Monitoring and analysis of internet traffic targeting unused address spaces

Today’s evolving networks are experiencing a large number of different attacks ranging from system break-ins, infection from automatic attack tools such as worms, viruses, trojan horses and denial of service (DoS). One important aspect of such attacks is that they are often indiscriminate and target Internet addresses without regard to whether they are bona fide allocated or not. Due to the absence of any advertised host services the traffic observed on unused IP addresses is by definition unsolicited and likely to be either opportunistic or malicious. The analysis of large repositories of such traffic can be used to extract useful information about both ongoing and new attack patterns and unearth unusual attack behaviors. However, such an analysis is difficult due to the size and nature of the collected traffic on unused address spaces. In this dissertation, we present a network traffic analysis technique which uses traffic collected from unused address spaces and relies on the statistical properties of the collected traffic, in order to accurately and quickly detect new and ongoing network anomalies. Detection of network anomalies is based on the concept that an anomalous activity usually transforms the network parameters in such a way that their statistical properties no longer remain constant, resulting in abrupt changes. In this dissertation, we use sequential analysis techniques to identify changes in the behavior of network traffic targeting unused address spaces to unveil both ongoing and new attack patterns. Specifically, we have developed a dynamic sliding window based non-parametric cumulative sum change detection techniques for identification of changes in network traffic. Furthermore we have introduced dynamic thresholds to detect changes in network traffic behavior and also detect when a particular change has ended. Experimental results are presented that demonstrate the operational effectiveness and efficiency of the proposed approach, using both synthetically generated datasets and real network traces collected from a dedicated block of unused IP addresses.

Characterising anomalous events using change point correlation on unsolicited network traffic

Monitoring unused or dark IP addresses offers opportunities to extract useful information about both on-going and new attack patterns. In recent years, different techniques have been used to analyze such traffic including sequential analysis where a change in traffic behavior, for example change in mean, is used as an indication of malicious activity. Change points themselves say little about detected change; further data processing is necessary for the extraction of useful information and to identify the exact cause of the detected change which is limited due to the size and nature of observed traffic. In this paper, we address the problem of analyzing a large volume of such traffic by correlating change points identified in different traffic parameters. The significance of the proposed technique is two-fold. Firstly, automatic extraction of information related to change points by correlating change points detected across multiple traffic parameters. Secondly, validation of the detected change point by the simultaneous presence of another change point in a different parameter. Using a real network trace collected from unused IP addresses, we demonstrate that the proposed technique enables us to not only validate the change point but also extract useful information about the causes of change points.

Bias reduction using stochastic approximation

The paper studies stochastic approximation as a technique for bias reduction. The proposed method does not require approximating the bias explicitly, nor does it rely on having independent identically distributed (i.i.d.) data. The method always removes the leading bias term, under very mild conditions, as long as auxiliary samples from distributions with given parameters are available. Expectation and variance of the bias-corrected estimate are given. Examples in sequential clinical trials (non-i.i.d. case), curved exponential models (i.i.d. case) and length-biased sampling (where the estimates are inconsistent) are used to illustrate the applications of the proposed method and its small sample properties.

Sequential development of algebra knowledge : a cognitive analysis

Learning to operate algebraically is a complex process that is dependent upon extending arithmetic knowledge to the more complex concepts of algebra. Current research has shown a gap between arithmetic and algebraic knowledge and suggests a pre-algebraic level as a step between the two knowledge types. This paper examines arithmetic and algebraic knowledge from a cognitive perspective in an effort to determine what constitutes a pre-algebraic level of understanding. Results of a longitudinal study designed to investigate students' readiness for algebra are presented. Thirty-three students in Grades 7, 8, and 9 participated. A model for the transition from arithmetic to pre-algebra to algebra is proposed and students' understanding of relevant knowledge is discussed.

On the diversity analysis of the sequential slotted amplify-decode-and-forward protocol

In this paper, we review the sequential slotted amplify-decode-and-forward (SADF) protocol with half-duplex single-antenna and evaluate its performance in terms of pairwise error probability (PEP). We obtain the PEP upper bound of the protocol and find out that the achievable diversity order of the protocol is two with arbitrary number of relay terminals. To achieve the maximum achievable diversity order, we propose a simple precoder that is easy to implement with any number of relay terminals and transmission slots. Simulation results show that the proposed precoder achieves the maximum achievable diversity order and has similar BER performance compared to some of the existing precoders.

Condensed phase combustion travelling waves with sequential exothermic or endothermic reactions

The one-dimensional propagation of a combustion wave through a premixed solid fuel for two-stage kinetics is studied. We re-examine the analysis of a single reaction travelling-wave and extend it to the case of two-stage reactions. We derive an expression for the travelling wave speed in the limit of large activation energy for both reactions. The analysis shows that when both reactions are exothermic, the wave structure is similar to the single reaction case. However, when the second reaction is endothermic, the wave structure can be significantly different from single reaction case. In particular, as might be expected, a travelling wave does not necessarily exist in this case. We establish conditions in the limiting large activation energy limit for the non-existence, and for monotonicity of the temperature profile in the travelling wave.

How well are Australian children doing in the first year of school : a demographic analysis

Background: The transition to school is a sensitive period for children in relation to school success. In the early school years, children need to develop positive attitudes to school and have experiences that promote academic, behavioural and social competence. When children begin school there are higher expectations of responsibility and independence and in the year one class, there are more explicit academic goals for literacy and numeracy and more formal instruction. Most importantly, children’s early attitudes to learning and learning styles have an impact on later educational outcomes. Method: Data were drawn from The Longitudinal Study of Australian Children (LSAC). LSAC is a cross-sequential cohort study funded by the Australian Government. In these analyses, Wave 2 (2006) data for 2499 children in the Kindergarten Cohort were used. Children, at Wave 2, were in the first year of formal school. They had a mean age of 6.9 years (SD= 0.26). Measures included a 6-item measure of Approaches to Learning (task persistence, independence) and the Academic Rating Scales for language and literacy and mathematical thinking. Teachers rated their relationships with children on the short form of the STRS. Results: Girls were rated by their teachers as doing better than boys on Language and literacy, Approaches to learning; and they had a better relationship with their teacher. Children from an Aboriginal or Torres Strait Island (ATSI) background were rated as doing less well on Language and Literacy and Mathematical thinking and on their Approaches to learning. Children from high Socio Economic Position families are doing better on teacher rated Language and Literacy, Mathematical thinking, Approaches to learning and they had a better relationship with their teacher. Conclusions: Findings highlight the importance of key demographic variables in understanding children’s early school success.

An historical analysis of the development of thinking in the principal writings of Malcolm Knowles

Malcolm Shepherd Knowles was a key writer and theorist in the field of adult education in the United States. He died in 1997 and left a large legacy of books and journal articles. This thesis traced the development of his thinking over the 46-year period from 1950 to 1995. It examined the 25 works authored, co-authored, edited, reissued and revised by him during that period. The writings were scrutinised using a literature research methodology to expose the theoretical content, and a history of thought lens to identify and account for the development of major ideas. The methodology enabled a gradual unfolding of the history. A broadly-consistent and sequential pattern of thought focusing on the notion of andragogy emerged. The study revealed that after the initial phases of exploratory thinking, Knowles developed a practical-theoretical framework he believed could function as a comprehensive theory of adult learning. As his thinking progressed, his theory developed into a unified framework for human resource development and, later, into a model for the development of self-directed lifelong learners. The study traced the development of Knowles’ thinking through the phases of thought, identified the writings that belonged within each phase and produced a series of diagrammatic representations showing the evolution of his conceptual framework. The production of a history of the development of Knowles’ thought is the major outcome of the study. In addition to plotting the narrative sequence of thought-events, the history helps to explicate the factors and conditions that influenced Knowles’ thinking and to show the interrelationships between ideas. The study should help practitioners in their use and appreciation of Knowles’ works.

Defending the patch : a labour geography analysis of unions’ construction of and responses to the problem of declining union membership amongst youth

If the trade union movement is to remain an influential force in the industrial, economic and socio/political arenas of industrialised nations it is vital that its recruitment of young members improve dramatically. Australian union membership levels have declined markedly over the last three decades and youth union membership levels have decreased more than any age group. Currently around 10% of young workers aged between 16-24 years are members of unions in Australia compared to 26% of workers aged 45-58 (Oliver, 2008). This decline has occurred throughout the union movement, in all states and in almost all industries and occupations. This research, which consists of interviews with union organisers and union officials, draws on perspectives from the labour geography literature to explore how union personnel located in various places, spaces and scales construct the issue of declining youth union membership. It explores the scale of connections within the labour movement and the extent to which these connections are leveraged to address the problem of youth union membership decline. To offer the reader a sense of context and perspective, the thesis firstly outlines the historical development of the union movement. It also reviews the literature on youth membership decline. Labour geography offers a rich and apposite analytical tool for investigation of this area. The notion of ‘scale’ as a dynamic, interactive, constructed and reconstructed entity (Ellem, 2006) is an appropriate lens for viewing youth-union membership issues. In this non-linear view, scale is a relational element which interplays with space, place and the environment (Howett, in Marston, 2000) rather than being ‘sequential’ and hierarchical. Importantly, the thesis investigates the notion of unions as ‘spaces of dependence’ (Cox, 1998a, p.2), organisations whose space is centred upon realising essential interests. It also considers the quality of unions’ interactions with others – their ‘spaces of engagement‘(Cox, 1998a, p.2), and the impact that this has upon their ability to recruit youth. The findings reveal that most respondents across the spectrum of the union movement attribute the decline in youth membership levels to factors external to the movement itself, such as changes to industrial relations legislation and the impact of globalisation on employment markets. However, participants also attribute responsibility for declining membership levels to the union movement itself, citing factors such as a lack of resourcing and a need to change unions’ perceived identity and methods of operation. The research further determined that networks of connections across the union movement are tenuous and, to date, are not being fully utilised to assist unions to overcome the youth recruitment dilemma. The study concludes that potential connections between unions are hampered by poor resourcing, workload issues and some deeply entrenched attitudes related to unions ‘defending (and maintaining) their patch’.

Sequential nonlinear manifold learning

The computation of compact and meaningful representations of high dimensional sensor data has recently been addressed through the development of Nonlinear Dimensional Reduction (NLDR) algorithms. The numerical implementation of spectral NLDR techniques typically leads to a symmetric eigenvalue problem that is solved by traditional batch eigensolution algorithms. The application of such algorithms in real-time systems necessitates the development of sequential algorithms that perform feature extraction online. This paper presents an efficient online NLDR scheme, Sequential-Isomap, based on incremental singular value decomposition (SVD) and the Isomap method. Example simulations demonstrate the validity and significant potential of this technique in real-time applications such as autonomous systems.

Multiscale analysis of protein functions and stochastic modelling of gene transcriptional regulatory networks

Genomic and proteomic analyses have attracted a great deal of interests in biological research in recent years. Many methods have been applied to discover useful information contained in the enormous databases of genomic sequences and amino acid sequences. The results of these investigations inspire further research in biological fields in return. These biological sequences, which may be considered as multiscale sequences, have some specific features which need further efforts to characterise using more refined methods. This project aims to study some of these biological challenges with multiscale analysis methods and stochastic modelling approach. The first part of the thesis aims to cluster some unknown proteins, and classify their families as well as their structural classes. A development in proteomic analysis is concerned with the determination of protein functions. The first step in this development is to classify proteins and predict their families. This motives us to study some unknown proteins from specific families, and to cluster them into families and structural classes. We select a large number of proteins from the same families or superfamilies, and link them to simulate some unknown large proteins from these families. We use multifractal analysis and the wavelet method to capture the characteristics of these linked proteins. The simulation results show that the method is valid for the classification of large proteins. The second part of the thesis aims to explore the relationship of proteins based on a layered comparison with their components. Many methods are based on homology of proteins because the resemblance at the protein sequence level normally indicates the similarity of functions and structures. However, some proteins may have similar functions with low sequential identity. We consider protein sequences at detail level to investigate the problem of comparison of proteins. The comparison is based on the empirical mode decomposition (EMD), and protein sequences are detected with the intrinsic mode functions. A measure of similarity is introduced with a new cross-correlation formula. The similarity results show that the EMD is useful for detection of functional relationships of proteins. The third part of the thesis aims to investigate the transcriptional regulatory network of yeast cell cycle via stochastic differential equations. As the investigation of genome-wide gene expressions has become a focus in genomic analysis, researchers have tried to understand the mechanisms of the yeast genome for many years. How cells control gene expressions still needs further investigation. We use a stochastic differential equation to model the expression profile of a target gene. We modify the model with a Gaussian membership function. For each target gene, a transcriptional rate is obtained, and the estimated transcriptional rate is also calculated with the information from five possible transcriptional regulators. Some regulators of these target genes are verified with the related references. With these results, we construct a transcriptional regulatory network for the genes from the yeast Saccharomyces cerevisiae. The construction of transcriptional regulatory network is useful for detecting more mechanisms of the yeast cell cycle.

Sequential Monte Carlo for Bayesian sequentially designed experiments for discrete data

In this paper we present a sequential Monte Carlo algorithm for Bayesian sequential experimental design applied to generalised non-linear models for discrete data. The approach is computationally convenient in that the information of newly observed data can be incorporated through a simple re-weighting step. We also consider a flexible parametric model for the stimulus-response relationship together with a newly developed hybrid design utility that can produce more robust estimates of the target stimulus in the presence of substantial model and parameter uncertainty. The algorithm is applied to hypothetical clinical trial or bioassay scenarios. In the discussion, potential generalisations of the algorithm are suggested to possibly extend its applicability to a wide variety of scenarios

Multifractal characterisation and analysis of complex networks

Complex networks have been studied extensively due to their relevance to many real-world systems such as the world-wide web, the internet, biological and social systems. During the past two decades, studies of such networks in different fields have produced many significant results concerning their structures, topological properties, and dynamics. Three well-known properties of complex networks are scale-free degree distribution, small-world effect and self-similarity. The search for additional meaningful properties and the relationships among these properties is an active area of current research. This thesis investigates a newer aspect of complex networks, namely their multifractality, which is an extension of the concept of selfsimilarity. The first part of the thesis aims to confirm that the study of properties of complex networks can be expanded to a wider field including more complex weighted networks. Those real networks that have been shown to possess the self-similarity property in the existing literature are all unweighted networks. We use the proteinprotein interaction (PPI) networks as a key example to show that their weighted networks inherit the self-similarity from the original unweighted networks. Firstly, we confirm that the random sequential box-covering algorithm is an effective tool to compute the fractal dimension of complex networks. This is demonstrated on the Homo sapiens and E. coli PPI networks as well as their skeletons. Our results verify that the fractal dimension of the skeleton is smaller than that of the original network due to the shortest distance between nodes is larger in the skeleton, hence for a fixed box-size more boxes will be needed to cover the skeleton. Then we adopt the iterative scoring method to generate weighted PPI networks of five species, namely Homo sapiens, E. coli, yeast, C. elegans and Arabidopsis Thaliana. By using the random sequential box-covering algorithm, we calculate the fractal dimensions for both the original unweighted PPI networks and the generated weighted networks. The results show that self-similarity is still present in generated weighted PPI networks. This implication will be useful for our treatment of the networks in the third part of the thesis. The second part of the thesis aims to explore the multifractal behavior of different complex networks. Fractals such as the Cantor set, the Koch curve and the Sierspinski gasket are homogeneous since these fractals consist of a geometrical figure which repeats on an ever-reduced scale. Fractal analysis is a useful method for their study. However, real-world fractals are not homogeneous; there is rarely an identical motif repeated on all scales. Their singularity may vary on different subsets; implying that these objects are multifractal. Multifractal analysis is a useful way to systematically characterize the spatial heterogeneity of both theoretical and experimental fractal patterns. However, the tools for multifractal analysis of objects in Euclidean space are not suitable for complex networks. In this thesis, we propose a new box covering algorithm for multifractal analysis of complex networks. This algorithm is demonstrated in the computation of the generalized fractal dimensions of some theoretical networks, namely scale-free networks, small-world networks, random networks, and a kind of real networks, namely PPI networks of different species. Our main finding is the existence of multifractality in scale-free networks and PPI networks, while the multifractal behaviour is not confirmed for small-world networks and random networks. As another application, we generate gene interactions networks for patients and healthy people using the correlation coefficients between microarrays of different genes. Our results confirm the existence of multifractality in gene interactions networks. This multifractal analysis then provides a potentially useful tool for gene clustering and identification. The third part of the thesis aims to investigate the topological properties of networks constructed from time series. Characterizing complicated dynamics from time series is a fundamental problem of continuing interest in a wide variety of fields. Recent works indicate that complex network theory can be a powerful tool to analyse time series. Many existing methods for transforming time series into complex networks share a common feature: they define the connectivity of a complex network by the mutual proximity of different parts (e.g., individual states, state vectors, or cycles) of a single trajectory. In this thesis, we propose a new method to construct networks of time series: we define nodes by vectors of a certain length in the time series, and weight of edges between any two nodes by the Euclidean distance between the corresponding two vectors. We apply this method to build networks for fractional Brownian motions, whose long-range dependence is characterised by their Hurst exponent. We verify the validity of this method by showing that time series with stronger correlation, hence larger Hurst exponent, tend to have smaller fractal dimension, hence smoother sample paths. We then construct networks via the technique of horizontal visibility graph (HVG), which has been widely used recently. We confirm a known linear relationship between the Hurst exponent of fractional Brownian motion and the fractal dimension of the corresponding HVG network. In the first application, we apply our newly developed box-covering algorithm to calculate the generalized fractal dimensions of the HVG networks of fractional Brownian motions as well as those for binomial cascades and five bacterial genomes. The results confirm the monoscaling of fractional Brownian motion and the multifractality of the rest. As an additional application, we discuss the resilience of networks constructed from time series via two different approaches: visibility graph and horizontal visibility graph. Our finding is that the degree distribution of VG networks of fractional Brownian motions is scale-free (i.e., having a power law) meaning that one needs to destroy a large percentage of nodes before the network collapses into isolated parts; while for HVG networks of fractional Brownian motions, the degree distribution has exponential tails, implying that HVG networks would not survive the same kind of attack.