Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Sydney Opera House – FM exemplar project

The Sydney Opera House Facilities Management Exemplar Project (SOH FM Exemplar Project) aims to develop innovative research on facility management (FM) with the focus on asset maintenance. The project utilises the Sydney Opera House (SOH), one of most unique buildings in Australia, to research and create innovative FM strategies and models that will have a direct beneficial role for the Australian facilities management industry as well as the economy as a whole. The procurement, benchmarking and digitisation are crucial in improving the performance of FM. The procurement develops strategic plan and deployment framework enabling products, services, etc. meet objectives of performance, economic, environment, etc. Benchmarking is a technology used to compare practice and assess performance against the competitors recognised as industry leaders who achieve most successful activities in the field. Digitisation develops digitized FM modelling that facilitates the integration and automation of facility management. The project carries out the research on all the three areas as well as the relationship between them. It aims to develop an integrated approach for the improvement of FM performance.

Procurement Case Study and Decision-making Strategies

Objectives The procurement research of Sydney Opera House FM Exemplar Project aims to develop innovative methods and guidelines for the procurement of FM services, applicable to iconic and / or performing arts centre facilities, or facilities with similar FM functions. The initial procurement report in June 2005 analysed the strategic objectives and operational requirements that provide ‘demand statements’ as evaluation criteria in the service procurement process. The subsequent interim procurement report in September 2005 discussed the elements contributing to the criteria for decision-making in the service procurement process. This procurement report concentrates on the research on procurement strategies and innovative methods using a case study approach. The objectives of this report are: • to investigate service procurement methods and process in iconic and/or performing arts centre facilities; • to showcase FM innovation in Sydney Opera House through a case study; • to establish a preliminary decision-making framework and guidelines for selection of appropriate FM procurement routes to provide a useful model for FM community. Findings Findings from this procurement research are presented as follows. • FM innovation and experience of Sydney Opera House • Innovative procurement methods and processes, drawn from a case study of Sydney Opera House as exemplar • An integrated performance framework to link maintenance service functions to high level organisational objective and strategies • Procurement methods and contract outcomes, focusing on building maintenance and cleaning services of Sydney Opera House • Multi-dimensional assessment of Service Providers • General decision-making strategies and guidelines for selection of appropriate FM procurement routes Further Research Whilst the Sydney Opera House case study emphasises the experience of Sydney Opera House, a study of procurement strategies and methods from published research and FM good practice will supply facilities managers with alternative procurement routes. Further research on the procurement theme will develop a final decision-making model for the procurement of FM services, drawn from the evaluation of the case study outcomes, as well as FM good practice and findings from current published research.

Digital Modelling

This Digital Modelling Report incorporates the previous research completed for the FM Exemplar Project utilising the Sydney Opera House as a case study. The research has demonstrated significant benefits in digitising design documentation and operational and maintenance manuals. Since Sydney Opera House do not have digital models of its structure, there is an opportunity to investigate the application of Digital Facility Modelling using standardised Building Information Models (BIM). The digital modelling research project has examined the potential of standardised building information models to develop a digital facility model supporting facilities management (FM). The focus of this investigation was on the following areas: • The re-usability of standardised building information models (BIM) for FM purposes. • The potential of BIM as an information framework acting as integrator for various FM data sources. • The extendibility and flexibility of the BIM to cope with business specific data and requirements. • Commercial FM software using standardised building information models. • The ability to add (organisation-specific) intelligence to the model. • A roadmap for Sydney Opera House to adopt BIM for FM.

Services Procurement

This Services Procurement Report incorporates the previous benchmarking research and aims to develop innovative methods and guidelines for the procurement of FM services, applicable to iconic and / or performing arts centre facilities, or facilities with similar FM functions. The FM Exemplar Project utilising the Sydney Opera House produced its initial procurement report in June 2005 which analysed the strategic objectives and operational requirements that provide ‘demand statements’ as evaluation criteria in the service procurement process. The subsequent interim procurement report in September 2005 discussed the elements contributing to the criteria for decision-making in the service procurement process. This procurement report concentrates on the research on procurement strategies and innovative methods using a case study approach. The objectives of this report are to: Investigate service procurement methods and process in iconic and/or performing arts centre facilities; Showcase FM innovation in Sydney Opera House through a case study; Establish a preliminary decision-making framework and guidelines for selection of appropriate FM procurement routes to provide a useful model for FM community

Building procurement methods

A plethora of methods for procuring building projects are available to meet the needs of clients. Deciding what method to use for a given project is a difficult and challenging task as a client’s objectives and priorities need to marry with the selected method so as to improve the likelihood of the project being procured successfully. The decision as to what procurement system to use should be made as early as possible and underpinned by the client’s business case for the project. The risks and how they can potentially affect the client’s business should also be considered. In this report, the need for client’s to develop a procurement strategy, which outlines the key means by which the objectives of the project are to be achieved is emphasised. Once a client has established a business case for a project, appointed a principal advisor, determined their requirements and brief, then consideration as to which procurement method to be adopted should be made. An understanding of the characteristics of various procurement options is required before a recommendation can be made to a client. Procurement systems can be categorised as traditional, design and construct, management and collaborative. The characteristics of these systems along with the procurement methods commonly used are described. The main advantages and disadvantages, and circumstances under which a system could be considered applicable for a given project are also identified.

Floating on a sea of talk: Reading comprehension through speaking and listening

Talk is the foundation for thought and understanding, and the key to literacy learning. Research demonstrates that powerful meta-cognitive strategies can be taught to help students self-monitor their comprehension when reading print and digital texts. This paper provides a repertoire of motivating speaking and listening tips to develop the meta-cognitive thinking of students in the elementary years.

Nation & internation practices in decision support tools in road asset management

This document provides a review of international and national practices in investment decision support tools in road asset management. Efforts were concentrated on identifying analytic frameworks, evaluation methodologies and criteria adopted by current tools. Emphasis was also given to how current approaches support Triple Bottom Line decision-making. Benefit Cost Analysis and Multiple Criteria Analysis are principle methodologies in supporting decision-making in Road Asset Management. The complexity of the applications shows significant differences in international practices. There is continuing discussion amongst practitioners and researchers regarding to which one is more appropriate in supporting decision-making. It is suggested that the two approaches should be regarded as complementary instead of competitive means. Multiple Criteria Analysis may be particularly helpful in early stages of project development, say strategic planning. Benefit Cost Analysis is used most widely for project prioritisation and selecting the final project from amongst a set of alternatives. Benefit Cost Analysis approach is useful tool for investment decision-making from an economic perspective. An extension of the approach, which includes social and environmental externalities, is currently used in supporting Triple Bottom Line decision-making in the road sector. However, efforts should be given to several issues in the applications. First of all, there is a need to reach a degree of commonality on considering social and environmental externalities, which may be achieved by aggregating the best practices. At different decision-making level, the detail of consideration of the externalities should be different. It is intended to develop a generic framework to coordinate the range of existing practices. The standard framework will also be helpful in reducing double counting, which appears in some current practices. Cautions should also be given to the methods of determining the value of social and environmental externalities. A number of methods, such as market price, resource costs and Willingness to Pay, are found in the review. The use of unreasonable monetisation methods in some cases has discredited Benefit Cost Analysis in the eyes of decision makers and the public. Some social externalities, such as employment and regional economic impacts, are generally omitted in current practices. This is due to the lack of information and credible models. It may be appropriate to consider these externalities in qualitative forms in a Multiple Criteria Analysis. Consensus has been reached in considering noise and air pollution in international practices. However, Australia practices generally omitted these externalities. Equity is an important consideration in Road Asset Management. The considerations are either between regions, or social groups, such as income, age, gender, disable, etc. In current practice, there is not a well developed quantitative measure for equity issues. More research is needed to target this issue. Although Multiple Criteria Analysis has been used for decades, there is not a generally accepted framework in the choice of modelling methods and various externalities. The result is that different analysts are unlikely to reach consistent conclusions about a policy measure. In current practices, some favour using methods which are able to prioritise alternatives, such as Goal Programming, Goal Achievement Matrix, Analytic Hierarchy Process. The others just present various impacts to decision-makers to characterise the projects. Weighting and scoring system are critical in most Multiple Criteria Analysis. However, the processes of assessing weights and scores were criticised as highly arbitrary and subjective. It is essential that the process should be as transparent as possible. Obtaining weights and scores by consulting local communities is a common practice, but is likely to result in bias towards local interests. Interactive approach has the advantage in helping decision-makers elaborating their preferences. However, computation burden may result in lose of interests of decision-makers during the solution process of a large-scale problem, say a large state road network. Current practices tend to use cardinal or ordinal scales in measure in non-monetised externalities. Distorted valuations can occur where variables measured in physical units, are converted to scales. For example, decibels of noise converts to a scale of -4 to +4 with a linear transformation, the difference between 3 and 4 represents a far greater increase in discomfort to people than the increase from 0 to 1. It is suggested to assign different weights to individual score. Due to overlapped goals, the problem of double counting also appears in some of Multiple Criteria Analysis. The situation can be improved by carefully selecting and defining investment goals and criteria. Other issues, such as the treatment of time effect, incorporating risk and uncertainty, have been given scant attention in current practices. This report suggested establishing a common analytic framework to deal with these issues.

Strategy for the development of investment decision-making framework for road asset management for queensland department of main roads

The aim of this project is to develop a systematic investment decision-making framework for infrastructure asset management by incorporation economic justification, social and environmental consideration in the decision-making process. This project assesses the factors that are expected to provide significant impacts on the variability of expenditures. A procedure for assessing risk and reliability for project investment appraisals will be developed. The project investigates public perception, social and environmental impacts on road infrastructure investment. This research will contribute to the debate about how important social and environmental issues should be incorporated into the investment decision-making process for infrastructure asset management.

National practices in investment decision making in road sector

This document provides the findings of a national review of investment decision-making practices in road asset management. Efforts were concentrated on identifying the strategic objectives of agencies in road asset management, establishing and understanding criteria different organisations adopted and ascertaining the exact methodologies used by different sate road authorities. The investment objectives of Australian road authorities are based on triple-bottom line considerations (social, environmental, economic and political). In some cases, comparing with some social considerations, such as regional economic development, equity, and access to pubic service etc., Benefit-Cost Ratio has limited influence on the decision-making. Australian road authorities have developed various decision support tools. Although Multi-Criteria Analysis has been preliminarily used in case by case study, pavement management systems, which are primarily based on Benefit Cost Analysis, are still the main decision support tool. This situation is not compatible with the triple-bottom line objectives. There is need to fill the gap between decision support tools and decision-making itself. Different decision criteria should be adopted based on the contents of the work. Additional decision criteria, which are able to address social, environmental and political impacts, are needed to develop or identify. Environmental issue plays a more and more important role in decision-making. However, the criteria and respective weights in decision-making process are yet to be clearly identified. Social and political impacts resulted from road infrastructure investment can be identified through Community Perceptions Survey. With accumulative data, prediction models, which are similar as pavement performance models, can be established. Using these models, the decision-makers are able to foresee the social and political consequences of investment alternatives.

User friendly guide for rehabilitation or strengthening of bridge structures using fiber reinforced polymer composites

A worldwide interest is being generated in the use of fibre reinforced polymer composites (FRP) in rehabilitation of reinforced concrete structures. As a replacement for the traditional steel plates or external post-tensioning in strengthening applications, various types of FRP plates, with their high strength to weight ratio and good resistance to corrosion, represent a class of ideal material in external retrofitting. Within the last ten years, many design guidelines have been published to provide guidance for the selection, design and installation of FRP systems for external strengthening of concrete structures. Use of these guidelines requires understanding of a number of issues pertaining to different properties and structural failure modes specific to these materials. A research initiative funded by the CRC for Construction Innovation was undertaken (primarily at RMIT) to develop a decision support tool and a user friendly guide for use of fibre reinforced polymer composites in rehabilitation of concrete structures. The user guidelines presented in this report were developed after industry consultation and a comprehensive review of the state of the art technology. The scope of the guide was mainly developed based on outcomes of two workshops with Queensland Department of Main Roads (QDMR). The document covers material properties, recommended construction requirements, design philosophy, flexural, shear and torsional strengthening of beams and strengthening of columns. In developing this document, the guidelines published on FIB Bulletin 14 (2002), Task group 9.3, International Federation of Structural Concrete (FIB) and American Concrete Institute Committee 440 report (2002) were consulted in conjunction with provisions of the Austroads Bridge design code (1992) and Australian Concrete Structures code AS3600 (2002). In conclusion, the user guide presents design examples covering typical strengthening scenarios.

Smart buildings for healthy and sustainable workplace: scoping study report

Deficiencies in the design and operation of office buildings can give rise to high social, environmental and economic (triple bottom line) costs. As a result, there are significant pressures and incentives to develop ‘smart building’ technologies that can facilitate improved indoor environment quality (IEQ), and more energy efficient operation of office buildings. IEQ indicators include lighting, ventilation, thermal comfort, indoor air quality and noise. In response to this, the CRC for Construction Innovation commissioned a six-month scoping study (Project no. 2002-043) to examine how different technologies could be used to improve the ‘triple bottom line’ for office buildings. The study was supported by three industry partners, Bovis Lend Lease, Arup, and The Queensland Department of Public Works. The objective of the study was to look at the history, trends, drivers, new technologies and potential application areas related to the operation of healthy and efficient office buildings. The key output from the study was a recommendation for a prototype system for intelligent monitoring and control of an office environment, based on identified market, technical and user requirements and constraints.

Forensic challenges in service oriented architectures

Digital forensics relates to the investigation of a crime or other suspect behaviour using digital evidence. Previous work has dealt with the forensic reconstruction of computer-based activity on single hosts, but with the additional complexity involved with a distributed environment, a Web services-centric approach is required. A framework for this type of forensic examination needs to allow for the reconstruction of transactions spanning multiple hosts, platforms and applications. A tool implementing such an approach could be used by an investigator to identify scenarios of Web services being misused, exploited, or otherwise compromised. This information could be used to redesign Web services in order to mitigate identified risks. This paper explores the requirements of a framework for performing effective forensic examinations in a Web services environment. This framework will be necessary in order to develop forensic tools and techniques for use in service oriented architectures.

Final Report

This project aims to assess the extent of economic sustainability of working in international markets by Australian construction design-related firms. This investigation also identified barriers and success factors firms experience, which ultimately increases or reduces their exposure to financial risk. This study explored new research territory by developing a detailed understanding of the way three successful firms have maintained their longevity in various international markets. The firms are not considered to be large firms by international standards. The manner in which the firms achieve long term sustainability, deal with problems and barriers in international markets and develop successful strategies rely upon being adaptable to different markets and changes within markets. A model was developed based upon a critical analysis of the literature. An adaptive performance framework for sustainability was developed which had three key areas; internationalisation process, market knowledge and design management. The sustainable business model is underpinned by the management of non-economic factors, which include social, cultural and intellectual capital. The ultimate aim of any firm and the ultimate indicator of success is financial capital. Firms typically develop their own highly sophisticated financial measures themselves however have only an implicit understanding of other softer and less tangible factors that impact upon sustainability. Adaptive performance is the firm’s continual adaptivity of business practices to respond to and thereby achieve client satisfaction by a combination of self, market and project needs assessment.

Long term sustainability in exporting creativity

This project aims to assess the extent of economic sustainability of working in international markets by Australian construction design-related firms. This investigation also identified barriers and success factors firms experience, which ultimately increases or reduces their exposure to financial risk. This study explored new research territory by developing a detailed understanding of the way three successful firms have maintained their longevity in various international markets. The firms are not considered to be large firms by international standards. The manner in which the firms achieve long term sustainability, deal with problems and barriers in international markets and develop successful strategies rely upon being adaptable to different markets and changes within markets. A model was developed based upon a critical analysis of the literature. An adaptive performance framework for sustainability was developed which had three key areas; internationalisation process, market knowledge and design management. The sustainable business model is underpinned by the management of non-economic factors, which include social, cultural and intellectual capital. The ultimate aim of any firm and the ultimate indicator of success is financial capital. Firms typically develop their own highly sophisticated financial measures themselves however have only an implicit understanding of other softer and less tangible factors that impact upon sustainability. Adaptive performance is the firm’s continual adaptivity of business practices to respond to and thereby achieve client satisfaction by a combination of self, market and project needs assessment.