Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Whole of life cycle cost analysis in bridge rehabilitation

The report presents a methodology for whole of life cycle cost analysis of alternative treatment options for bridge structures, which require rehabilitation. The methodology has been developed after a review of current methods and establishing that a life cycle analysis based on a probabilistic risk approach has many advantages including the essential ability to consider variability of input parameters. The input parameters for the analysis are identified as initial cost, maintenance, monitoring and repair cost, user cost and failure cost. The methodology utilizes the advanced simulation technique of Monte Carlo simulation to combine a number of probability distributions to establish the distribution of whole of life cycle cost. In performing the simulation, the need for a powerful software package, which would work with spreadsheet program, has been identified. After exploring several products on the market, @RISK software has been selected for the simulation. In conclusion, the report presents a typical decision making scenario considering two alternative treatment options.

Of tails and Tempests : Feminine sexuality and Shakespearean children's texts

This paper reads a range of nineteenth-century texts for children that retell either Shakespeare's The Tempest or mermaid narratives, considering the models of feminine subjectivity and sexuality that they construct. It then moves on to two key contemporary texts — Disney's film adaptation of The Little Mermaid (Clements and Musker 1989) and Penni Russon's Undine (2004) — that combine the Shakespearean heroine with the mermaid, and reads them against the nineteenth-century models. Ultimately, the essay determines that, while these texts seem to perform a progressive appropriation of the two traditions, they actually combine the most conservative aspects of both The Tempest and mermaid stories to produce authoritative (and dangerously persuasive) ideals of passive feminine sexuality that confine girls within patriarchally-dictated familial positions. The new figure for adolescent female subjectivity, the mermaid-Miranda, becomes in turn a model of identification and aspiration for the implied juvenile consumer.

Citizen journalism and political participation : the youdecide project and the 2007 Australian Federal Election

The 2007 Australian Federal election not only saw the election of a Labor government after 11 years of John Howard’s conservative Coalition government. It also saw new levels of political engagement through the Internet, including the rise of citizen journalism as an alternative outlet and mode of reporting on the election. This paper reports on the You Decide 2007 project, an initiative undertaken by a QUT-based research team to facilitate online news reporting on the election on a ‘hyper-local’, electorate-based model. We evaluate the You Decide initiative on the basis of: promoting greater citizen participation in Australian politics; new ways of engaging citizens and key stakeholders in policy deliberation; establishing new links between mainstream media and independent online media; and broadening the base of political participation to include a wider range of citizen and groups.

Multi-faceted visualisation of worklists

Due to the popularity of modern Collaborative Virtual Environments, there has been a related increase in their size and complexity. Developers therefore need visualisations that expose usage patterns from logged data, to understand the structures and dynamics of these complex environments. This chapter presents a new framework for the process of visualising virtual environment usage data. Major components, such as an event model, designer task model and data acquisition infrastructure are described. Interface and implementation factors are also developed, along with example visualisation techniques that make use of the new task and event model. A case study is performed to illustrate a typical scenario for the framework, and its benefits to the environment development team.

Development of a particle number and particle mass vehicle emissions inventory for an urban fleet

Motor vehicles are major emitters of gaseous and particulate pollution in urban areas, and exposure to particulate pollution can have serious health effects, ranging from respiratory and cardiovascular disease to mortality. Motor vehicle tailpipe particle emissions span a broad size range from 0.003-10µm, and are measured as different subsets of particle mass concentrations or particle number count. However, no comprehensive inventories currently exist in the international published literature covering this wide size range. This paper presents the first published comprehensive inventory of motor vehicle tailpipe particle emissions covering the full size range of particles emitted. The inventory was developed for urban South-East Queensland by combining two techniques from distinctly different disciplines, from aerosol science and transport modelling. A comprehensive set of particle emission factors were combined with traffic modelling, and tailpipe particle emissions were quantified for particle number (ultrafine particles), PM1, PM2.5 and PM10 for light and heavy duty vehicles and buses. A second aim of the paper involved using the data derived in this inventory for scenario analyses, to model the particle emission implications of different proportions of passengers travelling in light duty vehicles and buses in the study region, and to derive an estimate of fleet particle emissions in 2026. It was found that heavy duty vehicles (HDVs) in the study region were major emitters of particulate matter pollution, and although they contributed only around 6% of total regional vehicle kilometres travelled, they contributed more than 50% of the region’s particle number (ultrafine particles) and PM1 emissions. With the freight task in the region predicted to double over the next 20 years, this suggests that HDVs need to be a major focus of mitigation efforts. HDVs dominated particle number (ultrafine particles) and PM1 emissions; and LDV PM2.5 and PM10 emissions. Buses contributed approximately 1-2% of regional particle emissions.

The appeal of the International Baccalaureate in Australia’s educational market: A curriculum of choice for mobile futures

In Australia there is growing interest in a national curriculum to replace the variety of matriculation credentials managed by State Education departments, ostensibly to address increasing population mobility. Meanwhile, the International Baccalaureate (IB) is attracting increasing interest and enrolments in State and private schools in Australia, and has been considered as one possible model for a proposed Australian Certificate of Education. This paper will review the construction of this curriculum in Australian public discourse as an alternative frame for producing citizens, and ask why this design appeals now, to whom, and how the phenomenon of its growing appeal might inform national curricular debates. The IB’s emergence is understood with reference to the larger context of neo-liberal marketization policies, neo-conservative claims on the curriculum and middle class strategy. The paper draws on public domain documents from the IB Organisation and newspaper reportage to demonstrate how the IB is constructed for public consumption in Australia.

Hybrid system simulation of computer control applications over communication networks

Discrete event-driven simulations of digital communication networks have been used widely. However, it is difficult to use a network simulator to simulate a hybrid system in which some objects are not discrete event-driven but are continuous time-driven. A networked control system (NCS) is such an application, in which physical process dynamics are continuous by nature. We have designed and implemented a hybrid simulation environment which effectively integrates models of continuous-time plant processes and discrete-event communication networks by extending the open source network simulator NS-2. To do this a synchronisation mechanism was developed to connect a continuous plant simulation with a discrete network simulation. Furthermore, for evaluating co-design approaches in an NCS environment, a piggybacking method was adopted to allow the control period to be adjusted during simulations. The effectiveness of the technique is demonstrated through case studies which simulate a networked control scenario in which the communication and control system properties are defined explicitly.

Body-shadowing effects in indoor MIMO-OFDM channel capacity

We investigate Multiple-Input and Multiple-Output Orthogonal Frequency Division Multiplexing (MIMO-OFDM) systems behavior in indoor populated environments that have line-of-site (LoS) between transmitter and receiver arrays. The in-house built MIMO-OFDM packet transmission demonstrator, equipped with four transmitters and four receivers, has been utilized to perform channel measurements at 5.2 GHz. Measurements have been performed using 0 to 3 pedestrians with different antenna arrays (2 £ 2, 3 £ 3 and 4 £ 4). The maximum average capacity for the 2x2 deterministic Fixed SNR scenario is 8.5 dB compared to the 4x4 deterministic scenario that has a maximum average capacity of 16.2 dB, thus an increment of 8 dB in average capacity has been measured when the array size increases from 2x2 to 4x4. In addition a regular variation has been observed for Random scenarios compared to the deterministic scenarios. An incremental trend in average channel capacity for both deterministic and random pedestrian movements has been observed with increasing number of pedestrian and antennas. In deterministic scenarios, the variations in average channel capacity are more noticeable than for the random scenarios due to a more prolonged and controlled body-shadowing effect. Moreover due to the frequent Los blocking and fixed transmission power a slight decrement have been observed in the spread between the maximum and minimum capacity with random fixed Tx power scenario.

The passionate critic

It's hard to be dispassionate about Reyner Banham. For me, and for the plethora of other people with strong opinions about Banham, his writing is compelling, and one’s connection to him as a figure quite personal. For me, frankly, he rocks. As a landscape architect, I gleaned most of my knowledge about Modern architecture from Banham. His Theory and Design in the First Machine Age, along with Rowe and Koetter’s Collage City and Venturi’s Complexity and Contradiction in Architecture were the most influential books in my library, by far. Later, as a budding “real scholar”, I was disappointed to find that, while these authors had serious credibility, the writings themselves were regarded as “polemical” – when in fact what I admired about them most was their ability and willingness to make rough groupings and gross generalizations, and to offer fickle opinions. It spoke to me of a real personal engagement and an active, participatory reading of the architectural culture they discussed. They were at their best in their witty, cutting, but generally pithy, creative prose, such as in Rowe’s extrapolation of the modern citizen as the latest “noble savage”, or Banham railing against conservative social advocates and their response to high density housing: “those who had just re-discovered ‘community’ in the slums would fear megastructure as much as any other kind of large-scale renewal program, and would see to it that the people were never ready.” Any reader of Banham will be able to find a gem that will relate, somehow, personally, to what they are doing right now. For Banham, it was all personal, and the gaps in his scholarship, rather, were the dispassionate places: “Such bias is essential – an unbiased historian is a pointless historian – because history is an essentially critical activity, a constant re-scrutiny and rearrangement of the profession.” Reyner Banham: Historian of the Immediate Future, Nigel Whiteley’s recent “intellectual biography” (the MIT Press, 2002), allowed me to revisit Banham’s passionate mode of criticism and to consider what his legacy might be. The book examines Banham’s body of work, grouped according to his various primary fascinations, as well as his relationship to contemporaneous theoretical movements, such as postmodernism. His mode of practice, as a kind of creative critic, is also considered in some depth. While there are points where the book delves into Banham’s personal life, on the whole Whiteley is very rigorous in considering and theorizing the work itself: more than 750 articles and twelve books. In academic terms, this is good practice. However, considering the entirely personal nature of Banham’s writing itself, this separation seems artificial. Banham, as he himself noted, “didn’t mind a gossip”, and often when reading the book I was curious about what was happening to him at the time. Banham’s was an amazing type of intellectual practice, and one that academics (a term he hated) could do well to learn from. While Whiteley spends a lot of time arguing for his practice to be regarded as such, and makes strong points about both the role of the critic, and the importance of journalism, rather than scholarly publishing, I found myself wondering what his study looked like. What books he had in his library. Did he smoke when he wrote? What sort of teaching load did he have? He is an inspiration to design writers and thinkers, and I, personally, wanted to know how he did it.

Towards self-authorship in child care students : implications for working with children and their families

Using self authorship as a theoretical framework, this chapter examines the relationship between personal epistemology and beliefs about children’s learning for students studying to be child care workers in Australia. Scenario-based interviews were used to investigate how students’ views of knowledge, identity and relationships with others were related to beliefs about how children learn. Implications for vocational education are discussed.

A visualisation framework for collaborative virtual environment usage information

Due to the popularity of modern Collaborative Virtual Environments, there has been a related increase in their size and complexity. Developers therefore need visualisations that expose usage patterns from logged data, to understand the structures and dynamics of these complex environments. This chapter presents a new framework for the process of visualising virtual environment usage data. Major components, such as an event model, designer task model and data acquisition infrastructure are described. Interface and implementation factors are also developed, along with example visualisation techniques that make use of the new task and event model. A case study is performed to illustrate a typical scenario for the framework, and its benefits to the environment development team.

Similarity not favourability : the role of donor prototypes in predicting willingness to donate organs while living

Using an extended Prototype/Willingness Model, we examined the predictors of willingness to donate an organ to a partner/family member and a stranger while living. A questionnaire assessed university students’ (N = 284) attitudes, subjective norm, prototype favourability, prototype similarity, moral norm, and willingness to donate organs in each recipient scenario. All variables, except prototype favourability, predicted willingness to donate organs in both situations. Future strategies should emphasise perceived approval from important others for living donation, the consistency of living donation with one’s own morals, and encourage perceptions of similarity between oneself and living donors to increase acceptance of living donation.

The influence of instructions and body-scaling as constraints on decision-making processes in team sports

Team games conceptualized as dynamical systems engender a view of emergent decision-making behaviour under constraints, although specific effects of instructional and body-scaling constraints have yet to be verified empirically. For this purpose, we studied the effects of task and individual constraints on decision-making processes in basketball. Eleven experienced female players performed 350 trials in 1 vs. 1 sub-phases of basketball in which an attacker tried to perturb the stable state of a dyad formed with a defender (i.e. break the symmetry). In Experiment 1, specific instructions (neutral, risk taking or conservative) were manipulated to observe effects on emergent behaviour of the dyadic system. When attacking players were given conservative instructions, time to cross court mid-line and variability of the attacker's trajectory were significantly greater. In Experiment 2, body-scaling of participants was manipulated by creating dyads with different height relations. When attackers were considerably taller than defenders, there were fewer occurrences of symmetry-breaking. When attackers were considerably shorter than defenders, time to cross court mid-line was significantly shorter than when dyads were composed of athletes of similar height or when attackers were considerably taller than defenders. The data exemplify how interacting task and individual constraints can influence emergent decision-making processes in team ball games.

A study of entrepreneurship : Taiwanese digital content companies in China

China’s accession to the World Trade Organisation (WTO) has greatly enhanced global interest in investment in the Chinese media market, where demand for digital content is growing rapidly. The East Asian region is positioned as a growth area in many forms of digital content and digital service industries. China is attempting to catch up and take its place as a production centre to offset challenges from neighbouring countries. Meanwhile, Taiwan is seeking to use China both as an export market and as a production site for its digital content. This research investigates entry strategies of Taiwanese digital content firms into the Chinese market. By examining the strategies of a sample of Taiwan-based companies, this study also explores the evolution of their market strategies. However, the focus is on how distinctive business practices such as guanxi are important to Taiwanese business and to relations with Mainland China. This research examines how entrepreneurs manage the characteristics of digital content products and in turn how digital content entrepreneurs adapt to changing market circumstances. This project selected five Taiwan-based digital content companies that have business operations in China: Wang Film, Artkey, CnYES, Somode and iPartment. The study involved a field trip, undertaken between November 2006 and March 2007 to Shanghai and Taiwan to conduct interviews and to gather documentation and archival reports. Six senior managers and nine experts were interviewed. Data were analysed according to Miller’s firm-level entrepreneurship theory, foreign direct investment theory, Life Cycle Model and guanxi philosophy. Most studies of SMEs have focused on free market (capitalist) environments. In contrast, this thesis examines how Taiwanese digital content firms’ strategies apply in the Chinese market. I identified three main types of business strategy: cost-reduction, innovation and quality-enhancement; and four categories of functional strategies: product, marketing, resource acquisition and organizational restructuring. In this study, I introduce the concept of ‘entrepreneurial guanxi’, special relationships that imply mutual obligation, assurance and understanding to secure and exchange favors in entrepreneurial activities. While guanxi is a feature of many studies of business in Pan-Chinese society, it plays an important mediating role in digital content industries. In this thesis, I integrate the ‘Life Cycle Model’ with the dynamic concept of strategy. I outline the significant differences in the evolution of strategy between two types of digital content companies: off-line firms (Wang Film and Artkey) and web-based firms (CnYES, Somode and iPartment). Off-line digital content firms tended to adopt ‘resource acquisition strategies’ in their initial stages and ‘marketing strategies’ in second and subsequent stages. In contrast, web-based digital content companies mainly adopted product and marketing strategies in the early stages, and would adopt innovative approaches towards product and marketing strategies in the whole process of their business development. Some web-based digital content companies also adopted organizational restructuring strategies in the final stage. Finally, I propose the ‘Taxonomy Matrix of Entrepreneurial Strategies’ to emphasise the two dimensions of this matrix: innovation, and the firm’s resource acquisition for entrepreneurial strategy. This matrix is divided into four cells: Effective, Bounded, Conservative, and Impoverished.