Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Synthesis and Raman spectroscopic study of Mg/Al,Fe hydrotalcites with variable cationic ratios

Hydrotalcites of formula Mg6 (Fe,Al)2(OH)16(CO3).4H2O formed by intercalation with the carbonate anion as a function of divalent/trivalent cationic ratio have been successfully synthesised. The XRD patterns show variation in the d-spacing attributed to the size of the cation. Raman and infrared bands in the OH stretching region are assigned to (a) brucite layer OH stretching vibrations (b) water stretching bands and (c) water strongly hydrogen bonded to the carbonate anion. Multiple (CO3)2- symmetric stretching bands suggest that different types of (CO3)2- exist in the hydrotalcite interlayer. Increasing the cation ratio (Mg/Al,Fe) resulted in an increase in the combined intensity of the 2 Raman bands at around 3600 cm-1, attributed to Mg-OH stretching modes, and a shift of the overall band profile to higher wavenumbers. These observations are believed to be a result of the increase in magnesium in the structure. Raman spectroscopy shows a reduction in the symmetry of the carbonate, leading to the conclusion that the anions are bonded to the brucite-like hydroxyl surface and to the water in the interlayer. Water bending modes are identified in the infrared spectra at positions greater than 1630 cm-1, indicating the water is strongly hydrogen bonded to both the interlayer anions and the brucite-like surface.

Simulation and development of a mock circulation loop with variable compliance

Heart disease is attributed as the highest cause of death in the world. Although this could be alleviated by heart transplantation, there is a chronic shortage of donor hearts and so mechanical solutions are being considered. Currently, many Ventricular Assist Devices (VADs) are being developed worldwide in an effort to increase life expectancy and quality of life for end stage heart failure patients. Current pre-clinical testing methods for VADs involve laboratory testing using Mock Circulation Loops (MCLs), and in vivo testing in animal models. The research and development of highly accurate MCLs is vital to the continuous improvement of VAD performance. The first objective of this study was to develop and validate a mathematical model of a MCL. This model could then be used in the design and construction of a variable compliance chamber to improve the performance of an existing MCL as well as form the basis for a new miniaturised MCL. An extensive review of literature was carried out on MCLs and mathematical modelling of their function. A mathematical model of a MCL was then created in the MATLAB/SIMULINK environment. This model included variable features such as resistance, fluid inertia and volumes (resulting from the pipe lengths and diameters); compliance of Windkessel chambers, atria and ventricles; density of both fluid and compressed air applied to the system; gravitational effects on vertical columns of fluid; and accurately modelled actuators controlling the ventricle contraction. This model was then validated using the physical properties and pressure and flow traces produced from a previously developed MCL. A variable compliance chamber was designed to reproduce parameters determined by the mathematical model. The function of the variability was achieved by controlling the transmural pressure across a diaphragm to alter the compliance of the system. An initial prototype was tested in a previously developed MCL, and a variable level of arterial compliance was successfully produced; however, the complete range of compliance values required for accurate physiological representation was not able to be produced with this initial design. The mathematical model was then used to design a smaller physical mock circulation loop, with the tubing sizes adjusted to produce accurate pressure and flow traces whilst having an appropriate frequency response characteristic. The development of the mathematical model greatly assisted the general design of an in vitro cardiovascular device test rig, while the variable compliance chamber allowed simple and real-time manipulation of MCL compliance to allow accurate transition between a variety of physiological conditions. The newly developed MCL produced an accurate design of a mechanical representation of the human circulatory system for in vitro cardiovascular device testing and education purposes. The continued improvement of VAD test rigs is essential if VAD design is to improve, and hence improve quality of life and life expectancy for heart failure patients.

Examining the use of bid information in predicting the contractor’s performance

Purpose – The purpose of this paper is to examine the use of bid information, including both price and non-price factors in predicting the bidder’s performance. Design/methodology/approach – The practice of the industry was first reviewed. Data on bid evaluation and performance records of the successful bids were then obtained from the Hong Kong Housing Department, the largest housing provider in Hong Kong. This was followed by the development of a radial basis function (RBF) neural network based performance prediction model. Findings – It is found that public clients are more conscientious and include non-price factors in their bid evaluation equations. With the input variables used the information is available at the time of the bid and the output variable is the project performance score recorded during work in progress achieved by the successful bidder. It was found that past project performance score is the most sensitive input variable in predicting future performance. Research limitations/implications – The paper shows the inadequacy of using price alone for bid award criterion. The need for a systemic performance evaluation is also highlighted, as this information is highly instrumental for subsequent bid evaluations. The caveat for this study is that the prediction model was developed based on data obtained from one single source. Originality/value – The value of the paper is in the use of an RBF neural network as the prediction tool because it can model non-linear function. This capability avoids tedious ‘‘trial and error’’ in deciding the number of hidden layers to be used in the network model. Keywords Hong Kong, Construction industry, Neural nets, Modelling, Bid offer spreads Paper type Research paper

Numerical methods for the variable-order fractional advection-diffusion equation with a nonlinear source term

In this paper, we consider a variable-order fractional advection-diffusion equation with a nonlinear source term on a finite domain. Explicit and implicit Euler approximations for the equation are proposed. Stability and convergence of the methods are discussed. Moreover, we also present a fractional method of lines, a matrix transfer technique, and an extrapolation method for the equation. Some numerical examples are given, and the results demonstrate the effectiveness of theoretical analysis.

Stability and convergence of a new explicit finite-difference approximation for the variable-order nonlinear fractional diffusion equation

In this paper, we consider the variable-order nonlinear fractional diffusion equation View the MathML source where xRα(x,t) is a generalized Riesz fractional derivative of variable order View the MathML source and the nonlinear reaction term f(u,x,t) satisfies the Lipschitz condition |f(u1,x,t)-f(u2,x,t)|less-than-or-equals, slantL|u1-u2|. A new explicit finite-difference approximation is introduced. The convergence and stability of this approximation are proved. Finally, some numerical examples are provided to show that this method is computationally efficient. The proposed method and techniques are applicable to other variable-order nonlinear fractional differential equations.

The impact of institutional, instrumental and interpersonal underpinnings on network dynamics and outcomes

Networks form a key part of the infrastructure of contemporary governance arrangements and, as such, are likely to continue for some time. Networks can take many forms and be formed for many reasons. Some networks have been explicitly designed to generate a collective response to an issue; some arise from a top down perspective through mandate or coercion; while others rely more heavily on interpersonal relations and doing the right thing. In this paper, these three different perspectives are referred to as the “3I”s: Instrumental, Institutional or Interpersonal. It is proposed that these underlying motivations will affect the process dynamics within the different types of networks in different ways and therefore influence the type of outcomes achieved. This proposition is tested through a number of case studies. An understanding of these differences will lead to more effective design, management and clearer expectations of what can be achieved through networks.

Elicitator : an expert elicitation tool for regression in ecology

Expert elicitation is the process of retrieving and quantifying expert knowledge in a particular domain. Such information is of particular value when the empirical data is expensive, limited, or unreliable. This paper describes a new software tool, called Elicitator, which assists in quantifying expert knowledge in a form suitable for use as a prior model in Bayesian regression. Potential environmental domains for applying this elicitation tool include habitat modeling, assessing detectability or eradication, ecological condition assessments, risk analysis, and quantifying inputs to complex models of ecological processes. The tool has been developed to be user-friendly, extensible, and facilitate consistent and repeatable elicitation of expert knowledge across these various domains. We demonstrate its application to elicitation for logistic regression in a geographically based ecological context. The underlying statistical methodology is also novel, utilizing an indirect elicitation approach to target expert knowledge on a case-by-case basis. For several elicitation sites (or cases), experts are asked simply to quantify their estimated ecological response (e.g. probability of presence), and its range of plausible values, after inspecting (habitat) covariates via GIS.

Glycaemic load is associated with insulin resistance in older Australian women

Background: Diets with a high postprandial glycemic response may contribute to long-term development of insulin resistance and diabetes, however previous epidemiological studies are conflicting on whether glycemic index (GI) or glycemic load (GL) are dietary factors associated with the progression. Our objectives were to estimate GI and GL in a group of older women, and evaluate cross-sectional associations with insulin resistance. Subjects and Methods: Subjects were 329 Australian women aged 42-81 years participating in year three of the Longitudinal Assessment of Ageing in Women (LAW). Dietary intakes were assessed by diet history interviews and analysed using a customised GI database. Insulin resistance was defined as a homeostasis model assessment (HOMA) value of >3.99, based on fasting blood glucose and insulin concentrations. Results: GL was significantly higher in the 26 subjects who were classified as insulin resistant compared to subjects who were not (134±33 versus 114±24, P<0.001). In a logistic regression model, an increment of 15 GL units increased the odds of insulin resistance by 2.09 (95%CI 1.55, 2.80, P<0.001) independently of potential confounding variables. No significant associations were found when insulin resistance was assessed as a continuous variable. Conclusions: Results of this cross-sectional study support the concept that diets with a higher GL are associated with increased risk of insulin resistance. Further studies are required to investigate whether reducing glycemic intake, by either consuming lower GI foods and/or smaller serves of carbohydrate, can contribute to a reduction in development of insulin resistance and long-term risk of type 2 diabetes.

Characterisation of soils with the use of instrumental techniques : a multivariate forensic study

The value of soil evidence in the forensic discipline is well known. However, it would be advantageous if an in-situ method was available that could record responses from tyre or shoe impressions in ground soil at the crime scene. The development of optical fibres and emerging portable NIR instruments has unveiled a potential methodology which could permit such a proposal. The NIR spectral region contains rich chemical information in the form of overtone and combination bands of the fundamental infrared absorptions and low-energy electronic transitions. This region has in the past, been perceived as being too complex for interpretation and consequently was scarcely utilized. The application of NIR in the forensic discipline is virtually non-existent creating a vacancy for research in this area. NIR spectroscopy has great potential in the forensic discipline as it is simple, nondestructive and capable of rapidly providing information relating to chemical composition. The objective of this study is to investigate the ability of NIR spectroscopy combined with Chemometrics to discriminate between individual soils. A further objective is to apply the NIR process to a simulated forensic scenario where soil transfer occurs. NIR spectra were recorded from twenty-seven soils sampled from the Logan region in South-East Queensland, Australia. A series of three high quartz soils were mixed with three different kaolinites in varying ratios and NIR spectra collected. Spectra were also collected from six soils as the temperature of the soils was ramped from room temperature up to 6000C. Finally, a forensic scenario was simulated where the transferral of ground soil to shoe soles was investigated. Chemometrics methods such as the commonly known Principal Component Analysis (PCA), the less well known fuzzy clustering (FC) and ranking by means of multicriteria decision making (MCDM) methodology were employed to interpret the spectral results. All soils were characterised using Inductively Coupled Plasma Optical Emission Spectroscopy and X-Ray Diffractometry. Results were promising revealing NIR combined with Chemometrics is capable of discriminating between the various soils. Peak assignments were established by comparing the spectra of known minerals with the spectra collected from the soil samples. The temperature dependent NIR analysis confirmed the assignments of the absorptions due to adsorbed and molecular bound water. The relative intensities of the identified NIR absorptions reflected the quantitative XRD and ICP characterisation results. PCA and FC analysis of the raw soils in the initial NIR investigation revealed that the soils were primarily distinguished on the basis of their relative quartz and kaolinte contents, and to a lesser extent on the horizon from which they originated. Furthermore, PCA could distinguish between the three kaolinites used in the study, suggesting that the NIR spectral region was sensitive enough to contain information describing variation within kaolinite itself. The forensic scenario simulation PCA successfully discriminated between the ‘Backyard Soil’ and ‘Melcann® Sand’, as well as the two sampling methods employed. Further PCA exploration revealed that it was possible to distinguish between the various shoes used in the simulation. In addition, it was possible to establish association between specific sampling sites on the shoe with the corresponding site remaining in the impression. The forensic application revealed some limitations of the process relating to moisture content and homogeneity of the soil. These limitations can both be overcome by simple sampling practices and maintaining the original integrity of the soil. The results from the forensic scenario simulation proved that the concept shows great promise in the forensic discipline.

Demographic category membership and leadership in small groups : a social identity analysis

Developing the social identity theory of leadership (e.g., [Hogg, M. A. (2001). A social identity theory of leadership. Personality and Social Psychology Review, 5, 184–200]), an experiment (N=257) tested the hypothesis that as group members identify more strongly with their group (salience) their evaluations of leadership effectiveness become more strongly influenced by the extent to which their demographic stereotype-based impressions of their leader match the norm of the group (prototypicality). Participants, with more or less traditional gender attitudes (orientation), were members, under high or low group salience conditions (salience), of non-interactive laboratory groups that had “instrumental” or “expressive” group norms (norm), and a male or female leader (leader gender). As predicted, these four variables interacted significantly to affect perceptions of leadership effectiveness. Reconfiguration of the eight conditions formed by orientation, norm and leader gender produced a single prototypicality variable. Irrespective of participant gender, prototypical leaders were considered more effective in high then low salience groups, and in high salience groups prototypical leaders were more effective than less prototypical leaders. Alternative explanations based on status characteristics and role incongruity theory do not account well for the findings. Implications of these results for the glass ceiling effect and for a wider social identity analysis of the impact of demographic group membership on leadership in small groups are discussed.