Using honeypots to analyse anomalous Internet activities

Monitoring Internet traffic is critical in order to acquire a good understanding of threats to computer and network security and in designing efficient computer security systems. Researchers and network administrators have applied several approaches to monitoring traffic for malicious content. These techniques include monitoring network components, aggregating IDS alerts, and monitoring unused IP address spaces. Another method for monitoring and analyzing malicious traffic, which has been widely tried and accepted, is the use of honeypots. Honeypots are very valuable security resources for gathering artefacts associated with a variety of Internet attack activities. As honeypots run no production services, any contact with them is considered potentially malicious or suspicious by definition. This unique characteristic of the honeypot reduces the amount of collected traffic and makes it a more valuable source of information than other existing techniques. Currently, there is insufficient research in the honeypot data analysis field. To date, most of the work on honeypots has been devoted to the design of new honeypots or optimizing the current ones. Approaches for analyzing data collected from honeypots, especially low-interaction honeypots, are presently immature, while analysis techniques are manual and focus mainly on identifying existing attacks. This research addresses the need for developing more advanced techniques for analyzing Internet traffic data collected from low-interaction honeypots. We believe that characterizing honeypot traffic will improve the security of networks and, if the honeypot data is handled in time, give early signs of new vulnerabilities or breakouts of new automated malicious codes, such as worms. The outcomes of this research include: • Identification of repeated use of attack tools and attack processes through grouping activities that exhibit similar packet inter-arrival time distributions using the cliquing algorithm; • Application of principal component analysis to detect the structure of attackers’ activities present in low-interaction honeypots and to visualize attackers’ behaviors; • Detection of new attacks in low-interaction honeypot traffic through the use of the principal component’s residual space and the square prediction error statistic; • Real-time detection of new attacks using recursive principal component analysis; • A proof of concept implementation for honeypot traffic analysis and real time monitoring.

Difference and dispersion : educational research in a postmodern context

Difference and Dispersion is the fourth in a series of annual research papers produced by doctoral students from The Graduate School of Education, The University of Queensland, following their presentation at the School’s annual Postgraduate Research Conference in Education. The work featured herein celebrates the diversity of cultural and disciplinary backgrounds of education researchers who come from as far afield as Germany, Hong Kong, China, Nigeria, Russia, Singapore, Thailand and of course different parts of Australia. In keeping with a postmodern epistemology, ‘difference’ and ‘dispersion’ are key themes in apprehending the multiplicity of their research topics, methodologies, methods and speaking/writing positions. From widely differing contexts and situations, these writers address the consequences, implications and possibilities for education at the beginning of the third millennium. Their interest ranges from location-specific issues in schools and classrooms, change in learning contexts and processes, educational discourses and relations of power in diverse geographical settings, and the differing articulations of the local and the global in situated policy contexts. Conceived and developed in a spirit of ongoing dialogue with and insight to alternative views and visions of education and society, this edited collection exemplifies the quality in diversity and the high levels of scholarship and supervision at one of Australia’s finest Graduate Schools of Education.

An advanced implicit meshless approach for the non-linear anomalous subdiffusion equation

Recently, the numerical modelling and simulation for anomalous subdiffusion equation (ASDE), which is a type of fractional partial differential equation( FPDE) and has been found with widely applications in modern engineering and sciences, are attracting more and more attentions. The current dominant numerical method for modelling ASDE is Finite Difference Method (FDM), which is based on a pre-defined grid leading to inherited issues or shortcomings. This paper aims to develop an implicit meshless approach based on the radial basis functions (RBF) for numerical simulation of the non-linear ASDE. The discrete system of equations is obtained by using the meshless shape functions and the strong-forms. The stability and convergence of this meshless approach are then discussed and theoretically proven. Several numerical examples with different problem domains are used to validate and investigate accuracy and efficiency of the newly developed meshless formulation. The results obtained by the meshless formulations are also compared with those obtained by FDM in terms of their accuracy and efficiency. It is concluded that the present meshless formulation is very effective for the modeling and simulation of the ASDE. Therefore, the meshless technique should have good potential in development of a robust simulation tool for problems in engineering and science which are governed by the various types of fractional differential equations.

Novel analytical and numerical methods for solving fractional dynamical systems

During the past three decades, the subject of fractional calculus (that is, calculus of integrals and derivatives of arbitrary order) has gained considerable popularity and importance, mainly due to its demonstrated applications in numerous diverse and widespread fields in science and engineering. For example, fractional calculus has been successfully applied to problems in system biology, physics, chemistry and biochemistry, hydrology, medicine, and finance. In many cases these new fractional-order models are more adequate than the previously used integer-order models, because fractional derivatives and integrals enable the description of the memory and hereditary properties inherent in various materials and processes that are governed by anomalous diffusion. Hence, there is a growing need to find the solution behaviour of these fractional differential equations. However, the analytic solutions of most fractional differential equations generally cannot be obtained. As a consequence, approximate and numerical techniques are playing an important role in identifying the solution behaviour of such fractional equations and exploring their applications. The main objective of this thesis is to develop new effective numerical methods and supporting analysis, based on the finite difference and finite element methods, for solving time, space and time-space fractional dynamical systems involving fractional derivatives in one and two spatial dimensions. A series of five published papers and one manuscript in preparation will be presented on the solution of the space fractional diffusion equation, space fractional advectiondispersion equation, time and space fractional diffusion equation, time and space fractional Fokker-Planck equation with a linear or non-linear source term, and fractional cable equation involving two time fractional derivatives, respectively. One important contribution of this thesis is the demonstration of how to choose different approximation techniques for different fractional derivatives. Special attention has been paid to the Riesz space fractional derivative, due to its important application in the field of groundwater flow, system biology and finance. We present three numerical methods to approximate the Riesz space fractional derivative, namely the L1/ L2-approximation method, the standard/shifted Gr¨unwald method, and the matrix transform method (MTM). The first two methods are based on the finite difference method, while the MTM allows discretisation in space using either the finite difference or finite element methods. Furthermore, we prove the equivalence of the Riesz fractional derivative and the fractional Laplacian operator under homogeneous Dirichlet boundary conditions – a result that had not previously been established. This result justifies the aforementioned use of the MTM to approximate the Riesz fractional derivative. After spatial discretisation, the time-space fractional partial differential equation is transformed into a system of fractional-in-time differential equations. We then investigate numerical methods to handle time fractional derivatives, be they Caputo type or Riemann-Liouville type. This leads to new methods utilising either finite difference strategies or the Laplace transform method for advancing the solution in time. The stability and convergence of our proposed numerical methods are also investigated. Numerical experiments are carried out in support of our theoretical analysis. We also emphasise that the numerical methods we develop are applicable for many other types of fractional partial differential equations.

On the nature of over-dispersion in motor vehicle crash prediction models

Statistical modeling of traffic crashes has been of interest to researchers for decades. Over the most recent decade many crash models have accounted for extra-variation in crash counts—variation over and above that accounted for by the Poisson density. The extra-variation – or dispersion – is theorized to capture unaccounted for variation in crashes across sites. The majority of studies have assumed fixed dispersion parameters in over-dispersed crash models—tantamount to assuming that unaccounted for variation is proportional to the expected crash count. Miaou and Lord [Miaou, S.P., Lord, D., 2003. Modeling traffic crash-flow relationships for intersections: dispersion parameter, functional form, and Bayes versus empirical Bayes methods. Transport. Res. Rec. 1840, 31–40] challenged the fixed dispersion parameter assumption, and examined various dispersion parameter relationships when modeling urban signalized intersection accidents in Toronto. They suggested that further work is needed to determine the appropriateness of the findings for rural as well as other intersection types, to corroborate their findings, and to explore alternative dispersion functions. This study builds upon the work of Miaou and Lord, with exploration of additional dispersion functions, the use of an independent data set, and presents an opportunity to corroborate their findings. Data from Georgia are used in this study. A Bayesian modeling approach with non-informative priors is adopted, using sampling-based estimation via Markov Chain Monte Carlo (MCMC) and the Gibbs sampler. A total of eight model specifications were developed; four of them employed traffic flows as explanatory factors in mean structure while the remainder of them included geometric factors in addition to major and minor road traffic flows. The models were compared and contrasted using the significance of coefficients, standard deviance, chi-square goodness-of-fit, and deviance information criteria (DIC) statistics. The findings indicate that the modeling of the dispersion parameter, which essentially explains the extra-variance structure, depends greatly on how the mean structure is modeled. In the presence of a well-defined mean function, the extra-variance structure generally becomes insignificant, i.e. the variance structure is a simple function of the mean. It appears that extra-variation is a function of covariates when the mean structure (expected crash count) is poorly specified and suffers from omitted variables. In contrast, when sufficient explanatory variables are used to model the mean (expected crash count), extra-Poisson variation is not significantly related to these variables. If these results are generalizable, they suggest that model specification may be improved by testing extra-variation functions for significance. They also suggest that known influences of expected crash counts are likely to be different than factors that might help to explain unaccounted for variation in crashes across sites

Ions in motor vehicle exhaust and their dispersion near busy roads

Measurements in the exhaust plume of a petrol-driven motor car showed that molecular cluster ions of both signs were present in approximately equal amounts. The emission rate increased sharply with engine speed while the charge symmetry remained unchanged. Measurements at the kerbside of nine motorways and five city roads showed that the mean total cluster ion concentration near city roads (603 cm-3) was about one-half of that near motorways (1211 cm-3) and about twice as high as that in the urban background (269 cm-3). Both positive and negative ion concentrations near a motorway showed a significant linear increase with traffic density (R2=0.3 at p<0.05) and correlated well with each other in real time (R2=0.87 at p<0.01). Heavy duty diesel vehicles comprised the main source of ions near busy roads. Measurements were conducted as a function of downwind distance from two motorways carrying around 120-150 vehicles per minute. Total traffic-related cluster ion concentrations decreased rapidly with distance, falling by one-half from the closest approach of 2m to 5m of the kerb. Measured concentrations decreased to background at about 15m from the kerb when the wind speed was 1.3 m s-1, this distance being greater at higher wind speed. The number and net charge concentrations of aerosol particles were also measured. Unlike particles that were carried downwind to distances of a few hundred metres, cluster ions emitted by motor vehicles were not present at more than a few tens of metres from the road.

Numerical evaluation of pollutant dispersion at a toll plaza based on system dynamics and Computational Fluid Dynamics models

The health of tollbooth workers is seriously threatened by long-term exposure to polluted air from vehicle exhausts. Using traffic data collected at a toll plaza, vehicle movements were simulated by a system dynamics model with different traffic volumes and toll collection procedures. This allowed the average travel time of vehicles to be calculated. A three-dimension Computational Fluid Dynamics (CFD) model was used with a k–ε turbulence model to simulate pollutant dispersion at the toll plaza for different traffic volumes and toll collection procedures. It was shown that pollutant concentration around tollbooths increases as traffic volume increases. Whether traffic volume is low or high (1500 vehicles/h or 2500 vehicles/h), pollutant concentration decreases if electronic toll collection (ETC) is adopted. In addition, pollutant concentration around tollbooths decreases as the proportion of ETC-equipped vehicles increases. However, if the proportion of ETC-equipped vehicles is very low and the traffic volume is not heavy, then pollutant concentration increases as the number of ETC lanes increases.

Adhesion and dispersion of salmeterol xinofoate from lactose interactive mixtures for inhalation - can surface roughness of carriers determine performance

The objective was to understand the influence of the surface roughness of lactose carriers on the adhesion and dispersion of salmeterol xinafoate (SX) from interactive mixtures. The surface roughness of lactose carriers was determined by confocal microscopy. Particle images and adhesion forces between SX and lactose particles were determined by Atomic Force Microscopy. The dispersion of SX (2.5%) from interactive mixtures with lactose was determined using a twin-stage impinger (TSI) with a Rotahaler® at an airflow rate of 60L/min. SX was analysed using a validated HPLC assay. The RMS Rq of lactose carriers ranged from 0.93-2.84μm, the Fine Particle Fraction (FPF) of SX ranged between 4 and 24 percent and average adhesion force between a SX and lactose particles ranged between 49 and 134 nN. No direct correlation was observed between the RMS Rq of lactose carriers and either the FPF of SX for the interactive mixtures or the adhesion force of a SX on the lactose particles; however, the presence of fine lactose associated with the carrier surface increased the FPF of SX. Dispersion through direct SX detachment from the carrier surface was not consistent with the poor correlations described and was more likely to occur through complex particulate interactions involving fine lactose.

Effects of magnesium stearate on the efficient dispersion of salbutamol sulphate from carrier-based dry powder inhaler formulations

Dry powder inhaler (DPI) formulations is one of the most useful aerosol preparations in which drugs may be formulated as carrier-based interactive mixtures with micronised drug particles (<5 μm) adhered onto the surface of large inert carriers (lactose powders). The addition of magnesium stearate (MgSt) (1-3), was found to increase dispersion of various drugs from DPI formulations. Recently, some active compounds coated with 5% (wt/wt) MgSt using the mechanofusion method showed significant improvements in aerosolization behavior due to the reduction in intrinsic cohesion force (4). Application of MgSt in powder formulations is not new; however, no studies demonstrated the minimum threshold level for this excipient in efficient aerosolization of drug powders from the interactive mixtures. Therefore, this study investigated the role of MgSt concentration on the efficient dispersion of salbutamol sulphate (SS) from DPI formulations.