Good afternoon and a very warm welcome to the IAEA's webinar on the Artificial Intelligence Act, a balanced approach. My name is Joyce O'Connor and I chair the digital group here at the Institute of International and European Affairs. It's my great pleasure to welcome our distinguished speaker today, Yordanka Ivanova, a legal and policy officer in the European Commission, DG Connect. You are very welcome, Yordanka, and thank you for taking the time with us today. We appreciate it very much. As a member of the legal team who draft the commission's proposal for the regulation of AI, you are in an excellent position to discuss the Artificial Intelligence Act with us today, and we look forward to your presentation. Yordanka will speak to us for about 20 minutes, and I look forward to receiving questions from you, our audience for Yordanka, through the Q&A function at the bottom of your screen. Today's webinar will conclude at 1.50. A reminder also that today's presentation and Q&A is on the record, and please join our discussion on Twitter using the handle at IAEA. The European Commission's Draft Artificial Intelligence Act is the first comprehensive attempt at a global level to regulate specific issues of AI systems. It's probably a year ago in April 2021 that the Commission unveiled these regulations in the proposed AI Act. Following an extensive consultation process with all stakeholders, it is now going through the EU Legislative process. The proposed AI Act is a risk-based approach to classify AI systems with different requirements and obligations, according to their intended purpose and level of risks. Of course, a number of questions arise. Is this framework based on the right principles and approach to foster innovation and trustworthiness? What impact can we expect on AI producers and AI users? The EU Commission believes that the proposed AI Act should become the global standard if it is to be fully effective. Will the AI Act boost uptake of AI and guarantee a human-centric approach? Jerdanka will outline the thinking underpinning the AI Act proposal, and she will discuss the latest developments in relation to the proposed Act. As I've said, Jerdanka is a legal and policy officer in the European Commission DG Connect, which is responsible for AI policy development and coordination. And she is a member of that team who drafted the Commission's proposal for the regulation on AI. Before joining the Commission, Jerdanka worked as a researcher and attorney at law, advising companies on EU regulations in a wide range, including the area data protection, consumer rights, digital services, cybersecurity and copyright. Over to you, Jerdanka, and we really look forward to your presentation today. And thank you very much for being with us. Thank you so much, Jerd, for having me here with you and letting me present you the approach of the European Commission for the artificial intelligence and how we try to promote the trust of this technology. I'm just trying to share my presentation. Apologies for the hiccup. I hope you see it now well. And, yes. So, it's great to be here with you and engaging in this discussion. As a starting point, I will try to say that indeed, we have the Commission proposal package from last year, but it's been a long journey before we reach here. And artificial intelligence is one of the key priorities for the European Commission on which we have worked over the past almost four years and all this started already in 2014-18 when we had the first strategy. We have also, as mentioned by Joyce, a very extensive process and involvement of key experts, including from Ireland, from research academia in our high level expert group, which helped develop the guidelines for ethical and trustworthy artificial intelligence and all this also led us to the consultation process, which started with the white paper on artificial intelligence. This is an exceptional step in the EU legislative and policymaking process because what we really wanted to do with this initiative is to engage broadly with all stakeholders and think together how we can achieve our twin objectives, having the right ecosystem of excellence in Europe, which can help us develop this key technology for our digital sovereignty that can bring a lot of benefits also for the public, for consumers, for businesses, but also addressing the risks and ensuring the right level of trust of consumers and also guaranteeing that its use is aligned with our values. So with the white paper, we had extensive feedback from all kinds of stakeholders, more than 1,200 papers and a lot of discussions also with broader AI alliance of experts we have organized and now this helps us actually put up the two key deliverables last year, the coordinated plan on AI, which is the review of already set of actions we had set together with Member States how we can develop AI in Europe and make Europe a real world-class hub for development of AI and also the first proposal for regulation of artificial intelligence, as mentioned by Joyce, this is the first comprehensive attempt to regulate artificial intelligence, although we see that now in the national field there is an ongoing discussion and cooperation actually in setting common framework and standards so we are also working very much together with our partners while at the same time agreeing those actions internally in Europe. I will quickly present you briefly the coordinated plan because it is very important. The first deliverable is actually set out the joint commitment between the Commission and all Member States to develop together a very concrete set of actions, how we can develop artificial intelligence, make it accessible to companies, to users or around Europe and here we have a broad set of objectives, what we need to set is the right conditions including in terms of greater access to and sharing of good quality data, fostering computing capacities, collaboration with broad stakeholders, increasing our research capacities, creating also the right testing and experimentation infrastructure with specific facilities we fund, and also with the digital innovation hubs, probably you are familiar in every Member State, we'll have also with the new digital Europe program, even one of those hubs focus specifically for artificial intelligence, so with this we aim to give broad services to all companies, public authorities who are interested to test and invest in artificial intelligence. And then we also have a lot of actions in the area of skills because human resources are key, we need to keep our talents in Europe also to be upgraded, including also to cooperate internationally with partners and focus on some specific high impact areas, as you see here where we see the highest added value including in the mobility, agriculture, climate, health, public sector and others. So, this is really how we try to create, to encourage and to invest in artificial intelligence in Europe, but as I said before we have also been mindful that certain uses of those artificial intelligence technologies, they affect the society, they, because of the specific characteristics of AI like bias, opacity, dependency, unpredictability, they can also cause specific risks, and we, our objective is to ensure that this technology is trustworthy, and that it can deliver the benefits it promises. So that's why together with the whole set of actions, how we try to promote AI in Europe, we also put forward the first regulation, where we try to set the single European law, how artificial intelligence in Europe can be developed and promoted on the European single market. So we know already that we have a lot of existing legislation at place, but as I said before, because of the specific characteristics, because of the legal uncertainty and difficulty actually of effectively enforcing those existing crimes, we have seen the need to complement this legislation and create a single framework for internal markets, with common rules how companies can place on the market and use those systems. So this is a horizontal legislation, its objective is to apply across all sectors, public and private, because we think that this is the best way to create a consistent and clear legal framework that also builds trust in the market across the board. And our two main objectives with this legislation is indeed through this specific requirements to address the risk specifically to safety and fundamental rights, given the specific characteristics of certain AI applications, and also to create common rules and a single market in all European countries. So companies know how they can develop and market in a legally sound way they approach this in the union. We made an attempt really to complement not to overlap with existing legislation, so that's why this should not be conceived as next specialist for data protection or others. We are really here creating market based rules for how those systems are actually produced and marketed in the union, but we have also made sure that we are complementing and we are consisting also with with this existing legislation. And where relevant we have also tried to integrate specific procedures in other sectoral legislation that already exists. So we are building it very much on the product safety legislation framework and for already products for example that are now going to embed artificial intelligence. We are integrating and following the same new legislative model that we have already successfully achieved in the common European market for both. And with those rules, we also as mentioned by Joyce we try to be really proportional and regulate only what is strictly necessary to address those risks because we think this is also important for innovation to keep the rules clear but also limited to what is necessary. And also to give certainty to operators and to build trust in the market because we have seen already some pushbacks if those technologies are not properly designed and use that this could also negatively affect and actually discourage consumers, but also users to use the technology. And to keep our rules proportionate we are indeed following the risk based approach, and we are trying to set a common level playing field for actors who are designing and placing those systems irrespective of whether they are based in Europe or outside so the extent those systems are given to users in Europe and they produce their effects on people. We applied the same rules, which we think is very also important for the level. So here this slide is very important because it shows indeed the risk based approach we are following, because we don't try to regulate AI in general, we see that different use cases and applications for different risks. And to really keep the regulatory burden to the minimum, we follow this risk pyramid, and on the bottom, actually this is the largest category where we think that the majority of the existing applications are posing minimal or insignificant risks to fundamental rights and safety, and the existing legislation is sufficient to regulate those systems so we don't need to impose additional rules. But of course, if there is an interest they can follow also voluntarily similar ethical standards. Then on the yellow category you see the category where we think that certain AI applications like chatbots or deepfakes, because they have these risks of manipulation. It is important that we have this transparency towards users and they are informed if they are communicating with machine or with deepfake. So we think that this is more and more important in our world where we are engaged in a lot of digital interactions where chatbots are more and more resembling humans as well as deepfakes. And this is important to build trust in the technology. In the orange category we have the core of our proposal which covers high risk AI systems that are very specific cases we have identified when we see that those applications could have a very serious impact on fundamental rights or safety if they are not properly designed. So that's why we propose for those systems specific requirements, I'll talk more and on the next slide for them. But and also specific procedures before those systems can be placed on the market so we are sure that they are compliant. And on the top of the pyramid, we also have certain use cases of very limited for use cases where we think that these are really uses of artificial intelligence which are incompatible with our fundamental values and that's why it is important to clearly say that we don't want them in neural. Part of those are, for example, a manipulative and exploitative AI application, social scoring by public administration or renewable metric identification for personal purposes. And here I would like very briefly to touch upon the high risk categories again because this is maybe Joyce mentioned the impact of the regulation. This is the core impact of the regulation actually because providers of those systems that are built into categories will have to comply with these new requirements we propose. And then undergo also these conformity assessment procedures. So here we are trying to give very much legal certainty to operators, if they will be in the scope or not. So that's why we have identified certain AI systems that could be safety components of already regulated products like medical devices, machinery, which are already subject to third party conformity assessment. And also some other systems on the so-called cell-to-loan AI systems that are broadly grouped in eight areas where we see mainly implications for our fundamental rights because those issues have an important impact on us as society and also as citizens. For example, here you see the broad categories of biometric identification, critical infrastructure, certain use cases in education, employment, access to enjoyment of public services, law enforcement, migration, as well as administration of justice. But it's important to say that it's not the broad categories, we have really looked and identified specific use cases within those broad categories that will be only subject and we think that it's important to start with small use cases but be able to build progressively and add more if we see that there are more risks. So let me give you an example here. For example, in the education, it's not all AI applications that can be used in education, but only two use cases, for example, those that are really used already to determine eligibility of people to access education or also to assess them during tests and examinations, because we think that these are really the most important ones. And the same one, for example, for employment where we have only two limited cases, so we have really tried to be more proportionate in our approach but also ensure that this is a future proof regulation and we can add more along the line. And here we try for those systems to propose some very good baseline requirements that are built on the best practices that already exist, how to address the risks of artificial intelligence, those specific characteristics mentioned, capacity, unpredictability bias, and we build very much on the requirements of the high level expert group I mentioned before and we propose that it is important to have a risk management process where those risks are identified, to have good quality data so we ensure that the system is not biased and accurate, to have also documentation and logging capabilities so we ensure this with the ability, transparency and also sufficient information for users, human oversight measures, as well as robust and accuracy and cybersecurity. And our objective is to support this high level requirements with harmonized European standards, which will be developed by the European standardization organizations. So actually, our objective is to give the right technical solutions to companies, how to build designs of systems so they overcome these problems and they really ensure this human safety and transport net of the application. And then there are also a number of obligations for the providers who are mainly responsible to design, develop and market their systems and also check them with those conformity assessment procedures before them. They will also have to fix the C marking so this can build trust and it's a sort of a certification scheme and also register part of those systems in a publicly wide database, where we think that for users who rely and buy those systems from the market we try to have really only the limited obligations needed to ensure they just exercise the human oversight. And this is of course without prejudice without other existing legislation like the GDPR that normally applies to them. And we also have specific measures to support innovation with innovative tools like regulatory sandboxes where we try to encourage regulators and companies to cooperate, work together, experiment in a safe and controlled environment, how those AI systems are built. And also specific support measures for SMEs and startups because it is really important that the burden on those companies does not dissuade them from developing and investing in those technologies and that's why they need special support with the AI regulation and the coordinated plan to give them. And very briefly, this is just the government system because it's also important to have a good cooperation between national level, where we envisage mainly the enforcement of the system with national authorities, they will also have to cooperate with other responsible authorities, for example, linked to risks to fundamental rights, and also have a coordination mechanism at European level with an artificial intelligence board we are going to create. And I'm also an expert group with broad representation of stakeholders, similar to the high level expert group we had before, because it's really important also in developing and implementing this legislation to have involvement of all relevant parties and stakeholders. I'm going to finish by giving you this timeline which shows that now indeed we are in process of negotiations, there are important changes that are being discussed by the co-legislator, the parliament, the council who are making specific proposals. So it's a very interesting process, a lot of engagement too from stakeholders. And after we hope we can have the adoption next year, we will also have a three years of transitional period, so companies can prepare. And then in the meantime we also plan to have these harmonized standards and the technical solutions so we can actually help companies demonstrate compliance. So I stop here, and I'm very much looking forward to feedback and engaging discussion with you for the proposal, but also how to build together in Europe this ecosystem of excellence and trust.


Okay, what happened? Oh, 104, yeah. Hey guys, Realistic Gaming here. Before we start this video, I want to let you guys know that I partnered with this channel here, as you guys can see, called Four Night Films. If you guys want to go check it out, go subscribe to it and all that good stuff. It would mean so much to me, and I would appreciate it so much. Alright, so let's get started with today's video, called... Now, I don't know what kind of nightmares can happen at the Chrissy Krabby Society. It's a hash-linked slasher, man, as you guys can see. I think that's him right here. It kind of looks like a minion. I'm not sure, man. It's a dark shadow. Okay, so it says, oh, Rip Stephan Hillenberg. If you guys didn't know, that's the creator of Spongebob. He did pass away, like, in November of last year. So rest in peace to him, and thank him for all the childhood memories. Alright, so let's begin with this nightmare at the Chrissy Krabby. Okay, 9.27 p.m. Journal number one. Oh, look, we're in the kitchen. We have put some Krabby Patties. Hey, today is Tuesday at the Chrissy Krabby. Mr. Krabbs had Squidward and I worked the night shift. What? I've never seen the Chrissy Krabby open that night. I'm getting very tired, although, okay, so, oh, look, Squidward right there. Kind of camouflage. What? 1 a.m. Okay, so everything turned dark. Journal number two, although... What's going on with the TV? It turned red. What's going on with Squidward? I think the lights are out. I'm going to run. I'm going to turn on the lights in the TV to see what's happening outside the kitchen. Okay, seems like Squidward is arguing with someone. Okay, what happened? Oh, 1 a.m. Oh! Squidward just... Oh, my God, is that the hatchlinger slasher? Look, he's trying to break into the kitchen, and that's where we are. Holy Squidward! Oh, my God, not my boy. He was banging on the door. Okay, that's the hatchlinger slasher. Hatchlinger slasher. Got loads. What? SpongeBob has a gun? What in the world is going on? Oh! SpongeBob just shot the hatchlinger slasher. What? Oh, my God, okay, Squidward is dead. I hear something. Squidward warned me of the hatchlinger slasher. So there's more than one. They have to be way out of here. Okay, so we have to find a way out. So what time is it? It's like 1 a.m. or 3 a.m. Oh, God, what's going on here? Hey! I hear that music. Okay, Mr. Crab Safe will open. Mr. Crab Safe will open soon? Okay, so we have to wait for it to open or something? Oh, God. Dude, there's like 20 hatchlinger slasher outside. Get away from me! You guys are not allowed in the front of the crab, man. Oh, God. Okay, so it seems like we're going to have to fight these guys.  Suckers. Okay, let's look around the building. Let's try to look for stuff. There has to be some stuff around, I assume. To help us get out of here. Okay, so I saw the chum bucket. Oh, look, there's something back here. It's a little outpost. What is this? It says you must find and deliver Squidward's body from the grave and deliver it to the time machine. Where are we going to find Squidward's body at, man? Where are we going to find Squidward's body at, man? I have no idea, man. We're lost out here. Oh, it's a TV. Who is that? Oh! Oh, my God, that sounds pretty horrible, man. Dude, look at how many hatchlinger slashes there are. Maybe we have to take a... Let's just keep taking some down. Maybe we'll unlock something. Or something we'll unlock. Oh, God. Please get away from me. Give me some space. Okay, let's try to go inside the chum bucket. Oh, my God. This guy just keeps spawning in. Okay, back away, man. Okay, it says plankton needs a formula. We need to get the formula for plankton. Dude, back away, man. Oh, God. Why is there a red flashing light? Let's go back over there. Wait, let's go check out the bus. Maybe we can get out of here. Use a bus. Okay, infinity spatula required to start ignition. Great. When you use a spatula to start up a bus, that makes no sense, man.  Okay, we only have 28 more bullets. That is not good. Oh, God. Please. Somebody help me. There has to be somebody around here, man. Dude, we're never going to be able to take all these guys down. Like a whole army. Okay, we only have four bullets. Okay, don't get near me. Great. We have no ammo. Can we close the doors? No, we can't. Oh, my God. Okay, so maybe we can buy a new gun? What is that? Maybe something opened. Maybe the safe? No. Oh, my God, it's still closed. Okay, can we buy the shotgun? No, we can't. Oh, my God, no. Dude, we can't let them come in here. No. If they come in here, they're going to trap us. Okay, how do we get this? Press F. Okay, press F. Oh, my God. Oh, my God, Mr. Krabs is mad because we just bought a weapon. We're spending all his money. Oh, my God. Can we clear paths? Dude, they just threw the table. No. They're going to trap us in here. Look at the table, man. Dude, how are we going to get out of here? This is impossible. We're trapped. Okay, maybe we can do a laugh around these guys. Oh, my God. Okay, this is just too much. There's too many of them, man. Oh, no. We can get the formula now. Okay, let's try to get out and then come back in. We'll come back for the formula. I'll be back. I promise. I mean, we actually have to come back in order to try to pass. So, let's do a quick little lap out here. Dude, this is not fair. They keep spawning in. It's like never ending. Oh, my God. Okay, are they all out? Nope. Great, man. Can you guys just hurry up and get out of there? Oh, you just hit me. Take that. Oh, no, there's another one next to me. Dude, okay, they're taking forever to get out of there. I don't want to waste all my ammo again. Oh, my God. Okay, we're going to try to go in there.  Come on. Okay, we can sprint, I think. Well, it seems like he's actually sprinting. Let's go grab it. Let's grab this thing. Okay, we got the formula. Let's go to the chum bucket. Can we buy some ammo real quick? How do you buy ammo? Yes. Not enough money. Okay. Oh, my God. Okay, so they trapped us in here. Let's get a couple before we get the formula. All right, you guys, we managed to get the secret crab and patty formula. Let's go. Let's get some ammo. Oh, no, dude, every time we try to escape, they come in. You got to be kidding me, man. This is a setup. This is a trap, man. Okay, let's try to wait for them to come in. And then we'll sneak around them, hopefully. Because, I mean, it is way too many of them to get past. I don't know if this is going to be possible. Please. Oh, my God. Oh, you see an exit? Get away. Oh, my God, they hit me. Okay, we got out. Let's head over to the chum bucket. Yeet, I'm out. Okay, we made it. Let's go in the chum bucket now. Let me in. 4 a.m. Oh, my God, it's 4 a.m. already. Chum bucket. Okay, what can we get off the menu? What do you guys want? There's chum barriers, fries, shake, chump on a stick, plank things. Well, well, well, if it isn't SpongeBob, you fell into my trap. That's right, this whole thing was just an experiment to get the formula. I didn't even have to walk into the Krusty Krab myself. Now that I have the formula, I'm gonna dominate the world.  Oh, my God, that does sound like Plankton.  Oh, my God, that's him in his robot suit?  I need to fight him before he does. It looks like their flamethrower is on his arms. What? How am I supposed to... Oh, my God! How am I supposed to destroy this thing? It's a robot! It's like I'm fighting the Transformers. Or a Power Ranger, man. Oh, his house is going down pretty fast. Alright, let's just keep shooting him in the stomach. I think that's his weak spot. C. Needle. Oh, I see why it's called C. Needle. There's something behind him.  No! Okay, we can't go... We can't get caught by that flame.  Oh, my God. I'm out. Okay, let's keep shooting him in the stomach, man. Oh, my God, we're right under the fire. I can feel the fire! Oh, my God. Oh, no, no, no, no, no. That was so close. I feel like it's gonna take forever to defeat Plankton, man. Okay, we got this. Just gotta keep running in a giant circle. We'll defeat this giant robot, Plankton. Oh, no, dude, the fire's right above our head. You gotta be more careful than that, man. Come on. It's more than halfway done. Not so hard after all. That is gonna be a little more difficult. Oh! Jeez. It's nearly burned my hair off, man. Even though SpongeBob doesn't have hair. Come on. No, no, no, no. Come on, we're almost there, please. I swear, if I oof here, I'm gonna rage quit, because, like, we're almost there. Oh! There you go. We defeated Plankton. Okay, now what? I feel like if that's the best ending, Plankton died in an explosion after fighting SpongeBob. He never used a formula or conquered the land outside of the beginning bottom. The explosion had toxic fumes that killed him. Sandy successfully survived the outbreak after building a jetpack. She also built the end-distributed weapons to surviving citizens, which led to many more people surviving. Oh, my God. Thank you, Sandy. Mr. Krabs is his arsenal and escaped beginning bottom with his daughter, Pearl. Nobody knows where he went and what happened to him. He was never seen again. What? Mr. Krabs vanished? Squidward died in a tragic death due to the hatchling he slashed that she was made in a memorial displayed in the beginning bottom years later. His heart was also recognized. Oh, my God. I couldn't finish. But rest in peace, him. Patrick survived the outbreak. He used his house as a rock underground shelter. It is the normal life in the beginning bottom today. Typical Patrick. The beginning bottom was in ruins after the fire. 75% of the population died or left. It has still been restored today. More citizens are moving in. Oh, my God. He goes lower, spooned up, lived on more than 30 more years and died peacefully. A peaceful death. The entire ocean's house, spooned up as a hero, saved the sea. That shows I'm made around the beginning bottom. Rest in peace, Devin Hillenberg. Oh, my God. That is so sad. Congrats. You just beat the game. Or did you? I heard there were multiple endings. What? Oh, yeah. We didn't get the... Remember how we were supposed to get the body, Squidward's body? We were supposed to put in that shack back there? But like, I have no idea where we could find it.  Maybe he was buried in there or something, man. We played, man, you, I don't know, man. But we got the good ending and said good ending there at the end because we defeated the robot, Plankton. Well, that was The Nightmares at the Curse of Crabby, guys. If you guys enjoyed the video, just make sure to slap the like button. If you're new to the channel, make sure to subscribe and hit that notification bell. And I will see you guys in the next one. Bye.


With the University of Southern Mississippi and the anti-child porn organization now incorporated. At this point I'll probably have to say that University of Southern Mississippi has the greatest IT department computer science program. I have to say that now. Can you hear me? All righty. Again, my name is Tim Lawless with the University of Southern Mississippi and anti-child porn organization. I'm here to talk about a little project I've been working on in St. Jude where we're trying to detect improper root transitions. Come on. Wake up. There we go. Of course, the computer thinks it's a Monday too. Actually, no, Star Office. Really, really heck with this person. This is my email address and we'll be dropping this presentation plus other information out on this URL a little bit later on today. St. Jude really came about because in our institution we have to allow clear text passwords on a lot of systems, which as you know is the most evil thing that one can do. Once you get in, they pretty much, it's just a matter of time. So we started looking for a way to save ourselves a lot of time from sleeping on the floor. One thing led to another. Guy put forth an idea back in October, I believe, of 97 in a system in magazine about actually trying to detect the transitions into the root user by monitoring audit trails under Solaris. That's really where we got the beginning of this and has come forward. The reason why we had to go and start looking at things like this is because our firewalls really would not protect us. We're also with clear text passwords coming in. Our users themselves will expose our systems. They're sometimes our best friends and our worst enemies. The misuse detection scanners like Snort and the like really would not pick up everything. We've already seen how they can be bypassed, how the systems that we're putting out on our hosts really themselves can be defeated and you will see this continually through the day. And of course, we've come to love our Unix vendors, the ones who give us new root exploits and every update that they send out. And we also, the problem also with our detections that you may go one, two days without finding it. Unfortunately, the system ends real-time on vacation. And the longer that that is, the more damage will be done to the system. But anytime that they're on the system, we can't trust anything really on the system itself. So that's where we began. When we began the project, we wanted to produce ultimately critical level IDS implementation. Our target was Solaris, but we went over to Linux because it was easier to do development. There was a little bit more information just to get the wheels going. I can't. We also wanted to try to minimize the number of false positives that we would be getting. And of course, the negatives. That was a problem with the original implementation put forth and systemed in is a heap load of false negatives. Before we would be able to really respond to anything, we wanted to reduce those false negatives and false positives to a point where we won't shoot our users, plus we'll be able to catch enough of what's really going on. So what we were doing, we used reference monitoring implementation. I believe you'll probably hear a little bit more about this later on this evening when a gentleman talks about penetrating B1 systems. We also went to a rule-based anomaly detection. Just a moment, I'll go in a little bit more about that in a model of behavior for execution after we're doing copious BSM outputs. Before we get into this, I'll go into a little bit that we're going to talk about subjects and objects. How many here have dealt with maybe trusted operating systems? Good. Excellent. So you'll follow what I'm saying. The subjects are the things that do things onto other things. Well, the objects are those which are being done too. A little bit better definition is put up there. We'll also sometimes see that our subjects will be the objects themselves. The reference monitor, it will be enforcing our policy by forcing all actions performed by the subject to actually go through it. It will act as a stop-gap to prevent things from occurring which we really do not want to occur. The rule-based anomaly IDS as opposed to our statistical anomaly IDS systems. Given a rule set, if we're looking at a chain of events, we'll start off with the beginning where we'll enter the rule set. And we'll move forward. If at some point one of the options at that point is not actually what is occurring, we have an anomaly going on. That's really what this guy's about. It was implemented at LOLNL and the Wisdom Incense and also the TIMS Project with Digital Corporation. What we're going to be doing is looking at, we take every subject or process in our case. We would classify it as being a privileged or uncrivileged process. The privileges won't be rude, but it also would be a set of root plus somebody else. This would allow us to detect transitions into, say, oracle users or other damage that we're running within the system. Unprivileged subjects, just normal user processes, will transition up, like we know, through execution of the set UAD binaries. And doing so, we then have to catch them and determine how they're beginning, where they're beginning, and the chain of events that may then occur. The privileged subjects, the processes, will drop their privileges through one of, and one of these three calls. I believe under Salish, we'll be dealing with a fourth one. Given the subject with privilege, and this is really where the decision is made, they may execute any other following system to exceed. Only if the subject first drops its privileges through one of the means we just talked about before, and the object is within the restriction list, within the rule base. A subject without privilege may execute any object. Just a normal user may go about his daily life. As long as they do not transition up into a privileged state, we're going to be perfect if they can't allow them to do what they want. Now upon execution, we're going to have to do some stuff and juggle around, change our states, where once upon execution, the new subjects restriction list will be updated based upon the subjects prior state and the objects executed. I'll show you in a moment where we go through and have to serve running and binary. He calls another function and he's okay to execute. We've already passed it on. The binary will then find the best rule and we have to ensure that the next rule for what the next guy, this about to run, can do is a subset of the current processes rule. Otherwise, we could gain privileges just merely by executing a certain path of applications. And finally, a subject's update restriction must be subject to our restriction list in a minute or two. This is currently where we're standing right now. We've got a Slurs Perl implementation. It'll run currently under Slurs 251 through 8. It has some problems with its arguments where it will not give those out to us in the BSM. It's not yet been fixed by some microsystems. And the current Linux implementation is running at this time not a multiprocessor system. We do not use argv's for context in the Perl module at this point, but under Slurs, under the Linux kernel, we are using the arguments to decide a context. The reason this being is some applications will make a call system, for example, which goes out there and will run slash bin slash sh with v dash minus c, and then the argument passed the system as the third argv. Without being able to look at our argv's for the context of what we wanted to do, we would then just have to allow these programs that are executing a system call to then just go merely out and run in the shell, which is something bad. We're hoping to have an internal slurs implementation out and around Christmas of this year. This year, maybe early 2001 at worst, probably in the I-277 point, Slurs 7 kernel 80 at worst. I'm just going to show you. I'll switch the slides, I'm sorry. Externally, internal versus external, inside or outside the kernel. When we implement, when we would do this, to be able to really stop the things before they occur, we would have to do it within the kernel to cramp them. However, when we go into the kernel, some things change. Externally, when we get them up through our audit trails, each event is a discrete instance. In one line is one event. We have all the information about what's going on while inside the kernel. We're watching it as it's actually going on. Sometimes we have to wait until another event occurs before we can really determine what happened with the prior event. For example, with the execution of a set UID binary, the execution code down in the file system objects in the Linux kernel will actually set the UID and the effective user ID to zero during the execution phase. However, since exec never returns, we never really know that a set UID binary has in fact been executed until another event occurs and we can really see, we can infer from what has changed in the state of the system that it was in fact a set UID binary that went forth and then we build our trees from there. Externally, the detection is delayed. In the Solare implementation, we're seeing about two, three seconds on a single processor system, a little bit less on a multiple processor system, but at that point we begin racing to see who can kill whom first. Also, externally, it is easy within those two seconds, two, three seconds to strip a kill of the external monitor. Within the kernel, it's a little bit harder. You would have to do it before actually doing an exec, which would require you to have the code within the module itself. For example, this little application will execute a bash shell. If it set UID root, it would give us root normally. Over here for a second. Normally, we're running this. We've dropped out to a root shell upon execution of the binary. However, going through the syncing model. The font? Yes, sir. Just a second, please. I'm sorry. Let me find a nice... This has been with the font. Maybe that'll work. Whoa. It did get big. Well... Okay, let's try this one again. Normally, we'd be dropped out to a root shell. Possibly. Hi, sir. Normally, at this point, your friendly administrator will spend the next evening. Instead of with his wife and kids, we're building a system. What we want to do... What we want to do, I'm sorry, let me just...  And then it catches the exec just as it begins. It kills it at the exec process, and... We just dropped out a message to our KLOG. There are some... This would catch the buffer overflows. We tried it with several buffer... We pretty much saw the buffer overflows. We could. I try not to keep many buffer overflow vulnerabilities on my laptop. I apologize. I'm nervous. You can tell. Let's see if I can just minimize this guy. Right now, there's no other tracing. We're playing into kernel. Well, we're not outputting any tracing. There's some extra tracing in there depending on the compile time defines you do. But right now, the minimal ones will just make a hard drive rattle for several hours for just running an LS. It is feasible to add in additional tracing into the system. Just modifying the source code of the main app. Let's see if I'll... I'll get into the source code in just a minute. Let me find the window. I want to... I'm going to have to fast forward through these again probably. Unfortunately, some things in Unix are not quite as good as they are in Windows yet. Pay attention to... I feel like I'm doing patches right now. Unfortunately, right now, there's no silver bullet. Not even this guy can really stop everything. He would be just another layer in there. For example, with the buffer overflow, the buffer overflow actually does occur. The shell code does get executed. However, just at that execute is where it's caught and it stopped. That's why I'm referring to... That's what it's referred to as the last ditch effort right before Hellfire and Bromstone falls down upon us. Also, the restriction rules must be written. There are some applications, for example, I discovered when I came here, I have been spoiled all my life and have not used PPP yet, that the using that CTL script causes that module to go really wild. So you have to go through and write out the rules in the script before it will not catch those and actually let them pass. Also, there's the additional overhead. As we're playing around with the kernel, just doing the extra stuff and lunging the data, it costs a little bit. Just executing user processes without going through having to do any of the checks. We're seeing less than 1% slowdown. However, let's say we're root and we're compiling a kernel. See almost a 5% slowdown at that point. And it's really spending it in system time now because we're having to update all of our checklists. There's really no optimizations in at this time. We do have some inline functions, but that's it. Now, the rule sense that I spoke of, that's the end of the slide presentation. No network connection right now. Oh yeah, well, we'll just hit that right here. Well, unfortunately it's not PowerPoint, but religious reasons prevent me from using that. That's the contact information once again. Probably by 1 or 2 o'clock this afternoon, we'll probably have this PowerPoint out there along with the source code. The source code is available on PacketStorm at this time. I sent out an update last night. You got it? Good? Okay. Now, let's try to get this a little bit smaller. Much better. Can you read? Whoa. For example, right down here are the general rules that we've, the rule sense, and unfortunately we're having to compel them in by hand right now not reading them at low time. We do want to be able to go to root sometimes, and so we're going to have some guys that really have to be granted an IA pardon. SU and Pseudo, by the way Pseudo is bad, you should never use it, are in there. Gene Mixer was one that just had to go in there because it will execute mod probe through system as root.  Are there any questions? Yes? Pardon? No. A set UAD process may execute. However, it may not execute other processes by default. The default rule down here is actually rule zero, which is nine, you can really go through and execute nothing else, but that set UAD process itself may execute. By granting all privileges it may, it has carte blanche in your system. SU and Pseudo, of course, would be applicable, we'd want to do that. I don't think there would be anything else we'd want to do that for. Some of the testing that we did, just with a couple things, gets really long. Unfortunately, that's the nature of the beast right now for this guy. We're wanting to add in later support for just loading it in from a configuration file. Yes, right now I can. There is the option in there commented out for debugging purposes to prevent the loading of the unloading options. We just replaced the load and the clear module syscalls in there. Now it is still possible to attack it through KMM. However, personally using lids to prevent that may be something put in this guy later on in the future. Policy such as what we're looking at, what we're just looking at. Initially, what we'd have to go do is go through a learning phase where we just run through the system normally in a safe environment. Not plugged into the network, we just hope we know what we're going to run on the system beforehand. After determining from the output of the learning process, which is, does everything, but still permits it to actually execute. It just gives us the error message and from those we then would be able to write these rules. Once that these rules are populated, you've recompiled without the learning option enabled, you'd load that in and go from there. When you make changes to the system which may require these root execute features, you'd have to modify and reload from there. Not through this guy. He wraps himself around the kernel at this point. In fact, let me just go into... Also, since we can't link when we build the module to make it manageable, we've done includes my C professor shit when he saw this. I think I committed a sin. And loading the module, this is just handling the execs since... I point you to the stuff by pragmatic of THC for how to handle execs. We're going down here, what we do is we're saving the original CIS call to a pointer, replacing it with our wrapper. And within that wrapper, we're going to make a call to that original CIS call. So we just wrap ourselves around the kernel. We're not actually being invasive. And that's why we can actually pull ourselves out without much problem. That would be possible. Would not be part of the module itself because it would be such an expensive process to do. Probably through a proc file system interface with a monitoring daemon running. That you would be able to do that. I'm sorry. It was asked whether we would be able to, at some later point, modify this so that it would communicate or be able to attack the offending processes, offending users' processes and pretty much retaliate against the login instance that may be perpetrating this. Would I be correct in saying that? Basically be able to take a dump of memory and just... That would be something we'd be doing in an external monitoring application. The dumping of memory and gathering of further information about the offending processes. Yeah, during the execs, forks, and to a much lesser extent, the set UIDs and exits. Yeah, I could see how it would be much easier to do it in user space versus kernel space since a lot of the fun with viewing it in kernel spaces, you've got your set right here and you're limited in what you can do. A lot of just string calls. You're going to have to write them yourself since you cannot call external libraries while in kernel space. Plus, if you core dump in kernel space, that's a bad thing. Yes, we lost exec many times. Everything keeps running, nothing else will. But after we load the functions and wrapper cells, it just goes on. Right now we're allowed to clean up a module, we free our memory and go on. What normally we do to prevent you from cleaning up or loading in other modules is we just replace those with an error message of either for loading no memory or for clean up module, module not found. It just errors out and blocks any attempts to add or remove because those syscalls can be called from within, for example, buffer overflow. Apache runs as nobody, so really you'd be hitting just running in user space at that point. If you're just without privilege, just not root, we branch out just into the wrapper and go straight to the syscall itself, so it's practically no expense if you're just doing user stuff. Name D, let's say you're not running name D as root. Just a moment on that, but let's say you're running name D as root and that guy was cracked. If you had no, he could not really execute anything else after that. Maybe name DX for it would be the only thing he would be allowed to run. It would catch that with one caveat. We still have a lot of the stuff that starts up at the beginning. We're still generating rules for that and we're working on handling a login because login will sometimes transition over, be logged in root on console or login user. We're playing with how we would handle that guy right now. That would be one thing that would come out within the next two conversions. The question would be to load with an Apache web server. Other web servers, I have run this with Roxxon without any problems. Just running regular CGIs. Unless I shoot myself in the foot by making an error in my logic. We can go with all, with a set of privileges, which root will always be the superset. Easier for just development, right now it's been root. That's been the part where my headache personally came from which caused me to really want to do this. I don't like sleeping on machine room floors. I asked why are we just limiting this to root transitions. Also transitioning from user to user until you transition into that root user. You can have your other IDS utilities running out there as root with more privilege than that user. Monitoring them, T2I Snoop, other applications, watching logs. But once they actually acquire that root privilege in their ended system, you can no longer trust that stuff. So the only thing that has more privilege than root is kernel. Anything? Pardon? Issue, well right now because the root... The question is, if you're using SU, is there anything to help? I'm not quite sure if I fully understand what you're... Unfortunately right now, SU is a trusted binary. To keep it more secure. If SU is... If you can root SU, especially on the Linux box, congratulations man, don't let anyone find out about it. You could own the world, literally. But yeah, SUTO, I do it for convenience, but really, SU would be the only one you really should have in there. I hope SU is secure. I hope people have been hacking on it, trying to get it not to be secure enough. Yes sir, back in the back. I'm storing the argument itself, not the inode. So moving around files on the file system would not affect it. It's a little bit... I think you were probably going towards the lids project in that question. We're really not doing ACLs at any point in here. If flush bin is SU, it could be replaced, yes. However, I hope the file system is set up properly. It should not be easily replaced without already having the privilege which we're trying to acquire. And then again, if they have physical access to your machine, you might as well just pack it up and go home. Pardon sir? Copy a set UID binary. No, because we're actually looking at the file name as it's coming in through the exec, which is the fully qualified path name, not the arg-via-0. The guy we were asking if, for example, you created a user bin under your home directory and would run SU under that, would that be it? Which I think you were trying to get if we're checking slash arg-via-0, you'd have relative path issues. I see each route. Actually, I don't know. I'd have to try that back in the hotel room. That would be correct. You would not be able to give it, set UID route privileges. You'd have to have a collaborating administrator or a negligent one. Right now, pretty much within a group, just the guys have been beating on it. A few other people would like to see what people could do to it. Yes, sir, right in the back. The question was if NARC was loaded prior to this module actually being loaded onto this system, would it be able to detect the route transitions? If you tried to execute something, like let's say an LS, or just a command through the system, it would catch that. If just any Trojan binary that you would just say anything, just not even that guy, if he did not have to call exec up to that point, it would not go through the reference monitor to be stopped or permitted through it. Yes, ma'am. Right now, well, the question is why, why is a symmetrical multiple processor box has been exceeded at this point? At this point, we are not handling spin locks within the code, so race conditions probably would occur. That is something else to be going into. First need to get a good S&P box that I can crash. Yes, ma'am? Could you repeat that a little bit louder? We're not using, let me just go into that and I'll show you. Where is that? This question, if you modified RGV of 0 to point to a legitimate file, would it be able to bypass it? No, that was one that actually came up earlier on in the testing. What is it? Try S calls. We're not using the file name that actually comes in through the exec statement, which is really what is executed. That's what we're using for it to figure out what you're going to run out. Run, yeah. Yes, sir? Well, if it is a buffer overflow. That is, this guy, sorry. Is there a Sean Hedges in this room? Sean Hedges? Okay. Sorry, could you repeat for me? The memory that's been overwritten is not in kernel space. The memory that's overwritten is on the stack at that point in time. You're not in the kernel memory at that point. You're still actually in user space. We try to terminate the process at that point, exit the process, literally just destroying the fending application because after that buffer overflow and we deny the exec, it's not deterministic what will happen. The shell code will execute on the buffer overflow. It stops it at the exec itself. You call the syscalls. Yes. In normal production, you would not have the unloading of the module. We would be overriding actually replacing the syscalls for loading and unloading the module where you would have to go through an attack came down at that point. Yes, sir? To run the actual shell, not the exec calls. The question is if you could actually just write a shell in the buffer. That was actually not the attack that we have recently been actually looking at, such as not so much writing a shell, but writing what you want to occur within the attack, within it, for say, just to give you an example, one that we're trying to work on now is handling, you call open, open ecc password and write mode, write out a new line, close the file. Probably even take up less space than what you're probably shooting at. At which point that's where you bring in other applications, not a silver bullet. Things like lids, we actually be watching and protecting these files. Yes, sir? That would be something that we'd be doing actually in an external application. I'm sorry. Pardon? Actually, you would have to copy the binary over. Yes. You would be wanting to, using applications like lids where you would be protecting the files themselves, your read file systems, yes. And with, it is 1046. So if there are any other questions, thank you for coming.


Right, so you can see the screen and everything right. Yes. Yes. So first off, allow me to apologize because my voice just abandoned me cruelly today, and then I would like to thank all the organizers for giving me the opportunity to talk to you today here in this lovely workshop out. So I'm going to talk about the non-equilibrium energy harvesting systems. Let me just say to begin with, that all of this is going to be contained in this, in this paper that it's now available on archive. And our research question begins with the following which is, we look at all of these molecular systems that have this twofold structure in which we have some, say, in this case the Krebs cycle we have some backbone structure biochemical structure, and it's going to be driven out of equilibrium by these enzymes that are operating on top, and therefore, it's main goal is to actually extract some ATP and store it into some reservoir. Now we call these such systems energy harvesting systems. And we ask the question, are there limitations at the thermodynamic limitations that we can actually derive formally for these types of molecular energy harvesting systems, we believe so. And I will finish very quickly, how do we actually go on and tackle this problem. To begin with, we need to have some, a bit of a setup or some definitions, and we actually are going to consider the following system, where we have a non-equilibrium environment, and then we have what we call the baseline and the efficient rates that are going to be all encoded in this matrix are right. Then we also have a reservoir with which you can exchange it and we have very importantly, a work reservoir where we actually will store this energy that the system's goal is to basically harvest right. The non-equilibrium environment is actually going to drive the system which is going to be an important part. And then at this point we will say that there is one unique non-equilibrium steady state, which we call pi, for this system so far. You think of this system as the backbone so far here, we have, if you want, this biochemical backbone that I just showed before from the prep cycle. And now we add another type of transitions, which we name control, but this is just nomenclature. It's not exactly, you can think of them as control from control theory, but it's not really necessary to think of this as way, it's just nomenclature that we add. And these are going to be fine, right? So for example, the transition matrix corresponds to this new set of transitions that we put on top of the previous baseline is going to be primed. Also there will be some work exchanged with the reservoir and as well as dissipation, but importantly control, we will set it in such a way that it cannot be invoked such that it changes the driver of this non-equilibrium environment comes as part of the baseline and its driving comes as part of the baseline but not as part of this control. Let me give you a very simple example that I hope that will somehow move us beyond this formal definition into something that it's a bit more tangible and we actually solve this problem in our paper. We solve also two other problems and this particular one consists of a ring of states, there is like n states. If you forget about this thing over here for a second, if you consider the fully symmetric ring in the study field of ring, right? So we expect this to go into some equilibrium steady state which is basically unidistributed. Now let's consider how the environment is going to apply here and we are going to do it in a very, very simple form. Actually, we're going to take it to be dissipative less, although you can also add that to another problem. Suppose that our environment in this cycle basically works as follows. If there's a transition from one to two, then theta KT or theta joules of energy is going to be stored into the work reservoir and then vice versa if there's a transition from two to one. For this particular example, we take it to be dissipative less, we can also move beyond that. So how, if this is the baseline of my system, how can I imagine those control mechanisms, those control transitions? Well, we can think of them as I said, as I introduced in the beginning, just as an enzyme, right, that can be driven out of like depleting part of the energy available from the work reservoir is connected to the system. This also can include some dissipation. And basically the goal here is that if I manage to have such an enzyme, right, maybe we can think of an evolutionary process that needs to give rise to the enzyme. Then I can drive the system in a clockwise manner. They're in a way that I can store more and more energy. And then here the problem is, is there some balance because this is also self maintaining process that corresponds to this control and code mechanisms that also entail some cost, some cost, sorry. And then the question is, can we actually find some universal balance that will give us sort of like an upper bound on the maximum power that it can be stored in this in this way. Before we go to the main goal here, let me just maybe rephrase this whole situation into a bit of a more formal but also heuristic sort of approach. Remember that I said pi was our steady state for the baseline. Therefore, this is without any control mechanisms. But it doesn't have to be equidistributed all the time just like for exemplary purposes here it is. And now when I add a control mechanism, all I'm all I'm doing is I'm shifting away from this baseline distribution right to another distribution, which basically its aim is to actually map or get closer to the distribution of the states that yield the highest amount of energy into the reservoir. Right, so this is sort of what is the operation that is being carried on underneath this process of adding control mechanism. This is the goal of the system to harvest the most, the maximum amount of energy possible, the maximum amount of power. But importantly, whenever you have such a such a departure from one, from one distribution to another, then you can actually have some cost that they can be measured through entropic terms and you'll see how in a second. This actually leads me to the main, the main point of this. This talk, which is the result here with whatever we think here is on the left hand side we have the maximum increase on power that can ever be achieved for any given system with separated as I explained with the baseline and control mechanisms. But on the right hand side we have the computation for these upper bound this is an upper bound. And importantly just very briefly, these right hand side corresponds to a complex optimization problem that contains two terms is like a trade off right. On the one hand we have the cost of maintaining the speed is distributed going to be far away from pi pi remember is the baseline steady state distribution. You can, this is actually an entropic term here, and then the other term will just be the benefits, which it comes in terms of a workflow okay, just to be clear all of these V and q, these are all fluxes so these are not just gross values but actually fluxes on this system at steady state. Great. And now we see one of one important result here is that these upper bound, if you actually go in detail and observe these two terms, these upper bound is computed, regardless of the control mechanism that one should impose. What does this mean, this means that remember in our previous example right in this sort of like bio bio chemically inspired example we have an enzyme over here and we set out these and can be driving the system in a way that I get a net current over in the clockwise direction so force, and therefore I can extract more energy that if I stay in the steady state which in this case gives yields no net energy. I can't go to the system, but the point of this result is that if I for example imagine any other set of control mechanisms. These are actually going to be bounded exactly by the same computation here which is given by this complex optimization. Right. Now this complex optimization problem which basically aims is that finding this solution P, which we show with the show can be can be always found. And also, that it can be saturated by using Markovian control mechanisms, but then you, your first need to show need to solve this problem this complex optimization problem which is not a trivial thing to do. And in fact, not even for a two state system you'll find close general close from solutions. However, there are close from solutions in three distinctive regimes that we that we show in the paper and describe how to, how to arrive at them. So briefly and again from a heuristical standpoint, these three regimes with their return them linear response microscopic and far from equilibrium in each of the cases for example here it's kind of easy to understand what's going on. Right here we have the baseline again in the same sort of like a realistic approach have a baseline and deviating from the baseline is rather costly so this means that this term here is very high. And therefore you can only go ever so slightly away from the baseline and that actually give rise to some approximation that you can solve in the close form solution, the microscopic case is kind of the other extreme. I'll give you some hint of the towards the end of the talk of how do you actually make sure whether you are in the microscopic or the linear response regime, but very naively, this corresponds to the case in which you have a high abundance of glucose in the system, for example, and therefore you can spend as much energy as you want to pay this cost, and you just go into a delta function. It is very extreme of course but it's just like a mathematical approach. All right. So, finally, far from equilibrium is just an operative expansion of this microscopic regime. These three cases can be explicitly put in close form for any, for any system for the case of the ring that I showed you. We actually did so and it shows that it is very well in accordance with numerical solutions here exact means that I am performing some numerical analysis on this complex optimization problem. I don't have the linear response kids perfectly where you expect it to be which is low energies and so on, the microscopic regime will all will only take a whole once you go to very high energies. Also, the, the optimal probability distributions can be shown in close form for the three limiting regimes, and then it all can also be computed and checked for this particular case. And finally, last remark in this in the sense is that one of the interesting aspects that you can figure out is for example that if you're considered this is being and you go for large and this means that you have a very large number of states, you find interesting relations but not only the increase in power that you can, that you have upper bounded for whatever control mechanisms you can come up with goes like feet a square this is remember the energy that is input by the non-equilibrium environment but also you have this scaling as one of our end which somehow somehow if you can, you can think of this kind of constraints what type of chemical cycles you would like to go to if your goal is basically to maximize energy harvest. And this is my main point here so basically I talked about how there are limits in energy harvesting systems and this can be actually figured out for any type of control mechanisms as well as long as you have this distinction between control, so then you have this type sort of universality. There are close form solutions that are in pre regimes in the paper we described with a more accuracy that I've been able to have the time to do here. How do you can actually distinguish these three regimes and they're actually there is a dimensional parameter that you can always compute for a system, which allows you to do that. You can generate a generalized these for fluctuating environments so here I talked about environments that are not fluctuating but you can go beyond that and it's all explicit in the paper. So just allow me to thank again all the organizers and more collaborators and all these funding agencies here and thank you very much for your attention. Thank you very much already for a great talk. And there was a question during the chat by Tom, so maybe he wants to. Hey, so a question. Thanks for the talk a question about what alterations you see. So the default system I come up with your baseline system that includes the work reservoir doesn't. Yes, yes. Sorry. Yeah. Yeah. And presumably some temperature bath. Yes, in India. And you then imagine adding something to it. What do you allow yourself to add. Do you allow new transitions new states, or, or varied transition rates of the between the states. That's a great question. Thank you very much for asking it because this is the bit of like the need to give you the other paper. I encourage you to maybe go find it because it's clear there but let me give you a few answers to this. Yeah, the work reservoir he belongs to the system. So if we go here, before we actually have any control mechanisms, the water reservoir is part of the system the environment is also part of the system. Okay, and the, there's a heat reservoir and you exchange heat with that. Now control mechanisms, you can add other other transitions between states you cannot add new states. In general, not in the, in the, in the, I think that you know, you couldn't do that in general for for our system here. And importantly, and I think I mentioned these, the control mechanism is, I think it to give you an example like imagine that your, your environment is concentration of glucose. So like I say, and I'm going to control the system by increasing the amount of glucose that is involved in the environment so therefore you would have like some, if you want some vector here D prime, that would be non zero that we don't allow. Okay. Now, if you actually consider more complicated environment, you need to be more careful in how you define control mechanisms as well, because maybe the way that we define all of these, all of the system which is using my my coven. Although let me just say that you can go beyond that as well, and more terms will need to be added in Europe in Europe around. But in my coven dynamics, you will have to be careful when you allow to have a non equilibrium. I'm sorry fluctuating environment, because basically what you're going to be doing is you're going to be adding the fluctuations of the environment in this matrix here. Okay, because it's again all part of the same system. Okay, and then sorry. Well I was going to say just just getting back to your like your inspiration was this biochemical energy harvesting thing. So my experience of biochemical energy harvesting mechanism or like, maybe not energy harvesting but energy transduction. Yeah, is that is that what what happens is effectively you have a system. And then you couple it to I don't know ATP turnover. And basically what you're doing is providing another pathway to get from a to be via a catalyst that couples you to ATP turnover for example, and I'm just, I'm wondering how that relates to your description of the system. I think this is a great question. In fact, you can contain all of these phenomena in a single model. These, these description over here, let me just say, this is sort of like, let's say an observer dependent situation you really need to be explicit here what what are you doing. And of course that's going to be on the on the part of the scientists to decide which goes where. But, for example, in this case.


Okay, welcome back to theCUBE. This is live coverage of Hadoop Summit in Silicon Valley. In the heart of Silicon Valley, we are in the San Jose Convention Center for day two of exclusive wall-to-wall coverage of Hortonworks and Yahoo. And the ecosystem, the community of Hadoop and Hadoop Summit. The hashtag is Hadoop Summit. If you're watching, you can always hit the hashtag Hadoop Summit. We're tracking it, we're watching it. We're getting great commentary and great production from the folks out there. And feel free to ask us questions that we don't mind stirring the pot up and also answering your questions and asking the guests additional questions. Again, this is theCUBE, our flagship program where we go out to the events and extract the signal from the noise. I'm John Furrier, the founder of SiliconANGLE. I'm George, my co-host. Hi everybody, I'm Dave Vellante of Wikibon.org. Abhi Mehta is here. And Abhi is a good friend of theCUBE, a long-time contributor. Abhi is the CEO and founder of Trasada. And somebody who has just been an awesome visionary in this business. Abhi, welcome back, great to see you. Well, thank you so much. It's good to be back with the original crew from almost four years ago. You are the original tech athlete. I think when we were talking about theCUBE, we were always talking about being the ESPN of tech. When Dave and I and the team, Mark Hopkins, put this cube together, we're always talking about this. It's like talking sports to us. We're big sports fans or whatever you're interested in, having in-depth conversations. When we were at Hadoop World, the original Hadoop World, you were one of our most prolific guests talking about the Industrial Revolution and data factories. And since then, it's been such a great ride. We really appreciate your collaboration.  And you're certainly a great guy, knowledgeable, and an entrepreneur. So you're out there getting dirty, building a business. Way too dirty. Yeah, you're only just leaves up being an entrepreneur. You're the janitor and chief executive at the same time. So a lot's changed. So I got to ask you.  What's changed in the past year, in the two years? Absolutely, but first of all, congratulations to the two of you. I remember CUBE being a small desk at Hadoop World. And I had said that one day, the next time, in like five years, I'm on the CUBE, we'll have makeup people, you know? Getting us ready for the CUBE. This is a beautiful setup, so. Well, Horton works in our sponsors too. We don't have the makeup yet, so. We don't think our sponsors are underwriting. It's been great. We're working on the makeup and hair. This is, I'm very proud of what you guys have done at the CUBE and you truly are. You know, you've made watching tech really cool and a shout out to the crew at the back and Mark and Jeff and you guys are awesome. So what's changed? I think a lot has changed. I was talking to a customer last weekend and we sat back from a very interesting conversation on a unique application we are bringing to market. And he asks me, but you've been doing this, this is our third year. Truseta has achieved what I wanted to achieve in our three years.  Some people call it the hard way. Like what you've done with the CUBE and your ventures. We haven't raised VC money. You know, we say the best capital is revenues. We have a lot of revenues. Our customers are our best supporters. We have an office in New York now. We've expanded to a new vertical. And we're finally seeing this shift. In 2011, there was still more skeptics than believers on big data. We've seen that change. In 2013, that number has flipped. There are a lot more believers in big data than skeptics. So that's the first thing that's changed. I think for all the big tech companies that we have witnessed, kind of validating the platform, there's a big issue with the validation we'll talk about in a second.  I've said multiple times with you gentlemen, this is not a tech revolution. If we make Hadoop purely a storage platform, we as an ecosystem would have failed.  So this is a business revolution, everybody gets it. The second thing that's changed is we are past the credit crisis. So there's a business change happening and we are hearing the business community now finally getting it. The reality has been, it's taken two years to push back the pain of the credit crisis and people are finally gasping for air and saying, all right, the bad news is behind us. I know I have to transform my business. Seems like this term big data could be that force, but I don't know where to go. So there's a realization in the market that there is a new normal. In the new normal, people like you, me and John as customers Dave have different aspirations, different behaviors. In order for businesses to monetize that, the old tools just don't work. The days of selling a database are over. Doesn't matter what you say, doesn't matter if it's proprietary, doesn't matter if it's six years old or a dupe, you can sell a database to any company because you can't monetize a database. What you can monetize is inside. So we are seeing the businesses saying there's a new normal, I need to understand what my customers want and I don't know how to do it. The third thing that's changed is the fact that people are finally realizing that the tectonic shift in technology, big data just being one of them, mobile, social, the commoditization of the analytics stack has firmly taken root and we now see it in the quarterly results of some large tech players. That's not sales guys not being able to sell. Sales guys aren't being able to sell because there's nothing to sell. There is no one answering the knock on the door. So those three things combined, social, mobile, commoditization of the analytics stack is putting a tremendous amount of pressure in three big areas. Understanding what to do, there's a new term being coined, it's called omni-channel. I don't know if the two of you have heard it, I would love to get your perspective on it. And an omni-channel is rapidly becoming way bigger than .com ever was. So just as we saw a rush in everybody doing a website in 2000. Yeah it's called hashtags. Hashtags, yeah exactly. People are now saying I want to be omni-present with my customer on a phone, on an iPad, in social, in online, and in brick and mortar. And people are saying that's part one, how do I reach my customer? Omni-channel. Number two, what should I collect from the channel? There's lots of interesting, the channel is not just a means to reach the customer, it's also a means to collect information. So I should be able to look at John and collect his mobile information, his social information, his hashtags, his tweets. So how do I collect it all? And number three, once I've got the platforms and collected data, what do I do with it? I know there's gold in Facebook likes. I don't know how to monetize it. So that's a change. Let me ask you a question. This is awesome. So first of all, we know it on the channel as we live it every day. This is what theCUBE's all about.  But the Obama campaign really revolutionized micro-targeting, so macro-funneling, micro-targeting. This is the new marketing. So I got to ask you, because you talk to customers, you're only an entrepreneur and knowledgeable and prolific, but you talk to customers and that's really impressed with how you do that. But I got to ask you, when you meet people that don't get the omni-channel kind of concept there, they haven't really crossed over mindset-wise. Because it is a mindset. Absolutely. What do you hear from them and what do you say to them to kind of convince them that this is a really explosive, disruptive, innovative opportunity? And you hear it all the time. CIOs are on Twitter. How many times have we heard that? Or I don't get why, what you're coming from. What's that? Hashtag, is that a marketing thing? How's your value in hashtag? It's a communication revolution. What do you say to those folks to get them over the hump? There is, we have this really fascinating thing. We have built that to say that we call it a data pyramid. This is how I answer the question, by the way. And I think I'm seeing the skepticism change, John, this in the pyramid, John, what we did was something very fascinating. We built the pyramid and we overlaid the pyramid very purposefully in a way where the bottom part of the pyramid was existing data assets. What we call transactional data, identification data. It's extremely thick, rapidly available and every industry vertical, whether it's retail or banking or pharma, gets it. They go, oh yeah, we do that today. We know who our customers are and we collect transactional information about them. I said, absolutely, great. So they're kind of, I got a hook, right? Then we layer on top of it what we call interaction data. This is data that is, so the first two layers of the pyramid tell you who you are and what you do. There's a fundamental flaw that every customer agrees with me on, on transactional data analytics. Analytics has a fundamental flaw today. That flaw is when you use transactional data to predict the future, the issue becomes transactional data is telling you what you have done in the past. What you've done in the past is typically not an accurate predictor what you do in the future. A great example, Dave uses his credit card to buy beer and wine and shops late night because he's a partier. Now Dave is married and when you get married, Dave, you don't call your bank and say, yeah, you don't go out, first of all. But also you're not calling your bank and saying, hey, just let you know I'm married, you know? Don't send me the old offers. You don't call Walmart a target and say, well, I'm not going to be buying beer at midnight. Well, maybe you are buying more alcohol now, but that's your problem, Dave, you know? But the fact is, if you just look at transactional data as a retailer, the coupons they would send you, the marketing messages, we're based on a behavior that has fundamentally changed. You can observe that behavior through interaction data. So the bottom two layers tell you who you are and what you do. Interactions tell you who you do it with. At the top is what I call emotions. This is the golden nugget in analytics. Everybody's trying to predict emotions. And I can tell you, you cannot predict emotions. So golden rule of analytics, you cannot, statistics, you can't predict the future. So what can you do? You can observe emotions. How do you observe emotions? It's through hashtags, it's through tweets, it's through likes. What is the best predictor that you are gonna buy a Toyota or a Honda? Well, it's the fact that you tweeted, I'm looking for a Toyota. No analytical model will tell you you're looking for a Toyota. So when I draw that pyramid, they go, oh, I get it. You're telling me what I do today isn't bad. I'm like, yeah, you're right.  What you're doing today is not bad. It's just not sufficient for the future. And how's that gonna change your business? So here's why it changes the business. Analytical models today are written within those layers of the pyramid. That's a problem. The next generation of article models have to be across the pyramid. So you have to be able to vertical. You have to be able to look at emotions and interactions, attach it to transactions to see what you actually do. Are you capable of buying a new car before I called you on the tweet? Yeah, okay, do you have the way with all of it? Two of them together. I need a new Ferrari. You got it. Not capable. Or when John is tweeting and saying exactly, when John tweets and says I want a Toyota, well actually John can afford a Ferrari, you should call him and say, John, no. You should buy the Tesla S, you know? John's jealous that Ray Wang just got a Tesla. So the three layers. That's the, that's the. So let's go through the pyramid. So layer one is what? Who? Layer two is what? What's layer three? Emotions, why you do what you do. So who what why? Why you buy? Why you buy? If you write analytical models that combine it, no CIO, no chief marketing officer, no head of retail will argue and say, I don't need that. They do need it. The problem is, you can't go and tell them to stop doing what they're doing. Number one, you have to then tell them, anybody can write models within the layers which they do. You got to write models across the layer. So this is. That's the transformation. So you mentioned a new vertical. Retail is a new vertical for you guys. It is, absolutely. Financial service is your traditional vertical. Correct. Now is this what you're doing in that new vertical? Yeah, so you know we've always been very deliberate in entering vertical because we believe that the future of big data isn't in selling commoditized tools and platforms because with search and fast SQL, those layers will be rapidly commoditized. So we are making a very, we've been, we had a very, the reason why we're in retail, it's a great story. We had a phenomenally powerful social marketing app and we couldn't sell it. No financial services customer would buy our social marketing app. I guess the reality was, well they were dealing with some other issues. So I got to ask you hypothetically, let's just say that I was going in to meet a venture capitalist and I wanted to explain to them what this is. How would you describe it to an investor? There's a lot of startups out there are pioneering omni-channels, multi-channels, using the new paradigm of communications and creating new value proposition. So what do you say to a venture capitalist who's evaluating, oh well we already have a horse in the track there. What is this, what do you would call this? I mean, because it's disruptive. It's not yet in a category. So what do you call this thing? Hey, I have a blank. We continue to call it an analytics application. The issue in the market is there's too much confusion among the world's platform and applications. They're too intermingled. No one knows what the one means. Ron Conway nailed it when he said that three years ago, if you had mentioned the word platform, VCs shut their doors. Today, platform is the hottest buzzword in the market. You don't have a platform, I'm sure, yeah. The issue is to answer your question in two parts. But the VCs aren't always a predictor of the revolution. And I was going to say that. Very few VCs truly understand what the future of this data analytics stack looks like. It may not even be a stack. And the very few VCs who understand that are willing to admit they don't understand what the future looks like. And I think those VCs, Palantir, could never raise VC money. There is money from Peter Thier. Why? And everybody's- Because he had vision. Because he got vision, exactly. So when we talk to people, we say there is a new suite of analytical applications coming about that will fundamentally rebuild the stack in a way that no one can define. The best way I define the stack, we draw a big box and we draw a drag line in the middle. And we say they'll be creators and they'll be commoditizers. And the VCs are going to pass. Exactly. The VCs will do- They'll pass. They'll probably do what- Not a big enough opportunity. I saw a lovely video on Nikola Tesla and the VC on YouTube. I don't know if you guys saw it or not. And he talks about his idea of wireless charging and he says, so is it a wireless play, an energy play, or a mobile play? He goes, that's way too much losing focus. The reality is, in big data analytics, it is a omnichannel play, whether you like it or not. It is a data play and it is a technology play. And how it is going to be fused together is up for grabs. Here's how I answer the question. The way I answer the question is that three questions are omnichannel that need to be answered, John, and all those big new companies to be built. Number one, which channels should you play in and should you not play in? There's tremendous confusion in the market amongst retail, especially amongst retailers who will lead the omnichannel charge. Should they have a Facebook app? Should they have a Twitter platform? Should they have a Pinterest app? Should they have a Foursquare app? What should the mobile app do? Tremendous confusion. That's number one. What platforms should you play in? Number two, what data should you collect from those platforms? No one knows. No one has a clue. Should you connect every single like from Facebook? Should you collect the friends? Should you collect the fact that I also like Ritz Cracker Falls? No one has a clue. And we're doing some fascinating work in that area, by the way. Where we have actually proven to the world what is a like worth. I can tell you what a like is worth. No one has a scam. The last issue in omnichannel is if you can now figure out the platform you're in, collect the right data, and figure out what is the right best product to offer you. What channel should you offer it on? If I know that Dave should buy a Tesla, should that offer be delivered over email as a direct mail in a beautiful black card with silver lining? Bannerad and Twitter. As a bannerad on Twitter, as a tweet, through your mobile as a pop-up, no one knows. Those three are massive issues in omnichannel that need to be solved. So the first one, which channel to play in this confusion? Second one, there's no clue about which data to collect. And then selection of products, the delivery and what's the problem there? Confusion. The problem is they don't know. No, the problem, there are two problems. Finding the right product offer to make to increase wallet share, make it the most predictive. So we are seeing hit rates. This is a statistic for you. We are seeing hit rates on using omnichannel well, where we have taken our customers on the right channels, collected the right data, figured out that person X should be made, at a segment of one by the way, X person should be made Y offer, booking rates average of 20%. When direct mail is 30 basis points, email is 3%. So the problems mount is confusion on the channel, those channel to play in. There's no clue about the data collect. And the third thing is they have no ability to deliver. So it was confusion, clue, delivery, availability. No, no, no, no option.  They can't squeeze any more out of that level. Every marketer that you talk to will tell you that. So they're looking for, and they know there's gold out there in these Amazon. And what they're also seeing to add to that point, Dave, is not only do they know there's gold there, they've seen Amazon go mine the gold. They're like, so you go talk to a retailer, and you ask them, what's their biggest competition? Guess what the answer is? Amazon, no one even mentioned Walmart anymore. Because Amazon, when you think of it, so if you were to ask me, what will be the most predictive, there's information arms race going on, which you've heard me say, no one knows the right platform capability you build. That's where Pivotal will struggle. Pivotal is going to struggle because the platform, the way they define it, isn't what a platform is. They're talking messaging, bus, and metadata. That's not the right platform to build apps on. There's different, and there's a different conversation. There's different platform capability and big data to enable apps. And Salesforce gets it, not Pivotal. It's a very interesting thing that we just talked about. But it took, you talk to them, and they see Amazon sitting there having the richest profile of what you buy. So Facebook knows what you like. Google knows what you search for. Amazon actually knows what you buy. Guess who's the most valuable data source? And not only do they know what you buy on books, but they know what you buy on groceries, and on shoes, and on, and so in the retail world, if you were to combine that, that's a mixture of Neiman Marcus, and Nordstrom, and Walmart, and Target, and grocery stores under one roof.  And they have a platform where the marginal cost of doing it is zero. So then what people are scared about is Amazon has this thing called third-party resellers that they can sell on the platform. Guess how much money they make a year through that platform? Six billion dollars, which is straight profit. Right, the marginal cost, like you said, is zero. The third-party retailer is nothing. Because Amazon built their platform for the peaks, and they're saying, well, I'm not going to sit on it. It's the cost of the signup. Exactly. So that's where Amazon, Google, and Facebook, it's their battle to win or lose, and it's an information arms race, and other retailers are saying, we want that capability. The good news is they realize that it comes from Hadoop, they realize that companies like ours that can live with the king. So we have a retailer who is redoing their entire future infrastructure to deliver products and services, build products and services, and make the right customer offers Omnichannel on Tresena's technology, which you guys, hopefully, Jeff will write about in two months. That is exciting, because they say that capability will make me compete with Amazon. And that's the revolution that's coming. We are seeing more customers do that. So real quick, what did you mean by Salesforce gets it with Heroku and building apps? Yeah, so I think Salesforce realizes that in order to monetize any data, the platform capabilities starts with three core components. It has to be data on it. Salesforce has data on it. There needs to be certain infrastructure components that need to be free, that gets what comes with Heroku. And then there need to be certain enabling platform capabilities, I call them engines, that allow for an app developer. So if we all agree that the future of big data is segment of one analytics, how do you get to segment of one? You're not getting to segment of one by a metadata platform and by fast SQL search and linguistic search. You get that by data. You get that by data, but then an engine that can infuse the data at the individual level. We have that, we call it tree. Then graph is becoming the killer app. The killer engine on Hadoop is graph. Facebook has it called graph search. LinkedIn has it called PYMK, Twitter has it. So those two are becoming core engines. So Salesforce has that capability. Doesn't Pivotal have the data through EMC kind of? I don't know, I don't think so. I don't think EMC has data. EMC is in customers who have data. Yeah, exactly. So if you can pull those three things off on a platform, you'll get people to build apps. Guess who has it? It's Salesforce. It's Splunk. So those companies are more interesting than Pivotal. They're the new application development platform. Absolutely. I think Pivotal and Clutter will get there, by the way, but it doesn't exist today. Yeah. Okay, Abhi, great to have you on theCUBE. We really appreciate it. Prolific, it's exciting. You've got a lot of passion. We love that. And as you guys said, we're a tech athlete. And also an entrepreneur to say that congratulations on doing some cutting edge work. Thank you. Great to have you on, CUBE alumni. This is theCUBE. This is SiliconANGLE, Wikibon. I'm John Furrier with Dave Vellante. We'll be right back with our next guest here at Hadoop Summit Live for day two, exclusive wall-to-wall coverage. We'll be right back.