Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Geek goddesses go to school : A study of female pre-service teachers in information technology courses

Various reasons have been proffered for female under-representation in tertiary information technology (IT) courses and the IT industry with most relating to cultural moirés. The 2006 Geek Goddess calendar was designed to alter IT’s “geeky image” and the term is used here to represent young women enrolled in pre-service IT teaching courses. Their special mix of IT and teaching draws on conflicting stereotypes and represents a micro-climate which is typically lost in studies of IT occupations because of the aggregation of all IT roles. This paper will report on a small-scale investigation of female students (N=25) at a university in Queensland (Australia) studying to become teachers of secondary IT subjects. They are entering the IT industry, gendered as a “male” occupation, through the safe space of teaching a discipline allied to feminine qualities of nurturing. They are “geek goddesses” who – perhaps to balance the masculine and feminine of these occupations - have decided to go to school rather than into corporations or government.

Using data mining to improve building life cycle

The building life cycle process is complex and prone to fragmentation as it moves through its various stages. The number of participants, and the diversity, specialisation and isolation both in space and time of their activities, have dramatically increased over time. The data generated within the construction industry has become increasingly overwhelming. Most currently available computer tools for the building industry have offered productivity improvement in the transmission of graphical drawings and textual specifications, without addressing more fundamental changes in building life cycle management. Facility managers and building owners are primarily concerned with highlighting areas of existing or potential maintenance problems in order to be able to improve the building performance, satisfying occupants and minimising turnover especially the operational cost of maintenance. In doing so, they collect large amounts of data that is stored in the building’s maintenance database. The work described in this paper is targeted at adding value to the design and maintenance of buildings by turning maintenance data into information and knowledge. Data mining technology presents an opportunity to increase significantly the rate at which the volumes of data generated through the maintenance process can be turned into useful information. This can be done using classification algorithms to discover patterns and correlations within a large volume of data. This paper presents how and what data mining techniques can be applied on maintenance data of buildings to identify the impediments to better performance of building assets. It demonstrates what sorts of knowledge can be found in maintenance records. The benefits to the construction industry lie in turning passive data in databases into knowledge that can improve the efficiency of the maintenance process and of future designs that incorporate that maintenance knowledge.

Using videotelephony to support paediatric oncology-related palliative care in the home : from abandoned RCT to acceptability study

Videotelephony (real-time audio-visual communication) has been used successfully in adult palliative home care. This paper describes two attempts to complete an RCT (both of which were abandoned following difficulties with family recruitment), designed to investigate the use of videotelephony with families receiving palliative care from a tertiary paediatric oncology service in Brisbane, Australia. To investigate whether providing videotelephone-based support was acceptable to these families, a 12-month non-randomised acceptability trial was completed. Seventeen palliative care families were offered access to a videotelephone support service in addition to the 24 hours ‘on-call’ service already offered. A 92% participation rate in this study provided some reassurance that the use of videotelephones themselves was not a factor in poor RCT participation rates. The next phase of research is to investigate the integration of videotelephone-based support from the time of diagnosis, through outpatient care and support, and for palliative care rather than for palliative care in isolation

Bayesian versus frequentist statistical inference for investi gating a one-off cancer cluster reported to a health department

Background The problem of silent multiple comparisons is one of the most difficult statistical problems faced by scientists. It is a particular problem for investigating a one-off cancer cluster reported to a health department because any one of hundreds, or possibly thousands, of neighbourhoods, schools, or workplaces could have reported a cluster, which could have been for any one of several types of cancer or any one of several time periods. Methods This paper contrasts the frequentist approach with a Bayesian approach for dealing with silent multiple comparisons in the context of a one-off cluster reported to a health department. Two published cluster investigations were re-analysed using the Dunn-Sidak method to adjust frequentist p-values and confidence intervals for silent multiple comparisons. Bayesian methods were based on the Gamma distribution. Results Bayesian analysis with non-informative priors produced results similar to the frequentist analysis, and suggested that both clusters represented a statistical excess. In the frequentist framework, the statistical significance of both clusters was extremely sensitive to the number of silent multiple comparisons, which can only ever be a subjective "guesstimate". The Bayesian approach is also subjective: whether there is an apparent statistical excess depends on the specified prior. Conclusion In cluster investigations, the frequentist approach is just as subjective as the Bayesian approach, but the Bayesian approach is less ambitious in that it treats the analysis as a synthesis of data and personal judgements (possibly poor ones), rather than objective reality. Bayesian analysis is (arguably) a useful tool to support complicated decision-making, because it makes the uncertainty associated with silent multiple comparisons explicit.

Doctors and their patients : A context for understanding the wish to hasten death

There is a paucity of research that has directly examined the role of the health professional in dealing with a terminally ill patient's wish to hasten death (WTHD) and the implications of this for the support and services needed in the care for a dying patient. Themes to emerge from a qualitative analysis of interviews conducted on doctors (n=24) involved in the treatment and care of terminally ill patients were (i) the doctors' experiences in caring for their patients (including themes of emotional demands/expectations, the duration of illness, and the availability of palliative care services); (ii) the doctors' perception of the care provided to their respective patients (comprising themes concerning satisfaction with the care for physical symptoms, for emotional symptoms, or overall care); (iii) the doctors' attitudes to euthanasia and (iv) the doctors' perception of their patients' views/beliefs regarding euthanasia and hastened death. When responses were categorised according to the patients' level of a WTHD, the theme concerning the prolonged nature of the patients' illnesses was prominent in the doctor group who had patients with the highest WTHD, whereas there was only a minority of responses concerning support from palliative care services and satisfaction with the level of emotional care in this group. This exploratory study presents a set of descriptive findings identifying themes among a small group of doctors who have been involved in the care of terminally ill cancer patients, to investigate factors that may be associated with the WTHD among these patients. The pattern of findings suggest that research investigating the doctor-patient interaction in this setting may add to our understanding of the problems (for patients and their doctors) that underpins the wish to hasten death in the terminally ill.

Psychological predictors of the propensity to omit short-response items on a high-stakes achievement test

This article presents the findings of a study of the psychological variables that discriminate between high and low omitters on a high-stakes achievement test using a short-response format. Data were obtained from a questionnaire administered to a random sample (N = 1,908) of students prior to sitting the 1997 Queensland Core Skills (QCS) Test (N = 29,273). Fourteen psychological variables were measured including test anxiety (four subscales), emotional stability, achievement motivation, self-esteem, academic self-concept, self-estimate of ability, locus of control (three subscales), and approaches to learning (two subscales). The results were analyzed using descriptive discriminant analysis and suggested that the psychological predictors of the propensity to omit short-response items include test-irrelevant thinking and academic self-concept, with sex of candidate being a mediating variable.

Elementary school students’ learner self-concept, academic self-concepts and approaches to learning

The present study investigated the relationships between academic selfconcepts, learner self-concept, and approaches to learning in elementary school students. A sample of 580 Australian Grade 6 and 7 school students with a mean age of 10.7 years participated in the study. Weak negative correlations between learner self-concepts and surface approaches to learning were identiŽ ed. In contrast, deep approaches for both boys and girls showed the highest positive correlations with school self-concept and learning self-concept. Only slight variations in these Ž gures were found between boys and girls.

Terminally ill cancer patients’ wish to hasten death

This exploratory study investigated factors associated with the wish to hasten death among a sample of terminally ill cancer patients. Semi-structured interviews conducted on a total of 72 hospice and home palliative care patients were subjected to qualitative analysis using QSRNUDIST. The main themes to emerge suggested that patients with a high wish to hasten death had greater concerns with physical symptoms and psychologica l suffering, perceived themselves to be more of a burden to others, and experienced higher levels of demoralization, while also reporting less confidence in symptom control, fewer social supports, less satisfaction with life experiences and fewer religious beliefs when compared with patients who had a moderate or no wish to hasten death. The implications of these findings will be discussed.

Re-invent yourself: from London intensive care nursing and the Nigerian oil fields to an an academic library in Brisbane; a career change worth making.

A complete change of career forces a seismic shift in every aspect of your life. From day one, you have to face the loss of long held beliefs, behaviours, the known world of self, and security. We came from professions that themselves are poles apart, and many of the challenges we faced entering the profession were the same: juggling full-time work, part time study, and family commitmemts, taking a pay cut, and loss of social life. But over a short period of time we both transitioned to our new profession successfully. so what make our successful transition possible?

Trip to Sunshine Coast Queensland, September 2004 visit to bridge and foreshore

A trip was undertaken to look at concerns of Public Works and Main Roads Departments of Queensland. David Paterson and Wayne Ganther from CSIRO travelled to the Sunshine Coast with Alan Carse of Queensland Department of Main Roads and Michael Ball of Queensland Department of Public Works. We were also joined for part of the visits by Ed Bowers of QBuild which is a commercial unit of Public Works responsible for maintenance of Public Works. During the trip we visited a bridge on the David Low Way at Sunrise Beach near Noosa. This bridge was in a serve marine environment with high salt content in the concrete and corrosion of the galvanised guardrails and barriers. Also the foreshore at Coolum was visited and the use of stainless steel was examined. This is discussed in this report. Most problems stemmed from incorrect specification due to lack of awareness of the severity of the environment. The companion report Visit to Schools Report 2002-059-B No 7. covers the visit to four schools north of Caloundra.

Students’ perceptions of teaching and learning: the influence of students’ approaches to learning and teachers’ approaches to teaching

Nearly 500 secondary students in 24 classes were surveyed and four students in each class interviewed concerning their approaches to learning and perceptions of their classroom environment. While interviewed students with deep approaches to learning generally demonstrated a more sophisticated understanding of the learning opportunities offered to them than did students with surface approaches, teaching strategies also influenced students' perceptions. When teachers focused strongly on actively engaging students and creating a supportive environment, students with both deep and surface approaches focused on student-centred aspects of the class. In contrast, when traditional expository teaching methods were used exclusively, students with deep and surface approaches both focused on transmission and reproduction.

Foucault Goes to Law School : Using Foucault to Examine Australian Legal Education

This paper will consider the way that Foucault’s work has been utilised to examine Australian legal education, particularly in the context of understanding the construction of the legal identity. While remaining sensitive to the many potential ‘uses’ of Foucault’s tools, as well as his problematisation of the author as an organising feature of discourse, this paper will argue that legal education scholarship overwhelmingly utilises concepts such as ‘discourse’ and ‘power-knowledge’, which, while useful, cannot provide a nuanced understanding of the construction of the legal identity. Consequently, this paper suggests that future legal education research utilise Foucault’s concepts of ‘ethics’ and ‘governmentality’ to address these issues.