DriftInsight: Detecting Anomalous Behaviors in Large-Scale Cloud Platform

The navigational safety of ships on waterways plays a crucial role in ensuring the operational efficiency of ports. Ship anomalous behavior detection is an important method of water traffic surveillance that can effectively identify abnormal ship behavior, such as sudden acceleration or deceleration. In order to detect potential anomalous ship behavior in real time, a method for ship anomalous behavior detection in waterways is proposed based on text similarity and kernel density estimation. Under the assumption of known traffic patterns entering and leaving the port, this method can identify ship behaviors that violate traffic patterns in real time. Firstly, kernel density estimation is applied to construct a traffic pattern density model for ship trajectories entering and leaving the port, used to estimate the density values of ship motion states. Simultaneously, a semantic transformation method is used to convert traffic pattern trajectory into pattern trajectory text, which is used to identify the ship’s traffic pattern. Subsequently, the historical trajectory data of the target ship are transformed into textual trajectories, and text similarity is used to identify ship inbound and outbound traffic patterns. Furthermore, the constructed traffic pattern density model is used to estimate real-time density values of the state of ship motion, and the trajectory points that exceed the threshold of the anomaly factor are marked as anomalies. Finally, the effectiveness of the proposed method is validated using simulation data, and the results indicate an accuracy of more than 90% for the comprehensive detection of anomalous behavior. This study, approaching the detection of potential ship anomalous behavior from the perspective of port traffic patterns, enriches the methods of ship anomalous behavior detection in port waterways.

The behavior of dynamic component (slow component) and steady component of the frog glossopharyngeal nerve response to CaCl2, measured in number of impulses firing per second, was examined under various conditions. 1) The magnitude of the dynamic component increased with the flow rate below about 0.3 ml/s, whereas that of the steady component was independent of the flow rate. 2) The magnitude of the dynamic component increased with a rise of temperature between 2.5 and 20 degrees C, whereas that of the steady component was practically independent of temperature. Removal of Ca2+ from the receptor membrane yielded a large dynamic component even at 2.5 degrees C. 3) The treatment of the tongue with procaine led to a large reduction in the magnitude of the dynamic component, whereas the effect of procaine on the steady component was not pronounced. 4) The magnitude of the dynamic component varied with the pH of the stimulating solution, whereas that of steady component was practically independent of a pH between 4.5 and 7.5. The above results were well interpreted by the following reaction scheme: S (stimulus + A (receptor domain) in equilibrium (SA)active in equilibrium (SA) inactive where (SA) active and (SA) inactive are active and inactive complexes.

Cloud services are offered to consumers based on Service Level Agreements (SLAs) signed between Cloud Service Provider (CSP) and consumer. Due to on-demand provisioning of resources there is exponential growth of cloud consumers. Job scheduling is one of the areas that has attracted researchers to improve performance of cloud management system. Along with the on premise infrastructure, Small and Medium Enterprises (SMEs) also depend on public cloud infrastructure (leading to hybrid cloud) for seamless continuity of their businesses. In this context, ensuring SLAs and effective management of hybrid cloud resources are major challenging issues to be considered. Hence, there is a need for an effective scheduling algorithm which considers multiple objective functions like SLA (deadline), cost and energy while making scheduling decisions. Most of the state of the art schedulers in hybrid cloud environment considered single objective function. However, in real world, it is inadequate for scheduling effectiveness. To overcome this problem, we proposed an integrated framework which ensures SLAs (deadline), cost effectiveness and energy efficiency with an underlying scheduling algorithm known as SCE-TS. This algorithm is evaluated with different workloads and SLAs using a cloud platform. The empirical study revealed that the proposed framework improves scheduling efficiency in terms of meeting SLAs, cost and energy efficiency. It is evaluated and compared with the state of the art and found to be effective in making scheduling decisions in cloud environment.

The onset of Web 3.0 has catalyzed the rapid advancement of social networking, transforming platforms into essential elements deeply embedded within the fabric of daily life. Researchers have proposed several methods for detecting anomalous behaviors in various scenarios. This article provides a comprehensive review of current research and the latest developments in anomalous behavior detection within social networks. We present a hierarchical three-layer categorization scheme based on the distinct characteristics of base-level detection technologies and various datasets. First, anomaly detection based on user behavioral characteristics can intuitively reflect deviations in individual behavior. However, it may overlook the overall network structure’s impact. Second, detecting anomalies within a network’s topological structure highlights structural significance, but may overlook the subtle nuances of individual behavior. Finally, the coordinated fusion method, which blends individual behavioral characteristics and the network’s topological structure, addresses the multifaceted nature of anomalies, yielding a more thorough and accurate anomaly detection strategy. This paper provides an overview and assesses the performance of three anomaly detection methods. Furthermore, we explore the challenges associated with social network anomaly detection and the potential pathways for further research.

Mobile networks and smart phones have become ubiquitous in our daily life. Large amount of customer related telecom data from various sources are generated every day, from which diversified behavior patterns can be revealed, including some anomalous behaviors that are vicious. It becomes increasingly important to achieve both efficient and effective customer behavior analysis based on the telecom big data. In this paper, the Multi-faceted Telecom Customer Behavior Analysis (MTCBA) framework for anomalous telecom customer behavior detection and clustering analysis is proposed. In this framework, we further design the hierarchical Locality Sensitive Hashing-Local Outlier Factor (hierarchical LSH-LOF) scheme for suspicious customer detection, and the Autoencoders with Factorization Machines (FM-AE) structure for dimension reduction to achieve more efficient clustering. Hierarchical LSH-LOF is an improved algorithm of LOF, in which we design a hierarchical LSH process that selects the approximate k nearest neighbors from coarse to fine by gradually narrowing down the scope. Experiments show its superiority over KD-tree w.r.t searching speed. FM-AE exploits Factorization Machines for learning second order feature interactions, which we prove to be useful by designing comparative experiments with five dimension reduction algorithms. With the proposed MTCBA framework, efficient and effective telecom customer behavior analysis including anomalous customer behavior detection and clustering analysis is performed on the real world telecom operating data provided by one of the major Internet service providers (ISPs) in China. Meanwhile, interpretable clustering results of six clusters are obtained to provide valuable information for the precision marketing of telecom operators, criminal combating, and social credit system construction.

Application automatic deployment is an important prerequisite for migration existing application to cloud platform and has become an important factor. From the user's actual needs, we designed and implemented for the automated deployment SLA (Service-Level Agreement) private cloud platform based on the VMware IaaS (Infrastructure as a Service) cloud platform. Meanwhile, to meet the specific needs of different users, the platform introduced service level agreements, allowed the user to customize the QoS requirement to apply for service composition. Multi-stage decision algorithm is used for virtual machine placement policy to maintain the service-level. Finally, the experiment verifies the usability of the platform and the effectiveness of the virtual machine placement algorithm.

Internal employees have always been at the core of organizational security management challenges. Once an employee exhibits behaviors that threaten the organization, the resulting damage can be profound. Therefore, analyzing reasonably stored behavioral data can equip managers with effective threat monitoring and warning solutions. Through data-mining, a knowledge graph for internal threat data is deduced, and models for detecting anomalous behaviors and predicting resignations are developed. Initially, data-mining is employed to model the knowledge ontology of internal threats and construct the knowledge graph; subsequently, using the behavioral characteristics, the BP neural network is optimized with the Sparrow Search Algorithm (SSA), establishing a detection model for anomalous behaviors (SBP); additionally, behavioral sequences are processed through data feature vectorization. Utilizing SBP, the LSTM network is further optimized, creating a predictive model for employee behaviors (SLSTM); ultimately, SBP detects anomalous behaviors, while SLSTM predicts resignation intentions, thus enhancing detection strategies for at-risk employees. The integration of these models forms a comprehensive threat detection technology within the organization. The efficacy and practicality of detecting anomalous behaviors and predicting resignations using SBP and SLSTM are demonstrated, comparing them with other algorithms and analyzing potential causes of misjudgment. This work has enhanced the detection efficiency and update speed of abnormal employee behaviors, lowered the misjudgment rate, and significantly mitigated the impact of internal threats on the organization.

Anomalous behaviors in social networks can lead to privacy leaks and the spread of false information. In this paper, we propose an anomalous behavior detection method based on optimized graph embedding representation. Specifically, the user behavior logs are first extracted into a social network user behavior temporal knowledge graph, based on which the graph embedding representation method is used to transform the network topology and temporal information in the user behavior knowledge graph into structural embedding vectors and temporal information embedding vectors, and the hybrid attention mechanism is used to merge the two types of vectors to obtain the final entity embedding to complete the prediction and complementation of the temporal knowledge graph of user behavior. We use graph neural networks, which use the temporal information of user behaviors as a time constraint and capture both user behavioral and semantic information. It converts the two parts of information into vectors for concatenation and linear transformation to obtain a comprehensive representation vector of the whole subgraph, as well as joint deep learning models to evaluate abnormal behavior. Finally, we perform experiments on the Yelp dataset to validate that our method achieves a 9.56% improvement in the F1-score.

Enterprise Messaging is a very popular message exchange concept in asynchronous distributed computing environments. The Enterprise Messaging Servers are heavily used in building business critical Enterprise applications such as Internet based Order processing systems, pricing distribution of B2B, geographically dispersed enterprise applications. It is always desirable that Messaging Servers exhibit high performance to meet the Service Level Agreements (SLAs). There are investigations in this area of managing the performance of the distributed computing systems in different ways such as the IT administrators configuring and tuning the Messaging Servers parameters, implement complex conditional programming to handle the workload dynamics. But in practice it is extremely difficult to handle such dynamics of changing workloads in order to meet the performance requirements. Additionally it is challenging to cater to the future resource requirements based on the future workloads. Though there have been attempts to self-regulate the performance of Enterprise Messaging Servers, there is a limited investigation done in exploring feedback control systems theory in managing the Messaging Servers performance. We propose an adaptive control based solution to not only manage the performance of the servers to meet SLAs but also to pro-actively self-regulate the performance such that the Messaging Servers are capable to meet the current and future workloads. We implemented and evaluated our solution and observed that the control theory based solution will improve the performance of Enterprise Messaging Servers significantly.

As the second most visited website globally, YouTube serves as a central platform for video sharing, entertainment, and information dissemination. However, its expansive and highly active user base also facilitates problematic behavior, particularly among commenters. This study presents a methodology driven by social network analysis to detect and examine anomalous commenter behaviors, with a specific focus on commenter mobs that collaborate to artificially manipulate engagement metrics on videos. Additionally, the study seeks to characterize YouTube channels based on the prevalence of such behaviors, uncovering patterns of coordination among channels. The analysis utilizes a dataset comprising 47 YouTube channels, 26,901 videos, 1,377,902 commenters, and 2,496,558 comments, including 20 channels involved in disseminating misleading information about the U.S. Military and 27 additional channels, which serve as a control group to provide a baseline for normal behavior, helping to distinguish between anomalous and non-anomalous patterns more clearly. The methodology compares principal component analysis (PCA) with Graph2vec and uniform manifold approximation and projection (UMAP), in conjunction with K-means and hierarchical clustering, to identify and categorize anomalous behaviors across channels. Through comprehensive qualitative and quantitative analyses, the study identifies the themes of the videos where these anomalous behaviors occurred in comment sections. These findings provide valuable insights into the dynamics of online discourse and the mechanisms by which coordinated groups influence content and engagement on YouTube.

Business process anomalous behavior detection reveals unexpected cases from event logs to ensure the trusted operation of information systems. Anomaly behavior is mainly identified through a log-to-model alignment analysis or numerical outlier detection. However, both approaches ignore the influence of probability distributions or activity relationships in process activities. Based on this concern, this paper incorporates the behavioral relationships characterized by the process model and the joint probability distribution of nodes related to suspected anomalous behaviors. Moreover, a Petri Net-Based Bayesian Network (PN-BBN) is proposed to detect anomalous behaviors based on the probabilistic inference of behavioral contexts. First, the process model is filtered based on the process structure of the process activities to identify the key regions where the suspected anomalous behaviors are located. Then, the behavioral profile of the activity is used to prune it to position the ineluctable paths that trigger these activities. Further, the model is used as the architecture for parameter learning to construct the PN-BBN. Based on this, anomaly scores are inferred based on the joint probabilities of activities related to suspected anomalous behaviors for anomaly detection under the constraints of control flow and probability distributions. Finally, PN-BBN is implemented based on the open-source frameworks PM4PY and PMGPY and evaluated from multiple metrics with synthetic and real process data. The experimental results demonstrate that PN-BBN effectively identifies anomalous process behaviors and improves the reliability of information systems.

There are ample of research work on the detection of anomalies in the area of cyber security. However, only a few of them focus on physical access security. Physical access control, including employee and guest access and management system, supervised doors or location, surveillance camera, are critical checkpoints of a premise in terms of security monitoring. Breaches of these checkpoints can cause serious damage, where an insider or an outsider (e.g. through social engineering) may gain access to sensitive areas of the premise and may further result in data leakage or disruptions of services. In this paper, we characterise users based on their physical movement behavior and job profile in order to identify users with anomalous physical access behaviour using an unsupervised machine learning algorithm known as the Two Step clustering method. We further evaluate the type of risk posed by these users by comparing the user's behaviour with its peer group and observing a set of rule-based metrics. The framework is then being compared with other recent approaches for anomaly detection of physical access logs. Lastly, this framework is deployed in a real-world environment and successfully assisted in the detection of anomalous physical access behaviour.

Airports are critical infrastructures that require special protection. Public spaces are considered vulnerable areas and a possible target for general crime as well as terrorism. Because of the latest terrorist attacks which targeted vulnerable areas in airports, it is essential to test proactive methods capable of helping to detect potential threats. In this context, there are also other illicit activities closely related to civil air transport, which must also be addressed. First, we propose a theoretical framework to explain the presence and detection of anomalous behaviors. Therefore, in this research, we start by analyzing the behavior of airport users (N = 352) in terms of “patterns of movement,” “patterns of communication,” indicators activated by the autonomic nervous system, and object adaptors. The results show significant differences in both movement and communication patterns between those who commit illegal acts and those who do not. No significant differences were found related to indicators coming from the autonomous nervous system or the object adaptors. Six significant behaviors account for the 49% of the variance in those who commit illegal activities. Three significant behaviors account for the 19% of the variance in those who possess background records.

<div align="center"><span>Efficient scheduling algorithms are necessary in the cloud paradigm to optimize service provision to clients while minimizing time duration, energy consumption, and violations of service level agreements (SLAs). Disregarding task appropriateness in resource scheduling can have a detrimental effect on the quality of service provided by cloud providers. Moreover, the utilization of resources in an ineffective manner will necessitate a substantial expenditure of energy to execute activities, leading to prolonged processing duration that adversely affect the temporal duration. Many research projects have focused on employment scheduling problems, and the algorithms used in these studies have offered answers that were deemed nearly flawless. This study presents a chaos bird swarm algorithm (Chaos BSA) approach that use machine learning to consider task priority while allocating tasks to the cloud platform. The method calculates the priorities of task virtual machines and incorporates these values into the scheduler. The scheduler will select tasks that align with the specified priorities and are compatible with the virtual machines. The implementation of the system utilized the openstack cloud platform and the cloudsim tool. The results and comparison with the baseline approach genetic algorithm (GA), ant colony optimization (ACO), and particle swarm optimization (PSO) clearly demonstrate that our Chaos BSA outperforms them by 18% in terms of efficiency.</span></div>

Cloud Computing provides higher level services and shared pools of configurable resources with minimal management effort over the internet. Cloud Computing achieves coherence and economic of scale by means of shared resources. The growth of cloud computing depends on the high availability of low cost computers, storage devices and networks as well as hardware virtualization and utility computing. Service Level Agreement (SLA) is a service commitment tool between a cloud service provider and a cloud customer. Using SLA in cloud computing, reduce the chances of disappointing the cloud customer and manage the expectation between the service provider and the customer. The challenge is, it is very difficult to handle all request by the cloud providers at a time during peak hours and to keep up SLA. So when there is an uneven request arrival pattern, the cloud resources may either be underutilized or over-utilized. In order to balance the load, the load balancer plays the major role in cloud computing. The load balancing algorithm equalizes the workload and computing resources in a cloud computing environment. It allows an organization to manage their workload demands by allocating resources among multiple servers and thus it minimizes the response time, minimize the waiting time, maximize the throughput time, maximize the resource utilization and minimize the communication delays of the server by meeting the SLA. The major goal of this study is to review both the existing static and dynamic load balancing algorithms proposed till now and to design and implement a Load balancer that uses a Meta Heuristics approach – Ant Colony Optimization technique to perform balancing the load so that the SLA is met evenly without any issues. Each of the load balancing algorithms is compared with other algorithms theoretically and experimentally one of it is tested with the proposed system using AWS Cloud PaaS (Platform as a Service).