The topic of this paper is about prediction of performance anomalies caused by software aging. We have developed a framework for detection of performance anomalies that is targeted to web and component-based applications. In this study, we selected some amount of historical data previously collected and we conducted a correlation analysis with this data. The resulting dataset was then submitted to some Machine-Learning (ML) classification algorithms. The best algorithms were selected according to the accuracy and precision. In a second step, we induced some synthetic aging scenarios (memory leaks and CPU contention) in the application and we tried to do estimation of the system parameters by using time-series analysis. With the estimated values we conducted a classification with the three previous ML algorithms. From the initial results we observed that combining the estimation of parameters supported by time-series models with ML classification techniques provides some good results on the prediction of performance anomalies. We also observed that there is no single ML algorithm that can be applied effectively to predict the response time for all the web-transactions.

The complexity of systems is considered an obstacle to the progress of the IT industry. Autonomic computing is presented as the alternative to cope with the growing complexity. It is a holistic approach, in which the systems are able to configure, heal, optimize, and protect by themselves. Web-based applications are an example of systems where the complexity is high. The number of components, their interoperability, and workload variations are factors that may lead to performance failures or unavailability scenarios. The occurrence of these scenarios affects the revenue and reputation of businesses that rely on these types of applications. In this article, we present a self-healing framework for Web-based applications ( SHõ WA). SHõ WA is composed by several modules, which monitor the application, analyze the data to detect and pinpoint anomalies, and execute recovery actions autonomously. The monitoring is done by a small aspect-oriented programming agent. This agent does not require changes to the application source code and includes adaptive and selective algorithms to regulate the level of monitoring. The anomalies are detected and pinpointed by means of statistical correlation. The data analysis detects changes in the server response time and analyzes if those changes are correlated with the workload or are due to a performance anomaly. In the presence of performance anomalies, the data analysis pinpoints the anomaly. Upon the pinpointing of anomalies, SHõ WA executes a recovery procedure. We also present a study about the detection and localization of anomalies, the accuracy of the data analysis, and the performance impact induced by SHõ WA. Two benchmarking applications, exercised through dynamic workloads, and different types of anomaly were considered in the study. The results reveal that (1) the capacity of SHõ WA to detect and pinpoint anomalies while the number of end users affected is low; (2) SHõ WA was able to detect anomalies without raising any false alarm; and (3) SHõ WA does not induce a significant performance overhead (throughput was affected in less than 1%, and the response time delay was no more than 2 milliseconds).

Cybersecurity is critical for mitigating the economic and reputational impacts of cyberattacks. To address these risks, frameworks like the NIST Cybersecurity Framework (NIST CSF) provide standardized guidelines for managing and reducing cybersecurity threats. This paper presents a maturity assessment approach aligned with the NIST CSF, incorporating a dual-survey methodology. The first survey engages cybersecurity experts to calibrate question importance, while the second targets organizations across management, IT staff, and other roles. The approach employs algorithms to deliver consistent evaluations and facilitate cross-organization comparisons. Results from case studies illustrate cybersecurity maturity levels for each NIST CSF function and highlight priority controls for enhancing organizational cybersecurity.

Performance management and dependability are two of the fundamental issues in business-critical applications. The ability to detect the occurrence of performance failures and anomalies has raised the attention of researchers in the last years. It is in fact a difficult problem, since a visible change in the performance can result from some natural cause (e.g., workload variations, upgrades) or by some internal anomaly or fault that may end up in a performance failure or application crash. Distinguish between the two scenarios is the goal of the framework presented in this paper. Our framework is targeted for web-based and component-based applications. It makes use of AOP-based monitoring, data correlation techniques and time-series alignment algorithms to spot the occurrence of performance anomalies avoiding false alarms due to workload variations. The paper includes some experimental results that show the effectiveness of our techniques under the occurrence of dynamic workloads and some fault-load situations.

The Domain Name Service (DNS) is a central point in the functioning of the internet. Just as organizations use domain names to enable the access to their computational services, malicious actors make use of domain names to point to the services under their control. Distinguishing between non-malicious and malicious domain names is extremely important, as it allows to grant or block the access to external services, maximizing the security of the organization and users. Nowadays there are many DNS firewall solutions. Most of these are based on known malicious domain lists that are being constantly updated. However, in this way, it is only possible to block known malicious communications, leaving out many others that can be malicious but are not known. Adopting machine learning to classify domains contributes to the detection of domains that are not yet on the block list. The dataset described in this manuscript is meant for supervised machine learning-based analysis of malicious and non-malicious domain names. The dataset was created from scratch, using publicly DNS logs of both malicious and non-malicious domain names. Using the domain name as input, 34 features were obtained. Features like the domain name entropy, number of strange characters and domain name length were obtained directly from the domain name. Other features like, domain name creation date, Internet Protocol (IP), open ports, geolocation were obtained from data enrichment processes (e.g. Open Source Intelligence (OSINT)). The class was determined considering the data source (malicious DNS log files and non-malicious DNS log files). The dataset consists of data from approximately 90000 domain names and it is balanced between 50% non-malicious and 50% of malicious domain names.