Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Dense Correspondence Extraction in Difficult Uncalibrated Scenarios

The relationship between multiple cameras viewing the same scene may be discovered automatically by finding corresponding points in the two views and then solving for the camera geometry. In camera networks with sparsely placed cameras, low resolution cameras or in scenes with few distinguishable features it may be difficult to find a sufficient number of reliable correspondences from which to compute geometry. This paper presents a method for extracting a larger number of correspondences from an initial set of putative correspondences without any knowledge of the scene or camera geometry. The method may be used to increase the number of correspondences and make geometry computations possible in cases where existing methods have produced insufficient correspondences.

Contrasting scenarios : embracing speech recognition

The purpose of this chapter is to describe the use of caricatured contrasting scenarios (Bødker, 2000) and how they can be used to consider potential designs for disruptive technologies. The disruptive technology in this case is Automatic Speech Recognition (ASR) software in workplace settings. The particular workplace is the Magistrates Court of the Australian Capital Territory.----- Caricatured contrasting scenarios are ideally suited to exploring how ASR might be implemented in a particular setting because they allow potential implementations to be “sketched” quickly and with little effort. This sketching of potential interactions and the emphasis of both positive and negative outcomes allows the benefits and pitfalls of design decisions to become apparent.----- A brief description of the Court is given, describing the reasons for choosing the Court for this case study. The work of the Court is framed as taking place in two modes: Front of house, where the courtroom itself is, and backstage, where documents are processed and the business of the court is recorded and encoded into various systems.----- Caricatured contrasting scenarios describing the introduction of ASR to the front of house are presented and then analysed. These scenarios show that the introduction of ASR to the court would be highly problematic.----- The final section describes how ASR could be re-imagined in order to make it useful for the court. A final scenario is presented that describes how this re-imagined ASR could be integrated into both the front of house and backstage of the court in a way that could strengthen both processes.

Incorporating authentic assessment into different university learning scenarios

There is a current requirement for universities to prepare graduates who are skilled in practical as well as theoretical knowledge of the workplace. It is argued in this paper that assessment, as integral to the teaching/learning process, should also relate to the real world context of the workplace, in that students are able to transform, use and apply the knowledge that they learn into these contexts. While assessment authentic for students in a university setting is often a difficult task for lecturers. This paper discusses three different learning contexts that involved different assessment experiences linked in some way to real world learning and application of the theory. The results of the trial indicated that as contexts became close to a real world experience, the sustainability of the assessment became more problematic. While acknowledging the difficulty of these practices, it is suggested that there is a need for a continuous cycle of evaluation amid some creative and innovative approaches to assessment practice.

Prospective bus rapid transit scenarios for pilot corridor in Dhaka

Dhaka doesn’t have a mature transport system. Lacking in institutional arrangements, policy and planning, and law enforcement, the transport system operates has developed ad hoc and is situationally problematic. Absence of proper coordination between modes, poor public transport system, inadequate pedestrian facilities, and environmental degradation justify full consideration of Bus Rapid Transit (BRT) in Dhaka. BRT centres on sustainable transport principles. BRT is a system, which is capable to mitigate Dhaka’s transport problem if properly planned. In Strategic transport plan of Dhaka three BRT transport corridor has been proposed and BRT pre-feasibility study came up with one pilot corridor for early implementation of BRT. This paper first reviews international best practices then explores various BRT system packages and evaluates the suitability of these BRT packages by analyzing current bus service condition and physical and geometric configuration along the BRT pilot corridor. It concludes by proposing some BRT scenarios, which can be considered for further evaluation with respect to speed, delay, travel time and environmental pollution.

Projecting future heat-related mortality under climate change scenarios : A systematic review

Background: Heat-related mortality is a matter of great public health concern, especially in the light of climate change. Although many studies have found associations between high temperatures and mortality, more research is needed to project the future impacts of climate change on heat-related mortality. Objectives: We conducted a systematic review of research and methods for projecting future heat-related mortality under climate change scenarios. Data sources and extraction: A literature search was conducted in August 2010, using the electronic databases PubMed, Scopus, ScienceDirect, ProQuest, and Web of Science. The search was limited to peer-reviewed journal articles published in English up to 2010. Data synthesis: The review included 14 studies that fulfilled the inclusion criteria. Most projections showed that climate change would result in a substantial increase in heat-related mortality. Projecting heat-related mortality requires understanding of the historical temperature-mortality relationships, and consideration of the future changes in climate, population and acclimatization. Further research is needed to provide a stronger theoretical framework for projections, including a better understanding of socio-economic development, adaptation strategies, land-use patterns, air pollution and mortality displacement. Conclusions: Scenario-based projection research will meaningfully contribute to assessing and managing the potential impacts of climate change on heat-related mortality.

Fixing the city one photo at a time : mobile logging of maintenance requests

We have designed a mobile application that takes advantage of the built-in features of smart phones such as camera and GPS that allow users to take geo-tagged photos while on the move. Urban residents can take pictures of broken street furniture and public property requiring repair, attach a brief description, and submit the information as a maintenance request to the local government organisation of their city. This paper discusses the design approach that led to the application, highlights a built-in mechanism to elicit user feedback, and evaluates the progress to date with user feedback and log statistics. It concludes with an outlook highlighting user requested features and our own design aspirations for moving from a reporting tool to a civic engagement tool.

The influence of conformity and group identity on drink walking intentions : comparing intentions to drink walk across risky pedestrian crossing scenarios

Despite the dangers associated with drink walking, limited research is currently available regarding the factors which influence individuals to engage in this risky behaviour. This study examined the influence of psychosocial factors upon individuals’ intentions to drink walk across four experimental scenarios (and a control condition). Specifically, a 2 × 2 repeated measures design was utilised in which all of the scenarios incorporated a risky pedestrian crossing situation (i.e., a pedestrian crossing against a red man signal) but differed according to the level of group identity (i.e., low/strangers and high/friends) and conformity (low and high). Individuals were assessed for their intentions to drink walk within each of these different scenarios. Undergraduate students (N = 151), aged 17–30 years, completed a questionnaire. Overall, most of the study's hypotheses were supported with individuals reporting the highest intentions to drink walk when in the presence of friends (i.e., high group identity) and their friends were said to be also crossing against the red man signal (i.e., high conformity). The findings may have significant implications for the design of countermeasures to reduce drink walking. For instance, the current findings would suggest that potentially effective strategies may be to promote resilience to peer influence as well as highlight the negative consequences associated with following the behaviour of other intoxicated pedestrians who are crossing against a red signal.

A review of models and model usage scenarios for an airport complex system

Airports represent the epitome of complex systems with multiple stakeholders, multiple jurisdictions and complex interactions between many actors. The large number of existing models that capture different aspects of the airport are a testament to this. However, these existing models do not consider in a systematic sense modelling requirements nor how stakeholders such as airport operators or airlines would make use of these models. This can detrimentally impact on the verification and validation of models and makes the development of extensible and reusable modelling tools difficult. This paper develops from the Concept of Operations (CONOPS) framework a methodology to help structure the review and development of modelling capabilities and usage scenarios. The method is applied to the review of existing airport terminal passenger models. It is found that existing models can be broadly categorised according to four usage scenarios: capacity planning, operational planning and design, security policy and planning, and airport performance review. The models, the performance metrics that they evaluate and their usage scenarios are discussed. It is found that capacity and operational planning models predominantly focus on performance metrics such as waiting time, service time and congestion whereas performance review models attempt to link those to passenger satisfaction outcomes. Security policy models on the other hand focus on probabilistic risk assessment. However, there is an emerging focus on the need to be able to capture trade-offs between multiple criteria such as security and processing time. Based on the CONOPS framework and literature findings, guidance is provided for the development of future airport terminal models.

Experimental validation of an unpowered unmanned aerial system : application to forced landing scenarios

The ability to perform autonomous emergency (forced) landings is one of the key technology enablers identified for UAS. This paper presents the flight test results of forced landings involving a UAS, in a controlled environment, and which was conducted to ascertain the performances of previously developed (and published) path planning and guidance algorithms. These novel 3-D nonlinear algorithms have been designed to control the vehicle in both the lateral and longitudinal planes of motion. These algorithms have hitherto been verified in simulation. A modified Boomerang 60 RC aircraft is used as the flight test platform, with associated onboard and ground support equipment sourced Off-the-Shelf or developed in-house at the Australian Research Centre for Aerospace Automation(ARCAA). HITL simulations were conducted prior to the flight tests and displayed good landing performance, however, due to certain identified interfacing errors, the flight results differed from that obtained in simulation. This paper details the lessons learnt and presents a plausible solution for the way forward.

A visual language for the collaborative visualization of integrated conceptual models in product development scenarios

In various industrial and scientific fields, conceptual models are derived from real world problem spaces to understand and communicate containing entities and coherencies. Abstracted models mirror the common understanding and information demand of engineers, who apply conceptual models for performing their daily tasks. However, most standardized models in Process Management, Product Lifecycle Management and Enterprise Resource Planning lack of a scientific foundation for their notation. In collaboration scenarios with stakeholders from several disciplines, tailored conceptual models complicate communication processes, as a common understanding is not shared or implemented in specific models. To support direct communication between experts from several disciplines, a visual language is developed which allows a common visualization of discipline-specific conceptual models. For visual discrimination and to overcome visual complexity issues, conceptual models are arranged in a three-dimensional space. The visual language introduced here follows and extends established principles of Visual Language science.