannel detection test that does not use exact pre-change (legitimate) and post-change (attack) traffic models. The proposed nonparametric method can be effectively applied to detect a wide variety of attacks such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. In addition, we propose a multichannel CUSUM procedure that is based on binary quantized data; this procedure turns out to be more efficient than the previous two algorithms in certain scenarios. All proposed detection algorithms are based on the change-point detection theory. They utilize the thresholding of test statistics to achieve a fixed rate of false alarms, while allowing changes in statistical models to be detected “as soon as possible”. Theoretical frameworks for the performance analysis of detection procedures, as well as results of Monte Carlo simulations for a Poisson example and results of detecting real flooding attacks, are presented.     

Misperception of chance and loss repair: On the dynamics of tax compliance

Previous experimental studies on tax behavior have been particularly concerned with determining the absolute effect of detection rate and punishment on tax filing, leading to mixed results. In this paper, we shed some additional light on the effectiveness of audit probability and sanctions by drawing upon a dynamic setting with particular focus on the time lag between audits. Our results showed that tax compliance decreased immediately after a random audit, suggesting that subjects were prone to misperception of chance. Sanctions decreased compliance to a lesser extent; they were, however, associated with the tendency of subjects to repair their losses by increasing their capital stock.     

The Worth of Life and the Limits of Law

Survey data show that for Russians the most heinous crimes are serial murder, rape of minors, and premeditated murder, and these are the crimes for which they most often demand the death penalty. Four out of five say the Russian system of justice is guilty of mistakes often and very often, yet almost half of Russians are in favor of reinstituting and expanding the practical imposition of the death penalty     

Bayesian design and analysis of composite endpoints in clinical trials with multiple dependent binary outcomes

The author considers studies with multiple dependent primary endpoints. Testing hypotheses with multiple primary endpoints may require unmanageably large populations. Composite endpoints consisting of several binary events may be used to reduce a trial to a manageable size. The primary difficulties with composite endpoints are that different endpoints may have different clinical importance and that higher‐frequency variables may overwhelm effects of smaller, but equally important, primary outcomes. To compensate for these inconsistencies, we weight each type of event, and the total number of weighted events is counted. To reflect the mutual dependency of primary endpoints and to make the weighting method effective in small clinical trials, we use the Bayesian approach. We assume a multinomial distribution of multiple endpoints with Dirichlet priors and apply the Bayesian test of noninferiority to the calculation of weighting parameters. We use composite endpoints to test hypotheses of superiority in single‐arm and two‐arm clinical trials. The composite endpoints have a beta distribution. We illustrate this technique with an example. The results provide a statistical procedure for creating composite endpoints. Published 2013. This article is a U.S. Government work and is in the public domain in the USA.     

Un cas élémentaire d'oscillations

The probability laws describing the numbers of oscillations of the continuous symmetric random walk express themselves through the numbers of Stirling of first kind. The asymptotic behavior can easily be derived using characteristic functions.     

Robust Bayesian analysis of loss reserving data using scale mixtures distributions

It is vital for insurance companies to have appropriate levels of loss reserving to pay outstanding claims and related settlement costs. With many uncertainties and time lags inherently involved in the claims settlement process, loss reserving therefore must be based on estimates. Existing models and methods cannot cope with irregular and extreme claims and hence do not offer an accurate prediction of loss reserving. This paper extends the conventional normal error distribution in loss reserving modeling to a range of heavy-tailed distributions which are expressed by certain scale mixtures forms. This extension enables robust analysis and, in addition, allows an efficient implementation of Bayesian analysis via Markov chain Monte Carlo simulations. Various models for the mean of the sampling distributions, including the log-Analysis of Variance (ANOVA), log-Analysis of Covariance (ANCOVA) and state space models, are considered and the straightforward implementation of scale mixtures distributions is demonstrated using OpenBUGS.     

Victims of the Genocidal Mind: Societal Indicators and Individual Case Treatment Considerations

This paper uses the theoretical lens of object relations and takes the position that the paranoid-schizoid position and the related mechanism of projective identification—cornerstone pathology found in the phenomenon of fascism and totalitarianism—are not atypical, but rather live within the seemingly normal individual. Using Rwanda as a case example, the author illustrates the continuum of beliefs and actions that can result in genocide, and then describes some of the treatment considerations facing the clinician dealing with victims of genocide.