Models of Fuzzy Identification of Cyber Incidents in Information and Communication Systems by Intelligent SIEM Systems

Abstract

   The issue of detecting cyber incidents that occur during the functioning of information and communication systems, based on the use of a SIEM system in the cyber protection circuit, as the basis for its design, is considered. This study concludes that the use of the latest information technologies, such as artificial intelligence, intelligent data analysis, big data processing, and machine learning, is necessary to improve cyber incident detection. These technologies make it possible to increase the effectiveness of the SIEM system by minimizing human involvement in solving cyber incident response tasks. The analysis of methods used to detect cyber incidents has revealed their major limitations, particularly their inability to consistently provide the desired outcome in scenarios where information about such incidents is incomplete or inaccurate. To address this issue, a new approach to detect cyber incidents is proposed. This approach is based on using knowledge delivery models within the knowledge base that provide information about the signs of cyber incidents occurring in information and communication systems, as well as the various types of cyber incidents. This knowledge will be used to identify cyber incidents by collecting and processing expert information, utilizing the theory of fuzzy sets. Additionally, the proposed approach includes the formalization of the causal relationships between the variables "signs of cyber incidents" and "types of cyber incidents." This is achieved by describing these relationships in natural language using the theory of fuzzy sets and linguistic variables. The models proposed in this study can improve the effectiveness of cyber incident detection by addressing the limitations of current methods.

Keywords

•  1  Cybersecurity
• cyber incident
• SIEM system
• fuzzy sets
• fuzzy production rules

1. Introduction 

management, data analysis, decision-making, and implementation. In [ 3 ], a method for the rational selection of a SIEM system for constructing a cyber security situational center has been discussed.

The effectiveness of the system developed based on the proposed model is heavily reliant on the utilization of the latest information technologies, including Artificial Intelligence (AI), Data Mining (DM), Big Data, Machine Learning (ML), and others. These technologies enable the system to minimize human involvement in responding to cyber incidents occurring within the ICS, thereby increasing the efficiency and accuracy of its decisions [ 4 ].

Analysis of recent research and publications confirms the feasibility of using these technologies for detecting and promptly responding to cyber incidents.

The works [ 5, 6 ] address the use of data mining (DM) technology for detecting cyber incidents in SIEM systems. Specifically, this study analyzes the efficiency of using DM methods, such as association rules, classification, clustering, prediction, and sequential patterns, for implementing the primary functions of a SIEM system.

The authors of [ 7 ] examine the application of association rules in intrusion detection systems (IDS), with a focus on how these rules are formed from big data.

The study [ 8 ] presents a classification model for cyber incidents based on rules with weighted attributes.

The work [ 9 ] focuses on detecting DoS attack patterns by analyzing HTTP, HTTPS, and FTP traffic.

The issues of detecting unknown cyber attacks by IDS-systems, which are built on the basis of statistical methods, are considered in [ 10, 11 ].

The work [ 10 ] is devoted to the application of hybrid methods of detecting cyberattacks based on associative rules and ant algorithms. The authors prove the effectiveness of this approach in comparison with known ones by conducting experimental studies with the NSL-KDD data set.

In [ 12 ] a simulation model was proposed for evaluating the effectiveness of cyber attack detection systems.

The study [ 13 ] focuses on increasing the effectiveness of detecting network attacks in IDS Snort by applying DM techniques. The effectiveness of the results is experimentally evaluated using the MITDARPA 1999 data set.

The authors of [ 14 ] propose using a self-learning SIEM system to analyze network events and detect abnormal patterns using associative rules.

Despite numerous scientific publications on the application of DM and other modern information technologies in SIEM systems to detect cyber incidents, knowledge organization in the knowledge bases of intelligent SIEM systems remains largely unexplored.

This study aims to develop a model for incorporating knowledge about cyber incidents into the knowledge base of an intelligent SIEM system. 2. Statement of the problem of cyber incidents identification 

It is widely acknowledged that the effectiveness of any intelligent system depends largely on the quality of its knowledge base. In [ 15 ], the matter of organizing knowledge in the knowledge bases of intelligent systems is discussed. However, research suggests that the most commonly used methods for detecting cyber incidents in SIEM systems are rule-oriented [ 16 ] approaches that rely on classical production rules. Therefore, a production model of knowledge delivery is used to represent knowledge in the SIEM system's knowledge base.

However, when information about cyber incidents during ICS operation is incomplete or inaccurate, these methods may not produce the desired results, making them inefficient. To address this issue, it is recommended to utilize models and techniques based on fuzzy set theory for fuzzy inference [ 16-21 ].

According to this, the model for detecting (recognizing) cyber incidents by a SIEM system can be represented as [ 16 ]: where KF – fuzzy classifier; ,  ,   ⟩, (1)

− a set of fuzzy rules for recognizing cyber incidents: : , ,   : , ,  … ,   : ,

  →   . their identification, and its solution is to find a mapping:

Based on the works [ 22-25 ], the task of recognizing cyber incidents can be considered as the task of * *,  * , … ,  * → ∈ , , … ,  , (2) where * a set of signs of a cyber incident;

a set of possible cyber incidents.

The area of change of signs of a cyber incident ∈ , , 1, , and the initial value of the identification result с ∈ , are considered to be known. Accordingly, – the lower (upper) value of the parameters of the cyber incident, ,   1, ; с , , 1, – the lower (upper) value of the identification result.

In practice, the most commonly used methods for solving the problem (2) are parametric identification

methods, such as the least squares method, maximum likelihood method, mean discrepancy method, stochastic approximation method, and more [ 19 ].

The main drawbacks of these methods that complicate their use include [ 22, 23 ]: - the lack of clear interpretation in "input-output" type models; - the inability to work with qualitative input and output variables; - the inability to incorporate expert experience regarding object structure in the form of "IFTHEN" logical statements.

To address these shortcomings, a different approach based on models and methods of knowledge engineering is needed, particularly models for delivering knowledge base (KB) about the signs of cyber incidents (SCI) and classes of cyber incidents (CCI) that occur during ICS operation. This approach involves collecting and processing expert information using fuzzy set theory.

The primary concept of this approach is to formalize causal relationships between "SCI-CCI" variables by describing them in natural language using the theory of fuzzy sets and linguistic variables. This enables the mathematical formalization of natural language statements to solve the problem of identifying cyber incidents in the statement of the problem (2).

To translate expert knowledge presented in "IF-THEN" linguistic statements into a mathematical model, the mathematical apparatus of membership functions (MF) is used to express the expert's degree of confidence that a certain value belongs to a fuzzy concept (term). In turn, methods of fuzzy logical inference make it possible to connect the FN of the signs of cyber incidents with the results of their identification, provided that there is a model of cyber incidents in the form of a set of fuzzy rules of the "IF–THEN" type – a fuzzy knowledge base (FKB).

The primary principles used in developing a mathematical model for identifying cyber incidents include [ 17, 18, 20, 22, 23 ]:

- the principle of linguistic state of the ICS, which considers the type of cyber incident and its signs as linguistic variables (LV) evaluated by qualitative terms;

- the principle of forming the structure of the dependence of the type of cyber incident on its signs by means of the FKB; of nested logical statements.

- the principle of the hierarchy of the FKB, according to which the reduction in the dimension of the FKB can be carried out by classifying input variables and building an "output tree" that defines a system

The third principle of the model allows for consideration of a wide range of indicators used in identifying cyber incidents. Its implementation is particularly significant when dealing with a complex model since adding new indicators and accumulating knowledge about them requires such an approach.

Therefore, the model for identifying (detecting) cyber incidents can be specified in the form of FKB, represented by a set of "IF-THEN" fuzzy rules that connect linguistic evaluations of the signs of cyber incidents with their identification results.

Based on the above, the problem (2) can be formulated as follows.

It is important to note that the formal solution to this problem requires the presence of dependence (3): of dependence (3): ,

Let ∗ , 1,

∗,   ∗,   … ,   ∗ is a vector of fixed values of signs of a cyber incident, where ∗ ∈ . Then the task of identification is to determine the type of cyber incident ∈ based on the vector *. Note that a necessary condition for the formal solution of this problem is the presence с , , … , , where , , … ,

– a set of values of signs of cyber incidents, – the result of identification.

Models of fuzzy identification of cyber incidents  To evaluate a LV, it is quite appropriate to apply qualitative terms that make up term sets [ 22-25 ]: , , … , – term set of the variable , 1, , where – k-linguistic term of the variable , 1, , 1,

; variable , m – number of possible classes of cyber incidents.

In general, cardinalities of term sets Α , 1,

can be different: , , … , – term set of the variable , where , 1, – linguistic term of the Note that in expressions (6) and (7) the sign  denotes the union of pairs / .

Let L be the amount of data that links the input data – the characteristics of cyber incidents and the output value – the class of the cyber incident, and: ⋯ , where – the number of data received from experts that correspond to the output variable – the class , m – the number of classes of cyber incidents, and in the general of the cyber incident case: ⋯ ∈ Δ, 1, . various combinations of input signs of cyber incidents.

Note that the number of data received from experts is much smaller than a complete enumeration of Α Δ where

 ik  i , k  1, ki , i  1, n

;  j  , j  1, m of the term – the class of cyber incident Besides, term names , , … , Therefore, the linguistic terms may differ for different linguistic variables , 1, . ∈ Α , 1, , 1, and ∈ Δ, 1, can be considered as fuzzy sets defined on the universal sets ,

(5).

In turn, the fuzzy sets and can be defined as follows [ 22, 23 ]: ⋯

. oi oi c c j  ik   ik oi / oi , 

j j    j c j / c j ,

To solve the formulated problem, it is necessary to consider the input and output variables from (3) as linguistic variables defined on universal sets [ 22, 23 ]: , , , .

(3) (4) (5)  (6)  (7) (8)  o1  o2  oi  …  on  11  111    211    i11   …   n11   1…2   …112   …212    …i12    ……   …n12     1   1k1  11k1   11k2    i1k1   …   n1k1   …  …  …  …  …  …  …  j1  1j1    2j1    ij1   …   nj1   j…2   …1j 2   …2j 2   …ij 2   ……   …nj 2    j   jkj  1jk j    2jk j    ijk j   …   njk j   …  …  …  …  …  …  …  m1  1m1    2m1    im1   …   nm1   m…2   …1m 2   …2m 2    im 2   ……    nm 2    m   mkm  1mkm    2mkm    imkm   …   nmkm  

Similarly to [ 22, 23 ], let us call this table a matrix of knowledge about cyber incidents. It has the following properties:

- dimension of the matrix: n  1 N , where n  1 – the number of columns of the matrix, and L  l1  l2  lm – the number of its rows;

- each row of the matrix is a combination of the input values of the signs of cyber incidents oi ,i  1, n , which is assigned by the expert to one of its classes  j , with the first 1l rows corresponding to the class 1 , and the last 1m rows – to the class  m ;

- first n columns of the matrix correspond to the input values of the signs of cyber incidents oi ,i  1, n , and n  1 column corresponds to the output value – the class of the cyber incident c.

- at the intersection of the i-column and the jkj -row there is an element  ijk j , that corresponds to the linguistic assessment of the cyber incident sign oi the row of the matrix jk j , which belongs to the term set of the corresponding sign oi:  ik  i , k  1, ki , i  1, n .

The matrix of knowledge about cyber incidents described above can be represented in the form of a system of fuzzy rules of "IF–THEN" type [ 22, 23 ], that connect the values of the input signs of cyber incidents oi ,i  1, n with one of the possible classes of cyber incidents  j  , j  1, m :

IF( oi   111 )AND( o2   211 )AND…AND( on   n11 )OR …, IF( oi   1j1 )AND( o2   2j1 )AND…AND( on   nj1 )OR ( oi   112 )AND( o2   212 )AND…AND( on   n12 )OR ( oi   11k1 )AND( o2   21k1 )AND…AND( on   n1k1 )THEN(с=1 ),… ( oi   1j2 )AND( o2   2j2 )AND…AND( on   nj2 )OR ( oi  1k j )AND( o2   2jk j )AND…AND( on   njk j )THEN(с= j ),… (9) …, IF( oi   1m1 )AND( o2   2m1 )AND…AND( on   nm1 )OR

( oi   1m2 )AND( o2   2m2 )AND…AND( on   nm2 )OR ( oi  1mkm )AND( o2   2mkm )AND…AND( on   nmkm )THEN(с= m ), (10) (11) determined on the term set i   i1, i2 ,, iki ; where  ijk – linguistic evaluation of the sign of cyber incident oi ,i  1, n in the k row of j-disjunction  j  , j  1, m – linguistic evaluation of the class of cyber incident, determined on the term set   1, 2 ,, m.

Therefore, the expression (9) given in the form of a set of fuzzy rules of "IF–THEN" type, which are based on the matrix of knowledge about cyber incidents (Table 1), represents a model for the identification of cyber incidents by the SIEM system.

If the linguistic evaluations  ijk of the variables o1, o2 ,,on and  j , j  1, m from (9) are     considered as fuzzy sets defined on universal sets oi   oi , oi , c   c j , c j , i  1, n, j  1, m , then      jk    i – MF (belongingness) of the sign of cyber incident oi   oi , oi  to the fuzzy term    ijk , i  1, n, j  1, m, k  1, k j , and   j o1, o2 ,, on  – to the vector of sign of a cyber incident, O  o1, o2 ,, on,i  1, n , to the value of the initial assessment с   j , j  1, m .

The relationship between them is determined through a fuzzy matrix of knowledge about cyber incidents (Table 1) and by replacing linguistic terms with their MF, as well as replacing logical operations AND or OR with operations  and  can be represented as follows:   j o1, o2 ,, on    1j1 o1    2j1 o2    nj1 on    1j2 o1    2j2 o    nj2 o  

2 n   1jk j o1    2 o2    n on , j  1, m

 jk j  jk j Then expression (10) can be represented as follows:

kj  n   j o1.о2 ,,оn   k1i1ijk oi , j 1, m.

Taking into account that in the theory of fuzzy sets, operations  and  correspond to operations min and max [ 22, 23 ], then by transforming (11) we will obtain a model of identification of cyber incidents by SIEM systems (12):   j oi , o2 ,, on   max  min ijk oi , j  1, m. (12)

 k  1, k j i  1, n 

This model can be the basis for the development of a rule-oriented method of detecting cyber incidents by a SIEM system. 4. Model of fuzzy identification of cyber incidents with weighted rules 

The main drawback of the model (12) is that the expert’s confidence in each "IF–THEN" rule, which is included in the fuzzy KB (9), may differ. This shortcoming can be eliminated by introducing the weight of the rule, which will characterize the significance of a particular rule during the identification of cyber incidents. Based on the works [ 24, 27, 28 ], the weight of a rule should be understood as a number in the interval [ 0, 1 ], which characterizes the subjective measure of the expert’s confidence in a particular rule.

In this case, the multidimensional table of signs of cyber incidents and their corresponding classes (Table 1), taking into account the expert’s confidence in a particular rule, which is specified using the weight of the rule, will take the following form (Table 2): Table 2  Multidimensional table of signs of cyber incidents and their corresponding classes in accordance with  the weight of the rules 

Signs of cyber incident 

Class of 

cyber incident  The number of 

the input  combination of  cyber incident  sign values  11  12  …  1k1  …  j1  j2  …  jkj  …  m1  m2  …  mkm  o1 

Thereby, taking into account the weight of the rules, the FKB, which is represented by a set of fuzzy "IF–THEN" rules that link linguistic evaluations of signs of cyber incidents with the results of their identification, will take the following form:

IF( oi   111 )AND( o2   211 )AND…AND( on   n11 ) with weight w11 OR ( oi   112 )AND( o2   212 )AND…AND( on   n12 ) with weight w12 OR ( oi   11k1 )AND( o2   21k1 )AND…AND( on   n1k1 ) with weight w1k1

THEN(с=1 ), … …, IF( oi   1j1 )AND( o2   2j1 )AND…AND( on   nj1 ) with weight w j1 OR ( oi   1j 2 )AND( o2   2j2 )AND…AND( on   nj 2 ) з вагою ( oi   1jk j )AND( o2   2jk j )AND…AND( on   njk j ) з вагою w jk j

THEN(с= j ), … …, IF( oi   1m1 )AND( o2   2m1 )AND…AND( on   nm1 ) with weight wm1

OR THEN(с= m ), ( oi   1m2 )AND( o2  2m2 )AND…AND( on  nm2 ) with weight wm2 ( oi   1mkm )AND( o2   2mkm )AND…AND( on   nmk m ) with weight wmk m disjunction determined on the term set i   i1, i2 ,, iki ; where  ijk – linguistic evaluation of the sign of cyber incident oi ,i  1, n in the k row of j j  , j  1, m – linguistic evaluation of the class of cyber incident determined on the term set   1, 2 ,, m; w jk – weight of the rule.

Taking into account the weight of the rules, the fuzzy knowledge base (13) can be represented by a modified system of fuzzy equations (11) as follows:

k j   n    j o1.о2 ,, оn     jk i1

   ijk oi , j  1, m k 1 

By replacing the operations  and  with min та max operations, which correspond to them, we will obtain a modified model of fuzzy identification of cyber incidents by SIEM systems (15) with weighted rules:   j oi , o2 ,, on   max  min  

  ijk oi , j  1, m.

k  1, k j  jk i  1, n  

The given model makes it possible to eliminate the shortcomings present in model (12) by taking into account the expert's confidence in a particular rule.

5. Conclusion 

The models proposed for cyber incident identification by a SIEM system differ from existing models in that they utilize fuzzy rules to identify incidents that occur during the operation of an information and communication system. As a result, it becomes possible to mitigate the shortcomings that arise from incomplete and inaccurate information in the identification process.

OR (13)  OR (14) (15) 

Potential areas for future research include developing rule-oriented methods for detecting cyber incidents using the proposed models in the SIEM system, along with techniques for generating fuzzy production rules to apply within these methods. 6. References 

References

[1] I. Subach , V. Fesokha , N. Fesokha , Analysis of existing intrusion prevention solutions in information and telecommunication networks, opened on the basis of publicly available licenses , Information Technology and Security Vol. 5 Iss. 1 ( 2017 ) 29 - 41 . doi: 10 .20535/ 2411 - 1031 . 2017 . 5 .1.120554.

[2] I. Subach , V. Kubrak , A. Mykytiuk , Architecture and functional model of a promising proactive intelligent system SIEM-system for cyber protection of critical infrastructure , Information Technology and Security Vol. 7 Iss. 2 ( 2019 ) 208 - 215 . doi: 10 .20535/ 2411 - 1031 . 2019 . 7 .2.190570.

[3] I. Subach , V. Kubrak , A. Mykytiuk , Methodology of rational choice of security incident management system for building operational security center , CEUR Workshop Proceedings (CEUR-WS.org) Vol. 2577 ( 2019 ) 11 - 20 . doi: 10 .5281/zenodo.7027782.

[4] I. Subach , B. Gerasimov , Quality indicators of information support and their impact on the effectiveness of decision support systems , Bulletin of Taras Shevchenko National University of Kiev Vol. 20 ( 2008 ) 18 - 25 .

[5] A. R. Zope , A. Vidhate , N. Harale , Data Mining Approach in Security Information and EventManagement, International Journal of Future Computer and Communication Vol. 2 Iss. 2 ( 2013 ) 80 - 84 . doi: 10 .7763/IJFCC. 2013 .V2.126

[6] F. Salo , M. Injadat , A. Nassif , A. Shami , A. Essex , Data Mining Techniques in Intrusion Detection Systems: A Systematic Literature Review , in Proc. IEEEAccess Vol. 6 ( 2018 ) 56046 - 56058 . doi: 10 .1109/ACCESS. 2018 . 2872784 .

[7] D. Selvamani , V. Selvi , Association Rule Mining for Intrusion Detection System: A Survey , Asian Journal of Engineering and Applied Technology Vol. 8 Iss. 1 ( 2019 ) 20 - 24 . doi: 10 .51983/ajeat-2019.8.1.1065.

[8] L. Mehrotra , P. S. Saxena , N. V. Doohan , A Data Classification Model: For Effective Classification of Intrusion in an Intrusion Detection System Based on Decision Tree Learning Algorithm , Information and Communication Technology for Sustainable Development vol 9 ( 2018 ) 61 - 66 . doi: 10 .1007/ 978 -981-10-3932- 4 _ 7 .

[9] HC. Chen , SS. Kuo, DoS Attack Pattern Mining Based on Association Rule Approach for Web Server, International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing. Innovative Mobile and Internet Services in Ubiquitous Computing Vol. 773 ( 2018 ) 527 - 536 . doi: 10 .1007/978-3- 319 -93554-6_ 50 .

[10] L. Mehrotra , P. S. Saxena , An Assessment Report on: Statistics-Based and Signature-Based Intrusion Detection Techniques, Information and Communication Technology Springer. Advances in Intelligent Systems and Computing Vol. 625 ( 2018 ) 321 - 327 . doi: 10 .1007/ 978 - 981-10-5508-9_ 31 .

[11] R. Shanmugavadivu , N. Nagarajan , Network Intrusion Detection System using Fuzzy Logic , Indian Journal of Computer Science and Engineering (IJCSE) Vol. 2 Iss. 1.( 2011 ) 101 - 111 .

[12] C. Gupta , A. Sinhal , R. Kamble , An Enhanced Associative Ant Colony Optimization Technique-based Intrusion Detection , Artificial Intelligence and Evolutionary Algorithms in Engineering Systems. Advances in Intelligent Systems and Computing Vol. 325 ( 2015 ) 541 - 553 . doi: 10 .1007/ 978 -81-322-2135-7_ 58 .

[13] I. Subach , D. Mogylevych , A. Mykytiuk , V. Kubrak , V. Fesokha , Simulation Model of a Fuzzy Cyber Attack Detection System , CEUR Workshop Proceedings (CEUR-WS.org) Vol. 3421 ( 2021 ) 92 - 101 . doi: 10 .5281/zenodo.7247964.

[14] N. Khamphakdee , N. Benjamas , S. Saiyod , Improving Intrusion Detection System Based on Snort Rules for Network Probe Attacks Detection with Association Rules Technique of Data Mining , Journal of ICT Research and Applications , Vol. 8 , Iss . 3 , ( 2015 ) 234 - 250 . doi: 10 .5614/itbj.ict. res.appl . 2015 . 8 . 3 .4.

[15] R. R. Tiwari , A. K. Singh , V. Singh , Self-Learning SIEM System Using Association Rule Mining , Journal of Advanced Database Management & Systems Vol. 2 Iss. 2, ( 2015 ) 10 - 23 .

[16] I. Subach , B. Gerasimov , E. Nikiforov, Models of knowledge delivery for use in decision support systems , Scientific and technical information Vol. 1 ( 2005 ) 7 - 11 .

[17] I. Subach , V. Kubrak , A. Mykytiuk , V. Korotaev , Rule-oriented method of cyber incidents detection by SIEM based on fuzzy logical inference , CEUR Workshop Proceedings (CEURWS.org) Vol. 2859 ( 2020 ) 210 - 219 . doi: 10 .5281/zenodo.7123656.

[18] L. Zadeh , The concept of a linguistic variable and its application to approximate reasoning , Moscow, Mir, 1976 .

[19] A.N. Borisov , O.A. Krumberg , I.P. Fedorov , Decision-making based on fuzzy models: examples of use , Riga, Zinatne, 1990 .

[20] Y. Zaichenko , Operations Research: Fuzzy Optimization, Kiev, High school, 1991 .

[21] A. Piegat , Fuzzy Modeling and Control, Physica-Verlag, Heidelberg, 2001 .

[22] M. Dodonov , N. Dodonova , Automated detection system of insider attacks using fuzzy logic , CEUR Workshop Proceedings (CEUR-WS.org) Vol. 1490 ( 2015 ) 376 - 380 .

[23] A. Rothstein , Medical diagnostics on fuzzy logic , Vinnytsia, Continent-PRIM, 1996 .

[24] A. Rothstein , Intelligent identification technologies: fuzzy sets, genetic algorithms, neural networks , Vinnytsia, UNIVERSUM , 1999 .

[25] O. Rothstein , G. Chernovolyk , E. Laryushkin, Method of constructing membership functions of fuzzy sets . Bulletin of VPI , Vol. 3 ( 1996 ) 72 - 75 .

[26] Y. Mityushkin , B. Mokin , O. Rothstein , Soft Computing: identification of patterns of fuzzy knowledge bases: a monograph. Vinnytsia, UNIVERSUM- Vinnytsia , 2002 .

[27] Rotshtein A.P. , Katelnikov D.I. Identification of Nonlinear Objects by Fuzzy Knowledge Bases. Cybernetics and System Analysis Iss . 5 ( 1998 ) 53 - 61 .

[28] Rotshtein А . Design and Tuning of Fuzzy Rule-Based Systems for Medical Diagnosis . In N.- H. Teodorescu (ed): Fuzzy and Neuro - Fuzzy Systems in Medicine ( 1998 ) 243 - 289 .