Class of 2014 Abstract / Specific Aims: To identify reasons that an angiotensin converting enzyme inhibitor (ACEi) would not be indicated in diabetic patients with repeated clinical alerts to add ACEi therapy for preservation of renal function and/or hypertension. In addition, to identify if these repeated clinical alerts to add ACEi therapy are appropriate. Methods: Eligible patient charts were reviewed by researchers using a data dictionary to complete a standardized spreadsheet with patient demographic information (age, gender, and location), type of diabetes mellitus, evidence indicative of comorbid hypertension, action taken by pharmacist in response to clinical alert (letter sent to patient and letter sent to prescriber), and rationale of that action. This data, along with SOAP notes of patient interactions, was used by researchers to classify the repeated clinical alert as appropriate or inappropriate. Main Results: There were a total of 200 charts reviewed (male n = 61 (30.5%), female n = 139 (69.5%), mean age = 70 ± 11 years). Reasons for not contacting patients again include previous failure or adverse drug reaction (n = 62, 31.0%), patient did not meet call script requirements (n = 55, 27.5%), patient did not have diabetes or hypertension (n = 20, 10.0%), potential drug-disease interaction (n = 17, 8.5%), overlapping or previously addressed alerts (1.9%), or documentation was provided for “other” reasons (n = 43, 21.5%). The previous failure or adverse drug reaction rationale was appropriate in 32 of 62 repeated clinical alerts (52%; χ2= 10.15). The patient did not have diabetes or hypertension rationale was appropriate in 11 of 20 repeated clinical alerts (55%, χ2= 2.72). The potential drug-disease interaction rationale was appropriate in 3 of 17 repeated clinical alerts (8%, χ2= 9.89). The patient did not meet call script requirements rationale was appropriate in 31 of 55 repeated clinical alerts (56%, χ2= 6.91). The overlapping or previous alerts rationale was appropriate in 2 of 3 repeated clinical alerts (67%, χ2= 0.18). The “other” rationale were appropriate in 22 of 43 repeated clinical alerts (51%, χ2= 7.21) Overall, retrigger alerts were considered appropriate 50.5% of the time compared to the predicted value of 90% (χ2= 347 > critical value = 3.84 for p = 0.05 Conclusion: There are multiple reasons pharmacists do not recommend initiating ACEi therapy in patients with diabetes. Although the Medication Management Center (MMC) has rationale of these reasons documented after individual patient interactions, there are still several reasons why a retrigger alert would be appropriate despite that rationale. In addition, retrigger alerts were not considered appropriate as frequently as expected.

Dans les systèmes d'informations, les outils de détection produisent en continu un grand nombre d'alertes.Des outils de corrélation permettent de réduire le nombre d'alertes et de synthétiser au sein de méta-alertes les informations importantes pour les administrateurs.Cependant, la complexité des règles de corrélation rend difficile leur écriture et leur maintenance.Cette thèse propose par conséquent une méthode pour générer des règles de corrélation de manière semi-automatique à partir d’un scénario d’attaque exprimé dans un langage de niveau d'abstraction élevé.La méthode repose sur la construction et l'utilisation d’une base de connaissances contenant une modélisation des éléments essentiels du système d’information (par exemple les nœuds et le déploiement des outils de détection). Le procédé de génération des règles de corrélation est composé de différentes étapes qui permettent de transformer progressivement un arbre d'attaque en règles de corrélation.Nous avons évalué ce travail en deux temps. D'une part, nous avons déroulé la méthode dans le cadre d'un cas d'utilisation mettant en jeu un réseau représentatif d'un système d'une petite entreprise.D'autre part, nous avons mesuré l'influence de fautes touchant la base de connaissances sur les règles de corrélation générées et sur la qualité de la détection. / Information systems produce continuously a large amount of messages and alerts. In order to manage this amount of data, correlation system are introduced to reduce the alerts number and produce high-level meta-alerts with relevant information for the administrators. However, it is usually difficult to write complete and correct correlation rules and to maintain them. This thesis describes a method to create correlation rules from an attack scenario specified in a high-level language. This method relies on a specific knowledge base that includes relevant information on the system such as nodes or the deployment of sensor. This process is composed of different steps that iteratively transform an attack tree into a correlation rule. The assessment of this work is divided in two aspects. First, we apply the method int the context of a use-case involving a small business system. The second aspect covers the influence of a faulty knowledge base on the generated rules and on the detection.

Network monitoring systems generate a high number of alerts reporting on anomalies and suspicious activity of IP addresses. From a huge number of alerts, only a small fraction is high priority and relevant from human evaluation. The rest is likely to be neglected. Assume that by analyzing large sums of these low priority alerts we can discover valuable information, namely, coordinated IP addresses and type of alerts likely to be correlated. This knowledge improves situational awareness in the field of network monitoring and reflects the requirement of security analysts. They need to have at their disposal proper tools for retrieving contextual information about events on the network, to make informed decisions. To validate the assumption new method is introduced to discover groups of coordinated IP addresses that exhibit temporal correlation in the arrival pattern of their events. The method is evaluated on real-world data from a sharing platform that accumulates 2.2 million alerts per day. The results show, that method indeed detected truly correlated groups of IP addresses.

With the thriving technology and the great increase in the usage of computer networks, the risk of having these network to be under attacks have been increased. Number of techniques have been created and designed to help in detecting and/or preventing such attacks. One common technique is the use of Network Intrusion Detection / Prevention Systems NIDS. Today, number of open sources and commercial Intrusion Detection Systems are available to match enterprises requirements but the performance of these Intrusion Detection Systems is still the main concern. In this paper, we have tested and analyzed the performance of the well know IDS system Snort and the new coming IDS system Suricata. Both Snort and Suricata were implemented on three different platforms (ESXi virtual server, Linux 2.6 and FreeBSD) to simulate a real environment. Finally, in our results and analysis a comparison of the performance of the two IDS systems is provided along with some recommendations as to what and when will be the ideal environment for Snort and Suricata.

The only way to simplify and promote the effective use of an alerting system that must be comprehensive in its coverage of hazardous or non-normal conditions is to convey top level information that provides an indication of criticality and identity. In order to prevent the continued proliferation of aural alerting signals presented in the flight deck, a simple aural alert categorization scheme that provides flight deck function and urgency level information was proposed and evaluated in this study. Specifically, the present investigation examined the ability of a population having "normal" hearing to: 1) distinguish among four sets of aural alerting signals having distinctive rhythmic patterns and pitch contours, 2) perceive three urgency levels having distinctive tempos within each alerting set, and 3) associate each alerting set and its related urgency levels with one of the four major flight deck functions. Magnitude estimation ratings revealed that subjects perceived differences between low urgency level alerts and moderate urgency level alerts and between low urgency level alerts and high urgency level alerts. Pair comparison ratings of similarity revealed that subjects differentiated among the four within of the alerting sets relatively well after participating in a brief training session. alerting sets. A sound identification task revealed that subjects were able to associate functional categories with four aural alerting sets and were also able to simultaneously distinguish among and perceive three urgency levels within each of the alerting sets relatively well after participating in a brief training session. / Master of Science

Procrastination is a pervasive problem in education. In computer science, procrastination and lack of necessary time management skills to complete programming projects are viewed as primary causes of student attrition. The most effective techniques known to reduce procrastination are resource-intensive and do not scale well to large classrooms. In this thesis, we examine three course interventions designed to both reduce procrastination and be scalable for large classrooms. Reflective writing assignments require students to reflect on their time management choices and how these choices impact their classroom performance. Schedule sheets force students to plan out their work on an assignment. E-mail alerts inform students of their current progress as they work on their projects, and provide ideas on improving their work behavior if their progress is found to be unsatisfactory. We implemented these interventions in a junior-level course on data structures. The study was conducted over two semesters and 330 students agreed to participate in the study. Data collected from these students formed the basis of our analysis of the interventions. We found a statistically significant relationship between the time a project was completed and the quality of that work, with late work being of lower quality. We also found that the e-mail alert intervention had a statistically significant effect on reducing the number of late submissions. This result occurred despite students responded negatively to the treatment. / Master of Science

abstract: Highly automated vehicles require drivers to remain aware enough to takeover during critical events. Driver distraction is a key factor that prevents drivers from reacting adequately, and thus there is need for an alert to help drivers regain situational awareness and be able to act quickly and successfully should a critical event arise. This study examines two aspects of alerts that could help facilitate driver takeover: mode (auditory and tactile) and direction (towards and away). Auditory alerts appear to be somewhat more effective than tactile alerts, though both modes produce significantly faster reaction times than no alert. Alerts moving towards the driver also appear to be more effective than alerts moving away from the driver. Future research should examine how multimodal alerts differ from single mode, and see if higher fidelity alerts influence takeover times. / Dissertation/Thesis / Masters Thesis Human Systems Engineering 2018

Man has a limited ability to accurately and continuously analyse large amounts of data. Observers are typically required to monitor displays over extended periods and to execute overt detection responses to the appearance of low probability critical signals. The signals are usually clearly perceivable when observers are alerted to them, but they can be missed in the operating environment. The challenge is to develop a computer application that will accumulate information on a variable, or several variables, over time and identify when the trend in observations has changed. In recent years, there has been a rapid growth in patient monitoring and medical data analysis using decision support systems, smart alarm monitoring systems, expert systems and many other computer aided protocols. The expert systems have the potential to improve clinician performance by accurately executing repetitive tasks, to which humans are ill-suited. Anaesthetists working in the operating theatre are responsible for carrying out a multitude of tasks which requires constant vigilance and thus a need for a smart decision support system has arisen. The decision support tools capable of detecting pathological events can enhance the anaesthetist’s performance by providing alternative diagnostic information. The main goal of this research was to develop a clinically useful diagnostic alarm system using two different techniques for monitoring a pathological event during anaesthesia. Several techniques including fuzzy logic, artificial neural networks, control and monitoring techniques were explored. Firstly, an industrial monitoring system called Supervisory Control and Data Acquisition (SCADA) software is used and implemented in the form of a prototype system called SCADA monitoring system (SMS). The output of the system in detecting hypovolaemia was classified into three levels; mild, moderate and severe using SCADA’s InTouch software. In addition, a new GUI display was developed for direct interaction with the anaesthetists. Secondly, a fuzzy logic monitoring system (FLMS) was developed using the fuzzy logic technique. New diagnostic rules and membership functions (MF) were developed using MATLAB. In addition, fuzzy inference system FIS, adaptive neuro fuzzy inference system ANFIS and clustering techniques were explored for developing the FLMS’s diagnostic modules. The raw physiological patient data acquired from an S/5 monitor were converted to a readable format using the DOMonitor application. The data was filtered, preprocessed, and analysed for detecting anaesthesia related events like hypovolaemia. The accuracy of diagnoses generated by SMS and FLMS was validated by comparing their diagnostic information with the one provided by the anaesthetist for each patient. Kappa-analysis was used for measuring the level of agreement between the anaesthetist’s, SMS’s, and FLMS’s diagnoses. In offline analysis both systems were tested with data from 15 patients. The SMS and FLMS achieved an overall agreement level of 87 and 88 percent respectively. It implies substantial level of agreement between SMS or FLMS and the anaesthetists. These diagnostic alarm systems (SMS and FLMS) have shown that evidence-based expert diagnostic systems can diagnose hypovolaemia, with a substantial degree of accuracy, in anaesthetized patients and could be useful in providing decision support to anaesthetists.

Man has a limited ability to accurately and continuously analyse large amounts of data. Observers are typically required to monitor displays over extended periods and to execute overt detection responses to the appearance of low probability critical signals. The signals are usually clearly perceivable when observers are alerted to them, but they can be missed in the operating environment. The challenge is to develop a computer application that will accumulate information on a variable, or several variables, over time and identify when the trend in observations has changed. In recent years, there has been a rapid growth in patient monitoring and medical data analysis using decision support systems, smart alarm monitoring systems, expert systems and many other computer aided protocols. The expert systems have the potential to improve clinician performance by accurately executing repetitive tasks, to which humans are ill-suited. Anaesthetists working in the operating theatre are responsible for carrying out a multitude of tasks which requires constant vigilance and thus a need for a smart decision support system has arisen. The decision support tools capable of detecting pathological events can enhance the anaesthetist’s performance by providing alternative diagnostic information. The main goal of this research was to develop a clinically useful diagnostic alarm system using two different techniques for monitoring a pathological event during anaesthesia. Several techniques including fuzzy logic, artificial neural networks, control and monitoring techniques were explored. Firstly, an industrial monitoring system called Supervisory Control and Data Acquisition (SCADA) software is used and implemented in the form of a prototype system called SCADA monitoring system (SMS). The output of the system in detecting hypovolaemia was classified into three levels; mild, moderate and severe using SCADA’s InTouch software. In addition, a new GUI display was developed for direct interaction with the anaesthetists. Secondly, a fuzzy logic monitoring system (FLMS) was developed using the fuzzy logic technique. New diagnostic rules and membership functions (MF) were developed using MATLAB. In addition, fuzzy inference system FIS, adaptive neuro fuzzy inference system ANFIS and clustering techniques were explored for developing the FLMS’s diagnostic modules. The raw physiological patient data acquired from an S/5 monitor were converted to a readable format using the DOMonitor application. The data was filtered, preprocessed, and analysed for detecting anaesthesia related events like hypovolaemia. The accuracy of diagnoses generated by SMS and FLMS was validated by comparing their diagnostic information with the one provided by the anaesthetist for each patient. Kappa-analysis was used for measuring the level of agreement between the anaesthetist’s, SMS’s, and FLMS’s diagnoses. In offline analysis both systems were tested with data from 15 patients. The SMS and FLMS achieved an overall agreement level of 87 and 88 percent respectively. It implies substantial level of agreement between SMS or FLMS and the anaesthetists. These diagnostic alarm systems (SMS and FLMS) have shown that evidence-based expert diagnostic systems can diagnose hypovolaemia, with a substantial degree of accuracy, in anaesthetized patients and could be useful in providing decision support to anaesthetists.

Com o crescimento das redes de computadores e, principalmente, de sua importância para as organizações, o gerenciamento de redes tornou-se fundamental. Contudo, o gerenciamento de redes é um processo difícil dada sua complexidade e mudanças freqüentes em sua configuração. O ideal seria que sistemas pudessem fazer o trabalho de administradores de redes, reduzindo com isso a sobrecarga de trabalho dos administradores, ou seja, essas pessoas poderiam realizar outras tarefas enquanto o sistema ficaria gerenciando a rede. O principal objetivo deste trabalho é propor um paradigma que, à medida que seja constatada a ocorrência de algum problema na rede, se tenha um módulo com inteligência suficiente para diagnosticá-lo, determinando porque aquele problema ocorreu. O trabalho descreve um sistema especialista para a gerência de redes que integrado com um sistema de registro de problemas. Módulos especializados, orientados à análise de aspectos específicos do comportamento da rede, efetuam uma análise das características e do status da mesma, filtrando eventos e tentando prover resposta automatizada e/ou recomendações sobre cursos de ação para as anormalidades percebidas. Portanto, com esse objeto, definiu-se um sistema denominado MAD (Módulo de Automatização de Diagnóstico), no qual são definidas regras para diagnosticar os problemas ocorridos e também tentar prover ao usuário a maior qualidade de serviço possível. Este sistema efetua monitorações diárias sobre objetos da MIB II (Management Information Base) para tentar localizar os problemas da rede e então gerar alertas ao administrador da rede dependendo de sua gravidade. Este trabalho é um sub-projeto do projeto CINEMA (Cooperative Integrated Network Management). No projeto CINEMA, foram especificados módulos de manuseio de registros de problemas numa base de dados (Sistema de Trouble Ticket) e uma plataforma básica para configurar a obtenção de informações sobre a rede - acesso a objetos gerenciados (Sistema de Alertas). O MAD atua como um integrador entre esses dois sistemas, filtrando eventos e gerando alertas ao administrador da rede na forma de um trouble ticket, isto é, um registro de problemas. A validação deste sistema foi realizada através da implementação de um protótipo. O protótipo utiliza o protocolo SNMP (Simple Network Management Protocol) para fazer polling em objetos da MIB II de determinados componentes da rede. Sua implementação foi 661 para que se pudesse fazer o refinamento das regras, tornando-as mais de acordo com a rede monitorada. / With the growth of computer networks and, mainly, of its importance to organizations, the management of networks has become fundamental. However, network management is a hard process given its complexity and its frequent configuration changes. The ideal would be if the systems could play the role of network managers, thus reducing the job overload from the managers. It means that these managers could perform other tasks while the system manages the network itself. The main objective of this work is to propose a paradigm so that, as any trouble is found in the network, a module intelligent enough to diagnose this problem will identify the reason why that has occurred. The work describes an intelligent system for network management which is integrated to a trouble ticket system. Specialized modules, directed to the analysis of specific aspects of the network behavior, bring about an analysis of its characteristics and status, filtering events and trying to supply an automated answer and/or advices about action paths to deal with the abnormalities. Therefore, with this goal, a system called MAD (Diagnosis Automatization Module) has been defined, in which rules to diagnose the most common troubles are specified and that tries to supply the user with a quality of services as higher as possible. This system executes daily monitoration on MIB II (Management Information Base) objects trying to locate the troubles in the network and then generating alerts to the network manager depending on its severity. This work is a sub-project for the project CINEMA (Cooperative Integrated Network Management). The project CINEMA specified modules of trouble ticket handling in a database (Trouble Ticket System) and a basic platform to configure the acquisition of information about the network - access to managed objects (Alerts System). MAD acts as an integrator between these two systems, filtering events and generating alerts to the network administrator in the form of a trouble ticket. The validation of this system has been done through the implementation of a prototype. The prototype uses the SNMP protocol (Simple Network Management Protocol) to do polling in MIB II objects located in certain network components. Its implementation has been useful to refine the rules, making them fit the network under management.