Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

A user driven data mining process model and learning system

This paper deals with the problem of using the data mining models in a real-world situation where the user can not provide all the inputs with which the predictive model is built. A learning system framework, Query Based Learning System (QBLS), is developed for improving the performance of the predictive models in practice where not all inputs are available for querying to the system. The automatic feature selection algorithm called Query Based Feature Selection (QBFS) is developed for selecting features to obtain a balance between the relative minimum subset of features and the relative maximum classification accuracy. Performance of the QBLS system and the QBFS algorithm is successfully demonstrated with a real-world application

Losing their marbles : syntax-free programming for assessing problem-solving skills

Novice programmers have difficulty developing an algorithmic solution while simultaneously obeying the syntactic constraints of the target programming language. To see how students fare in algorithmic problem solving when not burdened by syntax, we conducted an experiment in which a large class of beginning programmers were required to write a solution to a computational problem in structured English, as if instructing a child, without reference to program code at all. The students produced an unexpectedly wide range of correct, and attempted, solutions, some of which had not occurred to their teachers. We also found that many common programming errors were evident in the natural language algorithms, including failure to ensure loop termination, hardwiring of solutions, failure to properly initialise the computation, and use of unnecessary temporary variables, suggesting that these mistakes are caused by inexperience at thinking algorithmically, rather than difficulties in expressing solutions as program code.

Further evidence of a relationship between explaining, tracing and writing skills in introductory programming

This paper reports on a replication of earlier studies into a possible hierarchy of programming skills. In this study, the students from whom data was collected were at a university that had not provided data for earlier studies. Also, the students were taught the programming language Python, which had not been used in earlier studies. Thus this study serves as a test of whether the findings in the earlier studies were specific to certain institutions, student cohorts, and programming languages. Also, we used a non–parametric approach to the analysis, rather than the linear approach of earlier studies. Our results are consistent with the earlier studies. We found that students who cannot trace code usually cannot explain code, and also that students who tend to perform reasonably well at code writing tasks have also usually acquired the ability to both trace code and explain code.

Listening, sharing understanding and facilitating consumer, family and community empowerment through a priority driven partnership in Far North Queensland

Objectives: This paper provides an example of a mental health research partnership underpinned by empowerment principles that seeks to foster strength among community organizations to support better outcomes for consumers, families and communities. It aims to raise awareness among researchers and service providers that empowerment approaches to assist communities to address mental health problems are not too difficult to be practical but require long-term commitment and appropriate support. Methods: A collaborative research strategy that has become known as the Priority Driven Research (PDR) Partnership emerged through literature review,consultations, Family Wellbeing Program delivery with community groups and activities in two discrete Indigenous communities. Progress to date on three of the four components of the strategy is described. Results: The following key needs were identified in a pilot study and are now being addressed in a research-based implementation phase: (i) gaining two-way understanding of perspectives on mental health and promoting universal awareness; (ii) supporting the empowerment of carers, families, consumers and at-risk groups through existing community organizations to gain greater understanding and control of their situation; (iii) developing pathways of care at the primary health centre level to enable support of social and emotional wellbeing as well as more integrated mental health care; (iv) accessing data to enable an ongoing process of analysis/sharing/planning and monitoring to inform future activity. Conclusion: One of the key learnings to emerge in this project so far is that empowerment through partnership becomes possible when there is a concerted effort to strengthen grassroots community organizations. These include social health teams and men’s and women’s groups that can engage local people in an action orientation. Key words: Aboriginal, empowerment, Indigenous, mental health.

Seeing is understanding : the effect of visualisation in understanding programming concepts

How and why visualisations support learning was the subject of this qualitative instrumental collective case study. Five computer programming languages (PHP, Visual Basic, Alice, GameMaker, and RoboLab) supporting differing degrees of visualisation were used as cases to explore the effectiveness of software visualisation to develop fundamental computer programming concepts (sequence, iteration, selection, and modularity). Cognitive theories of visual and auditory processing, cognitive load, and mental models provided a framework in which student cognitive development was tracked and measured by thirty-one 15-17 year old students drawn from a Queensland metropolitan secondary private girls’ school, as active participants in the research. Seventeen findings in three sections increase our understanding of the effects of visualisation on the learning process. The study extended the use of mental model theory to track the learning process, and demonstrated application of student research based metacognitive analysis on individual and peer cognitive development as a means to support research and as an approach to teaching. The findings also forward an explanation for failures in previous software visualisation studies, in particular the study has demonstrated that for the cases examined, where complex concepts are being developed, the mixing of auditory (or text) and visual elements can result in excessive cognitive load and impede learning. This finding provides a framework for selecting the most appropriate instructional programming language based on the cognitive complexity of the concepts under study.

An investigation of differences in crash characteristics between males and females involved in a fatigue-related crash or close call event

There is consensus among community and road safety agencies that driver fatigue is a major road safety issue and it is well known that excessive fatigue is linked with an increased risk of a motor vehicle crash. Previous research has implicated a wide variety of factors involved in fatigue-related crashes and the effects of these various factors in regard to crash risk can be interpreted as causal (i.e. alcohol and/or drugs may induce fatigue states) or additive (e.g. where a lack of sleep is combined with alcohol). As such, the purpose of this investigation was to examine self-report data to determine whether there are any differences in the prevalence, crash characteristics, and travel patterns of males and females involved in a fatigue-related crash or close call event. Such research is important to understand how fatigue related incidents occur within the typical driving patterns of men and women and it provides a starting point in order to explore if males and females experience and understand the risk of diving when tired in the same way. A representative sample of (N = 1,600) residents living in the Australian Capital Territory (ACT) and New South Wales (NSW), Australia, were surveyed regarding their experience of fatigue and their involvement in fatigue-related crashes and close call incidents. Results revealed that over 35% of participants reported having had a close call or crash due to driving when tired in the five years prior to the study being conducted. In addition, the results obtained revealed a number of interesting characteristics that provide preliminary evidence that gender differences do exist when examining the prevalence, crash characteristics, and travel patterns of males and females involved in a fatigue-related crash or close call event. It is argued that the results obtained can provide particularly useful information for the refinement and further development of appropriate countermeasures that better target this complex issue.

AITPM Email Newsletter Volume 0902, February 2009: Presidents Message

President’s Report Hello fellow AITPM members, Welcome to the first edition of the AITPM National Newsletter for 2009! I trust we all had a relaxing break and managed to lose track of all things transport for just a little while. I know I had trouble doing so when hunting for a car space at the shopping centre, and experiencing new projects such as the Tugun Bypass – the new gateway between New South Wales and Queensland. Byron Bay is now as close as Noosa for those high profile beach goers of Brisbane. There was also my experience of the reduced posted speed of 90km/h on the Bruce Highway around the troublesome Gympie stretch, when returning from a short Fraser Coast holiday. I expect that this relatively inexpensive safety improvement will pay substantial dividends in terms of crash reduction. The Newsletter took its annual leave last month and is refreshed and ready for a new year to keep us all informed of the latest in traffic and transport engineering, planning and management. I would like to take this opportunity to acknowledge the ongoing significant contributions of many volunteers in the Newsletter’s production. Mr Andrew Hulse, AITPM’s Immediate Past National President, serves as the Editorial Coordinator on behalf of the Institute. Each Branch Committee also includes a Newsletter Coordinator and committee members frequently contribute as well. And the ongoing contributions of readers enable us to offer the Newsletter as a vehicle for dialogue and debate around our sector. If you would like to contribute please email AITPM’s administration officer Josephine Mitton at aitpm@aitpm.com or through your local Branch Committee. I would also like to welcome back on deck our Editor, Mr David Brown of Driven Media, who creates a fantastic package for us each month. Lastly, members would have received the Call for Papers for the AITPM 2009 National Conference, Traffic Beyond Tomorrow, to be held at the Adelaide Convention Centre between 5 – 7 August. Abstracts will be accepted up to 20 February 2009. We look forward to seeing everyone at this, our flagship event for the year. To all a good year ahead, Jon Bunker Post Script: We all will have seen through the media the enormous scale and nature of the two natural disasters Australia is experiencing at present. AITPM’s thoughts are with all of those members, family and friends who may be experiencing hardship as a result of the Victorian bushfires and North Queensland floods. AITPM is a not for profit organisation however the National Executive has taken the decision to donate in measure to the Red Cross Victorian Bushfire Disaster Relief fund and the Queensland Premier’s Disaster Relief fund as a gesture to support our fellow Australians in their time of need. Details about these funds can be found via the Victorian and Queensland Governments’ websites.

Engaging students in programming

Poor student engagement and high failure rates in first year units were addressed at the Queensland University of Technology (QUT) with a course restructure involving a fresh approach to introducing programming. Students’ first taste of programming in the new course focused less on the language and syntax, and more on problem solving and design, and the role of programming in relation to other technologies they are likely to encounter in their studies. In effect, several technologies that have historically been compartmentalised and taught in isolation have been brought together as a breadth-first introduction to IT. Incorporating databases and Web development technologies into what used to be a purely programming unit gave students a very short introduction to each technology, with programming acting as the glue between each of them. As a result, students not only had a clearer understanding of the application of programming in the real world, but were able to determine their preference or otherwise for each of the technologies introduced, which will help them when the time comes for choosing a course major. Students engaged well in an intensely collaborative learning environment for this unit which was designed to both support the needs of students and meet industry expectations. Attrition from the unit was low, with computer laboratory practical attendance rates for the first time remaining high throughout semester, and the failure rate falling to a single figure percentage.

In Pursuit of Excellence : A Policy Driven Systemic Initiative to Embed Gifted Education

Embedding gifted education practices requires major professional development strategies supported by transparent, credible and enforceable policy. This paper describes an analysis of a state-wide initiative involving the establishment of a series of schools tasked to develop and disseminate gifted education principles. The authors have been involved with this initiative at a number of levels over a ten-year period. Their involvement culminated in a commissioned review of the program. Extensive qualitative data were purposively collected from all stakeholders and the effectiveness of the initiative is examined from a theoretical framework of policy development and excellence. The findings summarised in this proposal, indicate the achievement of excellence at a systemic level was constrained by lack of vision, leadership and commitment to long term achievements of excellence. At a local level evidence exists that excellence can be manifested when there is synchronicity of vision, purpose, decisions, and actions.

Event-related potential (ERP) correlates of impaired visuospatial memory in schizophrenia

Previous studies have reported that patients with schizophrenia demonstrate impaired performance during working memory (WM) tasks. The current study aimed to determine whether WM impairments in schizophrenia are accompanied by reduced slow wave (SW) activity during on-line maintenance of mnemonic information. Event-related potentials were obtained from patients with schizophrenia and well controls as they performed a visuospatial delayed response task. On 50% of trials, a distractor stimulus was introduced during the delay. Compared with controls, patients with schizophrenia produced less SW memory negativity, particularly over the right hemisphere, together with reduced frontal enhancement of SW memory negativity in response to distraction. The results indicate that patients with schizophrenia generate less maintenance phase neuronal activity during WM performance, especially under conditions of distraction.

Getting Excited About Software Programming

Invited one hour presentation at Microsoft Tech Ed 2009 about getting students interested in games programming at QUT.

Improved GMM-based speaker verification using SVM-driven impostor dataset selection

The problem of impostor dataset selection for GMM-based speaker verification is addressed through the recently proposed data-driven background dataset refinement technique. The SVM-based refinement technique selects from a candidate impostor dataset those examples that are most frequently selected as support vectors when training a set of SVMs on a development corpus. This study demonstrates the versatility of dataset refinement in the task of selecting suitable impostor datasets for use in GMM-based speaker verification. The use of refined Z- and T-norm datasets provided performance gains of 15% in EER in the NIST 2006 SRE over the use of heuristically selected datasets. The refined datasets were shown to generalise well to the unseen data of the NIST 2008 SRE.

Data-driven impostor selection for T-norm score normalisation and the background dataset in SVM-based speaker verification

A data-driven background dataset refinement technique was recently proposed for SVM based speaker verification. This method selects a refined SVM background dataset from a set of candidate impostor examples after individually ranking examples by their relevance. This paper extends this technique to the refinement of the T-norm dataset for SVM-based speaker verification. The independent refinement of the background and T-norm datasets provides a means of investigating the sensitivity of SVM-based speaker verification performance to the selection of each of these datasets. Using refined datasets provided improvements of 13% in min. DCF and 9% in EER over the full set of impostor examples on the 2006 SRE corpus with the majority of these gains due to refinement of the T-norm dataset. Similar trends were observed for the unseen data of the NIST 2008 SRE.