Attack investigation is an important research field in forensics analysis. Many existing supervised attack investigation methods rely on well-labeled data for effective training. While the unsupervised approach based on BERT can mitigate the issues, the high degree of similarity between certain real-world attack and normal behaviors makes it challenging to accurately identify disguised attacks. This paper proposes ConLBS, an attack investigation approach that combines the contrastive learning framework and multi-layer Transformer network to realize the classification of behavior sequences. Specifically, ConLBS constructs behavior sequences describing behavior patterns from audit logs, and a novel lemmatization strategy is proposed to map the semantics to the attack pattern layer. Four different augmentation strategies are explored to enhance the differentiation between attack and normal behavior sequences. Moreover, ConLBS can perform unsupervised representation learning on unlabeled sequences, and can be trained either supervised or unsupervised depending on the availability of labeled data. The performance of ConLBS is evaluated in two public datasets. The results show that ConLBS can effectively identify at-tack behavior sequences in the cases of unlabeled data or less labeled data to realize attack investigation, and achieve the superior effectiveness compared to existing methods and models.

Communication has never been more accessible than today. With the help of Instant messengers and Email Services, millions of people can transfer information with ease, and this trend has affected organizations as well. There are billions of organizational emails sent or received daily, and their main goal is to facilitate the daily operation of organizations. Behind this vast corpus of human-generated content, there is much implicit information that can be mined and used to improve or optimize the organizations’ operations. Business processes are one of those implicit knowledge areas that can be discovered from Email logs of an Organization, as most of the communications are followed inside Emails. The purpose of this research is to propose an approach to discover the process models in the Email log. In this approach, we combine two tools, supervised machine learning and process mining. With the help of supervised machine learning, fastText classifier, we classify the body text of emails to the activity-related. Then the generated log will be mined with process mining techniques to find process models. We illustrate the approach with a case study company from the oil and gas sector.

The purpose of this work is to compare two fracture prediction models with real-world data. The pure Artificial Neural Network (ANN) model emphasizes regression analysis, while the hybrid model (SVM-ANN) focuses on the combination of regression and classification analysis or Support Vector Machine. The results were subsequently tested against logging data by combining the Machine Learning approach with advanced logging tools. In this context, we used electrical image logs and the dipole acoustic tool which together allowed the distinction of 404 open fractures and 231 closed fractures and, consequently the estimation of fracture porosity. The results are then fed into two machine-learning algorithms. Pure Artificial Neural Networks and hybrid models are used to establish comprehensive results, which are subsequently tested to check the accuracy of the models. The outputs obtained from the two methods demonstrate that the hybridized model has a lower Root Mean Square Error (RMSE) than pure ANN. The results of our approach strongly suggest that incorporating hybridized machine learning algorithms in fracture porosity estimations can contribute to the development of more trustworthy static reservoir models in simulation programs. Finally, the combination of Machine Learning (ML) and well-log analysis do permit reliable estimation of fracture porosity in the Ahnet field in Algeria, where, in many places, advanced logging data is absent and costly.

We use Matlab 3D finite element fluid flow/transport modelling to simulate localized wellbore temperature events of order 0.05-0.1oC logged in Fennoscandia basement rock at ~ 1.5km depths. The temperature events are approximated as steady-state heat transport due to fluid draining from the crust into the wellbore via naturally occurring fracture-connectivity structures. Flow simulation is based on the empirics of spatially-correlated fracture-connectivity fluid flow widely attested by well-log, well-core, and well-production data. Matching model wellbore-centric radial temperature profiles to a 2D analytic expression for steady-state radial heat transport with Peclet number Pe ≡ r0φv0/D (r0 = wellbore radius, v0 = Darcy velocity at r0, φ = ambient porosity, D = rock-water thermal diffusivity), gives Pe ~ 10-15 for fracture-connectivity flow intersecting the well, and Pe ~ 0 for ambient crust. Darcy flow for model Pe ~ 10 at radius ~ 10 meters from the wellbore gives permeability estimate κ ~ 0.02Darcy for flow driven by differential fluid pressure between least principal crustal stress pore pressure and hydrostatic wellbore pressure. Model temperature event flow permeability κm ~ 0.02Darcy is related to well-core ambient permeability κ ~ 1µDarcy by empirical poroperm relation κm ~ κ exp(αmφ) for φ ~ 0.01 and αm ~ 1000. Our modelling of wellbore temperature events calibrates the concept of reactivating fossilized fracture-connectivity flow for EGS permeability stimulation of basement rock.

Configurable process models are frequently used to represent business workflows and other discrete event systems among different branches of large organizations: they unify commonalities shared by all branches and describe their differences, at the same time. The configuration of such models is usually done manually, which is challenging. On the one hand, when the number of configurable nodes in the configurable process model grows, the size of the search space increases exponentially. On the other hand, the person performing the configuration may lack the holistic perspective to make the right choice for all configurable nodes at the same time, since choices influence each other. Nowadays, information systems that support the execution of business processes create event data reflecting how processes are performed. In this article, we propose three strategies (based on exhaustive search, genetic algorithms, and greedy heuristic) that use event data to automatically derive a process model from a configurable process model that better represents the characteristics of the process in a specific branch. These strategies have been implemented in our proposed framework, and tested in both business-like event logs as recorded in a higher educational ERP system, and a real case scenario involving a set of Dutch municipalities.

Background: Cloud-native software systems often have a much more decentralized structure and many independently deployable and (horizontally) scalable components, making it more complicated to create a shared and consolidated picture of the overall decentralized system state. Today, observability is often understood as a triad of collecting and processing metrics, distributed tracing data, and logging. The result is often a complex observability system composed of three stovepipes whose data is difficult to correlate. Objective: This study analyzes whether these three historically emerged observability stovepipes of logs, metrics and distributed traces could be handled more integrated and with a more straightforward instrumentation approach. Method: This study applied an action research methodology used mainly in industry-academia collaboration and common in software engineering. The research design utilized iterative action research cycles, including one long-term use case. Results: This study presents a unified logging library for Python and a unified logging architecture that uses the structured logging approach. The evaluation shows that several thousand events per minute are easily processable. Conclusion: The results indicate that a unification of the current observability triad is possible without the necessity to develop utterly new toolchains.