Intrusion Detection Systems (IDSs) are security tools widely used in computer networks. While they seem to be promising technologies, they pose some serious drawbacks: When utilized in large and high traffic networks, IDSs generate high volumes of low-level ALERTs which are hardly manageable. Accordingly, there emerged a recent track of security research, focused on ALERT CORRELATION, which extracts useful and high-level ALERTs, and helps to make timely decisions when a security breach occurs.In this paper, we propose an ALERT CORRELATION system consisting of two major components; first, we introduce an Attack Scenario Extraction Algorithm (ASEA), which mines the stream of ALERTs for attack scenarios. The ASEA has a relatively good performance, both in speed and memory consumption. Contrary to previous approaches, the ASEA combines both prior knowledge as well as statistical relationships. Second, we propose a Hidden Markov Model (HMM)-based CORRELATION method of intrusion ALERTs, red from different IDS sensors across an enterprise. We use HMM to predict the next attack class of the intruder, also known as plan recognition. This component has two advantages: Firstly, it does not require any usage or modeling of network topology, system vulnerabilities, and system configurations; Secondly, as we perform high-level prediction, the model is more robust against over- fitting. In contrast, other published plan-recognition methods try to predict exactly the next attacker action.We applied our system to DARPA 2000 intrusion detection scenario dataset.The ASEA experiment shows that it can extract attack strategies efficiently.We evaluated our plan-recognition component both with supervised and unsupervised learning techniques using DARPA 2000 dataset. To the best of our knowledge, this is the first unsupervised method in attack-plan recognition.

ALERT CORRELATION systems attempt to discover the relations among ALERTs produced by one or more intrusion detection systems to determine the attack scenarios and their main motivations. In this paper a new IDS ALERT CORRELATION method is proposed that can be used to detect attack scenarios in real-time.The proposed method is based on a causal approach due to the strength of causal methods in practice. To provide a picture of the current intrusive activity on the network, we need a real-time ALERT CORRELATION. Most causal methods can be deployed offline but not in real-time due to time and memory limitations. In the proposed method, the knowledge base of the attack patterns is represented in a graph model called the Causal Relations Graph. In the offline mode, we construct Queue trees related to ALERTs' probable CORRELATIONs. In the real-time mode, for each received ALERT, we can find its CORRELATIONs with previously received ALERTs by performing a search only in the corresponding tree.Therefore, the processing time of each ALERT decreases significantly. In addition, the proposed method is immune to deliberately slowed attacks. To verify the proposed method, it was implemented and tested using DARPA2000 dataset.Experimental results show the correctness of the proposed ALERT CORRELATION and its efficiency with respect to the running time.

Acute kidney injury (AKI) is increasingly prevalent in developing and developed countries and is associated with severe morbidity and mortality. Most etiologies of AKI can be prevented by interventions at the individual, community, regional and in-hospital levels. Effective measures must include community-wide efforts to increase an awareness of the devastating effects of AKI and provide guidance on preventive strategies, as well as early recognition and management. Efforts should be focused on minimizing causes of AKI, increasing awareness of the importance of serial measurements of serum creatinine in high risk patients, and documenting urine volume in acutely ill people to achieve early diagnosis, there is as yet no definitive role for alternative biomarkers. Protocols need to be developed to systematically manage prerenal conditions and specific infections. More accurate data about the true incidence and clinical impact of AKI will help to raise the importance of the disease in the community, increase awareness of AKI by governments, the public, general and family physicians and other health care professionals to help prevent the disease. Prevention is the key to avoid the heavy burden of mortality and morbidity associated with AKI.

The main purpose of the political systems from establishing and providing a license to the security institutions is to use these intelligence activities to protect policy makers from the loss of security or security threats. In this regard, the main philosophy of the intelligence cycle is to warn against future anti-security events; on this basis, intelligence defeat is defined as surprise and unpredictable crisis. The purpose of this study is to explain the 'optimal warning cycle' in intelligence – security activities and to answer the main question of “ what stages form the optimal warning cycle? ” . In order to answer this question, this study uses library study and the Delphi method in three phases and the idea of 7 experts in intelligence and security field to reach a theoretical stability and consensus. As a result, the proposed optimal cycle was formed with five peripheral stages: need assessment, warning, vigilance and prevention and a connecting core in the form of assessment and production of 'knowledge'.