Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

E-business adoption in construction : international review on impediments

The adoption of e-business by the Australian construction industry lags other service and product industries. It is assumed that slow adoption rate does not reflect the maturity of the technology but is due to adoption impediments peculiar to the nature of construction. This chapter examines impediments to the uptake of e-business nationally and internationally. A systematic and extensive literature search of impediments (also referred to as obstacles, impediments or hindrances) to adoption has been undertaken and the findings discussed in this chapter. This review included more that 200 documents and these have been published in a searchable database as part of a larger research initiative funded by the Cooperative Research Centre for Construction Innovation. The influence of levels of e-business maturity seen in other sectors such as retail, tourism and manufacturing was also captured and a number of major impediments were identified some including: privacy, trust, uncertainty of financial returns, lack of reliable measurement, fraud, lack of support and system maintenance. A total of 23 impediments were assessed in terms of impact to organisational type and size across reviewed documents. With this information it was possible to develop a reference framework for measuring maturity levels and readiness to uptake e-business in construction. Results have also shown that impediments to e-business adoption work differently according to organisational type and culture. Areas of training and people development need to be addressed. This would include a more sensitive approach to the nature of construction organisations, especially to those small and medium enterprises. Raising levels of awareness and creating trust for on-line collaboration are other aspects that need attention, which current studies confirm as lacking. An empirical study within construction, to validate these findings, forms the subsequent phase of this research.

An inverse time admittance relay for fault detection in distribution networks containing DGs

Isolation of a faulted segment, from either side of a fault, in a radial feeder that has several converter interfaced DGs is a challenging task when current sensing protective devices are employed. The protective device, even if it senses a downstream fault, may not operate if fault current level is low due to the current limiting operation of converters. In this paper, a new inverse type relay is introduced based on line admittance measurement to protect a distribution network, which has several converter interfaced DGs. The basic operation of this relay, its grading and reach settings are explained. Moreover a method is proposed to compensate the fault resistance such that the relay operation under this condition is reliable. Then designed relay performances are evaluated in a radial distribution network. The results are validated through PSCAD/EMTDC simulation and MATLAB calculations.

Trends in online journalism : a case study approach based on euaustralia online

This paper takes stock of current changes affecting journalism, and as a case study brings up to date the record of progress made with an online publishing enterprise, EUAustralia Online, first reported on in 2007. It perceives the development of news publishing on line as being in two sectors: media corporations moving to occupy the online publishing field, through complex business stratagems and product-making, and small publications enjoying low production costs and the ability to strike up relationships with numerous users, even on a mass scale. Recent developments in both major publishing and niche publishing are appraised in a literature review, considering both broad-scale industry trends; and pressure from fresh advances in information and communication technology to produce ever-more sophisticated media artefacts, like multi-platform news coverage. The paper also recounts the pattern of work on EUAustralia Online, showing how such publications, ubiquitous ‘blogs’ or newsletters, may be placed in a prospective online order, where large and small operations might co-exist.

The development of an evidentiary on-board massmonitoring application for heavy vehicles

This paper reports on the development of specifications for an on-board mass monitoring (OBM) application for regulatory requirements in Australia. An earlier paper reported on feasibility study and pilot testing program prior to the specification development [1]. Learnings from the pilot were used to refine this testing process and a full scale testing program was conducted from July to October 2008. The results from the full scale test and evidentiary implications are presented in this report. The draft specification for an evidentiary on-board mass monitoring application is currently under development.

Optimal mission path planning (MPP) for an air sampling unmanned aerial system

This paper presents advanced optimization techniques for Mission Path Planning (MPP) of a UAS fitted with a spore trap to detect and monitor spores and plant pathogens. The UAV MPP aims to optimise the mission path planning search and monitoring of spores and plant pathogens that may allow the agricultural sector to be more competitive and more reliable. The UAV will be fitted with an air sampling or spore trap to detect and monitor spores and plant pathogens in remote areas not accessible to current stationary monitor methods. The optimal paths are computed using a Multi-Objective Evolutionary Algorithms (MOEAs). Two types of multi-objective optimisers are compared; the MOEA Non-dominated Sorting Genetic Algorithms II (NSGA-II) and Hybrid Game are implemented to produce a set of optimal collision-free trajectories in three-dimensional environment. The trajectories on a three-dimension terrain, which are generated off-line, are collision-free and are represented by using Bézier spline curves from start position to target and then target to start position or different position with altitude constraints. The efficiency of the two optimization methods is compared in terms of computational cost and design quality. Numerical results show the benefits of coupling a Hybrid-Game strategy to a MOEA for MPP tasks. The reduction of numerical cost is an important point as the faster the algorithm converges the better the algorithms is for an off-line design and for future on-line decisions of the UAV.

Dynamic analysis of on-board mass data to determine tampering in heavy vehicle on-board mass systems

Transport Certification Australia Limited, jointly with the National Transport Commission, has undertaken a project to investigate the feasibility of on-board mass monitoring (OBM) devices for regulatory purposes. OBM increases jurisdictional confidence in operational heavy vehicle compliance. This paper covers technical issues regarding potential use of dynamic data from OBM systems to indicate that tampering has occurred. Tamper-evidence and accuracy of current OBM systems needed to be determined before any regulatory schemes were put in place for its use. Tests performed to determine potential for, and ease of, tampering. An algorithm was developed to detect tamper events. Its results are detailed.

Low-Cost vision-based AUV guidance system for reef navigation

Ensuring the long term viability of reef environments requires essential monitoring of many aspects of these ecosystems. However, the sheer size of these unstructured environments (for example Australia’s Great Barrier Reef pose a number of challenges for current monitoring platforms which are typically remote operated and required significant resources and infrastructure. Therefore, a primary objective of the CSIRO robotic reef monitoring project is to develop and deploy a large number of AUV teams to perform broadscale reef surveying. In order to achieve this, the platforms must be cheap, even possibly disposable. This paper presents the results of a preliminary investigation into the performance of a low-cost sensor suite and associated processing techniques for vision and inertial-based navigation within a highly unstructured reef environment.

Regulation of train service by coasting control in metro railway system

To maximise the capacity of the rail lineand provide a reliable service for pas-sengers throughout the day, regulation of train service to maintain steady service headway is es-sential. In most current metro systems, train usually starts coasting at a fixed distance from the departed station to achieve service regulation. However, this approach is only effective with re-spect to a nominal operational condition of train schedule but not necessarily the current service demand. Moreover, it is not simply to identify the necessary starting point for coasting under the run time constraints of current service conditions since train movement is attributed by a large number of factors, most of which are non-linear and inter-dependent. This paper presents an ap-plication of classical measures to search for the appropriate coasting point to meet a specified inter-station run time and they can be integrated in the on-board Automatic Train Operation (ATO) system and have the potential for on-line implementation in making a set of coasting command decisions.

Thermal studies of D.C. traction motors

This paper describes a thorough thermal study on a fleet of DC traction motors which were found to suffer from overheating after 3 years of full operation. Overheating of these traction motors is attributed partly because of the higher than expected number of starts and stops between train terminals. Another probable cause of overheating is the design of the traction motor and/or its control strategy. According to the motor manufacturer, a current shunt is permanently connected across the motor field winding. Hence, some of the armature current is bypassed into the current shunt. The motor then runs above its rated speed in the field weakening mode. In this study, a finite difference model has been developed to simulate the temperature profile at different parts inside the traction motor. In order to validate the simulation result, an empty vehicle loaded with drums of water was also used to simulate the full pay-load of a light rail vehicle experimentally. The authors report that the simulation results agree reasonably well with experimental data, and it is likely that the armature of the traction motor will run cooler if its field shunt is disconnected at low speeds

A Modified inverse integer Cholesky decorrelation method and the performance on ambiguity resolution

One of the research focuses in the integer least squares problem is the decorrelation technique to reduce the number of integer parameter search candidates and improve the efficiency of the integer parameter search method. It remains as a challenging issue for determining carrier phase ambiguities and plays a critical role in the future of GNSS high precise positioning area. Currently, there are three main decorrelation techniques being employed: the integer Gaussian decorrelation, the Lenstra–Lenstra–Lovász (LLL) algorithm and the inverse integer Cholesky decorrelation (IICD) method. Although the performance of these three state-of-the-art methods have been proved and demonstrated, there is still a potential for further improvements. To measure the performance of decorrelation techniques, the condition number is usually used as the criterion. Additionally, the number of grid points in the search space can be directly utilized as a performance measure as it denotes the size of search space. However, a smaller initial volume of the search ellipsoid does not always represent a smaller number of candidates. This research has proposed a modified inverse integer Cholesky decorrelation (MIICD) method which improves the decorrelation performance over the other three techniques. The decorrelation performance of these methods was evaluated based on the condition number of the decorrelation matrix, the number of search candidates and the initial volume of search space. Additionally, the success rate of decorrelated ambiguities was calculated for all different methods to investigate the performance of ambiguity validation. The performance of different decorrelation methods was tested and compared using both simulation and real data. The simulation experiment scenarios employ the isotropic probabilistic model using a predetermined eigenvalue and without any geometry or weighting system constraints. MIICD method outperformed other three methods with conditioning improvements over LAMBDA method by 78.33% and 81.67% without and with eigenvalue constraint respectively. The real data experiment scenarios involve both the single constellation system case and dual constellations system case. Experimental results demonstrate that by comparing with LAMBDA, MIICD method can significantly improve the efficiency of reducing the condition number by 78.65% and 97.78% in the case of single constellation and dual constellations respectively. It also shows improvements in the number of search candidate points by 98.92% and 100% in single constellation case and dual constellations case.