1,721,082 research outputs found
Formal modelling and analysis of socio-technical systems
Get PDFAttacks on systems and organisations increasingly exploit human actors, for example through social engineering. This non-technical aspect of attacks complicates their formal treatment and automatic identification. Formalisation of human behaviour is difficult at best, and attacks on socio-technical systems are still mostly identified through brainstorming of experts. In this work we discuss several approaches to formalising socio-technical systems and their analysis. Starting from a flow logic-based analysis of the insider threat, we discuss how to include the socio aspects explicitly, and show a formalisation that proves properties of this formalisation. On the formal side, our work closes the gap between formal and informal approaches to socio-technical systems. On the informal side, we show how to steal a birthday cake from a bakery by social engineering
Going Beyond Counting First Authors in Author Co-citation Analysis
Get PDFThe present study examines one of the fundamental aspects of author co-citation analysis (ACA) - the way co-citation
counts are defined. Co-citation counting provides the data on which all subsequent statistical analyses and mappings
are based, and we compare ACA results based on two different types of co-citation counting - the traditional type that
only counts the first one among a cited work's authors on the one hand and a non-traditional type that takes into
account the first 5 authors of a cited work on the other hand. Results indicate that the picture produced through this non-traditional author co-citation counting contains more coherent author groups and is therefore considerably clearer. However, this picture represents fewer specialties in the research field being studied than that produced through the traditional first-author co-citation counting when the same number of top-ranked authors is selected and analyzed. Reasons for these effects are discussed
Modelling Socio-Technical Aspects of Organisational Security
Get PDFIdentification of threats to organisations and risk assessment often take into consideration the pure technical aspects, overlooking the vulnerabilities originating from attacks on a social level, for example social engineering, and abstracting away the physical infrastructure. However, attacks on organisations are far from being purely technical. After all, organisations consist of employees. Often the human factor appears to be the weakest point in the security of organisations. It may be easier to break through a system using a social engineering attack rather than a pure technological one. The StuxNet attack is only one of the many examples showing that vulnerabilities of organisations are increasingly exploited on different levels including the human factor. There is an urgent need for integration between the technical and social aspects of systems in assessing their security. Such an integration would close this gap, however, it would also result in complicating the formal treatment and automatic identification of attacks. This dissertation shows that applying a system modelling approach to sociotechnical systems can be used for identifying attacks on organisations, which exploit various levels of the vulnerabilities of the systems. In support of this claim we present a modelling framework, which combines many features. Based on a graph, the framework presents the physical infrastructure of an organisation, where actors and data are modelled as nodes in this graph. Based on the semantics of the underlying process calculus, we develop a formal analytical approach that generates attack trees from the model. The overall goal of the framework is to predict, prioritise and minimise the vulnerabilities in organisations by prohibiting the overall attack or at least increasing the difficulty and cost of fulfilling it. We validate our approach using scenarios from IPTV and Cloud Infrastructure case studies
Variations on the Author
Get PDF“Variations on the Author” discusses two of Eduardo Coutinho’s recent films (Um Dia na Vida, from 2010, and Últimas Conversas, posthumously released in 2015) and their contribution to the general question of documentary authorship. The director’s filmography is characterized by a consistent yet self-effacing form of authorial self-inscription: Coutinho often features as an interviewer that rather than express opinions propels discourses; an interviewer that is good at listening. This mode of self-inscription characterizes him as an author who is not expressive but who is nonetheless markedly present on the screen. In Um Dia na Vida, however, Coutinho is completely absent form the image, while Últimas Conversas, on the contrary, includes a confessional prologue that moves the director from the margins to the center of his films. This article examines the ways in which these works stand out in the filmography of a director who offers new insights into the notion of cinematic authorship
Stack allocation of objects in the CACAO virtual machine
No full textStack allocation of objects reduces the cost of object allocation and garbage collection and can thus lead to large reductions in runtime. Escape analysis can statically determine which objects are eligible to stack allocation by examining the escape behavior of allocation sites. If objects created at a particular allocation site do not escape, i.e., are guaranteed not to leave the scope of the allocation site, stack allocation instead of expensive heap allocation can be applied.
We have implemented a lightweight and fast escape analysis within the CACAO Java Virtual Machine to enable stack allocation. The analysis proceeds in two stages: an intraprocedural analysis computes escape information for each allocation site within a single method and builds call-context agnostic summary information for the method. The summary information is then used during interprocedural analysis to capture the escape behavior of method arguments. The computed escape information is finally used to allocate a subset of thread-local Java objects on the call stack.
The implementation has been evaluated using the SPEC JVM98 and the dacapo benchmark suites. For the SPEC benchmarks up to 90% of all objects allocated at runtime can be allocated on the call stack, leading to a speed up of up to 69%. The more complex dacapo benchmarks still show speedups of up to 10%, with up to 20% of all objects being allocated on the stack
Appropriate Similarity Measures for Author Cocitation Analysis
Get PDFWe provide a number of new insights into the methodological discussion about author cocitation analysis. We first argue that the use of the Pearson correlation for measuring the similarity between authors’ cocitation profiles is not very satisfactory. We then discuss what kind of similarity measures may be used as an alternative to the Pearson correlation. We consider three similarity measures in particular. One is the well-known cosine. The other two similarity measures have not been used before in the bibliometric literature. Finally, we show by means of an example that our findings have a high practical relevance.information science;Pearson correlation;cosine;similarity measure;author cocitation analysis
Choose the red pill and the blue pill: a position paper
No full textIn the movie "The Matrix," our hero Neo must choose between taking the Blue Pill and continuing to live in an online, synthesized fantasy world, or taking the Red Pill and joining the real world. The fantasy world appears to those living in it to be full of flowers and trees and big steak dinners, but unknown to them contains malicious Agents who can alter any portion of the world to suit their needs. The real world, in turn, while real, has no visible sun, and the people have only gray mush for food.
Authorization and authentication of online transactions across a network requires a trusted path between the user and the server. We posit that those who attempt to solve this problem by creating the trusted path on the general-purpose operating system have taken the Blue Pill and are living in a fantasy world. One simply cannot properly secure a general-purpose operating system.
Solving the problem by taking the Red Pill and completely replacing currently used operating systems with ones that we can properly secure does not seem palatable. We suggest a solution that involves taking both the Blue Pill and the Red Pill: providing the trusted path by means of a separate device with a secure operating system, used in tandem with the existing general purpose operating system. Most user interaction occurs on the un-trusted system, with the secure device only being used to finalise transactions.
We believe that the technology required for such a device is readily available. Obviously our idea is not a completely novel idea; prior work in the area has had a similar goal. However, most of those attempts have not properly addressed the requirements for the trusted system, generally preferring to use existing general-purpose systems even when on a "dedicated device." [Balfanz 1999] [Kingpin 2001] Others have a very limited scope of use. [Blakely 2004].
We identify a minimum set of requirements for the trusted device. This paper does not provide a working solution (it is a position paper after all); we simply define how one should approach that working solution. Because we advocate a hybrid system it is possible to simplify the trusted system to a point where it would not be usable as a general purpose system, which should make the trusted system rather easier to build and have confidence in
Dispelling the Myths Behind First-author Citation Counts
Get PDFWe conducted a full-scale evaluative citation analysis study of scholars in the XML research field to explore just how different from each other author rankings resulting from different citation counting methods actually are, and to demonstrate the capability of emerging data and tools on the Web in supporting more realistic citation counting methods. Our results contest some common arguments for the continued
use of first-author citation counts in the evaluation of scholars, such as high correlations between author rankings by first-author citation counts and other citation
counting methods, and high costs of using more realistic citation counting methods that are not well-supported by the ISI databases. It is argued that increasingly available digital full text research papers make it possible for citation analysis studies to go beyond what the ISI databases have directly supported and to employ more
sophisticated methods
- …
