Tool-supported dataflow analysis of a security-critical embedded device

Defence organisations perform information security evaluations to confirm that electronic communications devices are safe to use in security-critical situations. Such evaluations include tracing all possible dataflow paths through the device, but this process is tedious and error-prone, so automated reachability analysis tools are needed to make security evaluations faster and more accurate. Previous research has produced a tool, SIFA, for dataflow analysis of basic digital circuitry, but it cannot analyse dataflow through microprocessors embedded within the circuit since this depends on the software they run. We have developed a static analysis tool that produces SIFA compatible dataflow graphs from embedded microcontroller programs written in C. In this paper we present a case study which shows how this new capability supports combined hardware and software dataflow analyses of a security critical communications device.

Data flow analysis of embedded program expressions

Data flow analysis techniques can be used to help assess threats to data confidentiality and integrity in security critical program code. However, a fundamental weakness of static analysis techniques is that they overestimate the ways in which data may propagate at run time. Discounting large numbers of these false-positive data flow paths wastes an information security evaluator's time and effort. Here we show how to automatically eliminate some false-positive data flow paths by precisely modelling how classified data is blocked by certain expressions in embedded C code. We present a library of detailed data flow models of individual expression elements and an algorithm for introducing these components into conventional data flow graphs. The resulting models can be used to accurately trace byte-level or even bit-level data flow through expressions that are normally treated as atomic. This allows us to identify expressions that safely downgrade their classified inputs and thereby eliminate false-positive data flow paths from the security evaluation process. To validate the approach we have implemented and tested it in an existing data flow analysis toolkit.

A taint marking approach to confidentiality violation detection

This article presents a novel approach to confidentiality violation detection based on taint marking. Information flows are dynamically tracked between applications and objects of the operating system such as files, processes and sockets. A confidentiality policy is defined by labelling sensitive information and defining which information may leave the local system through network exchanges. Furthermore, per application profiles can be defined to restrict the sets of information each application may access and/or send through the network. In previous works, we focused on the use of mandatory access control mechanisms for information flow tracking. In this current work, we have extended the previous information flow model to track network exchanges, and we are able to define a policy attached to network sockets. We show an example application of this extension in the context of a compromised web browser: our implementation detects a confidentiality violation when the browser attempts to leak private information to a remote host over the network.

Toward a shared understanding of competency in programming : an invitation to the BABELnot Project

The ICT degrees in most Australian universities have a sequence of up to three programming subjects, or units. BABELnot is an ALTC-funded project that will document the academic standards associated with those three subjects in the six participating universities and, if possible, at other universities. This will necessitate the development of a rich framework for describing the learning goals associated with programming. It will also be necessary to benchmark exam questions that are mapped onto this framework. As part of the project, workshops are planned for ACE 2012, ICER 2012 and ACE 2013, to elicit feedback from the broader Australasian computing education community, and to disseminate the project’s findings. The purpose of this paper is to introduce the project to that broader Australasian computing education community and to invite their active participation.

Perceived gender differences in STEM learning in the middle school

Women are underrepresented in science, technology, engineering and mathematics (STEM) university coursework, reflecting long-standing gender issues that have existed in core middle-school STEM subject areas. Using data from a survey and written responses, we report on findings following the introduction of engineering education in middle school classes across three schools (grade level 7, n=122). The engineering experiences fused science, technology and mathematics concepts. The survey revealed higher percentages for girls than boys in 13 of the 24 items; however there were six items with a 20% difference in their perceptions about learning in STEM. For instance, despite girls recording that they have been provided equal or more opportunities than boys in STEM, they believed they do not do as well as boys (80% boys, 48% girls) or want to seek a career in STEM (39% boys, 17% girls). The written responses revealed gender differences across a number of themes in the students’ responses, including resources, group work, the nature and type of learning experiences, content knowledge, and teachers’ instructional style. Exposing students to STEM education facilitates an awareness of their learning and may assist girls to consider studying STEM subjects or STEM careers.

Design on the future: developing and enacting sustainable living programs in primary schools

Sustainable living is high on the international agenda (Ginsberg & Frame, 2004; Sutton, 2004). If education is fundamental to global transformation towards sustainability, then schools are in strategic positions to facilitate this change. Over recent years, schools in Australia have become more active in encouraging sustainability with the implementation of programs such as Science Education for Sustainable Living (SESL) that focus on topics such as energy efficiency, recycling, enhancing biodiversity, protecting species, and managing resources. This paper reports on a government funded Australian School Innovation in Science, Technology and Mathematics (ASISTM) project titled “Integrating science, technology and mathematics for understanding sustainable living” in which teachers, preservice teachers and other science professionals worked collaboratively to plan and enact a range of SESL programs for primary school students. Participants in this study included: 6 teachers, 5 preservice teachers, 2 university partners, 2 scientists, 4 consultants, and over 250 primary students. The findings from this qualitative study revealed a need for: (1) professional development for understanding SESL, (2) procedures for establishing and implementing SESL, and (3) strategies to devise, implement and evaluate SESL units of work.

Classifying the user intent of web queries using k-means clustering

Purpose: Web search engines are frequently used by people to locate information on the Internet. However, not all queries have an informational goal. Instead of information, some people may be looking for specific web sites or may wish to conduct transactions with web services. This paper aims to focus on automatically classifying the different user intents behind web queries. Design/methodology/approach: For the research reported in this paper, 130,000 web search engine queries are categorized as informational, navigational, or transactional using a k-means clustering approach based on a variety of query traits. Findings: The research findings show that more than 75 percent of web queries (clustered into eight classifications) are informational in nature, with about 12 percent each for navigational and transactional. Results also show that web queries fall into eight clusters, six primarily informational, and one each of primarily transactional and navigational. Research limitations/implications: This study provides an important contribution to web search literature because it provides information about the goals of searchers and a method for automatically classifying the intents of the user queries. Automatic classification of user intent can lead to improved web search engines by tailoring results to specific user needs. Practical implications: The paper discusses how web search engines can use automatically classified user queries to provide more targeted and relevant results in web searching by implementing a real time classification method as presented in this research. Originality/value: This research investigates a new application of a method for automatically classifying the intent of user queries. There has been limited research to date on automatically classifying the user intent of web queries, even though the pay-off for web search engines can be quite beneficial. © Emerald Group Publishing Limited.

Investigating the performance of automatic new topic identification across multiple datasets 1

Recent studies on automatic new topic identification in Web search engine user sessions demonstrated that neural networks are successful in automatic new topic identification. However most of this work applied their new topic identification algorithms on data logs from a single search engine. In this study, we investigate whether the application of neural networks for automatic new topic identification are more successful on some search engines than others. Sample data logs from the Norwegian search engine FAST (currently owned by Overture) and Excite are used in this study. Findings of this study suggest that query logs with more topic shifts tend to provide more successful results on shift-based performance measures, whereas logs with more topic continuations tend to provide better results on continuation-based performance measures.

Using the work system method with freshman information systems students

Recent surveys of information technology management professionals show that understanding business domains in terms of business productivity and cost reduction potential, knowledge of different vertical industry segments and their information requirements, understanding of business processes and client-facing skills are more critical for Information Systems personnel than ever before. In an attempt to restrucuture the information systems curriculum accordingly, our view it that information systems students need to develop an appreciation for organizational work systems in order to understand the operation and significance of information systems within such work systems.

Some empirical results for neo-Piagetian reasoning in novice programmers and the relationship to code explanation questions

Recent research on novice programmers has suggested that they pass through neo-Piagetian stages: sensorimotor, preoperational, and concrete operational stages, before eventually reaching programming competence at the formal operational stage. This paper presents empirical results in support of this neo-Piagetian perspective. The major novel contributions of this paper are empirical results for some exam questions aimed at testing novices for the concrete operational abilities to reason with quantities that are conserved, processes that are reversible, and properties that hold under transitive inference. While the questions we used had been proposed earlier by Lister, he did not present any data for how students performed on these questions. Our empirical results demonstrate that many students struggle to answer these problems, despite the apparent simplicity of these problems. We then compare student performance on these questions with their performance on six explain in plain English questions.

Engaging parents in STEM: Coteaching and cogenerative dialoguing in a Queensland high school

Diminished student interest in science, technology, engineering and mathematics (STEM) is recognised by educators, researchers and public policy makers as a concerning global trend. Inviting stakeholders like scientists and industry specialists to discuss their work is one means schools use to facilitate student engagement in the sciences. However, these visits generally comprise one-off sessions with minimal relevance to students’ particular and ongoing learning needs. This case study investigated coteaching and cogenerative dialoguing with parents in teaching a Year-8 multidisciplinary unit with science and technology foci. Two parents cotaught alongside the resident teacher and researcher over eight months. This paper concentrates on one parent, a medical scientist by profession. Data sources included video and audio recordings of cogenerative dialogues and classroom interactions, student work samples and journal entries. Data were interrogated using the sociological constructs of fields and capitals and the dialectic of structure|agency. The findings reveal how (a) the parent’s science and technology knowledge was tailored to the students’ needs initially and continually and (b) student-generated data indicated enhanced engagement in science and technology. The research speaks to schools and governments about enhancing STEM education by furthering collaborative relationships with relevant stakeholders.

State convergence in the initialisation of the Sfinks stream cipher

Sfinks is a shift register based stream cipher designed for hardware implementation. The initialisation state update function is different from the state update function used for keystream generation. We demonstrate state convergence during the initialisation process, even though the individual components used in the initialisation are one-to-one. However, the combination of these components is not one-to-one.

A capabilities-based approach to obtaining a deeper understanding of information technology governance effectiveness : evidence from IT steering committees

Given the substantial investment in information technology (IT), and the significant impact IT has on organizational success, organizations consume considerable resources to manage acquisition and use of their IT resources. While various arguments proposed suggest which IT governance arrangements may work best, our understanding of the effectiveness of such initiatives is limited. We examine the relationship between the effectiveness of IT steering committee driven IT governance initiatives and firm's IT management and IT infrastructure related capabilities. We further propose that firm's ITrelated capabilities generated through IT governance initiatives should improve its business processes and firm-level performance. We test these relationships empirically by a field survey. Results suggest that firms' effectiveness of IT steering committee driven IT governance initiatives positively relates to the level of their IT-related capabilities. We also found positive relationships between IT-related capabilities and internal process-level performance. Our results also support that improvement in internal process-level performance positively relates to improvement in customer service and firm-level performance.

The case for ICT work-integrated learning from graduates in the workplace

An online survey of recent ICT graduates in the workplace was carried out as part of a recent project funded by the Australian Learning and Teaching Council. The survey was concerned with the ICT curriculum in relation to workplace job requirements and university preparation for these requirements. The survey contained quantitative and qualitative components and findings from the former have been published (Koppi et al., 2009). This paper reports on a quantitative comparison of responses from graduates who had workplace experience and those who did not, and a qualitative analysis of text responses from all ICT graduates to open-ended questions concerning the curriculum and their perceived university preparation for the workplace. The overwhelming response from ICT graduates in the workplace was for more industry related learning. These industry relationships included industry involvement, workplace learning and business experience, up-to-date teaching and technologies, practical applications, and real-world activities. A closer relationship of academia and industry was strongly advocated by ICT graduates in the workplace.

An example of cognitive obstacles in advanced integration: the case of scalar line integrals

Cognitive obstacles that arise in the teaching and learning of scalar line integrals, derived from cognitive aids provided to students when first learning about integration of single variable functions are described. A discussion of how and why the obstacles cause students problems is presented and possible strategies to overcome the obstacles are outlined.