Characterising anomalous events using change point correlation on unsolicited network traffic

Monitoring unused or dark IP addresses offers opportunities to extract useful information about both on-going and new attack patterns. In recent years, different techniques have been used to analyze such traffic including sequential analysis where a change in traffic behavior, for example change in mean, is used as an indication of malicious activity. Change points themselves say little about detected change; further data processing is necessary for the extraction of useful information and to identify the exact cause of the detected change which is limited due to the size and nature of observed traffic. In this paper, we address the problem of analyzing a large volume of such traffic by correlating change points identified in different traffic parameters. The significance of the proposed technique is two-fold. Firstly, automatic extraction of information related to change points by correlating change points detected across multiple traffic parameters. Secondly, validation of the detected change point by the simultaneous presence of another change point in a different parameter. Using a real network trace collected from unused IP addresses, we demonstrate that the proposed technique enables us to not only validate the change point but also extract useful information about the causes of change points.

Ceremony analysis : strengths and weaknesses

We investigate known security flaws in the context of security ceremonies to gain an understanding of the ceremony analysis process. The term security ceremonies is used to describe a system of protocols and humans which interact for a specific purpose. Security ceremonies and ceremony analysis is an area of research in its infancy, and we explore the basic principles involved to better understand the issues involved.We analyse three ceremonies, HTTPS, EMV and Opera Mini, and use the information gained from the experience to establish a list of typical flaws in ceremonies. Finally, we use that list to analyse a protocol proven secure for human use. This leads to a realisation of the strengths and weaknesses of ceremony analysis.

Creative nonfiction : Granta 104

A 1000-word review of Granta 104 - Fathers : The Men Who Made Us (Allen & Unwin, 2009)

Supporting context-aware process design : learnings from a design science study

Recent studies have started to explore context-awareness as a driver in the design of adaptable business processes. The emerging challenge of identifying and considering contextual drivers in the environment of a business process are well understood, however, typical methods and models for business process design do not yet consider this context. In this paper, we describe our work on the design of a method framework and appropriate models to enable a context-aware process design approach. We report on our ongoing work with an Australian insurance provider and describe the design science we employed to develop innovative and useful artifacts as part of a context-aware method framework. We discuss the utility of these artifacts in an application in the claims handling process at the case organization.

An investigation of contact transmission of methicillin-resistant staphylococcus aureus

Hand hygiene is critical in the healthcare setting and it is believed that methicillin-resistant Staphylococcus aureus (MRSA), for example, is transmitted from patient to patient largely via the hands of health professionals. A study has been carried out at a large teaching hospital to estimate how often the gloves of a healthcare worker are contaminated with MRSA after contact with a colonized patient. The effectiveness of handwashing procedures to decontaminate the health professionals' hands was also investigated, together with how well different healthcare professional groups complied with handwashing procedures. The study showed that about 17% (9–25%) of contacts between a healthcare worker and a MRSA-colonized patient results in transmission of MRSA from a patient to the gloves of a healthcare worker. Different health professional groups have different rates of compliance with infection control procedures. Non-contact staff (cleaners, food services) had the shortest handwashing times. In this study, glove use compliance rates were 75% or above in all healthcare worker groups except doctors whose compliance was only 27%.

Business process modeling : current issues and future challenges

Business process modeling has undoubtedly emerged as a popular and relevant practice in Information Systems. Despite being an actively researched field, anecdotal evidence and experiences suggest that the focus of the research community is not always well aligned with the needs of industry. The main aim of this paper is, accordingly, to explore the current issues and the future challenges in business process modeling, as perceived by three key stakeholder groups (academics, practitioners, and tool vendors). We present the results of a global Delphi study with these three groups of stakeholders, and discuss the findings and their implications for research and practice. Our findings suggest that the critical areas of concern are standardization of modeling approaches, identification of the value proposition of business process modeling, and model-driven process execution. These areas are also expected to persist as business process modeling roadblocks in the future.

Too young to drink but old enough to drive under the influence : a study of underage offenders as seen in substance abuse treatment in Texas

Driving under the influence (DUI) is a major road safety problem. Historically, alcohol has been assumed to play a larger role in crashes and DUI education programs have reflected this assumption, although recent evidence suggests that younger drivers are becoming more likely to drive drugged than to drive drunk. This is a study of 7096 Texas clients under age 21 who were admitted to state-funded treatment programs between 1997 and 2007 with a past-year DUI arrest, DUI probation, or DUI referral. Data were obtained from the State’s administrative dataset. Multivariate logistic regressions models were used to understand the differences between those minors entering treatment as a DUI as compared to a non-DUI as well as the risks for completing treatment and for being abstinent in the month prior to follow-up. A major finding was that over time, the primary problem for underage DUI drivers changed from alcohol to marijuana. Being abstinent in the month prior to discharge, having a primary problem with alcohol rather than another drug, and having more family involved were the strongest predictors of treatment completion. Living in a household where the client was exposed to alcohol abuse or drug use, having been in residential treatment, and having more drug and alcohol and family problems were the strongest predictors of not being abstinent at follow-up. As a result, there is a need to direct more attention towards meeting the needs of the young DUI population through programs that address drug as well as alcohol consumption problems.

Modeling key compromise impersonation attacks on group key exchange protocols

A key exchange protocol allows a set of parties to agree upon a secret session key over a public network. Two-party key exchange (2PKE) protocols have been rigorously analyzed under various models considering different adversarial actions. However, the analysis of group key exchange (GKE) protocols has not been as extensive as that of 2PKE protocols. Particularly, the security attribute of key compromise impersonation (KCI) resilience has so far been ignored for the case of GKE protocols. We first model the security of GKE protocols addressing KCI attacks by both outsider and insider adversaries. We then show that a few existing protocols are not secure even against outsider KCI attacks. The attacks on these protocols demonstrate the necessity of considering KCI resilience for GKE protocols. Finally, we give a new proof of security for an existing GKE protocol under the revised model assuming random oracles.

Towards model round-trip engineering : an abductive approach

Providing support for reversible transformations as a basis for round-trip engineering is a significant challenge in model transformation research. While there are a number of current approaches, they require the underlying transformation to exhibit an injective behaviour when reversing changes. This however, does not serve all practical transformations well. In this paper, we present a novel approach to round-trip engineering that does not place restrictions on the nature of the underlying transformation. Based on abductive logic programming, it allows us to compute a set of legitimate source changes that equate to a given change to the target model. Encouraging results are derived from an initial prototype that supports most concepts of the Tefkat transformation language

Topological SLAM Using Fast Vision Techniques

In this paper we propose a method for vision only topological simultaneous localisation and mapping (SLAM). Our approach does not use motion or odometric information but a sequence of colour histograms from visited places. In particular, we address the perceptual aliasing problem which occurs using external observations only in topological navigation. We propose a Bayesian inference method to incrementally build a topological map by inferring spatial relations from the sequence of observations while simultaneously estimating the robot's location. The algorithm aims to build a small map which is consistent with local adjacency information extracted from the sequence measurements. Local adjacency information is incorporated to disambiguate places which otherwise would appear to be the same. Experiments in an indoor environment show that the proposed technique is capable of dealing with perceptual aliasing using visual observations only and successfully performs topological SLAM.

Designing interaction for local communications : an urban screen study

This paper discusses the ongoing design and use of a digital community noticeboard situated in a suburban hub. The design intention is to engage residents, collect and display local information and communications, and spark discussion. A key contribution is an understanding of Situated Display navigation that aids retrieval from a long-term collection created by and for suburban community, and engaging qualities of this collection.