Search

Accurate estimation of galaxy cluster masses is a central problem in cosmology. Turbulence is believed to introduce significant deviations from the hydrostatic mass estimates. Estimation of turbulence properties is complicated by projection of the 3D cluster onto the 2D plane of the sky, and is commonly done in the form of indirect probes from fluctuations in the X-ray surface brightness and Sunyaev-Zeldovich effect maps. In this paper, we address this problem using simulations. We examine different methods for estimating the power spectrum on 2D projected fluctuation data, emulating data projected onto a 2D plane of the sky, and comparing them to the original, expected 3D power spectrum. Noise can contaminate the power spectrum of ICM observations, so we also briefly compare a few methods of reducing noise in the images for better spectral estimation.

Science DMZs are specialized networks that enable large-scale distributed scientific research, providing efficient and guaranteed performance while transferring large amounts of data at high rates. The high-speed performance of a Science DMZ is made viable via data transfer nodes (DTNs), therefore they are a critical point of failure. DTNs are usually monitored with network intrusion detection systems (NIDS). However, NIDS do not consider system performance data, such as network I/O interrupts and context switches, which can also be useful in revealing anomalous system performance potentially arising due to external network based attacks or insider attacks. In this paper, we demonstrate how system performance metrics can be applied towards securing a DTN in a Science DMZ network. Specifically, we evaluate the effectiveness of system performance data in detecting TCP-SYN flood attacks on a DTN using DBSCAN (a density-based clustering algorithm) for anomaly detection. Our results demonstrate that system interrupts and context switches can be used to successfully detect TCP-SYN floods, suggesting that system performance data could be effective in detecting a variety of attacks not easily detected through network monitoring alone.

In this paper, we propose principles of information control and sharing that support ORCON (ORiginator COntrolled access control) models while simultaneously improving components of confidentiality, availability, and integrity needed to inherently support, when needed, responsibility to share policies, rapid information dissemination, data provenance, and data redaction. This new paradigm of providing unfettered and unimpeded access to information by authorized users, while at the same time, making access by unauthorized users impossible, contrasts with historical approaches to information sharing that have focused on need to know rather than need to (or responsibility to) share.

Over the past six years, the nation has moved rapidly from punch cards and levers to electronic voting systems. These new systems have occasionally presented election officials with puzzling technical irregularities. The national experience has included unexpected and unexplained incidents in each phase of the election process: preparations, balloting, tabulation, and reporting results. Quick technical or managerial assessment can often identify the cause of the problem, leading to a simple and effective solution. But other times, the cause and scope of anomalies cannot be determined.In this paper, we describe the application of a model of forensics to the types of technical incidents that arise in computer-based voting technologies. We describe the elements of e-voting that current forensic techniques can address, as well as the need for a more structured analysis, and how this can be achieved given modifications to the design of e-voting systems. We also demonstrate how some concrete forensic techniques can be utilized today by election officials and their agents, to understand voting system events and indicators. We conclude by reviewing best practices for structuring a formal forensics team, and suggest legal steps and contractual provisions to undergird the team's authority and work.

Much of the literature on insider threat assumes, explicitly or implicitly, a binary, perimeter-based notion of an insider. However, it is generally accepted that this notion is unrealistic. The Attribute-Based Group Access Control (ABGAC) framework is a generalization of Role-Based Access Control (RBAC) which allows us to define a non-binary notion of "insiderness". In this paper, we illustrate how to use AB-GAC to perform insider threat analysis of high-risk resources with three case studies. This precise yet flexible identification of high-risk resources and associated insiders allows organizations to understand where to target efforts towards defending against the insider problem. © 2009 IEEE.

The insider threat has long been considered one of the most serious threats in computer security, and one of the most difficult to combat. But the problem has never been defined precisely, and that lack of precise definition inhibits solutions. This paper presents a precise definition of insider threat, and shows how the definition enables an analysis of the set of problems traditionally lumped into "the insider threat." It introduces a hierarchy of policy abstractions, and argues that the discrepancies between the different layers of abstraction expose the potential for insider threat. It also presents a methodology for analyzing the threat based upon our definitions. In the process, we introduce Attribute-Based Group Access Control, a generalization of the Role-Based Access Control model that allows any attributes to define a group. We apply this to the insider threat by defining groups based on access capabilities, and using that to identify users with a high level of threat with respect to high-risk resources.

We report results from two studies on the underlying dimensions of morphological awareness and vocabulary knowledge in elementary-aged children. In Study 1, 99 fourth-grade students were given multiple measures of morphological awareness and vocabulary. A single factor accounted for individual differences in all morphology and vocabulary assessments. Study 2 extended these results by giving 90 eighth-grade students expanded measures of vocabulary and morphology that assessed (a) definitional knowledge, (b) usage, (c) relational knowledge, and (d) knowledge of morphological variants, with each potential aspect of knowledge assessed using an identical set of 23 words to control for differential knowledge of specific vocabulary items. Results indicated that a single-factor model that encompassed morphological and vocabulary knowledge provided the best fit to the data. Finally, explanatory item response modeling was used to investigate sources of variance in the vocabulary and morphological awareness tasks we administered. Implications for assessment and instruction are discussed.