SEARCH · Engineering Papers

Results for “log”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 397 records · Page 22

All sources NASA NTRS DOE OSTI

DOE OSTI2022

A Mountaintop View Requires Minimal Sorting: A Faster Contour Tree Algorithm

Consider a scalar field f : M → R, where M is a triangulated simplicial mesh in R d . A level set, or contour, at value v is a connected component of f –1 (v). As v is changed, these contours change topology, merge into each other, or split. Contour trees are concise representations of f that track this contour behavior. The vertices of these trees are the critical points of f, where the gradient is zero. The edges represent changes in the topology of contours. It is a fundamental data structure in data analysis and visualization, and there is significant previous work (both theoretical and practical) on algorithms for constructing contour trees. Suppose M has n vertices, N facets, and t critical points. A classic result of Carr, Snoeyink, and Axen (2000) gives an algorithm that takes O(n log n+Nα(N)) time (where α(·) is the inverse Ackermann function). A further improvement to O(t log t + N) time was given by Chiang et al. All these algorithms involve a global sort of the critical points, a significant computational bottleneck. Unfortunately, lower bounds of Ω(t log t) also exist. We present the first algorithm that can avoid the global sort and has a refined time complexity that depends on the contour tree structure. Intuitively, if the tree is short and fat, we get significant improvements in running time. For a partition of the contour tree into a set of descending paths, P, our algorithm runs in O($\Sigma$ pϵP |p| log |p| + tα(t) + N). This is at most O(t log D + N), where D is the diameter of the contour tree. Moreover, it is O(tα(t) + N) for balanced trees, a significant improvement over the previous complexity. Our algorithm requires numerous ideas: partitioning the contour tree into join and split trees, a local growing procedure to iteratively build contour trees, and the use of heavy path decompositions for the time complexity analysis. There is a crucial use of a family of binomial heaps to maintain priorities, ensuring that any comparison made is between comparable nodes of the contour tree. We also prove lower bounds showing that the $\Sigma$ pϵP |p| log |p| complexity is inherent to computing contour trees.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

Analyzing Risks of Virtual Private Network Connections

The use of Splunk for analyzing VPN logs is an effective approach for identifying vulnerabilities in network endpoints. Splunk, a powerful platform for searching, monitoring, and analyzing machine-generated data, enables organizations to aggregate VPN logs in real-time, providing insights into network activity, user behavior, and potential security risks. By indexing VPN traffic and authentication logs, security teams can track abnormal patterns such as multiple failed login attempts, unusual IP addresses, or unexpected changes in bandwidth usage, all of which could indicate potential vulnerabilities or breaches. With Splunk’s advanced search and reporting capabilities, users can create custom dashboards and alerts to detect suspicious activities. Automated searches can flag endpoints exhibiting unusual behavior, while correlation analysis can identify links between compromised devices and broader network vulnerabilities. In particular, Splunk's machine learning capabilities can be leveraged to predict and prevent threats by identifying trends that might otherwise be missed in traditional log analysis. This proactive approach to monitoring VPN logs allows for the early detection of security weaknesses, enabling rapid response and minimizing potential damage to network integrity. By enhancing endpoint visibility, Splunk plays a crucial role in securing remote connections and safeguarding sensitive information. Additionally, Splunk’s automation and alerting features allow teams to create custom workflows that notify them of vulnerable or misconfigured endpoints identified through Shodan. This synergy between Splunk’s log analysis and Shodan’s device intelligence enhances an organization’s ability to proactively identify and mitigate security risks, improving the overall resilience of their VPN infrastructure.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2016

On the state of a solar active region before flares and CMEs

Several attempts have been made to find reliable diagnostic tools to determine the state prior to flares and related coronal mass ejections (CMEs) in solar active regions (ARs). Characterization of the level of mixed states is carried out using the Debrecen sunspot Data for 116 flaring ARs. Conditional flare probabilities (CFPs) are calculated for different flaring classes. The association with slow/fast CMEs is examined. Two precursor parameters are introduced: (i) the sum of the (daily averaged) horizontal magnetic gradient G {sub S} (G {sub DS}) and (ii) the separation parameter S{sub l−f}. We found that if S{sub l−f}⩽1 for a flaring AR then the CFP of the expected highest-intensity flare being X-class is more than 70%. If 1⩽S{sub l−f}⩽3 the CFP is more than 45% for the highest-intensity flare(s) to be M-class, and if 3⩽S{sub l−f}⩽13 there is larger than 60% CFP that C-class flare(s) may have the strongest intensity within 48 hr. Next, from analyzing G {sub S} for determining CFP we found: if 5.5⩽log(G{sub S}) ⩽ 6.5, then it is very likely that C-class flare(s) may be the most intense; if 6.5⩽log(G{sub S})⩽7.5 then there is ∼45% CFP that M-class could have the highest intensity; finally, if 7.5⩽log(G{sub S}) then there is at least 70% chance that the strongest energy release will be X-class in the next 48 hr. ARs are unlikely to produce X-class flare(s) if 13⩽S{sub l−f} and log(G {sub S}) ⩽ 5.5. Finally, in terms of providing an estimate of an associated slow/fast CME, we found that, if log(S{sub l−f}) ⩾ 0.4 or log(G{sub DS}) ⩽ 6.5, there is no accompanying fast CME in the following 24 hr.

79 ASTRONOMY AND ASTROPHYSICS↗

DOE OSTI2016

A new prescription for the mass-loss rates of WC and WO stars

We present a new empirical prescription for the mass-loss rates of carbon- and oxygen-sequence Wolf–Rayet stars as a function of their luminosity, surface chemical composition, and initial metallicity. The new prescription is based on results of detailed spectral analyses of WC and WO stars and improves the often applied Nugis and Lamers relation. We find that the mass-loss rates of WC and WO stars (with X = 0 and Y ≲ 0.98) can be expressed as log M-dot =−9.20+0.85log(L/L {sub ⊙}) + 0.44 log Y + 0.25 log (Z {sub Fe}/Z {sub Fe,⊙}). This relation is based on mass-loss determinations that assume a volume-filling factor of 0.1, but the prescription can easily be scaled to account for other volume-filling factors. The residual of the fit is σ = 0.06 dex. We investigated whether the relation can also describe the mass loss of hydrogen-free WN stars and showed that it can when an adjustment of the metallicity dependence (log M-dot ∝1.3log(Z{sub Fe}/Z{sub Fe,⊙})) is applied. Compared to that of Nugis and Lamers, M-dot is less sensitive to the luminosity and the surface abundance, implying a stronger mass loss of massive stars in their late stages of evolution. The modest metallicity dependence implies that if WC or WO stars are formed in metal-deficient environments, their mass-loss rates are higher than currently anticipated. These effects may result in the formation of a larger number of SNe Ic and fewer black holes and may favor the production of superluminous SNe Ic through interaction with C- and O-rich circumstellar material or dense stellar wind.

79 ASTRONOMY AND ASTROPHYSICS↗

DOE OSTI2022

The MASSIVE Survey. XVI. The Stellar Initial Mass Function in the Center of MASSIVE Early-type Galaxies

The stellar initial mass function (IMF) is a fundamental property in the measurement of stellar masses and galaxy star formation histories. In this work, we focus on the most massive galaxies in the nearby universe $\mathrm{log}({M}_{\star }/\,{M}_{\odot })\gt 11.2$. We obtain high-quality Magellan/LDSS-3 long-slit spectroscopy with a wide wavelength coverage of 0.4–1.01 μm for 41 early-type galaxies (ETGs) in the MASSIVE survey and derive high signal-to-noise spectra within an aperture of R e /8. Using detailed stellar synthesis models, we constrain the elemental abundances and stellar IMF of each galaxy through full spectral modeling. All the ETGs in our sample have an IMF that is steeper than a Milky Way (Kroupa) IMF. The best-fit IMF mismatch parameter, α IMF = (M/L)/(M/L) MW , ranges from 1.1 to 3.1, with an average of $\langle$α IMF $\rangle$ = 1.84, suggesting that on average, the IMF is more bottom heavy than Salpeter. Comparing the estimated stellar masses with the dynamical masses, we find that most galaxies have stellar masses that are smaller than their dynamical masses within the 1σ uncertainty. We complement our sample with lower-mass galaxies from the literature and confirm that $\mathrm{log}({\alpha }_{\mathrm{IMF}})$ is positively correlated with $\mathrm{log}(\sigma )$, $\mathrm{log}({M}_{\star })$, and $\mathrm{log}({M}_{\mathrm{dyn}})$. From the combined sample, we show that the IMF in the centers of more massive ETGs is more bottom heavy. In addition, we find that $\mathrm{log}({\alpha }_{\mathrm{IMF}})$ is positively correlated with both [Mg/Fe] and the estimated total metallicity [Z/H]. We find suggestive evidence that the effective stellar surface density Σ Kroupa might be responsible for the variation of α IMF . We conclude that σ, [Mg/Fe], and [Z/H] are the primary drivers of the global stellar IMF variation.

79 ASTRONOMY AND ASTROPHYSICS↗

DOE OSTI2022

CLEAR: The Ionization and Chemical-enrichment Properties of Galaxies at 1.1 < z < 2.3

We use deep spectroscopy from the Hubble Space Telescope Wide-Field-Camera 3 IR grisms combined with broadband photometry to study the stellar populations, gas ionization and chemical abundances in star-forming galaxies at z ~ 1.1–2.3. The data stem from the CANDELS Lyα Emission At Reionization (CLEAR) survey. At these redshifts, the grism spectroscopy measure the [O II] λλ3727, 3729, [O III]λλ4959, 5008, and Hβ strong emission features, which constrain the ionization parameter and oxygen abundance of the nebular gas. We compare the line-flux measurements to predictions from updated photoionization models (MAPPINGS V; Kewley et al.), which include an updated treatment of nebular gas pressure, $\mathrm{log}P/k={n}_{e}{T}_{e}$. Compared to low-redshift samples (z ~ 0.2) at fixed stellar mass, $\mathrm{log}{M}_{* }/{M}_{\odot }\,=$ 9.4–9.8, the CLEAR galaxies at z = 1.35 (1.90) have lower gas-phase metallicity, ${\rm{\Delta }}(\mathrm{log}Z)$ = 0.25 (0.35) dex, and higher ionization parameters, ${\rm{\Delta }}(\mathrm{log}q)$ = 0.25 (0.35) dex, where U ≡ q/c. We provide updated analytic calibrations between the [O III], [O II], and Hβ emission-line ratios, metallicity, and ionization parameter. The CLEAR galaxies show that at fixed stellar mass, the gas ionization parameter is correlated with the galaxy specific star formation rates, where ${\rm{\Delta }}\mathrm{log}q\simeq 0.4\times {\rm{\Delta }}(\mathrm{log}\,\mathrm{sSFR})$, derived from changes in the strength of galaxy Hβ equivalent width. We interpret this as a consequence of higher gas densities, lower gas covering fractions, combined with a higher escape fraction of H-ionizing photons. We discuss both tests to confirm these assertions and implications this has for future observations of galaxies at higher redshifts.

79 ASTRONOMY AND ASTROPHYSICS↗

DOE OSTI2022

CLASSY IV. Exploring UV Diagnostics of the Interstellar Medium in Local High- z Analogs at the Dawn of the JWST Era

The Cosmic Origins Spectrograph (COS) Legacy Archive Spectroscopic SurveY (CLASSY) provides the first high resolution spectral catalog of 45 local high-z analogs in the ultraviolet (UV; 1200–2000 Å) to investigate their stellar and gas properties. Here we present a toolkit of UV interstellar medium (ISM) diagnostics, analyzing the main emission lines of CLASSY spectra (N IV] λλ1483,87, C IV λλ1548,51, He IIλ1640, O III]λλ1661,6, Si III] λλ1883,92, C III] λ1907,9). Specifically, our aim is to provide accurate diagnostics for the reddening E(B - V), electron density n e , electron temperature T e , metallicity 12+log(O/H), and ionization parameter log(U), taking the different ISM ionization zones into account. We calibrate our UV toolkit using well-known optical diagnostics, analyzing archival optical spectra for all CLASSY targets. We find that UV density diagnostics estimate n e values that are ~1–2 dex higher (e.g., n e (C III] λλ1907,9) ~ 10 4 cm -3 ) than those inferred from their optical counterparts (e.g., n e ([S II]λλ6717,31) ~ 10 2 cm -3 ; n e ([Ar IV]λλ4714,41) ~ 10 3 cm -3 ). T e derived from the hybrid ratio [O III] λ1666/λ5007 proves to be reliable, implying differences in determining 12+log(O/H) compared to the optical counterpart O III] λ4363/[O III] λ5007 within ~ ±0.3 dex. We also investigate the relation between the stellar and gas E(B - V), finding consistent values at high specific star formation rates (sSFRs; log sSFR ≳ -8 yr -1 ), while at low sSFRs we confirmed an excess of dust attenuation in the gas. Finally, we investigate UV line ratios and equivalent widths to provide correlations with 12+log (O/H) and log(U), but note that there are degeneracies between the two. With this suite of UV-based diagnostics, we illustrate the pivotal role CLASSY plays in understanding the chemical and physical properties of high-z systems that JWST can observe in the rest-frame UV.

79 ASTRONOMY AND ASTROPHYSICS↗

DOE OSTI2026

The Stellar Mass Function for Nine Massive Galaxy Clusters in the Local Universe

We measure galaxy stellar mass functions (SMFs) for nine of the most massive galaxy clusters in the local Universe (0.07 < z < 0.11) using deep and complete spectroscopy from the MAssive Cluster Survey with Hectospec (MACH). We construct the cluster SMFs down to log (M * /M ⊙ ) ≳ 8.5. For comparison, we measure the SMF for field galaxies, complete to log (M * /M ⊙ ) ≳ 10.5, based on Sloan Digital Sky Survey spectroscopy over the same redshift range. The mean MACH SMF shows a shape similar to that of the field SMF but with a significantly higher amplitude at log (M * /M ⊙ ) < 11.4. At log (M * /M ⊙ ) > 11.4, the MACH SMF shows a clear excess, indicating the contribution of massive galaxies, including brightest cluster galaxies (BCGs). Based on homogeneous MACH spectroscopy, we compare SMF shapes for quiescent and star-forming members as a function of the cluster-centric distance. The quiescent SMFs display a curved shape with a peak at log (M * /M ⊙ ) ≈ 10.5; the star-forming SMFs decline monotonically with increasing stellar mass. We further compare the mean MACH SMF with SMFs derived from similarly massive clusters in the IllustrisTNG-300 simulations. The shape of the observed and simulated SMFs agrees well overall. However, the MACH clusters contain roughly a factor of 2 more galaxies at 9.0 < log (M * /M ⊙ ) < 10.5. These results demonstrate that constructing cluster SMFs from complete spectroscopic samples can test simulations and provide powerful constraints on galaxy formation and evolution in dense environments.

Park, Jong-In [Seoul National University (Korea, R↗

NASA NTRS1981

The high-excitation planetary nebulae: NGC 3918 and IC 2448

International Ultraviolet Exploration observations of NGC 3918 and IC 2448 are presented. Combining these observations with data in the optical range and computed model structure, the chemical composition for these objects is derived. For NGC 3918 log C = -3.02, log N = -3.61 and log 0 = -3.22; while for IC 2448 log C = -3.44, log N = -81 and log 0 = 3.54.

Torres-Peimbert, S.↗

NASA NTRS1987

The (C III lambda 1909/Si III lambda 1892) ratio as a diagnostic for planetary nebulae and symbiotic stars

Suitable IUE archival material on planetary nebulae has been examined to determine the log R /F(lambda 1909 C III)/F(lambda 1892 Si III)/ as a discriminant for distinguishing planetary nebulae from symbiotic stars and related objects. The mean value of log R for 73 galactic planetaries is 1.4, while that of extragalactic planetaries appears to be slightly lower, and that for symbiotics is 0.3. The lower value of log R for symbiotics is easily understood as a consequence of their higher densities. A plot of log R versus N-epsilon indicates that 80 percent of the planetaries fall into the range of log R between 1.2 and 1.8, but some of the 'peculiar' and bipolar nebulae fall below log R = 1.2. The corresponding N(C++)/N(Si++) ionic ratio varies over a large range.

Feibelman, Walter A.↗

NASA NTRS1993

Interpretation of gamma-ray burst source count statistics

Ever since the discovery of gamma-ray bursts, the so-called log N-log S relation has been used for determination of their distances and distribution. This task has not been straightforward because of varying thresholds for the detection of bursts. Most of the current analyses of these data are couched in terms of ambiguous distributions, such as the distribution of Cp/Clim, the ratio of peak to threshold photon count rates, or the distribution of V/Vmax = (Cp/Clim) exp -3/2. It is shown that these distributions are not always a true reflection of the log N-log S relation. Some kind of deconvolution is required for obtaining the true log N-log S. Therefore, care is required in the interpretation of results of such analyses. A new method of analysis of these data is described, whereby the bivariate distribution of Cp and Clim is obtained directly from the data.

Petrosian, Vahe↗

NASA NTRS1996

On the Rapid Computation of Various Polylogarithmic Constants

We give algorithms for the computation of the d-th digit of certain transcendental numbers in various bases. These algorithms can be easily implemented (multiple precision arithmetic is not needed), require virtually no memory, and feature run times that scale nearly linearly with the order of the digit desired. They make it feasible to compute, for example, the billionth binary digit of log(2) or pi on a modest workstation in a few hours run time. We demonstrate this technique by computing the ten billionth hexadecimal digit of pi, the billionth hexadecimal digits of pi-squared, log(2) and log-squared(2), and the ten billionth decimal digit of log(9/10). These calculations rest on the observation that very special types of identities exist for certain numbers like pi, pi-squared, log(2) and log-squared(2). These are essentially polylogarithmic ladders in an integer base. A number of these identities that we derive in this work appear to be new, for example a critical identity for pi.

Bailey, David H.↗

NASA NTRS2001

Properties of the Chandra Sources in M81

The Chandra X-ray Observatory obtained a 50-ks observation of the central region of M81 using the ACIS-S in imaging mode. The global properties of the 97 x-ray sources detected in the inner 8'.3 x 8'.3 field of M81 are examined. Roughly half the sources are concentrated within the central bulge. The remainder are distributed throughout the disk with the brightest disk sources lying preferentially along spiral arms. The average hardness ratios of both bulge and disk sources are consistent with power law spectra of index F approximates 1.6 indicative of a population of x-ray binaries. A group of much softer sources are also present. The background source- subtracted log(N)-log(S) distribution of the disk follows a power law of index about -0.5 with no change in slope over three decades in flux. The log(N)-log(S) distribution of the bulge follows a similar shape but with a steeper slope above about 4 x 10(exp 37) ergs/s. There is unresolved x-ray flux from the bulge with a radial profile similar to that of the bulge sources. This unresolved flux is softer than the average of the bulge sources and extrapolating the bulge log(N)-log(S) distribution towards weaker sources can only account for 20% of the unresolved flux. No strong time variability was observed for any source with the exception of one bright, soft source.

Tennant, Allyn F.↗

NASA NTRS2001

Properties of the Chandra Sources in M81

The Chandra X-Ray Observatory obtained a 50 ks observation of the central region of M81 using the ACIS-S in imaging mode. The global properties of the 97 X-ray sources detected in the inner 8.3' x 8.3' field of M81 are examined. Roughly half the sources are concentrated within the central bulge. The remainder are distributed throughout the disk, with the brightest disk sources lying preferentially along spiral arms. The average hardness ratios of both bulge and disk sources are consistent with power-law spectra of index Gamma equals approximately 1.6, indicative of a population of X-ray binaries. A group of much softer sources is also present. The background-source-subtracted log N-log S distribution of the disk follows a power law of index approximately -0.5 with no change in slope over three decades in flux. The log N-log S distribution of the bulge follows a similar shape but with a steeper slope above approximately 4 x 10(exp 37) ergs/s. There is unresolved X-ray flux from the bulge with a radial profile similar to that of the bulge sources. This unresolved flux is softer than the average of the bulge sources, and extrapolating the bulge log N-log S distribution toward weaker sources can account for only 20% of the unresolved flux. No strong time variability was observed for any source with the exception of one bright, soft source.

Tennant, Allyn F.↗

NASA NTRS2002

Coronal Heating and the Increase of Coronal Luminosity with Magnetic Flux

We present the observed scaling of coronal luminosity with magnetic flux in a set of quiet regions. Comparison of this with the observed scaling found for active regions suggests an underlying difference between coronal heating in active regions and quiet regions. From SOHO/EIT coronal images and SOHO/MDI magnetograms of four similar large quiet regions, we measure L(sub corona) and Phi(sub total) in random subregions ranging in area from about four supergranules [(70,000 km)(exp 2)] to about 100 supergranules [(0.5 R(sub sun))(exp 2)], where L(sub corona) is the luminosity of the corona in a subregion and Phi(sub total) is the flux content of the magnetic network in the subregion. This sampling of our quiet regions yields a correlation plot of Log L(sub corona) vs Log Phi(sub total) appropriate for comparison with the corresponding plot for active regions. For our quiet regions, the mean values of L(sub corona) and Phi(sub total) both increase linearly with area (simply because each set of subregions of the same area has very nearly the same mean coronal luminosity per unit area and mean magnetic flux per unit area), and in each constant-area set the values of L(sub corona) and Phi(sub total) 'scatter' about their means for that area. This results in the linear least-squares fit to the Log ((L (sub corona)), vs Log ((Phi (sub total)) plot having a slope somewhat less than one. If active regions mimicked our quiet regions in that all large sets of same-area active regions had the same mean coronal luminosity per unit area and same mean magnetic flux per unit area, then the least-squares fit to their Log((L (sub corona)) vs Log((Phi (sub total)) plot would also have a slope of less than one. Instead, the slope for active regions is 1.2. Given the observed factor of three scatter about the least-squares linear fit, this slope is consistent with Phi(sub total) on average increasing linearly with area (A) as in quiet regions, but L(sub corona) on average increasing as the volume (A(exp 1.5)) of the active region instead of as the area. This possibility is reasonable if the heating in active regions is a burning down of previously-stored coronal magnetic energy rather than a steady dissipation of energy flux from below as expected in quiet regions.

Moore, R. L.↗

NASA NTRS2019

Rest-Frame UV and Optical Emission Line Diagnostics of Ionized Gas Properties: a Test Case in a Star-Forming Knot of a Lensed Galaxy at Z ∼ 1.7

We examine the diagnostic power of rest-frame ultraviolet (UV) nebular emission lines, and compare them to more commonly used rest-frame optical emission lines, using the test case of a single star-forming knot of the bright lensed galaxy RCSGA 032727–132609 at redshift z ∼ 1.7. This galaxy has complete coverage of all the major rest-frame UV and optical emission lines from Magellan/MagE and Keck/NIRSPEC. Using the full suite of diagnostic lines, we infer the physical properties: nebular electron temperature (T(sub e)), electron density (n(sub e)), oxygen abundance (log (O/H), ionization parameter [log (q), and interstellar medium (ISM) pressure (log (P/k)]. We examine the effectiveness of the different UV, optical, and joint UV–optical spectra in constraining the physical conditions. Using UV lines alone we can reliably estimate log (q), but the same is difficult for log (O/H). UV lines yield a higher (∼1.5 dex) log (P/k) than the optical lines, as the former probes a further inner nebular region than the latter. For this comparison, we extend the existing Bayesian inference code IZI, adding to it the capability to infer ISM pressure simultaneously with metallicity and ionization parameter. This work anticipates future rest-frame UV spectral data sets from the James Webb Space Telescope (JWST) at high redshift and from the Extremely Large Telescope (ELT) at moderate redshift.

Acharyya, Ayan↗

DOE OSTI2018

Automated Behavior Analysis of Malware: A Case Study of WannaCry Ransomware

Ransomware, a class of self-propagating malware that uses encryption to hold the victims’ data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan [1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation. We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm’s feature extraction and provide analysis of the method’s robustness to variations of input data—changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) antivirus (AV) products fail.

Chen, Qian↗

DOE OSTI2018

Recurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly Detection

Automated analysis methods are crucial aids for monitoring and defending a network to protect the sensitive or confidential data it hosts. This work introduces a flexible, powerful, and unsupervised approach to detecting anomalous behavior in computer and network logs; one that largely eliminates domain-dependent feature engineering employed by existing methods. By treating system logs as threads of interleaved ``sentences'' (event log lines) to train online unsupervised neural network language models, our approach provides an adaptive model of normal network behavior. We compare the effectiveness of both standard and bidirectional recurrent neural network language models at detecting malicious activity within network log data. Extending these models, we introduce a tiered recurrent architecture, which provides context by modeling sequences of users' actions over time. Compared to isolation forests and Principal Components Analysis (PCA), two popular anomaly detection algorithms, we observe superior performance on the Los Alamos National Laboratory Cyber Security dataset. For log-line-level predictions, our best performing character-based model provides test set anomaly scores ranking red team events in the 98th percentile on average, and yields 0.97 area under the receiver operator characteristic curve, demonstrating the strong fine-grained anomaly detection performance of this approach on open vocabulary logging sources.

Cyber Analysis, Deep Learning, language analysis, ↗