Dealing with temporal inconsistency in automated computer forensic profiling

Computer profiling is the automated forensic examination of a computer system in order to provide a human investigator with a characterisation of the activities that have taken place on that system. As part of this process, the logical components of the computer system – components such as users, files and applications - are enumerated and the relationships between them discovered and reported. This information is enriched with traces of historical activity drawn from system logs and from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work examines the impact of temporal inconsistency in such information and discusses two types of temporal inconsistency that may arise – inconsistency arising out of the normal errant behaviour of a computer system, and inconsistency arising out of deliberate tampering by a suspect – and techniques for dealing with inconsistencies of the latter kind. We examine the impact of deliberate tampering through experiments conducted with prototype computer profiling software. Based on the results of these experiments, we discuss techniques which can be employed in computer profiling to deal with such temporal inconsistencies.

CAT Detect (Computer Activity Timeline Detection) : a tool for detecting inconsistency in computer activity timelines

The construction of timelines of computer activity is a part of many digital investigations. These timelines of events are composed of traces of historical activity drawn from system logs and potentially from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work introduces a software tool (CAT Detect) for the detection of inconsistency within timelines of computer activity. We examine the impact of deliberate tampering through experiments conducted with our prototype software tool. Based on the results of these experiments, we discuss techniques which can be employed to deal with such temporal inconsistencies.

Inconsistency of surrogate measures of alcohol-related accidents in South Australia

Three major changes in drink driving enforcement have occurred in South Australia since 1981. The effect of these changes on a number of surrogate measures of alcohol involvement in accidents were investigated. The surrogates included alcohol involvement of driver fatalities, and combinations of casualty, serious casualty, single vehicle and nighttime accidents. Data from previous studies were also cited. It was found that relationships between surrogate measures were inconsistent, and incompatible with assumptions about drink driving levels and related accidents. It was concluded that until these effects are understood the use of surrogate measures should be treated with caution.

Property cash flow studies : focusing on model consistency and data accuracy

The high degree of variability and inconsistency in cash flow study usage by property professionals demands improvement in knowledge and processes. Until recently limited research was being undertaken on the use of cash flow studies in property valuations but the growing acceptance of this approach for major investment valuations has resulted in renewed interest in this topic. Studies on valuation variations identify data accuracy, model consistency and bias as major concerns. In cash flow studies there are practical problems with the input data and the consistency of the models. This study will refer to the recent literature and identify the major factors in model inconsistency and data selection. A detailed case study will be used to examine the effects of changes in structure and inputs. The key variable inputs will be identified and proposals developed to improve the selection process for these key variables. The variables will be selected with the aid of sensitivity studies and alternative ways of quantifying the key variables explained. The paper recommends, with reservations, the use of probability profiles of the variables and the incorporation of this data in simulation exercises. The use of Monte Carlo simulation is demonstrated and the factors influencing the structure of the probability distributions of the key variables are outline. This study relates to ongoing research into functional performance of commercial property within an Australian Cooperative Research Centre.

Error, Bias, and Long-Branch Attraction in Data for Two Chloroplast Photosystem Genes in Seed Plants

Sequences of two chloroplast photosystem genes, psaA and psbB, together comprising about 3,500 bp, were obtained for all five major groups of extant seed plants and several outgroups among other vascular plants. Strongly supported, but significantly conflicting, phylogenetic signals were obtained in parsimony analyses from partitions of the data into first and second codon positions versus third positions. In the former, both genes agreed on a monophyletic gymnosperms, with Gnetales closely related to certain conifers. In the latter, Gnetales are inferred to be the sister group of all other seed plants, with gymnosperms paraphyletic. None of the data supported the modern ‘‘anthophyte hypothesis,’’ which places Gnetales as the sister group of flowering plants. A series of simulation studies were undertaken to examine the error rate for parsimony inference. Three kinds of errors were examined: random error, systematic bias (both properties of finite data sets), and statistical inconsistency owing to long-branch attraction (an asymptotic property). Parsimony reconstructions were extremely biased for third-position data for psbB. Regardless of the true underlying tree, a tree in which Gnetales are sister to all other seed plants was likely to be reconstructed for these data. None of the combinations of genes or partitions permits the anthophyte tree to be reconstructed with high probability. Simulations of progressively larger data sets indicate the existence of long-branch attraction (statistical inconsistency) for third-position psbB data if either the anthophyte tree or the gymnosperm tree is correct. This is also true for the anthophyte tree using either psaA third positions or psbB first and second positions. A factor contributing to bias and inconsistency is extremely short branches at the base of the seed plant radiation, coupled with extremely high rates in Gnetales and nonseed plant outgroups. M. J. Sanderson,* M. F. Wojciechowski,*† J.-M. Hu,* T. Sher Khan,* and S. G. Brady

Protocol engineering for protection against denial-of-service attacks

Denial-of-service attacks (DoS) and distributed denial-of-service attacks (DDoS) attempt to temporarily disrupt users or computer resources to cause service un- availability to legitimate users in the internetworking system. The most common type of DoS attack occurs when adversaries °ood a large amount of bogus data to interfere or disrupt the service on the server. The attack can be either a single-source attack, which originates at only one host, or a multi-source attack, in which multiple hosts coordinate to °ood a large number of packets to the server. Cryptographic mechanisms in authentication schemes are an example ap- proach to help the server to validate malicious tra±c. Since authentication in key establishment protocols requires the veri¯er to spend some resources before successfully detecting the bogus messages, adversaries might be able to exploit this °aw to mount an attack to overwhelm the server resources. The attacker is able to perform this kind of attack because many key establishment protocols incorporate strong authentication at the beginning phase before they can iden- tify the attacks. This is an example of DoS threats in most key establishment protocols because they have been implemented to support con¯dentiality and data integrity, but do not carefully consider other security objectives, such as availability. The main objective of this research is to design denial-of-service resistant mechanisms in key establishment protocols. In particular, we focus on the design of cryptographic protocols related to key establishment protocols that implement client puzzles to protect the server against resource exhaustion attacks. Another objective is to extend formal analysis techniques to include DoS- resistance. Basically, the formal analysis approach is used not only to analyse and verify the security of a cryptographic scheme carefully but also to help in the design stage of new protocols with a high level of security guarantee. In this research, we focus on an analysis technique of Meadows' cost-based framework, and we implement DoS-resistant model using Coloured Petri Nets. Meadows' cost-based framework is directly proposed to assess denial-of-service vulnerabil- ities in the cryptographic protocols using mathematical proof, while Coloured Petri Nets is used to model and verify the communication protocols using inter- active simulations. In addition, Coloured Petri Nets are able to help the protocol designer to clarify and reduce some inconsistency of the protocol speci¯cation. Therefore, the second objective of this research is to explore vulnerabilities in existing DoS-resistant protocols, as well as extend a formal analysis approach to our new framework for improving DoS-resistance and evaluating the performance of the new proposed mechanism. In summary, the speci¯c outcomes of this research include following results; 1. A taxonomy of denial-of-service resistant strategies and techniques used in key establishment protocols; 2. A critical analysis of existing DoS-resistant key exchange and key estab- lishment protocols; 3. An implementation of Meadows's cost-based framework using Coloured Petri Nets for modelling and evaluating DoS-resistant protocols; and 4. A development of new e±cient and practical DoS-resistant mechanisms to improve the resistance to denial-of-service attacks in key establishment protocols.

Indoor environments : design, productivity and health

In a typical large office block, by far the largest lifetime expense is the salaries of the workers - 84% for salaries compared with : office rent (14%), total energy (1%), and maintenance (1%). The key drive for business is therefore the maximisation of the productivity of the employees as this is the largest cost. Reducing total energy use by 50% will not produce the same financial return as 1% productivity improvement? The aim of the project which led to this review of the literature was to understand as far as possible the state of knowledge internationally about how the indoor environment of buildings does influence occupants and the impact this influence may have on the total cost of ownership of buildings. Therefore one of the main focus areas for the literature has been identifying whether there is a link between productivity and health of building occupants and the indoor environment. Productivity is both easy to define - the ratio of output to input - but at the same time very hard to measure in a relatively small environment where individual contributions can influence the results, in particular social interactions. Health impacts from a building environment are also difficult to measure well, as establishing casual links between the indoor environment and a particular health issue can be very difficult. All of those issues are canvassed in the literature reported here. Humans are surprisingly adaptive to different physical environments, but the workplace should not test the limits of human adaptability. Physiological models of stress, for example, accept that the body has a finite amount of adaptive energy available to cope with stress. The importance of, and this projects' focus on, the physical setting within the integrated system of high performance workplaces, means this literature survey explores research which has been undertaken on both physical and social aspects of the built environment. The literature has been largely classified in several different ways, according to the classification scheme shown below. There is still some inconsistency in the use of keywords, which is being addressed and greater uniformity will be developed for a CD version of this literature, enabling searching using this classification scheme.

Detecting and resolving redundancies in EP3P policies

Current regulatory requirements on data privacy make it increasingly important for enterprises to be able to verify and audit their compliance with their privacy policies. Traditionally, a privacy policy is written in a natural language. Such policies inherit the potential ambiguity, inconsistency and mis-interpretation of natural text. Hence, formal languages are emerging to allow a precise specification of enforceable privacy policies that can be verified. The EP3P language is one such formal language. An EP3P privacy policy of an enterprise consists of many rules. Given the semantics of the language, there may exist some rules in the ruleset which can never be used, these rules are referred to as redundant rules. Redundancies adversely affect privacy policies in several ways. Firstly, redundant rules reduce the efficiency of operations on privacy policies. Secondly, they may misdirect the policy auditor when determining the outcome of a policy. Therefore, in order to address these deficiencies it is important to identify and resolve redundancies. This thesis introduces the concept of minimal privacy policy - a policy that is free of redundancy. The essential component for maintaining the minimality of privacy policies is to determine the effects of the rules on each other. Hence, redundancy detection and resolution frameworks are proposed. Pair-wise redundancy detection is the central concept in these frameworks and it suggests a pair-wise comparison of the rules in order to detect redundancies. In addition, the thesis introduces a policy management tool that assists policy auditors in performing several operations on an EP3P privacy policy while maintaining its minimality. Formal results comparing alternative notions of redundancy, and how this would affect the tool, are also presented.

Fast searching algorithm for candidate satellite-node set in NLMG

The Node-based Local Mesh Generation (NLMG) algorithm, which is free of mesh inconsistency, is one of core algorithms in the Node-based Local Finite Element Method (NLFEM) to achieve the seamless link between mesh generation and stiffness matrix calculation, and the seamless link helps to improve the parallel efficiency of FEM. Furthermore, the key to ensure the efficiency and reliability of NLMG is to determine the candidate satellite-node set of a central node quickly and accurately. This paper develops a Fast Local Search Method based on Uniform Bucket (FLSMUB) and a Fast Local Search Method based on Multilayer Bucket (FLSMMB), and applies them successfully to the decisive problems, i.e. presenting the candidate satellite-node set of any central node in NLMG algorithm. Using FLSMUB or FLSMMB, the NLMG algorithm becomes a practical tool to reduce the parallel computation cost of FEM. Parallel numerical experiments validate that either FLSMUB or FLSMMB is fast, reliable and efficient for their suitable problems and that they are especially effective for computing the large-scale parallel problems.

Emergency department triage revisited

Triage is a process that is critical to the effective management of modern emergency departments. Triage systems aim, not only to ensure clinical justice for the patient, but also to provide an effective tool for departmental organisation, monitoring and evaluation. Over the last 20 years, triage systems have been standardised in a number of countries and efforts made to ensure consistency of application. However, the ongoing crowding of emergency departments resulting from access block and increased demand has led to calls for a review of systems of triage. In addition, international variance in triage systems limits the capacity for benchmarking. The aim of this paper is to provide a critical review of the literature pertaining to emergency department triage in order to inform the direction for future research. While education, guidelines and algorithms have been shown to reduce triage variation, there remains significant inconsistency in triage assessment arising from the diversity of factors determining the urgency of any individual patient. It is timely to accept this diversity, what is agreed, and what may be agreeable. It is time to develop and test an International Triage Scale (ITS) which is supported by an international collaborative approach towards a triage research agenda. This agenda would seek to further develop application and moderating tools and to utilise the scales for international benchmarking and research programmes.

Measuring Visual Consistency in 3D Rendering Systems

One of the major challenges facing a present day game development company is the removal of bugs from such complex virtual environments. This work presents an approach for measuring the correctness of synthetic scenes generated by a rendering system of a 3D application, such as a computer game. Our approach builds a database of labelled point clouds representing the spatiotemporal colour distribution for the objects present in a sequence of bug-free frames. This is done by converting the position that the pixels take over time into the 3D equivalent points with associated colours. Once the space of labelled points is built, each new image produced from the same game by any rendering system can be analysed by measuring its visual inconsistency in terms of distance from the database. Objects within the scene can be relocated (manually or by the application engine); yet the algorithm is able to perform the image analysis in terms of the 3D structure and colour distribution of samples on the surface of the object. We applied our framework to the publicly available game RacingGame developed for Microsoft(R) Xna(R). Preliminary results show how this approach can be used to detect a variety of visual artifacts generated by the rendering system in a professional quality game engine.

Computer profiling for forensic purposes

Computer forensics is the process of gathering and analysing evidence from computer systems to aid in the investigation of a crime. Typically, such investigations are undertaken by human forensic examiners using purpose-built software to discover evidence from a computer disk. This process is a manual one, and the time it takes for a forensic examiner to conduct such an investigation is proportional to the storage capacity of the computer's disk drives. The heterogeneity and complexity of various data formats stored on modern computer systems compounds the problems posed by the sheer volume of data. The decision to undertake a computer forensic examination of a computer system is a decision to commit significant quantities of a human examiner's time. Where there is no prior knowledge of the information contained on a computer system, this commitment of time and energy occurs with little idea of the potential benefit to the investigation. The key contribution of this research is the design and development of an automated process to describe a computer system and its activity for the purposes of a computer forensic investigation. The term proposed for this process is computer profiling. A model of a computer system and its activity has been developed over the course of this research. Using this model a computer system, which is the subj ect of investigation, can be automatically described in terms useful to a forensic investigator. The computer profiling process IS resilient to attempts to disguise malicious computer activity. This resilience is achieved by detecting inconsistencies in the information used to infer the apparent activity of the computer. The practicality of the computer profiling process has been demonstrated by a proof-of concept software implementation. The model and the prototype implementation utilising the model were tested with data from real computer systems. The resilience of the process to attempts to disguise malicious activity has also been demonstrated with practical experiments conducted with the same prototype software implementation.

Motivational misalignment on an iconic infrastructure project

Aligning the motivation of contractors and consultants to perform better than ‘business-as-usual’ (BAU) on a construction project is a complex undertaking and the costs of failure are high as misalignment can compromise project outcomes. Despite the potential benefits of effective alignment, there is still little information about optimally designing procurement approaches that promote motivation towards ‘above BAU’ goals. The paper contributes to this knowledge gap by examining the negative drivers of motivation in a major construction project that, despite a wide range of performance enhancing incentives, failed to exceed BAU performance. The paper provides a case study of an iconic infrastructure project undertaken in Australia between 2002 and 2004. It is shown that incentives provided to contractors and consultants to achieve above BAU performance can be compromised by a range of negative motivation drivers including: • inequitable contractual risk allocation; • late involvement of key stakeholders; • inconsistency between contract intentions and relationship intentions; • inadequate price negotiation; • inconsistency between the project performance goals and incentive goals; •unfair and inflexible incentive performance measurement processes. Future quantitative research is planned to determine the generalisability of these results.

Acid hydrolysis of easily dispersed and microaggregate-derived silt- and clay-sized fractions to isolate resistant soil organic matter

The current paradigm in soil organic matter (SOM) dynamics is that the proportion of biologically resistant SOM will increase when total SOM decreases. Recently, several studies have focused on identifying functional pools of resistant SOM consistent with expected behaviours. Our objective was to combine physical and chemical approaches to isolate and quantify biologically resistant SOM by applying acid hydrolysis treatments to physically isolated silt- and clay-sized soil fractions. Microaggegrate-derived and easily dispersed silt- and clay-sized fractions were isolated from surface soil samples collected from six long-term agricultural experiment sites across North America. These fractions were hydrolysed to quantify the non-hydrolysable fraction, which was hypothesized to represent a functional pool of resistant SOM. Organic C and total N concentrations in the four isolated fractions decreased in the order: native > no-till > conventional-till at all sites. Concentrations of non-hydrolysable C (NHC) and N (NHN) were strongly correlated with initial concentrations, and C hydrolysability was found to be invariant with management treatment. Organic C was less hydrolysable than N, and overall, resistance to acid hydrolysis was greater in the silt-sized fractions compared with the clay-sized fractions. The acid hydrolysis results are inconsistent with the current behaviour of increasing recalcitrance with decreasing SOM content: while %NHN was greater in cultivated soils compared with their native analogues, %NHC did not increase with decreasing total organic C concentrations. The analyses revealed an interaction between biochemical and physical protection mechanisms that acts to preserve SOM in fine mineral fractions, but the inconsistency of the pool size with expected behaviour remains to be fully explained.

The significance of endogeneity problems in crash models: An examination of left-turn lanes in intersection crash models

Crash prediction models are used for a variety of purposes including forecasting the expected future performance of various transportation system segments with similar traits. The influence of intersection features on safety have been examined extensively because intersections experience a relatively large proportion of motor vehicle conflicts and crashes compared to other segments in the transportation system. The effects of left-turn lanes at intersections in particular have seen mixed results in the literature. Some researchers have found that left-turn lanes are beneficial to safety while others have reported detrimental effects on safety. This inconsistency is not surprising given that the installation of left-turn lanes is often endogenous, that is, influenced by crash counts and/or traffic volumes. Endogeneity creates problems in econometric and statistical models and is likely to account for the inconsistencies reported in the literature. This paper reports on a limited-information maximum likelihood (LIML) estimation approach to compensate for endogeneity between left-turn lane presence and angle crashes. The effects of endogeneity are mitigated using the approach, revealing the unbiased effect of left-turn lanes on crash frequency for a dataset of Georgia intersections. The research shows that without accounting for endogeneity, left-turn lanes ‘appear’ to contribute to crashes; however, when endogeneity is accounted for in the model, left-turn lanes reduce angle crash frequencies as expected by engineering judgment. Other endogenous variables may lurk in crash models as well, suggesting that the method may be used to correct simultaneity problems with other variables and in other transportation modeling contexts.