The correlation of several events in a period of time is a necessity for a threat detection platform. In the case of multistep attacks (attacks characterized by a sequence of executed commands), it allows detecting the different steps one by one and correlating them to raise an alert. It also allows detecting abnormal behaviors on the IT system, for example, multiple suspicious actions performed by the same account. The correlation of security events increases the security of the system and reduces the number of false positives. The correlation of the events is made thanks to pre- existing correlation rules. The goal of this thesis is to evaluate the feasibility of using a correlation engine based on Apache Spark. There is a necessity of changing the actual correlation system because it is not scalable, it cannot handle all the incoming data and it cannot perform some types of correlation like aggregating the events by attributes or counting the cardinality. The novelty is the improvement of the performance and the correlation capacities of the system. Two systems are proposed for correlating events in this project. The first one is based on Apache Spark Structured Streaming and analyzed the flow of security logs in real- time. As the results are not satisfactory, a second system is implemented. It uses a more traditional approach by storing the logs into an Elastic Search cluster and does correlation queries on it. In the end, the two systems are able to correlate the logs of the platform. Nevertheless, the system based on Apache Spark uses too many resources by correlation rule and it is too expensive to launch hundreds of correlation queries at the same time. For those reasons, the system based on Elastic Search is preferred and is implemented in the workflow. / Korrelation av flera händelser under en viss tidsperiod är en nödvändighet för plattformen för hotdetektering. När det gäller attacker i flera steg (attacker som kännetecknas av en sekvens av utförda kommandon) gör det möjligt att upptäcka de olika stegen ett efter ett och korrelera dem för att utlösa en varning. Den gör det också möjligt att upptäcka onormala beteenden i IT- systemet, t.ex. flera misstänkta åtgärder som utförs av samma konto. Korrelationen av säkerhetshändelser ökar systemets säkerhet och minskar antalet falska positiva upptäckter. Korrelationen av händelserna görs tack vare redan existerande korrelationsregler. Målet med den här avhandlingen är att utvärdera genomförbarheten av en korrelationsmotor baserad på Apache Spark. Det är nödvändigt att ändra det nuvarande korrelationssystemet eftersom det inte är skalbart, det kan inte hantera alla inkommande data och det kan inte utföra vissa typer av korrelation, t.ex. aggregering av händelserna efter attribut eller beräkning av kardinaliteten. Det nya är att förbättra systemets prestanda och korrelationskapacitet. I detta projekt föreslås två system för korrelering av händelser. Det första bygger på Apache Spark Structured Streaming och analyserade flödet av säkerhetsloggar i realtid. Eftersom resultaten inte var tillfredsställande har ett andra system införts. Det använder ett mer traditionellt tillvägagångssätt genom att lagra loggarna i ett Elastic Searchkluster och göra korrelationsförfrågningar på dem. I slutändan kan de två systemen korrelera plattformens loggar. Det system som bygger på Apache Spark använder dock för många resurser per korrelationsregel och det är för dyrt att starta hundratals korrelationsförfrågningar samtidigt. Av dessa skäl föredras systemet baserat på Elastic Search och det implementeras i arbetsflödet.

In dieser Arbeit wird eine unrestricted Coupled-Cluster CC2 Response-Methode für die Berechnung von Eigenschaften erster und zweiter Ordnung, mit dem elektronischen g-Tensor als Schwerpunkt, präsentiert. Lokale Korrelations- und Dichtefittingnäherungen wurden verwendet. Die fundamentalen Konzepte notwendig für das Verständnis von Coupled-Cluster-Theorie, Dichtefitting, lokaler Korrelation, allgemeinen Coupled-Cluster Eigenschaften und dem elektronischen g-Tensor werden diskutiert. Die berechneten g-Tensoren werden mit denen durch Coupled-Cluster Singles and Doubles, Dichtefunktionaltheorie und Experiment erhaltenen verglichen. Effizienz und Genauigkeit der Näherung wird untersucht. Ein detailierter Anhang beschreibt die diagrammatische Coupled-Cluster-Theorie sowie ihre Anwendung zur Herleitung der verwendeten Arbeitsgleichungen. Die in dieser Arbeit entwickelte Methode ermöglicht es, den elektronischen g-Tensor von ausgedehnten Systemen mit einer Methode, die nicht auf Dichtefunktionaltheorie basiert, quantitativ vorherzusagen. Damit ist sie ein wichtiger Schritt hin zur Entwicklung von niedrig skalierenden Coupled-Cluster-Methoden höherer Ordnung für diese Art von Problem. / This work presents an unrestricted coupled-cluster CC2 response method using local correlation and density fitting approximations for the calculation of first and second order properties with particular focus on the electronic g-tensor. The fundamental concepts related to coupled-cluster theory, density fitting, local correlation, general coupled-cluster properties and the electronic g-tensor are discussed. The calculated g-tensors are benchmarked against those obtained from coupled-cluster singles and doubles, density functional theory and experiment. Efficiency and accuracy of the approximations is investigated. A detailed appendix covers the fundamentals of diagrammatic coupled-cluster and its application to the derivation of the working equations. The method presented in this thesis enables the quantitative prediction of the electronic g-tensor of extended systems with a method other than density functional theory. It represents an important step towards the development of low-scaling higher order coupled-cluster methods for this type of problem.

In dieser Arbeit wird eine unrestricted Coupled-Cluster CC2 Response-Methode für die Berechnung von Eigenschaften erster und zweiter Ordnung, mit dem elektronischen g-Tensor als Schwerpunkt, präsentiert. Lokale Korrelations- und Dichtefittingnäherungen wurden verwendet. Die fundamentalen Konzepte notwendig für das Verständnis von Coupled-Cluster-Theorie, Dichtefitting, lokaler Korrelation, allgemeinen Coupled-Cluster Eigenschaften und dem elektronischen g-Tensor werden diskutiert. Die berechneten g-Tensoren werden mit denen durch Coupled-Cluster Singles and Doubles, Dichtefunktionaltheorie und Experiment erhaltenen verglichen. Effizienz und Genauigkeit der Näherung wird untersucht. Ein detailierter Anhang beschreibt die diagrammatische Coupled-Cluster-Theorie sowie ihre Anwendung zur Herleitung der verwendeten Arbeitsgleichungen. Die in dieser Arbeit entwickelte Methode ermöglicht es, den elektronischen g-Tensor von ausgedehnten Systemen mit einer Methode, die nicht auf Dichtefunktionaltheorie basiert, quantitativ vorherzusagen. Damit ist sie ein wichtiger Schritt hin zur Entwicklung von niedrig skalierenden Coupled-Cluster-Methoden höherer Ordnung für diese Art von Problem. / This work presents an unrestricted coupled-cluster CC2 response method using local correlation and density fitting approximations for the calculation of first and second order properties with particular focus on the electronic g-tensor. The fundamental concepts related to coupled-cluster theory, density fitting, local correlation, general coupled-cluster properties and the electronic g-tensor are discussed. The calculated g-tensors are benchmarked against those obtained from coupled-cluster singles and doubles, density functional theory and experiment. Efficiency and accuracy of the approximations is investigated. A detailed appendix covers the fundamentals of diagrammatic coupled-cluster and its application to the derivation of the working equations. The method presented in this thesis enables the quantitative prediction of the electronic g-tensor of extended systems with a method other than density functional theory. It represents an important step towards the development of low-scaling higher order coupled-cluster methods for this type of problem.

Bakgrund: Aktiemarknaden är viktig för att företag ska kunna samla kapital och möjligheten för investerare att få avkastning. Utländskt ägande är betydande, vilket ökar likviditeten men samtidigt sårbarheten. Valutakurser påverkar aktiemarknaden, särskilt för exportföretag. En svag krona gör svenska investeringar mer attraktiva och gynnar exporten. Sambandet mellan valutakurser, aktiemarknaden och utländskt ägande är viktigt för investerare. Syfte: Studiens syfte är att undersöka det dynamiska sambandet mellan valutakurser, utländskt ägande och den svenska aktiemarknaden. Dessutom avser den att beskriva om det går att förutse marknadsrörelser med hjälp av valutakurserna. Metod: Studien använder sig av kvantitativ metod och använder sig av Pearson korrelationsanalys samt multipel regression. Teori: Studien utgår från effektiva marknadshypotesen och behavioral finance.  Slutsatser: Det visade sig att 4 av 5 valutor har en signifikant korrelation till OMXSPI, där den norska kronan är den enda som saknar samband. Korrelationen är dock för svag för att kunna säga att den kan hjälpa till att förutsäga rörelser i aktiekursen. Samtliga valutor har ingen korrelation med det utländska ägandet. Därför går det inte heller att med hjälp av valutorna förutsäga förändringar i det utländska ägandet på marknaden. / Background:The stock market is important for companies to raise capital and an opportunity for investors to get returns. Foreign ownership is significant, which increases liquidity but at the same time volatility. Exchange rates affect the stock market, especially for export companies. A weak krona makes Swedish investments more attractive and favors exports. The relationship between exchange rates, the stock market and foreign ownership is important to investors. Purpose: The purpose of the study is to investigate the dynamic relationship between exchange rates, foreign ownership and the Swedish stock market. In addition, it intends to see if it is possible to predict market movements using the exchange rates. Methodology: In this study a quantitative method is used in the form of Pearson's correlation analysis and multiple regression analysis.  Theory: The study is based on the efficient market hypothesis and behavioral finance. Conclusions: It turned out that 4 out of 5 currencies have a significant correlation to OMXSPI, with the Norwegian krone being the only one without correlation. However, the correlation is too weak to say that it can help predict movements in the share price. All currencies have no correlation with foreign ownership. Therefore, it is also not possible to use the currencies to predict changes in foreign ownership in the market.

Syfte och frågeställningar. Syftet med studien är att, hos äldre personer, över 65 år, samt hos yngre vuxna, mellan 20-30 år, jämföra syreupptagningsförmågan med två olika metoder, fem-minuterspyramidtest (5MPT) samt VO2max-test på löpband. Vid båda mätmetoderna används direkt syrgasmätning. Metod. Totalt deltog 36 personer i studien, varav 17 äldre personer 65 till 85 år (9 kvinnor och 8 män) samt 19 yngre med en ålder mellan 20 till 35 år (10 kvinnor och 9 män). Deltagarnas syreupptagningsförmåga mättes under 5MPT vid två tillfällen som sedan jämfördes med VO2max mätt via ett maximalt test på löpband vid ett tillfälle. Således utfördes sammanlagt tre mätningar med direkt syrgasmätning, via andningsmask, under ett maximalt löpbandstest samt under två separata tester av 5MPT med minst 48 timmar mellan varje testtillfälle. Utandningsluften analyserades sedan, vid 5MPT för alla, via det trådlösa portabla systemet Jaeger Oxycon Mobile och vid test på löpband för testgruppen med yngre deltagare. För den testgrupp med äldre deltagare användes, vid testet på löpband, den fasta on-line-utrustningen Jaeger Oxycon Pro som är en liknande mätmetod för syreupptag. 5MPT är ett fem minuter långt test där individen från golvnivå, med högsta möjliga tempo, förflyttar sig fram och tillbaka på en 5,50 meter lång sträcka med en centralt placerad trappramp som är pyramidformad och med en högsta central höjd på 0,62 meter. Resultat. Det primära fyndet i studien var att en stark signifikant korrelation (r = 0,99) visade sig mellan direkt uppmätt VO2max under maximalt test på löpband gentemot syreupptagningsförmågan vid 5MPT då båda åldersgrupperna var sammanslagna, uppmätt i l·min–1. Slutsats. Då det i undersökningen visades en stark signifikant korrelation mellan direkt uppmätt VO2max vid 5MPT och ett maximalt test på löpband i l·min–1 för äldre och yngre vuxna ger det indikationer på att 5MPT kan används som en tillförlitlig metod vid undersökning och uppföljning av en persons aeroba förmåga. Fyndet kan vara av värde då det genom mindre kostsamma och enklare metoder går att få ett mått på en persons hälsa i form av aerob kapacitet, vilket är betydelsefullt ur flera hälsoaspekter på individ- och samhällsnivå. / Aim. The purpose of the study was to investigate the results and correlation between oxygen uptake levels (VO2max) at five-minute pyramid test (5MPT) against maximal oxygen uptake test (VO2max) on a treadmill test, both measured by direct oxygen measurement, in elderly people over 65 years and younger adults aged 20-30 years. Method. A total of 36 people participated in the study, 17 elderly people aged between 65 to 85 years (9 women and 8 men) and 19 younger adults aged between 20 to 35 years (10 women and 9 men). The participants' oxygen uptake was measured twice during 5MPT and then compared with VO2max measured by a maximal treadmill test at one occasion. Thus a total of three measurements with direct oxygen measurement, via the breathing mask, during a maximum treadmill test and two separate tests of 5MPT with at least 48 hours between each test. The exhaled air was analyzed at 5MPT for all, through the wireless portable system Jaeger Oxycon Mobile and also during the test on treadmill for the test group with younger participants. The test group of older participants, got their exhaled air analyzed through a stationary on-line equipment Jaeger Oxycon Pro instead of the portable system which is a similar reliable method to measure VO2max. 5MPT is a five minute test where the subjects from floor level, with the highest possible speed, moves back and forth at a measured distance of 5.50 meter with a central staircase ramp, which is pyramid-shaped, with a maximum center height of 0.62 meters. Results. The main finding of the study was that there was a strong significant correlation (r = 0.99) between directly measured VO2max during a maximum treadmill test compared to oxygen uptake at 5MPT when both the elderly people and the younger adults were combined, measured in l·min–1. Conclusion. The study showed a strong significant correlation between directly measured VO2max at 5MPT and a maximal treadmill testing l·min–1 for older and younger adults. This indicates that 5MPT can be used as a reliable method for investigation and monitoring a person’s aerobic capacity. This finding may be of value because it shows that less expensive and easier methods can be used to measure a person's health in terms of aerobic capacity, which is important from several aspects of health at both the individual and society level.

Die vorliegende Arbeit untersucht elektronische Korrelationseffekte in Realsubstanzen wie Europium-Sulphid (EuS) und Gadolinium-Nitrid (GdN). Es wird dazu eine Kombination von vielteilchentheoretischen Analysen der Spin-Austauschwechselwirkung zwischen itineranten Bandelektronen und lokalisierten 4f-Momenten, durchgefuehrt im Rahmen eines Mehr-Band-Kondo-Gitter-Modells (KLM), mit first-principles (T=0) Bandstrukturrechnungen vorgeschlagen. Die Ein-Teilchen-Energien (hopping-Integrale), die als Energie-Matrix in den Mehr-Band-Hamilton-Operator eingehen, werden einer TB-LMTO-ASA entnommen. Die interessierenden physikalischen Eigenschaften wie die Quasiteilchen-Spektraldichte und die Quasiteilchen-Zustandsdichte werden mit der Bewegu-ngsgleichungs-Methode Greencher Funktionen berechnet. Dazu wird fuer die gesuchte Mehr-Band-Selbstenergie der itinerantenLadungstraeger als Verallgemeinerung des sogenannten Interpolating Selfenergy Approach (ISA) ein Ansatz vorgeschlagen. Es stellt sich heraus, dassdas elektronische Anregungsspektrum durch die Austausch-Kopplung an das lokalisierte Momenten-System eine spektakulaere Temperaturabhaengigkeit aufweist, in Uebereinstimmung mit vorliegenden experimentellen Beobachtungen. Stark temperaturbestimmte Korrelationseffekte werden registriert, z.B. eine mit fallender Temperatur in der ferromagnetischen Phase auftretende Rotverschiebung der unteren Leitungsbandkante in guter Uebereinstimmung mit experimentellen Daten. Um die reinen f-Spin-Korrelationen zu beschreiben, wird eine modifizierte RKKY-Theorie fuer Mehr-Band-Systeme entwickelt, wobei durch Ausmitteln der elektronischen Freiheitsgrade das Mehr-Band KLM auf ein effektives Heisenberg-Modell abgebildet wird. Mit einer RPA-Theorie wird das effektive Heisenberg-Modell auf Aussagen zu zentralen magnetischen Eigenschaften wie Curie-Temperatur und Magnetisierungskurve analysiert. Durch gezielte Variation der Systemparameter wird die Brauchbarkeit des Modells getestet. / This dissertation deals with a combination of many-body evaluation of a spin exchange interaction between the itinerant electrons and localized 4f moments on a periodic lattice, i.e. within the so-called multi-band Kondo lattice model (KLM), and the T=0 first principles calculations in order to study the electronic correlation effects in real materials like Europium Sulphide (EuS) and Gadolinium Nitride (GdN).The single-particle ground state energy or hopping integral acting as an input in the many-body part is obtained using tight binding linear muffin-tin orbital within atomic sphere approximation (TB-LMTO-ASA) program and is a matrix in general. The physical properties of interest like the quasi-particle spectral density and quasi-particle density of states are calculated within the Green function theory and the equation of motion method. In order to do so the required multi-band self-energy of the band electrons istaken as an ansatz, i.e. the so-called interpolating self-energy approach (ISA). The electronic excitation spectrum gets a striking temperature dependence by its exchange coupling to the localized spin system. We observe very strong temperature dependent electronic correlation effects in GdN and the calculated red-shift of the lower conduction band is in close comparison with experiment. In order to determine the pure f-spin correlations, we develop the multi-band modified RKKY theory. The central idea of this theory beingto average out the itinerant electron degrees of freedom from the spin-exchange interaction and map the latter on to an effective Heisenberg model. Using this procedure, we determine the magnetic properties of the system like Curie temperature (within Random Phase Approximation) while calculating the chemical potential and magnetization within a self consistent scheme for various configurations of system parameters.

<p><em>Background:</em> The international accounting standard regarding goodwill gives opportunities to several accounting procedure choices, as goodwill is a complex, intangible asset. The valuation of goodwill affects equity/asset ratio and income statement, which gives that the stakeholders’ impression of the group’s financial statement is affected by the valuation of this asset. It has been pointed out that difficult economic times bring impairment loss to the fore. During financial crisis, equity/asset ratio may be significant as the economy of the groups is expected to be strained.</p><p><em>Purpose:</em> The purpose of this essay is to explain the appearance of the possible relationship between a group’s impairment loss for goodwill and their equity/asset ratio, during financial straits. Watts and Zimmerman’s debt/equity hypothesis serve as the starting point for our study. This hypothesis expresses, ceteris paribus, that the larger debt/equity ratio, the more likely it is to select accounting procedures that shift reported earnings from future periods to the current period. According to the hypothesis there should be a positive relationship between a group’s equity/asset ratio and their percentage share of goodwill impairment loss. A high equity/asset ratio would motivate a higher impairment loss for goodwill, as a lower equity/asset ratio would induce a lower impairment loss.</p><p><em>Method:</em> We decided to investigate all groups with the parent company listed on Nasdaq OMX Stockholm within the sectors financials and industrials. In financials, banks were excluded. The data was collected from annual reports of 2008 and was analyzed with the statistical analyzing methods correlation and regression.</p><p><em>Result/conclusion:</em> For those industrial groups which have had impairment loss for goodwill, the result is in accordance with Watts and Zimmerman’s hypothesis. A strong positive linear relationship could be found for those groups, but not for the sector as a whole. The equity/asset ratio therefore seems to not affect the decision of whether to lose impairment or not, but when the decision is made, the ratio of equity/asset seems to affect the size of the impairment loss. Within the financial sector, no relationship could be found – neither for the groups which have had impairment loss nor the sector as a whole.</p>

<p><strong>Purpose</strong>: Examine if there is a connection between the athletic performance and the financial status in football clubs.</p><p><strong>Theoretical perspectives</strong>: This thesis is based on the theory that the modern football club is like every other company trying to maximize profit. The clubs should therefore use the same business strategies.</p><p><strong>Empirical foundation</strong>: The study is based on 25 observations over five years and five Allsvenska football clubs. The data is a compilation of the key ratios from the annual reports and the league table, years 2004 through 2008 in the clubs. Year 2009’s league table place is also included since tests have been done with one year’s displacement between the financial status and the league table.</p><p><strong>Conclusion</strong>:</p><ul><li>There is no correlation between solidity and the place in the league table in Allsvenska football clubs.</li><li>There is no correlation between net profit and the place in the league table in Allsvenska football clubs.</li><li>There is no correlation between equity and the place in the league table in Allsvenska football clubs.</li></ul>

Background: The international accounting standard regarding goodwill gives opportunities to several accounting procedure choices, as goodwill is a complex, intangible asset. The valuation of goodwill affects equity/asset ratio and income statement, which gives that the stakeholders’ impression of the group’s financial statement is affected by the valuation of this asset. It has been pointed out that difficult economic times bring impairment loss to the fore. During financial crisis, equity/asset ratio may be significant as the economy of the groups is expected to be strained. Purpose: The purpose of this essay is to explain the appearance of the possible relationship between a group’s impairment loss for goodwill and their equity/asset ratio, during financial straits. Watts and Zimmerman’s debt/equity hypothesis serve as the starting point for our study. This hypothesis expresses, ceteris paribus, that the larger debt/equity ratio, the more likely it is to select accounting procedures that shift reported earnings from future periods to the current period. According to the hypothesis there should be a positive relationship between a group’s equity/asset ratio and their percentage share of goodwill impairment loss. A high equity/asset ratio would motivate a higher impairment loss for goodwill, as a lower equity/asset ratio would induce a lower impairment loss. Method: We decided to investigate all groups with the parent company listed on Nasdaq OMX Stockholm within the sectors financials and industrials. In financials, banks were excluded. The data was collected from annual reports of 2008 and was analyzed with the statistical analyzing methods correlation and regression. Result/conclusion: For those industrial groups which have had impairment loss for goodwill, the result is in accordance with Watts and Zimmerman’s hypothesis. A strong positive linear relationship could be found for those groups, but not for the sector as a whole. The equity/asset ratio therefore seems to not affect the decision of whether to lose impairment or not, but when the decision is made, the ratio of equity/asset seems to affect the size of the impairment loss. Within the financial sector, no relationship could be found – neither for the groups which have had impairment loss nor the sector as a whole.

Purpose: Examine if there is a connection between the athletic performance and the financial status in football clubs. Theoretical perspectives: This thesis is based on the theory that the modern football club is like every other company trying to maximize profit. The clubs should therefore use the same business strategies. Empirical foundation: The study is based on 25 observations over five years and five Allsvenska football clubs. The data is a compilation of the key ratios from the annual reports and the league table, years 2004 through 2008 in the clubs. Year 2009’s league table place is also included since tests have been done with one year’s displacement between the financial status and the league table. Conclusion: There is no correlation between solidity and the place in the league table in Allsvenska football clubs. There is no correlation between net profit and the place in the league table in Allsvenska football clubs. There is no correlation between equity and the place in the league table in Allsvenska football clubs.