Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Critical Systems Theory: A Political Economy of Language, Thought, and Technology

An emergent form of political economy, facilitated by information and communication technologies (ICTs), is widely propagated as the apotheosis of unmitigated social, economic, and technological progress. Meanwhile, throughout the world, social degradation and economic inequality are increasing logarithmically. Valued categories of thought are, axiomatically, the basic commodities of the “knowledge economy”. Language is its means of exchange. This paper proposes a sociolinguistic method with which to critically engage the hyperbole of the “Information Age”. The method is grounded in a systemic social theory that synthesises aspects of autopoiesis and Marxist political economy. A trade policy statement is analysed to exemplify the sociolinguistically created aberrations that are today most often construed as social and political determinants.

Managing hostile environments : journalists and media workers : learning to survive the world's difficult, remote and hostile environments

The aim of this research is to examine the changing nature of risks that face journalists and media workers in the world's difficult, remote and hostile environments, and consider the 'adequacy' of managing hostile environment safety courses that some media organizations require prior to foreign assignments. The study utilizes several creative works and contributions to this area of analysis, which includes a documentary film production, course contributions, an emergency reference handbook, security and incident management reviews and a template for evacuation and contingency planning. The research acknowledges that employers have a 'duty of care' to personnel working in these environments, identifies the necessity for pre-deployment training and support, and provides a solution for organizations that wish to initiate a comprehensive framework to advise, monitor, protect and respond to incidents. Finally, it explores the possible development of a unique and holistic service to facilitate proactive and responsive support, in the form of a new profession of 'Editorial Logistics Officer' or 'Editorial Safety Officer' within media organizations. This area of research is vitally important to the profession, and the intended contribution is to introduce a simple and cost-efficient framework for media organizations that desire to implement pre-deployment training and field-support – as these programs save lives. The complete proactive and responsive services may be several years from implementation. However, this study demonstrates that the facilitation of Managing Hostile Environment (MHE) courses should be the minimum professional standard. These courses have saved lives in the past and they provide journalists with the tools to "cover the story, and not become the story."

How well are Australian infants and children aged 4 to 5 years doing? Findings from the Longitudinal Study of Australian Children Wave 1

This report presents an analysis of the data from the first wave of the Longitudinal Study of Australian Children (LSAC) to explore the wellbeing of 5,107 children in the infant cohort of the study and the 4,983 children, aged 4 to 5 years, in the child cohort. Wave 1 of LSAC includes measures of multiple aspects of children’s early development. These developmental measures are summarised in the LSAC Outcome Index, a composite measure which includes an overall index as well as three separate domain scores, tapping physical development, social and emotional functioning, and learning and cognitive development.

A summary view of government cost recovery policies in Australia and New Zealand relating to the supply of public sector information

Researching administrative history is problematical. A trail of authoritative documents is often hard to find; and useful summaries can be difficult to organise, especially if source material is in paper formats in geographically dispersed locations. In the absence of documents, the reasons for particular decisions and the rationale underpinning particular policies can be confounded as key personnel advance in their professions and retire. The rationale for past decisions may be lost for practical purposes; and if an organisation’s memory of events is diminished, its learning through experience is also diminished. Publishing this document tries to avoid unnecessary duplication of effort by other researchers that need to venture into how policies of charging for public sector information have been justified. The author compiled this work within a somewhat limited time period and the work does not pretend to be a complete or comprehensive analysis of the issues.----- A significant part of the role of government is to provide a framework of legally-enforceable rights and obligations that can support individuals and non-government organisations in their lawful activities. Accordingly, claims that governments should be more ‘business-like’ need careful scrutiny. A significant supply of goods and services occurs as non-market activity where neither benefits nor costs are quantified within conventional accounting systems or in terms of money. Where a government decides to provide information as a service; and information from land registries is archetypical, the transactions occur as a political decision made under a direct or a clearly delegated authority of a parliament with the requisite constitutional powers. This is not a market transaction and the language of the market confuses attempts to describe a number of aspects of how governments allocate resources.----- Cost recovery can be construed as an aspect of taxation that is a sole prerogative of a parliament. The issues are fundamental to political constitutions; but they become more complicated where states cede some taxing powers to a central government as part of a federal system. Nor should the absence of markets be construed necessarily as ‘market failure’ or even ‘government failure’. The absence is often attributable to particular technical, economic and political constraints that preclude the operation of markets. Arguably, greater care is needed in distinguishing between the polity and markets in raising revenues and allocating resources; and that needs to start by removing unhelpful references to ‘business’ in the context of government decision-making.

High-stakes national testing: it's global, it's here to stay, and graduating teachers need to know about it

My oldest daughter recently secured a position as a Science/Geography teacher in a P-12 Catholic College in regional Queensland. This paper looks at the teaching world into which she has graduated. Specifically, the paper will outline and discuss findings from a survey of graduating early childhood student teachers in relation to their knowledge and skills of the current regime of high-stakes testing in Australia. The paper argues that understanding accountability and possessing skills to scrutinise test data are essential for the new teacher as s/he enters a profession in which governments world-wide are demanding a return for their investment in education. The paper will examine literature on accountability and surveillance in the form of high-stakes testing from global, school and classroom perspectives. It makes the claim that it is imperative for beginning teachers to be able to interpret high-stakes test data and considers the skills required to do this. The paper also draws on local research to comment on the readiness of graduates to meet this comparatively new professional demand.

Autopoiesis, language, literacy and the brain

When we attempt to speak about the relationship between language, literacy, and the brain, we find ourselves ill equipped to deal with these conceptually and qualitatively different phenomena. Immediately we must straddle different academic traditions that treat each of these as separate “things”. Broadly speaking, the study of language firstly belongs to the domain of biology, then to anthropology, sociology, and linguistics. At its most functional, a study of literacy education is a study of a particular technology, its diffusion techniques, and the abilities and motivations of people to adopt, or adapt themselves to, this technology. The brain is most commonly studied in the field of neurology, which is also a sub-discipline of biology, biochemistry, and medicine.

ePortfolios and eGovernment : from technology to the entrepreneurial self

We analyse the electronic portfolio (ePortfolio) in higher education policy and practice. While evangelical accounts of the ePortfolio celebrate its power as a new eLearning technology, we argue that it allows the mutually-reinforcing couple of neoliberalism and the enterprising self to function in ways in which individual difference can be presented, cultured and grown, all the time within a standardised framework which relentlessly polices the limits of the acceptable and unacceptable. We point to the ePortfolio as a practice of (self-) government, arguing that grander policy coalesces out of a halting, experimental set of technological instruments for thinking about how life should be lived.

Reframing evaluation of learning and teaching: An approach to change

Evaluation practices in the Higher Education sector have been criticised for having unclear purpose and principles; ignoring the complexity and changing nature of learning and teaching and the environments in which they occur; relying almost exclusively on student ratings of teachers working in classroom settings; lacking reliability and validity; using data for inappropriate purposes; and focusing on accountability and marketing rather than the improvement of learning and teaching. In response to similar criticism from stakeholders, in 2011 Queensland University of Technology (QUT) began a project which aims to reframe the organisation’s approach to the evaluation of learning and teaching. This paper describes the existing evaluation system; the emergence and early development of the project; and formulation of a conceptual framework identifying key dimensions of evaluation. It then compares the draft framework with other conceptualisations and models of evaluation identified in the literature, to determine its validity and suitability for supporting QUT’s plans for the future. Overall, the paper represents a structured evaluation of the REFRAME project at a particular point in its lifecycle. Given that the project follows an evidence based, practice-led process and applies an ongoing action research cycle, the findings are presented in the belief that QUT’s experience is broadly applicable to other institutions which may be contemplating change in relation to evaluation of learning and teaching.

Cross-cultural language learning and web design complexity

Accepting the fact that culture and language are interrelated in second language learning (SLL), the web sites should be designed to integrate with the cultural aspects. Yet many SLL web sites fail to integrate with the cultural aspects and/or focus on language acquisition only. This study identified three issues: (1) anthropologists’ cultural models mostly adopted in cross-cultural web user interface have been superficially used; (2) web designers deal with culture as a fixed one which needs to be modeled into interface design elements, so (3) there is a need for a communication framework between educators and design practitioners, which can be utilized in web design processes. This paper discusses what anthropology can contribute to language learning, mediated through web design processes and suggests a cultural user experience framework for web-based SLL by presenting an exemplary matrix. To evaluate the effectiveness of the framework, the key stakeholders (learners, teachers, and designers) participated in a case scenario-based evaluation. The result shows a high possibility that the framework can enhance the effective communication and collaboration for the cultural integration.

Attitudes and expectations of technologies to manage high risk wandering and elopement in persons with dementia : an Australian perspective

Wandering is aimless and repetitive locomotion that may expose persons with dementia (PWD) to elopement, getting lost and death. This study is an Australian replication of a US study. Cross-disciplinary consensus- based analysis was applied to data from five focus groups (N =47: cognitively intact LTC residents (5), carers of PWD (11), home care workers (13) allied health professionals and health-focused engineers (7) and RNs (11). Groups received briefing about wandering monitoring and elopement management systems. Consistent with US attitudes, participants in all groups agreed on what a wandering technology should do, how it should do it, and necessary technical specifications. Within each group participants raised the need for a continuum of care for PWD and the imperative for early recognition of potentially dangerous wandering and getting lost when they occur. Global Positioning System elopement management was the preferred option. Interestingly, the prospective value of GPS to recover a lost or eloped wanderer far outweighed privacy concerns, as in the US. A pervasive theme was that technologies need to augment, but cannot replace, attentive, compassionate caregiver presence. A significant theme raised only by Australian carers of PWD was the potential for development of implantable GPS technologies and the need for public debate about attendant ethical issues. Given that 60% or more of over 200,000 Australians and 4.5 million Americans with dementia will develop wandering, there is a pressing need to develop effective locator systems that may delay institutionalization, help allay carer concern and enhance PWD safety.

The ethnographer as community manager : language translation and user negotiation

This article investigates the ethnographic methodological question of how the researcher observes objectively while being part of the problem they are observing. It uses a case study of ABC Pool to argue a cooperative approach that combines the roles of the ethnographer with that of a community manager who assists in constructing a true representation of the researched environment. By using reflexivity as a research tool, the ethnographer engages in a process to self-check their personal presumptions and prejudices, and to strengthen the constructed representation of the researched environment. This article also suggests combining management and expertise research from the social sciences with ethnography, to understand and engage with the research field participants more intimately - which, ultimately, assists in gathering and analysing richer qualitative data.

A comparison of Chinese and Australian early childhood mathematics

In the 21st century mathematics proficiency is synonymous with a numerate citizenry. In the past few decades young children’s ability to reason mathematically and develop mathematical proficiencies has been recognised. This paper explores the history of early childhood mathematics (ECME) that may explicate differences in Chinese and Australian contexts. Results of this review established that China and Australia are diametrically positioned in ECME. Influencing each countries philosophies and practices are their cultural beliefs. ECME in China and Australia must be culturally sustainable to achieve excellent outcomes for young children. Ongoing critique and review is necessary to ensure that ECME is meeting the needs of all teachers and children in their particular context. China and Australia with their rich contrasting philosophies can assist each other in their journeys to create exemplary ECME for the 21st century.

Language, Literacy and Literature

"Language, Literacy and Literature combines concepts of language, literature and literacy within a pedagogical framework that leads readers through a series of learning processes. In other words, it is as much a book about teaching English as it is a book about learning how to learn about teaching. The book provides models for pre-service teachers to help identify the kinds of dispositions towards learning that a teacher needs to develop, such as curiosity, collaboration and willingness to ‘give things a go’. It further challenges the pre-service teacher to question what they think they know, as well as discover what they need to know. A range of practical and relevant exercises and activities assist in building habits of reflexive practice."-- publisher website