text:
|Numéro de publication
|Type de publication
|Numéro de demande
|Numéro PCT
|Date de publication
|17 mai 2007
|Date de dépôt
|22 nov. 2004
|Date de priorité
|27 nov. 2003
|Autre référence de publication
|Numéro de publication
|Zoe Lock, Emma Peeling, Claire Thie, Neil Brown, Richard Hatch, Alan Hood, Simon Kilvington, Mohammed Zakiuddin
|Cessionnaire d'origine
|Qinetiq Limited
|Exporter la citation
|BiBTeX, EndNote, RefMan
|Référencé par (23), Classifications (7), Événements juridiques (5)
|Liens externes: USPTO, Cession USPTO, Espacenet
This invention relates to automated anomaly detection in data, and to a method, an apparatus and computer software for implementing it. More particularly, although not exclusively, it relates to detection of fraud in areas such as telecommunications and retail sales and to detection of software vulnerabilities by searching for anomalies in digital data.
It is known to detect data anomalies such as fraud or software vulnerabiiities with the aid of management systems which use hand-crafted rules to characterise fraudulent behaviour. In the case of fraud, the rules are generated by human experts in fraud, who supply and update them for use in fraud management systems. The need for human experts to generate rules is undesirable because it is onerous, particularly if the number of possible rules is large or changing at a significant rate.
It is also known to avoid the need for human experts to generate rules: i.e. artificial neural networks are known which learn to characterise fraud automatically by processing training data. They use characteristics so learned to detect fraud in other data. However, neural networks characterise fraud in a way that is not clear to a user and does not readily translate into recognisable rules. It is important to be able to characterise fraud in terms of breaking of acceptable rules, so this aspect of neural networks is a disadvantage.
Known rule-based fraud management systems can detect well-known types of fraud because human experts know how to construct appropriate rules. In particular, fraud over circuit-switching networks is well understood and can be dealt with in this way. However, telecommunications technology has changed in recent years with circuit-switching networks being replaced by Internet protocol packet-switching networks, which can transmit voice and Internet protocol data over telecommunications systems. Fraud associated with Internet protocol packet-switching networks is more complex than that associated with circuit-switching networks: this is because in the Internet case, fraud can manifest itself at a number of points on a network, and human experts are still learning about the potential for new types of fraud. Characterising complex types of fraud manually from huge volumes of data is a major task. As telecommunications traffic across packet-switching networks increases, it becomes progressively more difficult to characterise and detect fraud.
U.S. Pat. No. 6,601,048 to Gavan discloses rule-based recognition of telephone fraud by a thresholding technique: it establishes probabilities that certain occurrences will be fraudulent most of the time (e.g. 80% of credit card telephone calls over 50 minutes in length are fraudulent). It mentions that fraudulent behaviour is established from records but not how it is done.
U.S. Pat. No. 5,790,645 to Fawcett et al. also discloses rule-based recognition of telephone fraud. It captures typical customer account behaviour (non-fraudulent activity) and employs a standard rule learning program to determine rules distinguishing fraudulent activity from non-fraudulent activity. Such a rule might be that 90% of night-time calls from a particular city are fraudulent. Rules are used to construct templates each containing a rule field, a training field monitoring some aspect of a customer account such as number of calls per day, and a use field or functional response indicating fraudulent activity, e.g. number of calls reaching a threshold. Templates are used in one or more profilers of different types which assess customer account activity and indicate fraudulent behaviour: a profiler may simply indicate a threshold has been reached by output of a binary 1, or it may give a count of potentially fraudulent occurrences, or indicate the percentage of such occurrences in all customer account activity. The approach of detecting deviation from correct behaviour is more likely to yield false positives than detecting fraud directly, because it is difficult to characterise all possible forms of normal behaviour.
US Pat. Appln. No. US 2002/0143577 to Shiffman et al. discloses rule-based detection of compliant/valid non-compliant/invalid responses by subjects in clinical trials. Quantitative analysis is used to distinguish response types. This corresponds to rule generation by human experts which is time consuming. There is no disclosure of automatic rule generation.
US Pat. Appln. No. US 2002/0147754 to Dempsey et al. discloses detection of telecommunications account fraud or network intrusion by measuring difference between two vectors.
There is also a requirement for automated detection of potentially exploitable vulnerabilities in compiled software, i.e. binary code, by searching for code anomalies comprising potentially incorrect code fragments. A malicious attacker may be able to force such fragments to be executed in such a way as to cause a computer system running code containing the fragments to behave insecurely.
Software vulnerabilities in computer source code are detectable using static analysis techniques, also referred to as white-box testing techniques. However, source code is frequently not available for analysis and white-box techniques are not applicable.
It is also known to detect data anomalies in the form of vulnerabilities in compiled binary code and disassembled binary code using hand-crafted rules to identify potential bugs in the code. The rules are generated by human experts in vulnerability detection. For example, in a hand crafted rule set category, a "SmartRisk Analyzer" product of the @stake company looks for "triggers" in a computer program written in assembly language code. "Triggers" are calls to functions (such as strcpy) known to be vulnerable. On finding a trigger, SmartRisk Analyzer traces a data and control path back through the program in order to determine possible values of parameters comprising an argument of the vulnerable or unsafe function, to see if the function call will be vulnerable during run time. So-called black-box testing technologies are more commonly used, usually referred to as "fuzzers"; fuzzers essentially perform a random search or a brute force search through a (usually intractably large) space of test vectors. They can also be enhanced by hand crafting constraints on the search space's domain.
As before, the need for human experts to generate rules is undesirable because it is onerous. Although human experts may have much experience, it is not feasible for them to learn from all possible scenarios. Gaining additional and wider experience takes time and resources. Once a rule base is derived, it can be used to identify whether new software applications contain potentially exploitable binary code. However, current systems of vulnerability detection have rule bases which are typically static, i.e. unchanging over time unless rules are added or edited manually. As new vulnerabilities become apparent, such a system needs to be updated by hand in order to be able to identify associated 'bugs'. Further deficiencies of a rule-based approach, such as that used by @Stake, is that it has a limitation on 'semantic depth' that is practical for such techniques. A vulnerability having semantics which are sufficiently complex is not likely to be detectedby such an approach.
United Kingdom Patent GB 2387681 discloses machine learning of rules for network security. This disclosure concentrates on use of first-order logic to represent rules for dealing with the problem of intrusion detection. It involves firstly attempting to characterise, either pre-emptively or dynamically, behaviours on a given computer network that correspond to potentially malicious activity; then, secondly, such characterisation provides a means for preventing such activity or raising an alarm when such activity takes place. Intrusion detection techniques, such as that proposed in GB 2387681, do not address the problem of finding underlying vulnerabilities that might be used as part of an intrusion, rather they are concerned with characterising and monitoring network activity. Intrusion detection systems use on-line network monitoring technology rather than a static off-line assessment of code binaries. They therefore detect intrusion after it has happened, rather than forestalling it by detecting potential code vulnerabilities to enable their removal prior to exploitation by an intruder.
It is an object of the present invention to provide an alternative approach to anomaly detection.
The present invention provides a method of anomaly detection characterised in that it incorporates the steps of:
The method of the invention provides the advantage that it obtains rules from data, not human experts, it does so automatically, and the rules are not invisible to a user. At least first order logic is used to generate the rule set, which allows variables in rules and general relationships between them, and it is possible to include background knowledge. In the sense used in this specification, an anomaly is a portion of data indicating some feature or features which it is desired to locate or investigate, for example fraudulent behaviour or a potentially incorrect fragment of computer program code indicating a software vulnerability.
Data samples in the training data set may have characters indicating whether or not they are associated with anomalies. The invention may be a method of detecting telecommunications or retail fraud or software vulnerabilities from anomalous data and may employ inductive logic programming to develop the rule set.
Each rule may have a form that an anomaly is detected or otherwise by application of the rule according to whether or not a condition set of at least one condition associated with the rule is fulfilled. A rule may be developed by refining a most general rule by at least one of:
A variable in a rule which is defined as being in constant mode and is numerical is at least partly evaluated by providing a range of values for the variable, estimating an accuracy for each value and selecting a value having optimum accuracy. The range of values may be a first range with values which are relatively widely spaced, a single optimum accuracy value being obtained for the variable, and the method including selecting a second and relatively narrowly spaced range of values in the optimum accuracy value's vicinity, estimating an accuracy for each value in the second range and selecting a value in the second range having optimum accuracy.
The method may include filtering to remove duplicates of rules and equivalents of rules, i.e. rules having like but differently ordered conditions compared to another rule, and rules which have conditions which are symmetric compared to those of another rule. It may include filtering to remove unnecessary 'less than or equal to' ("Iteq") conditions. Unnecessary "Iteq" conditions may be associated with at least one of ends of intervals, multiple Iteq predicates and equality condition and Iteq duplication.
The method may include implementing an encoding length restriction to avoid overfitting noisy data by rejecting a rule refinement if the refinement encoding cost in number of bits exceeds a cost of encoding the positive examples covered by the refinement.
Rule construction may stop if at least one of three stopping criteria is fulfilled as follows:
A most significant rule may be added to a list of derived rules and positive examples covered by the most significant rule may be removed from the training data set.
The method may include:
In another aspect, the present invention provides computer apparatus for anomaly detection characterised in that it is programmed to execute the steps of:
The computer apparatus may be programmed to develop the rule set using Higher-Order logic. It may include developing the rule set by:
Data samples in the training data set may have characters indicating whether or not they are associated with anomalies. The at least one anomaly characterisation rule may have a form that an anomaly is detected or otherwise by application of such rule according to whether or not a condition set of at least one condition associated with that rule is fulfilled. It may be developed by refining a most general rule by at least one of:
A variable in the at least one anomaly characterisation rule which is defined as being in constant mode and is numerical may be at least partly evaluated by providing a range of values for the variable, estimating an accuracy for each value and selecting a value having optimum accuracy.
The computer apparatus may be programmed to filter out at least one of rule duplicates, rule equivalents and unnecessary 'less than or equal to' ("Iteq") conditions. It may be programmed to stop construction of a rule if at least one of three stopping criteria is fulfilled as follows:
In a further aspect, the present invention provides computer software for use in anomaly detection characterised in that it incorporates instructions for controlling computer apparatus to execute the steps of:
The computer software may incorporate instructions for controlling computer apparatus to develop the rule set using Higher-Order logic. It may incorporate instructions for controlling computer apparatus to develop the rule set by:
Data samples in the training data set may have characters indicating whether or not they are associated with anomalies.
The at least one anomaly characterisation rule may have a form that an anomaly is detected or otherwise by application of such rule according to whether or not a condition set of at least one condition associated with that rule is fulfilled.
The computer software may incorporate instructions for controlling computer apparatus to develop the at least one anomaly characterisation rule by refining a most general rule by at least one of:
The computer software may incorporate instructions for controlling computer apparatus to at least partly evaluate a variable in the at least one anomaly characterisation rule which is defined as being in constant mode and is numerical by providing a range of values for the variable, estimating an accuracy for each value and selecting a value having optimum accuracy. It may incorporate instructions for controlling computer apparatus to filter out at least one of rule duplicates, rule equivalents and unnecessary 'less than or equal to' ("Iteq") conditions. It may also incorporate instructions for controlling computer apparatus to stop construction of a rule if at least one of three stopping criteria is fulfilled as follows:
In order that the invention might be more fully understood, an embodiment thereof will now be described, by way of example only, with reference to the accompanying drawings, in which:
One example of an application of automated anomaly detection using the invention concerns characterisation of retail fraud committed in shops by cashiers. The invention in this example may be used in conjunction with current commercial systems that can measure and record the amount of money put into and taken out of cashiers' tills. Various kinds of cashier behaviour may indicate fraudulent or suspicious activity.
In this example of the invention transactions from a number of different cashiers' tills were employed. Each transaction was described by a number of attributes including cashier identity, date and time of transaction, transaction type (e.g. cash or non-cash) and an expected and an actual amount of cash in a till before and after a transaction. Each transaction is labelled with a single Boolean attribute which indicates "true" if the transaction is known or suspected to be fraudulent and "false" otherwise. Without access to retail fraud experts, definitions of background knowledge were generated in the form of concepts or functions relating to data attributes. One such function calculated a number of transactions handled by a specified cashier and having a discrepancy: here a discrepancy is a difference in value between actual and expected amounts of cash in the till before and after a single transaction.
In this example, the process of the invention derives rules from a training data set and the definitions of basic concepts or functions associated with data attributes previously mentioned. It evaluates the rules using a test data set and prunes them if necessary. The rules so derived may be sent to an expert for verification or loaded directly into a fraud management system for use in fraud detection. To detect fraud, the fraud management system reads data defining new events and transactions to determine whether they are described by the derived rules or not. When an event or transaction is described by a rule then an alert may be given or a report produced to explain why the event was flagged up as potentially fraudulent. The fraud management system will be specific to a fraud application.
Benefits of applying the invention to characterisation of telecommunications and retail fraud comprise:
This example of the invention employs inductive logic programming software implemented in a logic programming language called Prolog. It has an objective of creating a set of rules that characterises a particular concept, the set often being called a concept description. A target concept description in this example is a characterisation of fraudulent behaviour to enable prediction of whether an event or transaction is fraudulent or not. The set of rules should be applicable to a new, previously unseen and unlabelled transaction and be capable of indicating accurately whether it is fraudulent or not.
A concept is described by data which in this example is a database of events or transactions that have individual labels indicating whether they are fraudulent or non-fraudulent. A label is a Boolean value, 1 or 0, indicating whether a particular event or transaction is fraudulent (1) or not (0). Labelling transactions as fraudulent identifies fraudulent cashiers, which are then are referred to as positive examples of the target concept; Labelling transactions as non-fraudulent identifies non-fraudulent cashiers which are referred to as negative examples of the target concept.
In addition to receiving labelled event/transactional data, the inductive logic programming software may receive input of further information, i.e. concepts, facts of interest or functions that can be used to calculate values of interest e.g. facts about customers and their accounts and a function that can be used to calculate an average monthly bill of a given customer. As previously mentioned, this further information is known as background knowledge, and is normally obtained from an expert in the relevant type of fraud.
As a precursor to generating a rule set, before learning takes place, the labelled event/transaction and cashier data is randomly distributed into two non-overlapping subsets—a training data set and a test data set. Here non-overlapping means no data item is common to both subsets. A characterisation or set of rules is generated using the training data set. The set of rules is then evaluated on the test data set by comparing the actual fraudulent or otherwise label associated with a cashier with the equivalent predicted for it by the inductive logic programming software. This gives a value for prediction (or classification) accuracy—the percentage of correctly assessed cashiers in the test data set. Testing on a different data set of hitherto unseen examples, i.e. a set other than the training data set, is a good indicator of the validity of the rule set.
The target concept description is a set of rules in which each rule covers or characterises a proportion of the positive (fraudulent) examples of data but none of the negative (non-fraudulent) examples. It is obtained by repeatedly generating individual rules. When a rule is generated, positive examples which it covers are removed from the training data set. The process then iterates by generating successive rules using unremoved positive examples, i.e. those still remaining in the training data set. After each iteration, positive examples covered by the rule most recently generated are removed. The process continues until there are too few positive examples remaining to allow another rule to be generated. This is known as the sequential covering approach, and is published in Machine Learning, T. Mitchell, McGraw-Hill, 1997.
Referring to
IF {set of conditions} THEN {behaviour is fraudulent} (1)
A computer search for each individual rule begins at 30 with a most general rule (a rule with no conditions): searching is iterative (as will be described later) and generates a succession of rules, each new rule search beginning at 30. The most general rule is:
IF { } THEN target_predicate is true (2)
This most general rule is satisfied by all examples, both positive and negative, because it means that all transactions and facts are fraudulent. It undergoes a process of refinement to make it more useful. There are two ways of producing a refinement to a rule as follows:
Addition of a new condition and unification of different variables are standard expressions for refinement operator types though their implementation may differ between systems. A condition typically corresponds to a test on some quantity of interest, and tests are often implemented using corresponding functions in the background knowledge. When a new condition is added to a rule, its variables are unified with those in the rest of the rule according to user-specified mode declarations. Unification of a variable X to a variable Y means that all occurrences of X in the rule will be replaced by Y. A mode declaration for a predicate specifies the type of each variable and its mode. A variable mode may be input, output, or a constant. Only variables of the same type can be unified. Abiding by mode rules reduces the number of refinements than may be derived from a single rule and thus reduces the space of possible concept descriptions and speeds up the learning process. There may be more than one way of unifying a number of variables in a rule, in which case there will be more than one refinement of the rule.
For example, a variable X may refer to a list of items. X could be unified to a constant value [ ] which represents an empty list or to [Y|Z] which represents a non-empty list with a first element consisting of a variable Y and having another variable Z representing the rest of the list. Instantiating X by such unification constrains its value. In the first case, X is a list with no elements and in the second case it must be a non-empty list. Unification acts to refine variables and rules that contain them.
Variables that are defined as being in constant mode must be instantiated by a constant value. Variables of constant type can further be defined by the user as either non-numerical or numerical constants.
If a constant is defined as non-numerical then a list of possible discrete values for the constant must also be specified by a user in advance. For each possible value of the constant, a new version of an associated refinement is created in which the value is substituted in place of the corresponding variable. New refinements are evaluated using an appropriate accuracy estimate and the refinement giving the best accuracy score is recorded as the refinement of the original rule.
If a constant is specified as numerical, it can be further defined as either an integer or a floating-point number. A method for calculating a best constant in accordance with the invention applies to both integers and floating point numbers. If a constant is defined as numerical then a continuous range of possible constant values must be specified by a user in advance. For example, if the condition was "minutes_past_the_hour(X)" then X could have a range 0-59.
In an integer constant search, if a range or interval length for a particular constant is less than 50 in length, all integers (points) in the range are considered. For each of these integers, a new version of a respective associated refinement is created in which the relevant integer is substituted in place of a corresponding variable and new rules are evaluated and given an accuracy score using an appropriate accuracy estimation procedure. The constant(s) giving a best accuracy score is(are) recorded.
If the integer interval length is greater than 50, then the computer 1 carries out a recursive process as follows:
If a single constant value in X=15 to 25 gives the best accuracy score then that value is chosen as a final value of the constant X.
If the accuracy score decreases at an integer value N in the range 15 to 19 or 41 to 45, then (N-1) is taken as the constant in the refinement of the relevant rule.
The user can opt to conduct a beam constant search: here a beam is an expression describing generating a number of possible refinements to a rule and recording all of them to enable a choice to be made between them later when subsequent refinements have been generated. In this example, N refinements of a rule, each with a different constant value are recorded. This can be very effective, as the 'best' constant with highest accuracy at one point in the refinement process 32 may not turn out to be the 'best' value over a series of repeated refinement iterations. This avoids the process 32 getting fixed in local non-optimum maxima.
Some variables in conditions/rules may be associated with multiple constants: if so each constant associated with such a variable is treated as an individual constant, and a respective best value for each is found separately as described above. An individual constant value that obtains a highest accuracy score for the relevant rule is kept and the corresponding variable is instantiated to that value. The remaining variables of constant type are instantiated by following this process recursively until all constant type variables have been instantiated (i.e. substituted by values).
Once all refinements of a rule have been found, in accordance with the invention, the computer 1 filters refinements at 34 to remove any rules that are duplicates or equivalents of others in the set. Two rules are equivalent in that they express the same concept if their conditions in the IF {set of conditions} part of the rule are the same but the conditions are ordered differently. For example, IF {set of conditions} consisting of two conditions A and B is equivalent to IF {set of conditions} with the same two conditions in a different order, i.e. B and A. One of the two equivalent rules is removed from the list of refinements and so is not considered further during rule refinement, which reduces the processing burden.
Additionally, in accordance with the invention, symmetric conditions are not allowed in any rule. For example, a condition equal(X,2) means a variable X is equal in value to 2, is symmetric to equal(2,X), i.e. 2 is equal in value to a variable X. One of the two symmetric rules is removed from the list of refinements and so is not considered further.
Pruning refinements to remove equivalent rules and symmetric conditions results in fewer rules for the computer to consider at successive iterations of the refinement process 32, so the whole automated rule generation process is speeded up. Such pruning can reduce rule search space considerably, albeit the extent of this reduction depends on what application is envisaged for the invention and how many possible conditions are symmetric: in this connection where numerical variables are involved symmetric conditions are usually numerous due to the use of 'equals' conditions such as equal(Y,X). For example, in the retail fraud example, the rule search space can be cut by up to a third.
A 'less than or equals' condition referred to as 'Iteq', and an 'equals' conditions are often used as part of the background knowledge 14. They are very useful conditions for comparing numerical variables within the data. For this reason, part of the filtering process 34 ascertains that equals and Iteq conditions in rules meet checking requirements as follows:
Rule refinements are also filtered at 34 by the computer using a method called 'Encoding Length Restriction' disclosed by N. Lavrac and S. Dzeroski, Inductive Logic Programming: Techniques and Applications. Ellis Horwood, New York, 1994. It is based on a 'Minimum Description Length' principle disclosed by B. Pfahringer, Practical Uses of the Minimum Description Length Principle in Inductive Learning, PhD Thesis, Technical University of Vienna, 1995.
Where training examples are noisy (i.e. contain incorrect or missing values), it is desirable to ensure that rules generated using the invention does not overfit data by treating noise present in the data as requiring fitting. Rule sets that overfit training data may include some very specific rules that only cover a few training data samples. In noisy domains, it is likely that these few samples will be noisy: noisy data samples are unlikely to indicate transactions which are truly representative of fraud, and so rules should not be derived to cover them.
The Encoding Length Restriction avoids overfitting noisy data by generating a rule refinement only if the cost of encoding the refinement does not exceed the cost of encoding the positive examples covered by the refinement: here 'cost' means number of bits. A refinement is rejected by the computer if this cost criterion is not met. This prevents rules becoming too specific, i.e. covering few but potentially noisy transactions.
Once a rule is refined, the resulting refinements are evaluated in order to identify those which are best. The computer evaluates rules at 36 by estimating their classification accuracy. This accuracy may be estimated using an expected classification accuracy estimate technique disclosed by N. Lavrac and S. Dzeroski, Inductive Logic Programming, Techniques and Applications. Ellis Horwood, New York, 1994, and by F. Zelezny and N. Lavrac, An Analysis of Heuristic Rule Evaluation Measures, J. Stefan Institute Technical Report, March 1999. Alternatively, it may be estimated using a weighted relative accuracy estimate disclosed by N. Lavrac, P. Flach and B. Zupan, Rule Evaluation Measures: A Unifying View, Proceedings of the 9th International Workshop on Inductive Logic Programming (ILP-99), volume 1634 of Lecture Notes in Artificial Intelligence, pages 174-185, Springer-Verlag, June 1999. A user may decide which estimating technique is used to guide a rule search through a hypothesis space during rule generation.
Once refinements have been evaluated in terms of accuracy, they are then tested by the computer for what is referred to in the art of rule generation as 'significance'. In this example a significance testing method is used which is based on a likelihood ratio statistic disclosed in the N. Lavrac and S. Dzeroski reference above. A rule is defined as 'significant' if its likelihood ratio statistic value is greater than a predefined threshold set by the user.
If a rule covers n positive examples and m negative examples, an optimum outcome of refining the rule is that one of its refinements (an optimum refinement) will cover n positive examples and no negative examples. A likelihood ratio for this optimum refinement can be calculated by the computer. A rule is defined as 'possibly significant' if its optimum refinement is significant. Arising from this definition, it is possible that a rule may not actually be significant, but it may be possibly significant.
The computer checks a rule under consideration in the process 12 at 38 to see whether or not it meets rule construction stopping criteria: in this connection, the construction of an individual rule terminates when the computer determines that any one or more of three stopping criteria is fulfilled as follows:
3. the previous refinement step 32 produced no refinements eligible to enter the new beam; if a most significant rule exists it is added to the accumulating rule set at 40.
Note that a most significant rule may not necessarily exist, if so no significant refinements have been found so far. If it is the case that a most significant rule does not exist but the stopping criteria at 38 are satisfied, then no rule is added to the rule set at 40 by the computer and the stopping criteria at 44 are satisfied (as will be described later).
When a rule is added at 40, the positive examples it covers are removed from the training data by the computer 1 at 42, and remaining or unremoved positive and negative examples form a modified training data set for a subsequent iteration (if any) of the rule search.
At 44 the computer 1 checks to see whether or not the accumulating rule set satisfies stopping criteria. In this connection, accumulation of the rule set terminates at 46 (finalising the rule set) when either of the following criteria is fulfilled, that is to say when either:
If at 44 the accumulating rule set does not satisfy the rule set stopping criteria, the computer 1 selects another most general rule at 30 and accumulation of the rule set iterates through stages 32 etc. At any given time in operation of the rule generation process 12, there are a number (zero or more) rules for which computer processing has terminated and which have been added in the accumulating rule set, and there are (one or more) evolving rules or proto-rules for which processing to yield refinements continues iteratively.
If evolving rules are checked at 38 and are found not to meet any of the rule construction stopping criteria previously mentioned, those refinements of such rules are chosen which have the best accuracy estimate scores. The chosen refinements then provide a basis for a next generation of rules to be refined further in subsequent refinement iterations. The user defines the number of refinements forming a new beam to be taken by the computer to a further iteration by fixing a parameter called 'beam_width'. As has been said, a beam is a number of recorded possible refinements to a rule from which a choice will be made later, and beam_width is the number of refinements in it. For a beam width N, the refinements having the best N accuracy estimate scores are found and taken forward at 48 as part of the new beam to the next iteration. The sequence of stages 32 to 38 then iterates for this new beam via a loop 50.
Each refinement entering the new beam must:
If required by the user, the accumulated rule set can be post-pruned by the computer using a reduced error pruning method disclosed by J. Fürnkranz, "A Comparison of Pruning Methods for Relational Concept Learning", Proceedings of AAAI'94 Workshop on Knowledge Discovery in Databases (KDD-94), Seattle, Wash., 1994. In this case, another set of examples should be provided—a pruning set of examples.
Examples of a small training data set, background knowledge and a rule set generated therefrom will now be given. In practice there may be very large numbers of data samples in a data set.
Training data
These labelled transactions indicate that cashier_2 is suspected to have been fraudulent because the Suspicious Flag in the seventh of the above lines is 1, while cashier 1 is not giving us the following Prolog facts or statements:
The first statement is specifying that cashier_1 is not a fraudulent cashier because it begins with a minus sign. This is because the suspicious transaction flag is set to 0 for all of the transactions associated with cashier_1. Cashier_2 however has the Suspicious Flag set to 1 for one of the transactions associated with it, and therefore the second statement is specifying that cashier_2 is thought to be fraudulent. These provide positive and negative examples for learning the concept of a fraudulent cashier.
Generated Rule Set:
This example of a generated rule set characterises fraudulent cashiers using two rules. The first rule indicates that a cashier is fraudulent if that in a single month, the cashier has performed at least 10 transactions with a discrepancy greater than 100.
The second rule describes a cashier as fraudulent if in a single month, the cashier has carried out at least 455 transactions, where at least 230 of these have had a discrepancy between the expected amount and the actual transaction amount.
The embodiment of the invention described above provides the following benefits:
In the embodiment of the invention described with reference to FIGS. 1 to 3, expression of characterisations of anomalous (e.g. fraudulent) behaviour in data was in First-Order Logic (e.g. Prolog programs). This is not essential. The characterisations may also be expressed in Higher-Order Logic using a programming language such as Escher: J. W. Lloyd (1999) "Programming in an Integrated Functional and Logic Language", Journal of Functional and Logic Programming 1999(3). As increasingly complex problems are tackled, a more intricate approach is desirable. Escher is a functional logic language whose higher-order constructs allow arbitrarily complex observations to be captured and highly expressive generalizations to be conveyed. The Higher-Order Logic arises from logic functions and predicates being allowed to take other functions and predicates as arguments: it provides a natural mechanism for reasoning about sets of objects.
Rules characterising anomalous behaviour may be automatically developed using a learning system that learns rules expressed in Higher-Order Logic such as the Strongly Typed Evolutionary Programming System (STEPS): see C. J. Kennedy Ph.D. Thesis (2000), Department of Computer Science, University of Bristol, England.
STEPS alleviates the challenging problem of identifying an underlying structure for searching the resulting hypothesis space efficiently. This is achieved through an evolutionary based search that allows the vast space of highly expressive Escher programs to be explored. STEPS provides a natural upgrade of the evolution of concept descriptions to the higher-order level.
In particular STEPS uses what is referred to as an 'individuals-as-terms' approach to knowledge representation: this approach localises all information provided by an example as a single item or expression incorporating a set of elements characteristic of that example. For example, in the preceding embodiment of the invention, the problem domain is concerned with characterising fraudulent cashiers. Using the individuals-as-terms representation, all information relatingd to an individual cashier is combined into a single item. Such information is the cashier's identifying number or id and the respective transactions that the cashier has generated. Therefore each example consists of the cashier's id and a list of its transactions expressed as a single tuple (generic name for pair, triple etc.), e.g.:
(cashier1,[(1,(30,8,2003),(09:02),121.87,123.96), . . . (5,(30,8,2003),(08:44),115.71,116.5)]
This differs from the approach described in the preceding example where transactions were presented as separate Prolog facts.
The individuals-as-terms representation allows examples of arbitrary complexity to be treated in a uniform manner. STEPS also supports A-abstractions as arguments to higher-order functions thus enabling the creation of new functions not contained in an original alphabet. Finally, STEPS provides a number of specialised genetic operators for rule generation.
Rules learnt by STEPS are of the form:
IF {set of conditions} THEN {behaviour is anomalous} ELSE {behaviour is not anomalous}
This form is referred to as the rule template.
Referring to
Once the alphabet has been compiled at 64 and input to the computer 1 in
Once the set of conditions of the rule templates has been completed, the rules so formed are evaluated by the computer at 68 by applying them to the training examples 62 in order to estimate the accuracy by which they classify the training examples as anomalous or not. This establishes their fitness, i.e. it identifies which of the rules are best at classifying the training examples. At 70, a check is made to determine whether or not one of two termination criteria is met, i.e. if either
If neither of the termination criteria is met, the computer begins a procedure to generate improved rules by using genetic operators to create a new population of rules from the previous population created at 66. A population count index is reset to zero at 72, and at 74 a check is made to determine whether or not the new population is complete. If the new population is not complete, a rule is selected at 76 from the previous population. A rule is selected from the previous population using tournament selection. To perform a tournament selection, a subset of the previous population rules is randomly selected, and the rule in the subset with the highest fitness (classification accuracy) is the winner and is selected. Each of the previous population rules has the same probability of being selected for the subset.
A genetic operator (see Kennedy reference above) is now selected by the computer at 78. It has one of the following functions: a) combining two rules to form a new rule, b) modifying a single rule by deleting one of its conditions or adding a new condition to it, or c) changing one of a rule's constant values for another of an appropriate type. Genetic operators are applied in such a way as to maintain type and variable consistency for rules. A check is made at 80 to determine whether or not the genetic operator selected at 78 has the function of combining two rules to form a new rule. If so, another rule is selected at 82 by implementing a further tournament using a new randomly selected subset of the previous population, and the two-rule genetic operator is applied at 84 to the pair of rules selected at 78 and 82. If not, the single-rule genetic operator is applied at 84 to the rule selected at 78. In either case a population count is then incremented by 1 at 86.
The process of stages 74 to 86 iterates until the population count indicates that the new population of rules is of prearranged number, e.g. perhaps but not necessarily equal to the population size created at 66. When the prearranged number is reached, the iteration count G is incremented by 1 at 88 and then the evaluate population stage 68 is triggered to evaluate the new population. The two termination criteria are checked once more at 70.
The procedure continues if neither criterion is met, i.e. if the iteration count G has not reached a prearranged maximum, or a rule has not been found that adequately classifies the training examples.
If one or both of the termination criteria are met, the computer terminates the rule search 60. The computer determines the best performing rule (i.e. giving the best classification accuracy with the training examples) by testing at 90, and its classification accuracy with one or more conditions removed is determined. To remove redundancy, it prunes (deletes from the rule) conditions that when removed do not alter the accuracy of the rule, and the pruned rule is designated as a result at 92. Although this is a single rule, the ability to use the Boolean logical OR function in the rules makes it possible for such a rule to be equivalent to a number of rules obtained in the preceding example.
Using data from the embodiment described with reference to FIGS. 1 to 3, to characterise a fraudulent cashier, an individuals-as-terms representation used by STEPS groups the transactions associated with each cashier into a list:
fraudulent((cashier1,[(1,(30,8,2003),(09:02),121.87,123.96), . . . ,
fraudulent((cashier2,[(6,(30,8,2003),(22:40),431.68,435.17), . . . ,
Therefore the selector functions generated for this problem include the ability to select transactions from the lists, to obtain sub-lists with transactions that have certain properties, to obtain the length of such sub-lists. The transactions themselves are tuples with five positions each corresponding to a respective datatype of which there are five; the selector functions allow each of the five datatypes to be extracted and processed using various conditions. Such a condition may consist of comparing datatype values to another or may be application of a background knowledge concept. The background knowledge may contain the discrepancy concept represented as an Escher function: this discrepancy function takes a transaction and returns the discrepancy between the expected amount of cash in the till and the actual amount. Background knowledge can be embodied as a calculation in this way. The background knowledge in this case is that a discrepancy might be a useful thing to look at when constructing the rules: if so, it is necessary to find the size of the discrepancy that is sufficient to indicate fraud. The additional concepts provided in the ILP case may be constructed from the discrepancy function with the selector functions that have been automatically generated during the rule construction process. For example, identification of the number of transactions made by a cashier in a given month and year may be achieved using the following Escher fragment (the variable x is global to the function in which the fragment would be contained and is therefore not further quantified):
length (filter (\y→(y'elem'(proj2x) && ((proj2(proj2y) ==Month) && (proj3(proj2y) ==Year)))));
In the above expression, a filter function creates a list of 'y's that meet a number of criteria. First the ys are quantified: '\y →y 'elem' (proj2 x)' specifies that the items in the list (represented by the variable y) are the transactions associated with a cashier. The proj2 y function projects onto a second datatype that makes up an example (the example is represented by the global variable x). The cashier's id is a first datatype and the second datatype is a list of transactions associated with the cashier. The filter function is used to filter out transactions that meet two criteria. The first criterion is that the transactions fall within a given month: '(proj2 (proj2 y)==Month)'. The variable y has been quantified to be a transaction. A transaction is itself a tuple with five positions, the second position of the transaction tuple (obtained by applying the 'proj2' function) specifies the date as a triple (three position tuple), the second position of which contains the month (obtained by applying a further 'proj2' function). The month is then compared to a given month 'Month' (using the '==Month' function). The second criterion is that the transactions that make up the list fall within a given year: '(proj3 (proj2 y) ==Year)'. The date triple is obtained in the same manner as described above, but this time it is the third element of the date, the year, that is of interest (obtained using the 'proj3' function). The year contained in the date triple is then compared to a given year 'Year'. The length of this filtered list of transactions is then obtained using the 'length' function to provide the number of transactions that meet the specified criteria.
In order to identify the total number of transactions with a discrepancy made by a cashier in a given month, the following is used:
length (filter (\y→(y 'elem' (proj2 x) &&(((proj2(proj2y) ==Month) && (proj3 (proj2 y) == 2003)) && (( discrepancy y) !=0)))));
The rule set presented in the earlier example can then equivalently be expressed in Escher as follows:
fraudulent(cashier) = if (length (filter (\y -> (y 'elem' (proj2 x) &&( ((proj2 (proj2 y) == Month) && (( discrepancy y) > 100 )))))) >= 10 then True else False;
this rule expresses that, if the number of transactions associated with a cashier, carried out in a given month with a discrepancy greater than or equal to 100, is greater than or equal to 10, then the cashier is fraudulent.
fraudulent(cashier) = if (length (filter (\y -> (y 'elem' (proj2 x) &&( ((proj2 (proj2 y) == Month) && (( discrepancy y) != 0 )))))) >= 455 then True else False;
Another embodiment of the invention concerns characterisation of software vulnerabilities in a disassembled equivalent of binary code by code anomaly detection. It may be used in conjunction with current commercially available systems that can disassemble binary code. In this embodiment, disassembly of a program in binary code is a process which retrieves an assembly language equivalent of the program. Disassembly is to facilitate human understanding during development of a rule set; however, it is not essential and once rules have been learnt in assembly language they may be translated to operate directly on binary program code.
Various kinds of fragments of code may indicate a vulnerability in a software application which is potentially exploitable by an unauthorised intruder. The most common form of vulnerability is a buffer overflow. Strings in the C programming language are sequences of bytes, with a zero indicating the end of a string. This allows strings to be of unlimited length. However, memory is in limited supply, so fixed-size buffers must be allocated to hold strings. Copying a string of unknown (potentially unlimited) length into a buffer of fixed size can cause errors. If a C function known as strcpy is used, then the string will be copied even if it overflows its allocated space. In a C program it is typical to allocate fixed buffers for strings on a computer stack. This means that overflowing the buffer will overwrite a part of the stack not allocated to the buffer.
C is a procedural language that involves many function calls. Function calls are usually implemented on a computer (at a low level) by putting on to the stack a code address to return to after the call. Nested and recursive function calls may be implemented in this way. However, this approach enables a buffer overflow to overwrite the return address on the stack, and consequently data intended for the buffer replaces the return address. Overflow data supplied by an attacker may therefore specify a new return address, thus altering operation of a program containing the overwritten return address.
A common technique for an attacker to alter a return address is to supply program code to be executed in a buffer, and make the new return address point into that code; this makes the program execute arbitrary code inserted by the attacker. Another tactic is arc injection, which is a method that involves returning into an address in a known common library (such as the C standard library), to execute a C function such as system( ), which will execute a command on the host machine.
In this embodiment of the invention a number of different disassembled software programs are employed. Each program is broken down into individual instructions that form the program, where each instruction is described by a number of attributes including a program identifier (to indicate which program the instruction belonged to), the address of the instruction, the instruction operator and a list of the instructions operands. Each program is labelled with a single Boolean attribute which indicates "true" if the program is known or suspected to contain a vulnerability and "false" otherwise. Background knowledge which is used includes such functions as identifying a copying loop within a program. A copying loop is defined as a portion of code that (in any order) copies to a register (the Temporary Register) from a source pointer, changes the source pointer, copies from the register into a destination pointer, changes that destination pointer, and has a control flow path from the end of the code back to the start (thus forming a loop). Other definitions of a similar nature are also applicable.
Benefits of applying the invention to characterisation of software vulnerablities comprise:
This embodiment of the invention employs inductive logic programming software implemented in the Prolog logic programming language previously described. The target concept description in this embodiment is a characterisation of software vulnerabilities to enable prediction of whether a compiled program is vulnerable or not. The set of rules should be applicable to a new, previously unseen and unlabelled disassembled program and be capable of indicating accurately whether it is vulnerable or not.
IF {set of conditions} THEN {program is vulnerable} (3)
In addition to receiving labelled program data, the inductive logic programming software may receive input of further information, i.e. concepts, facts of interest or functions that can be used to calculate values of interest e.g. facts regarding the existence of copying loops within the compiled programs. As previously mentioned, this further information is known as background knowledge, and is normally obtained from an expert in the detection of software vulnerabilities.
Examples of a small training data set, background knowledge and a rule set generated therefrom will now be given.
Training Data:
The training data is a set of disassembled software programs that are referenced by a program identifier. The target concept is vulnerable(Program Identifier).
The first two of the four statements immediately above are specifying that program1 and program2 contain vulnerabilities. The third and fourth of these statements are preceded by the symbols ":-" specifying that programx and programy do not contain vulnerabilities. These form positive and negative examples for learning the concept of a vulnerable program.
Instructions that form the programs can be stored in a number of formats. An initial simple format is in Prolog facts with one fact per instruction:
A sample of an example set of simple instruction data associated with the program with program identifier "program1" is shown below.
The simple instructions can also be transformed into a graph-like format of nodes, with each node represented as a Prolog fact containing either a sequence of non-branching code, or a branching instruction, e.g.:
Block Length in the above instruction can be zero, which indicates that the list contains a single branching instruction. A branch is a program control structure in which one or more alternative sets of instructions are selected for execution. The selection is carried out when the program is run by means of a branching instruction.
A sample of an example set of graphically represented instruction data is shown below.
This graph format can then be normalised by splitting nodes to ensure that each branch always points to the start of a node (instruction sequence), never the middle.
Background knowledge: this includes tests that are thought to be appropriate by a domain expert. Examples of appropriate background concepts, represented using Prolog, are:
copying_loop(Program Identifier, Loop Start Index, List of Triples: (Instruction Address Instruction Operator, Instruction Operand List), Temporary Register).
The definition of a copying loop has been given previously, and an example is as follows:.
length_loop(Program Identifier, Loop Start Index, List of Triples: (Instruction Address Instruction Operator, Instruction Operand List)).
A length (finding) loop is defined as a portion of code that (in any order) copies to a register from a source pointer, changes the source pointer, and checks the register for a value of zero, and has a control flow path from the end of the code back to the start (thus forming a loop).
length_loop(program1_exe,7,[(x401016, mov, [[x1, [edi]], cl]), (x401019, inc, [edi]), (x40101a, test, [cl, cl]), (x40101c, jne, [x401016])],cl).
follows(Program Identifier, Block A Index, Block B Index, List of Triples: (Instruction Address, Instruction Operator, Instruction Operand List)).
This is an item of background knowledge which describes the situation if Block B follows Block A. Usually this is bounded by an upper limit of the number of instructions between Block A and Block B to prevent a large amount of background knowledge being generated by the combinatorial nature of the predicate. The list of instructions between the two blocks is also stored in the background knowledge. E.g.
strlen_call(Program Identifier, StrlenIndex).
This item of background knowledge indicates that the program makes a call to the function strlen at the specified index,e.g.:
get_jump_tests_from_list(InstructionList, JumpTests).
This item of background knowledge extracts tests that precede conditional jumps in an instruction list.
This item of background knowledge tests whether or not a given list is empty.
single_item_list(List, RegisterTested).
This item of background knowledge tests whether or not a given list has a single jump test (conditional), and if it is, returns the tested register in RegisterTested.
unreferenced_registers(InstructionList, Register).
This item of background knowledge tests whether or not the given list modifies the given register.
Generated rule set: The target concept is vulnerable(Program Identifier). Rules in the following rule set characterises programs that are vulnerable to buffer overflows.
The first rule of the above rule set classifies a program as vulnerable if there is a copying loop preceded by a call to the C function strlen, with no conditional jumps between the two. The second rule classifies a program as vulnerable if there is a copying loop, with a test for zero, and one other test, but a register referenced by the other test is not used during the loop.
The software vulnerability embodiment of the invention described above provides similar benefits to those associated with the fraud embodiment described with reference to
The processes described in the foregoing description can clearly be evaluated by an appropriate computer program comprising program instructions embodied in an appropriate carrier medium and running on a conventional computer system. The computer program may be embodied in a memory, a floppy or compact or optical disc or other hardware recordal medium, or an electrical or optical signal. Such a program is straightforward for a skilled programmer to implement on the basis of the foregoing description without requiring invention, because it involves well known computational procedures.
|Brevet citant
|Date de dépôt
|Date de publication
|20 oct. 2005
|17 mars 2009
|International Business Machines Corporation
|Computer controlled method using genetic algorithms to provide non-deterministic solutions to problems involving physical restraints
|21 déc. 2005
|24 aoűt 2010
|Mcafee, Inc.
|System, method and computer program product for hooking a COM interface
|1 aoűt 2005
|6 mars 2012
|Mcafee, Inc.
|System, method and computer program product for virtual patching
|19 mai 2008
|15 janv. 2013
|Electronics And Telecommunications Research Institute
|Learning apparatus and method of intelligent system
|27 mai 2010
|9 avr. 2013
|International Business Machines Corporation
|Automatic refinement of information extraction rules
|1 nov. 2010
|17 sept. 2013
|International Business Machines Corporation
|Scalable ontology extraction
|25 sept. 2012
|15 oct. 2013
|International Business Machines Corporation
|Scalable ontology extraction
|30 nov. 2007
|17 déc. 2013
|Microsoft Corporation
|Automatic data patch generation for unknown vulnerabilities
|13 nov. 2012
|6 janv. 2015
|Hitachi, Ltd.
|Storage system, storage system control method, and storage control device
|3 juin 2013
|13 janv. 2015
|At&T Intellectual Property I, L.P.
|Method and apparatus for automated end to end content tracking in peer to peer environments
|5 déc. 2012
|27 janv. 2015
|Blackberry Limited
|Method and system for managing data storage and access on a client device
|15 aoűt 2013
|24 mars 2015
|Google Inc.
|Propagating information among web pages
|3 aoűt 2012
|22 sept. 2015
|International Business Machines Corporation
|System for on-line archiving of content in an object store
|18 avr. 2006
|9 nov. 2006
|Nec Electronics Corporation
|Processor and method for executing data transfer process
|19 mai 2008
|5 mars 2009
|Electronics And Telecommunications Research Institute
|Learning apparatus and method of intelligent system
|3 mai 2012
|International Business Machines Corporation
|Scalable Ontology Extraction
|3 juin 2013
|3 oct. 2013
|At&T Intellectual Property I, L.P.
|Method and apparatus for automated end to end content tracking in peer to peer environments
|3 mai 2013
|6 févr. 2014
|International Business Machines Corporation
|System for on-line archiving of content in an object store
|15 aoűt 2013
|20 févr. 2014
|Daniel Egnor
|Propagating Information Among Web Pages
|15 juin 2012
|13 mars 2014
|International Business Machines Corporation
|Anomaly, association and clustering detection
|21 déc. 2012
|26 juin 2014
|Cloudvu, Inc.
|Machine learning for systems management
|28 juin 2013
|1 janv. 2015
|Vmware, Inc.
|Method and system for determining configuration rules based on configurations of complex systems
|16 oct. 2008
|23 avr. 2009
|Visa Usa Inc
|Fraud prevention based on risk assessment rule
|Classification aux États-Unis
|1/1, 707/999.102
|Classification internationale
|Classification coopérative
|8 déc. 2008
Owner name: QINETIQ LIMITED, UNITED KINGDOM
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:LOCK, ZOE PAULA;PEELING, EMMA CECILIA;THIE, CLAIRE JULIA;AND OTHERS;REEL/FRAME:021937/0607;SIGNING DATES FROM 20060503 TO 20060522
Owner name: QINETIQ LIMITED,UNITED KINGDOM
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:LOCK, ZOE PAULA;PEELING, EMMA CECILIA;THIE, CLAIRE JULIA;AND OTHERS;SIGNING DATES FROM 20060503 TO 20060522;REEL/FRAME:021937/0607
|2 nov. 2010
|Certificate of correction
|12 juil. 2013
|Maintenance fee reminder mailed
|29 nov. 2013
|Fee payment
Year of fee payment: 4
|29 nov. 2013
|Surcharge for late payment


text: Risto Womenswear A/W10 Risto Bimbiloski pushes artisinal hand knitting. Fashion Show 5 years ago Tweet 5 years ago Photography Shawn Brackbill Tweet x22 Risto Womenswear A/W10 Shaggy textures are abound in the shows so far and it seems a lot of designers are feeling the more tactile quality in clothes. Risto Bimbiloski ensured that his knits had provenance by using artisinal hand knitters. These knitted and quilted pieces were the folk-inspired elements that went over the slightly faded, nature-derived prints underneath. The prints were inspired by Nicola Sassoon and painted in slightly naïve computer pixels. This is Risto's "New New Age" where sartorial spiritual healing is abound and the natural and synthetic come together.Visit our Entire New York Fashion Week coverage » More: Fashion Show Fashion Week Autumn / Winter 2010 Womenswear New York Tweet

subset: commoncrawl


text:
Verified ID
Email AddressVerified
Phone Number(▒▒▒) ▒▒▒- ▒▒ 66
272 Friends
Reviewed94 Reviews
Offline IDPersonal Info
About Me
- School
- Centennial High School, Gonzaga University
- Kim's Airbnb Symbol
Hey, I'm Kim!
Portland, Oregon, United States · Member since March 2012
You have reported this user. Undo?
Yoga instructor living in Portland, Oregon. Easy going, crafty, fun loving and looking for adventure. I am in love with a beautiful and creative man, Brian. Together we share an adorable doggy named Stuart and a small remodel business, KB Handyworks Co.
We love to hike, play games with friends, practice yoga, adventure outside, watch movies, cook food, and sit fireside. We aspire to play music, but haven't booked any gigs lately ;) We love surrounding ourselves with mindful and inspiring people.


text:
Comfort Inn, Bonita Springs
- Free buffet breakfast, free WiFi, and free parking
Main amenities
- 69 smoke-free guestrooms
- Outdoor pool
- 24-hour business center
- 24-hour front desk
- Coffee/tea in the lobby
- Air conditioning
- Self-serve laundry
- Gift shops/newsstands
- Free newspapers in the lobby
What's around
- Riverside Park (0.9 mi / 1.5 km)
- Naples-Fort Myers Greyhound Track (1.2 mi / 2 km)
- Everglades Wonder Gardens (1.3 mi / 2.1 km)
- Golf Safari Mini Golf (1.7 mi / 2.8 km)
- Flamingo Island Flea Market (2 mi / 3.1 km)
The hotel has only one ice machine which is usually empty by 7am. Coffee machine never…
Room was Clean and comfortable. I got first floor so I was happy since I have kids.…
Enter dates to check prices
Hotel Info: 866-539-8117from $69
- Standard Room, 1 Queen Bed, Non Smoking
- Standard Room, 2 Queen Beds, Non Smoking, Poolside
- Standard Room, 2 Queen Beds, Accessible, Non Smoking
- Standard Room, 1 King Bed with Sofabed, Non Smoking, Poolside
- Standard Room, 2 Queen Beds, Non Smoking
Also popular with travelers from the USA
At a glance
Key facts
Hotel size
- This hotel has 69 rooms
- This hotel is arranged over 3 floors
- Check-in time 3 PM-midnight
- Check-out time is 11 AM
Required at check in
- Credit card or cash deposit required
- Government-issued photo ID required
Travelling with others
- Pets not allowed
Extra people
- Roll-away beds available, charges may apply*
- Free WiFi in public areas
- Free WiFi in rooms
- Free self parking
- Accessible parking
- RV/bus/truck parking
Other information
- Smoke-free property
Nearby Two Star Bonita Springs hotels
In the hotel
- Free buffet breakfast
- Coffee/tea in the lobby
- Outdoor pool
- Bicycle rentals nearby
- Golfing nearby
- 24-hour business center
- 24-hour front desk
- Laundry facilities
- Free newspapers in lobby
- Number of buildings/towers - 1
- Elevator/lift
- Disabled parking
- Accessible path of travel
- Braille or raised signage
- Accessibility equipment for the deaf
- Accessible bathroom
- Roll-in shower
In the room
- Air conditioning
- Coffee/tea maker
- Iron/ironing board
- Balcony
- Hair dryer
- Cable TV channels
- Free WiFi
- Free local calls
- Refrigerator
- Microwave
- Connecting/adjoining rooms available
Top Bonita Springs hotels
Recently reviewed hotels in Bonita Springs
- Baymont Fort Myers AirportFrom
"perfect. Folks at the front desk could not have been more pleasant"Sep 3, 2015
- Value Place Ft. Myers, FL (East)
"It was quiet."Sep 3, 2015
- La Quinta Inn & Suites Ft. Myers - Sanibel GatewayFrom
"clean room, great guest service, Pm, and Am ladies."Sep 3, 2015
- Quality Inn & Suites Golf ResortFrom
"Great view of golf course. Nothing but green viewed from our terrace. Working night bar with music until 11 PM. All a good 4.5 out of 5. I'd recommend this hotel to everyone. And…"Sep 3, 2015
Nearby hotels
Comfort Inn, Bonita Springs's small print
Also known as
- Comfort Inn Bonita Springs
- Comfort Inn Hotel Bonita Springs
The property has connecting/adjoining rooms, which are subject to availability and can be requested by contacting the property using the number on the booking confirmation.
Mandatory fees
Breakage deposit: USD 150.00 per stay
Optional extras
Rollaway beds are available for USD 10 per night
We have included all charges provided to us by this hotel. However, charges can vary, for example, based on length of stay or the room you book.


text:
Into Something Good
What's your favorite project?
An interesting java.net poll/survey/chat is going on... but not on java.net. Over on JavaLobby,
Java Champion Adam Bien is asking readers What's Your Favorite java.net Project? He writes, "java.net
seems to be a little bit underestimated. It is actually a great platform
for open source projects—and very easy to set up. You get SVN or CVS
access with mailing lists, project homepage, etc—the full
infrastructure. However, there are already some really interesting
java.net projects out there."
Adam's list is:
He asks readers to mention their favorite projects, and with our project count having just pased the 5,000 mark, there are plenty of good choices. Readers have suggested SwingExplorer, Facelets, Woodstock, and Flying Saucer. And that's just the start... readers should remember affiliated projects like Direct Web Remoting and OpenSymphony, to say nothing of longtime favorites like ROME and AppFuse.
And this is just scratching the surface. There are another 4900+ to consider. So what are your favorites?
Also in Java Today,
Christopher Kampmeier blogs about the packaging and delivery of OpenDS as IPS packages in OpenDS in IPS Format Using the UC2 Toolkit: An Experiment. "This article describes the results of the first of several experiments intended to demonstrate how projects' build environments can be enhanced to deliver IPS-based distributions. In this article we address the first stage of an experiment based on the popular OpenDS project." Advantages include Multi-OS platform packaging of packages and updates, pre-installed installation images, ongoing installation image management, network repository-based delivery of add-ons and updates, and desktop notification of updates and new add-ons. Eduardo Pelegri-Llopart adds "IPS
is the format we are going to use with the next version of the GlassFish
Update Center."
Andrew Hughes has announced the release of IcedTea 1.7, which "provides a harness to build the source code from OpenJDK using Free Software build tools and provides replacements libraries for the binary plugs with code from the GNU Classpath project." Andrew's blog entry has a summary of changes in this release, including a GNU/Linux HotSpot port, javax.sound.midi support, and a free version of jtreg.
In today's Weblogs, blogs about privacy with an ominous
Knock Knock.
"Slowly our lives are being moved online, yet how can we effectively secure our data? It seems traditional techniques become less than effective when left in the incapable hands of the average user, yet new technologies like biometrics present their own issues."
- Login or register to post comments
- Printer-friendly version
- editor's blog
- 878 reads


text:
Cullinan took advantage of oil gushes such as this one in Beaumont, Texas, after the striking of black gold in Spindletop's field on Jan. 10, 1901.... View Enlarged Image
It took Joseph Cullinan a quarter-century to make himself into an inspiring titan of energy.
Raised in Western Pennsylvania, he went to work in the oilfields at 14 as a messenger boy.
After joining Standard Oil as a 22-year-old roughneck, he rose through the corporate ranks over the next 15 years.
But it wasn't until Cullinan (1860-1937) rolled into Beaumont, Texas, on Jan. 11, 1901, that he hit the jackpot.
Oil was gushing from the ground in the sleepy southeast Texas town, creating a 200-foot-high plume of liquid gold that splattered homes three miles away.
It was the greatest gusher Americans had ever seen, the dawn of the modern oil age — and Cullinan was primed to strike.
Capitalizing on his oil expertise and financing from a New York backer, he started Texas Co., the forerunner of Texaco.
Company Gush
By 1904, his firm was one of the nation's most prestigious oil producers.
In 1913, just before he resigned as president, Texaco's assets topped $60 million — worth $1.4 billion now — and Cullinan sat atop an industry destined to transform the 20th century.
He had boosted Texaco from an initial capitalization of $3 million.
"Spindletop (the Beaumont oilfield) turned everyone's calculations around,'' Diana Hinton, co-author of "Oil in Texas: The Gusher Years,'' told IBD. "Nobody in the U.S. had ever seen a gusher like this. Nobody had seen anything like it. That's where, if you're Cullinan, you're thinking, 'Oh boy, this is big; this is really big.' He was a guy who knew what he was doing. He was ahead of his time."
The oldest son of Irish immigrants, Cullinan was born on New Year's Eve 1860 near Sharon, Pa., a few miles from the first producing oil well in North America.
Long before anyone dreamed of finding oil in Texas, John D. Rockefeller made himself the world's first billionaire, thanks to western Pennsylvania oil. His Standard Oil was doing 90% of the nation's oil refining by 1879. Cullinan left the Cleveland-based monopoly in 1895 to form an oil equipment company in Pennsylvania.
Two years later he was invited for a quick visit to Corsicana, Texas, to advise city leaders on oil development. It turned into a long stay.
He settled in the mid-Texas town and organized the state's first pipeline and refining firm: J.S. Cullinan & Co. It was 1897; he was 37.
At the time, America's 58 million annual barrels of oil came from the east, mainly Pennsylvania.
For Miller Huggins, the choice of a baseball career was a matter of listening to his heart. Oh, and future President William Howard Taft. Huggins was the first legendary manager of the New York Yankees, who'd had seven skippers in 10 years before his 1918 arrival. Owner Jacob Ruppert credited ...
It's hard to imagine how William "Buffalo Bill" Cody overcame the logistical problems of transporting his "Wild West" show. After becoming a legendary Army scout during America's Western expansion, Cody wanted to preserve the memory of the vanishing frontier life. Trains carrying his 500 cast ...
Chances are you've seen Michael Strahan over the past few days. With his "Live! With Kelly and Michael" syndicated morning TV talk show, regular on-air contributions to ABC pillar "Good Morning America," football analyst gig Sundays on Fox, men's clothing line, production company and new book, the ...
On the eve of 1890's Census tabulation, Herman Hollerith was ready. He had been working on his punch-card machine for years, since a superior in the U.S. Census Office had observed, "There ought to be a machine for doing the purely mechanical work" of counting. The 1880 Census, done manually, had ...
Greg Steltenpohl is a pioneer in the nonalcoholic beverage industry. And he has advice for the entrepreneur who thirsts to make it big. If you want to win in a product category, study hard and truly grasp what your competitors do. Then go out and create something unique. Or make the product a ...
Want more from your broker? See which stock brokers our annual survey reveals as the top five and how they rank in areas most important to investors. Check out all of them now!
Investor's Business Daily provides exclusive stock lists, investing data, stock market research, education and the latest financial and business news to help investors make more money in the stock market. All of IBD's products and features are based on the CAN SLIM® Investing System developed by IBD's Founder William J. O'Neil, who identified the seven common characteristics that winning stocks display before making huge price gains. Each letter of CAN SLIM represents one of those traits.


text:
Debenhams Online Exclusive - Girl's yellow pack of two gingham school uniform blouses
Item No.2370208892
Item No.2370208892
Up to 70% Off - Save up to £8.40
From our exclusive collection of schoolwear for girls, this puff sleeved gingham checked blouse comes in yellow and white with frilly trims at the collar, a single pocket to the left chest and through button fastening to the front.
UK Home Delivery Free (UK orders over £30) or £3.49
Delivered within 5 working days
Next or Named Day Delivery
7 days a week between 8am - 6pm
Sunday to Friday - order by 9pm - £3.99
Saturday - order by 6pm - £3.99
Next or Named Evening Delivery
7 days a week between 6pm - 10pm
Monday to Sunday - order by Midnight - £6.99
Collect from store the next day - FREE
Order before 9pm for next day collection after 12pm midday
Show participating stores
Show full delivery details
Subject to exceptions, Debenhams is happy to exchange or refund your purchase within 28 days of delivery. Please check here for more details on our returns policy and exceptions.


text:
What is the best day for you to boheminize?
Let's find out the perfect day for debates....
|Jun 22, 2011
|17 so far
What is your favorite day to bohemianize?
Hi Bohemians, about 2 years ago we did a poll to find out what the best day for meetings is. Since 2 years is a long time, let's repeat this. What is your favorite day to bohemianize? You don't have to decide on one preferred day, just name all the days that work for you.
|Apr 3, 2013
|10 so far
Field Trip to the Museum of Contemporary Art
Bohemians, let's take a walk on the lighter side of life. We will go on a field trip to the MCASD in La Jolla for the exhibit "Laugh In," an exploration of comedic performance in contemporary art. If you'd like to tag along, what day would work best for you? https://www.mcasd.org/exhibitions/on-view
|Mar 15, 2015
|13 so far
Meetup members, Log in
By clicking "Sign up" or "Sign up using Facebook", you confirm that you accept our Terms of Service & Privacy Policy