Visualizing Automatically Detected Periodic Network Activity

Malware frequently leaves periodic signals in network logs, but these signals are easily drowned out by non-malicious periodic network activity, such as software updates and other polling activity. This paper describes a novel algorithm based on Discrete Fourier Transforms capable of detecting multiple distinct period lengths in a given timeseries. We pair the output of this algorithm with aggregation summary tables that give users information scent about which detections are worth investigating based on the metadata of the log events rather than the periodic signal. A visualization of selected detections enables users to see all detected period lengths per entity, and compare detections between entities to check for coordinated activity. We evaluate our approach on real-world netflow and DNS data from a large organization, demonstrating how to successfully find malicious periodic activity in a large pool of noise and non-malicious periodic activity.

Multi-Agent-Based Information Retrieval System Using Information Scent in Query Log Mining for Effective Web Search

This chapter explains the multi-agent system for effective information retrieval using information scent in query log mining. The precision of search results is low due to difficult to infer the information need of the small size search query and therefore information need of the user is not satisfied effectively. Information Scent is used for modeling the information need of user web search session and clustering is performed to identify the similar information need sessions. Hyper Link-Induced Topic Search (HITS) is executed on clusters to generate the Hubs and authorities for web page recommendations to users who search with similar intents. This multi-agent system based on clustered query sessions uses query operations like expansion and recommendation to infer the information need of user search queries and recommends Hubs and authorities for effective web search.

Heuristics elements of information-seeking strategies and tactics: a conceptual analysis

Purpose The purpose of this paper is to elaborate the picture of strategies and tactics for information seeking and searching by focusing on the heuristic elements of such strategies and tactics. Design/methodology/approach A conceptual analysis of a sample of 31 pertinent investigations was conducted to find out how researchers have approached heuristics in the above context since the 1970s. To achieve this, the study draws on the ideas produced within the research programmes on Heuristics and Biases, and Fast and Frugal Heuristics. Findings Researchers have approached the heuristic elements in three major ways. First, these elements are defined as general level constituents of browsing strategies in particular. Second, heuristics are approached as search tips. Third, there are examples of conceptualizations of individual heuristics. Familiarity heuristic suggests that people tend to prefer sources that have worked well in similar situations in the past. Recognition heuristic draws on an all-or-none distinction of the information objects, based on cues such as information scent. Finally, representativeness heuristic is based on recalling similar instances of events or objects and judging their typicality in terms of genres, for example. Research limitations/implications As the study focuses on three heuristics only, the findings cannot be generalized to describe the use of all heuristic elements of strategies and tactics for information seeking and searching. Originality/value The study pioneers by providing an in-depth analysis of the ways in which the heuristic elements are conceptualized in the context of information seeking and searching. The findings contribute to the elaboration of the conceptual issues of information behavior research.

Multi-Agent-Based Information Retrieval System Using Information Scent in Query Log Mining for Effective Web Search

This chapter explains the multi-agent system for effective information retrieval using information scent in query log mining. The precision of search results is low due to difficult to infer the information need of the small size search query and therefore information need of the user is not satisfied effectively. Information Scent is used for modeling the information need of user web search session and clustering is performed to identify the similar information need sessions. Hyper Link-Induced Topic Search (HITS) is executed on clusters to generate the Hubs and authorities for web page recommendations to users who search with similar intents. This multi-agent system based on clustered query sessions uses query operations like expansion and recommendation to infer the information need of user search queries and recommends Hubs and authorities for effective web search.