Search

Recently, advanced cyber attacks, which consist of a sequence of steps that involve many vulnerabilities and hosts, compromise the security of many well-protected businesses. This has led to the solutions that ubiquitously monitor system activities in each host (big data) as a series of events, and search for anomalies (abnormal behaviors) for triaging risky events. Since fighting against these attacks is a time-critical mission to prevent further damage, these solutions face challenges in incorporating expert knowledge to perform timely anomaly detection over the large-scale provenance data. To address these challenges, we propose a novel stream-based query system that takes as input, a real-time event feed aggregated from multiple hosts in an enterprise, and provides an anomaly query engine that queries the event feed to identify abnormal behaviors based on the specified anomalies. To facilitate the task of expressing anomalies based on expert knowledge, our system provides a domain-specific query language, SAQL, which allows analysts to express models for (1) rule-based anomalies, (2) time-series anomalies, (3) invariant-based anomalies, and (4) outlier-based anomalies. We deployed our system in NEC Labs America comprising 150 hosts and evaluated it using 1.1TB of real system monitoring data (containing 3.3 billion events). Our evaluations on a broad set of attack behaviors and micro-benchmarks show that our system has a low detection latency (<2s) and a high system throughput (110,000 events/s; supporting ~4000 hosts), and is more efficient in memory utilization than the existing stream-based complex event processing systems., Comment: Accepted paper at USENIX Security Symposium 2018

The current trend of pushing CNNs deeper with convolutions has created a pressing demand to achieve higher compression gains on CNNs where convolutions dominate the computation and parameter amount (e.g., GoogLeNet, ResNet and Wide ResNet). Further, the high energy consumption of convolutions limits its deployment on mobile devices. To this end, we proposed a simple yet effective scheme for compressing convolutions though applying k-means clustering on the weights, compression is achieved through weight-sharing, by only recording $K$ cluster centers and weight assignment indexes. We then introduced a novel spectrally relaxed $k$-means regularization, which tends to make hard assignments of convolutional layer weights to $K$ learned cluster centers during re-training. We additionally propose an improved set of metrics to estimate energy consumption of CNN hardware implementations, whose estimation results are verified to be consistent with previously proposed energy estimation tool extrapolated from actual hardware measurements. We finally evaluated Deep $k$-Means across several CNN models in terms of both compression ratio and energy consumption reduction, observing promising results without incurring accuracy loss. The code is available at https://github.com/Sandbox3aster/Deep-K-Means, Comment: Accepted by ICML 2018

GC-1 and GC-2 are two globular clusters (GCs) in the remote halo of M81 and M82 in the M81 group discovered by Jang et al. using the {\it Hubble Space Telescope} ({\it HST}) images. These two GCs were observed as part of the Beijing--Arizona--Taiwan--Connecticut (BATC) Multicolor Sky Survey, using 14 intermediate-band filters covering a wavelength range of 4000--10000 \AA. We accurately determine these two clusters' ages and masses by comparing their spectral energy distributions (from 2267 to 20000~{\AA}, comprising photometric data in the near-ultraviolet of the {\it Galaxy Evolution Explorer}, 14 BATC intermediate-band, and Two Micron All Sky Survey near-infrared $JHK_{\rm s}$ filters) with theoretical stellar population-synthesis models, resulting in ages of $15.50\pm3.20$ for GC-1 and $15.10\pm2.70$ Gyr for GC-2. The masses of GC-1 and GC-2 obtained here are $1.77-2.04\times 10^6$ and $5.20-7.11\times 10^6 \rm~M_\odot$, respectively. In addition, the deep observations with the Advanced Camera for Surveys and Wide Field Camera 3 on the {\it HST} are used to provide the surface brightness profiles of GC-1 and GC-2. The structural and dynamical parameters are derived from fitting the profiles to three different models; in particular, the internal velocity dispersions of GC-1 and GC-2 are derived, which can be compared with ones obtained based on spectral observations in the future. For the first time, in this paper, the $r_h$ versus $M_V$ diagram shows that GC-2 is an ultra-compact dwarf in the M81 group., Comment: MNRAS 468, 4513-4528 (2017), 16 pages, 9 figures and 11 tables

We study the integral Galactic extinction and reddening based on the galaxy catalog of the South Galactic Cap U-band Sky Survey (SCUSS), where $u$ band galaxy number counts and $u-r$ color distribution are used to derive the Galactic extinction and reddening respectively. We compare these independent statistical measurements with the reddening map of \citet{Schlegel1998}(SFD) and find that both the extinction and reddening from the number counts and color distribution are in good agreement with the SFD results at low extinction regions ($E(B-V)^{SFD}<0.12$ mag). However, for high extinction regions ($E(B-V)^{SFD}>0.12$ mag), the SFD map overestimates the Galactic reddening systematically, which can be approximated by a linear relation $\Delta E(B-V)= 0.43[E(B-V)^{SFD}-0.12$]. By combing the results of galaxy number counts and color distribution together, we find that the shape of the Galactic extinction curve is in good agreement with the standard $R_V=3.1$ extinction law of \cite{ODonnell1994}.