Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Characterising anomalous events using change point correlation on unsolicited network traffic

Monitoring unused or dark IP addresses offers opportunities to extract useful information about both on-going and new attack patterns. In recent years, different techniques have been used to analyze such traffic including sequential analysis where a change in traffic behavior, for example change in mean, is used as an indication of malicious activity. Change points themselves say little about detected change; further data processing is necessary for the extraction of useful information and to identify the exact cause of the detected change which is limited due to the size and nature of observed traffic. In this paper, we address the problem of analyzing a large volume of such traffic by correlating change points identified in different traffic parameters. The significance of the proposed technique is two-fold. Firstly, automatic extraction of information related to change points by correlating change points detected across multiple traffic parameters. Secondly, validation of the detected change point by the simultaneous presence of another change point in a different parameter. Using a real network trace collected from unused IP addresses, we demonstrate that the proposed technique enables us to not only validate the change point but also extract useful information about the causes of change points.

ePortfolio use by university students in Australia : Developing a sustainable community of practice

This report documents Stage Two of the Australian ePortfolio Project (AeP2), to specifically explore the current scope of national and international ePortfolio communities of practice in order to identify the factors that have contributed to their success and sustainability. The study has built on Stage One of the Australian ePortfolio Project (Hallam, Harper, McCowan, Hauville, McAllister, & Creagh, 2008), which outlined the broad range of issues and challenges, as well as significant opportunities, that faced the higher education sector in terms of ePortfolio practice, to determine how the emergent community of ePortfolio researchers and practitioners in Australia might be advanced. ---------- The overarching aims of this project were to focus on building the Australian community of practice through an online forum and further symposium activities. Through the research activities the project sought to generate the following major outcomes: develop a forum within the ALTC Exchange to support an ePortfolio community of practice; develop strategies to encourage interest in and engagement with community of practice activities; develop and promote resources to support the diverse stakeholders in ePortfolio practice; collaborate in the establishment of a cross-sector ePortfolio community of practice; host a second Australian ePortfolio Symposium (AeP2) to disseminate the findings from the Australian ePortfolio Project, to explore innovative practice in ePortfolio use in higher education, to articulate policy developments, and to stimulate discussion on international ePortfolio issues; host an associated trade display as a forum for strengthening the higher education sector’s understanding of the features and functionality of ePortfolio platforms; develop resources to support an ePortfolio symposium model that may be adopted for future events. ----------- The project activities encompassed a survey of stakeholders, a program of semi-structured interviews with community managers and a series of case studies depicting successful ePortfolio communities. The survey of ePortfolio practitioners sought to determine the potential value of an ePortfolio CoP, the preferred focus for and the desired features of such a community, as well as the options for the technical and social architecture of an online forum. Through the semi-structured interviews it was possible to examine current examples of CoP activity, to identify the critical success factors and the challenges faced by individual ePortfolio CoPs, so that the attributes of good practice could be presented. The data collected in the interviews contributed to the development of 14 case studies, which have been beneficial in illustrating the diverse nature of CoPs in Australia and overseas.----------- The report presents a rich picture of national and international ePortfolio communities of practice, with an examination of the factors that have contributed to their success and sustainability.

Designing university, government and industry community engagement to build informed and effective interventions in the area of road safety

Individuals, community organisations and industry have always been involved to varying degrees in efforts to address the Queensland road toll. Traditionally, road crash prevention efforts have been led by state and local government organisations. While community and industry groups have sometimes become involved (e.g. Driver Reviver campaign), their efforts have largely been uncoordinated and under-resourced. A common strength of these initiatives lies in the energy, enthusiasm and persistence of community-based efforts. Conversely, a weakness has sometimes been the lack of knowledge, awareness or prioritisation of evidence-based interventions or their capacity to build on collaborative efforts. In 2000, the Queensland University of Technology’s Centre for Accident Research and Road Safety – Queensland (CARRS-Q) identified this issue as an opportunity to bridge practice and research and began acknowledging a selection of these initiatives, in partnership with the RACQ, through the Queensland Road Safety Awards program. After nine years it became apparent there was need to strengthen this connection, with the Centre establishing a Community Engagement Workshop in 2009 as part of the overall Awards program. With an aim of providing community participants opportunities to see, hear and discuss the experiences of others, this event was further developed in 2010, and with the collaboration of the Queensland Department of Transport and Main Roads, the RACQ, Queensland Police Service and Leighton Contractors Pty Ltd, a stand-alone Queensland Road Safety Awards Community Engagement Workshop was held in 2010. Each collaborating organisation recognised a need to mobilise the community through effective information and knowledge sharing, and recognised that learning and discussion can influence lasting behaviour change and action in this often emotive, yet not always evidence-based, area. This free event featured a number of speakers representing successful projects from around Australia and overseas. Attendees were encouraged to interact with the speakers, to ask questions, and most importantly, build connections with other attendees to build a ‘community road safety army’ all working throughout Australia on projects underpinned by evaluated research. The workshop facilitated the integration of research, policy and grass-roots action enhancing the success of community road safety initiatives. For collaboration partners, the event enabled them to transfer their knowledge in an engaged approach, working within a more personal communication process. An analysis of the success factors for this event identified openness to community groups and individuals, relevance of content to local initiatives, generous support with the provision of online materials and ongoing communication with key staff members as critical and supports the view that the university can directly provide both the leadership and the research needed for effective and credible community-based initiatives to address injury and death on the roads.

Augmenting mobile computing with video game elements to support, motivate and engage young people in educational, real-world events

Video games have shown great potential as tools that both engage and motivate players to achieve tasks and build communities in fantasy worlds. We propose that the application of game elements to real world activities can aid in delivering contextual information in interesting ways and help young people to engage in everyday events. Our research will explore how we can unite utility and fun to enhance information delivery, encourage participation, build communities and engage users with utilitarian events situated in the real world. This research aims to identify key game elements that work effectively to engage young digital natives, and provide guidelines to influence the design of interactions and interfaces for event applications in the future. This research will primarily contribute to areas of user experience and pervasive gaming.

Creating new narratives through shared time and space : the performer/audience connection in multi-site dance events

Site-specific performance provides choices in audience experience via degrees of scale, proximity, levels of immersion and viewing perspectives. Beyond these choices, multi-site promenade events also form a connected audience/performer relationship in which moving together in time and space can produce a shared narrative and aesthetic sensibility of collective, yet individuated and shifting meanings. This paper interrogates this notion through audience/performer experiences in two separate multi-site, dance-led events. here/there/then/now occurred in four intimate sites within the Brisbane Powerhouse, providing a theatricalised platform for audiences to create linked narratives through open-ended and fragmented intertextuality. Accented Body, based on the concept of “the body as site and in site” and notions of connectivity, provided a more expansive platform for a similar, but heightened, shared engagement. Audiences traversed 6 outdoor and 2 indoor Brisbane sites moving to varying levels of a large complex. Eleven, predominantly interactive, screens provided links to other sites as well as to distributed presences in Seoul and London. The differentiation in scale and travel time between sites deepened the immersive experiences of audiences who reported transformative engagements with both site and architecture, accompanied by a sense of extended and yet quickened time.

Coming to belong : a narrative analysis of international students’ experiences in an Australian university

This thesis reports on an interview study with 17 international students about their experiences of coming to belong in an Australian university. All used English as an additional language (EAL). The students’ narratives of ‘coming to belong’ are conceptualised through the theory of Bourdieu, in particular the concepts of field, capital, habitus and legitimation; and the methodological premises of critical realism’s layered ontology. The literature review argues that access to and accrual of a range of capital is critical to successful adaptation to a new educational system. This, and processes of legitimation by others in the fields, affects the senses of belonging for students of various linguistic backgrounds, of different countries of origin, studying from primary to higher education in diverse parts of the world. Data were collected by semi-structured interviews and email dialogues at three points during the students’ first year of study in Australia. The analysis shows how the students’ empirical experiences were ordered in terms of narrative structure—orientation, complication, evaluation, resolution and coda—and highlight the emotions generated by the sequence of events. The findings show that EAL international students sought new field positions through legitimation in multiple senses across (sub-)fields. They also show that academic, social and linguistic legitimacy granted by others produced a spectrum of belonging: in the centre, at the margin, and/or to meaningful intercultural encounters. This study makes a contribution to the growing literature around the experience of international students in higher education, and to empirical literature using Bourdieu to understand educational relations.

Protection of structural systems and mechanisms from catastrophic and life-threatening failure caused by unforeseeable events

Structural framing systems and mechanisms designed for normal use rarely possess adequate robustness to withstand the effects of large impacts, blasts and extreme earthquakes that have been experienced in recent times. Robustness is the property of systems that enables them to survive unforeseen or unusual circumstances (Knoll & Vogel, 2009). Queensland University of Technology with industry collaboration is engaged in a program of research that commenced 15 years ago to study the impact of such unforeseeable phenomena and investigate methods of improving robustness and safety with protective mechanisms embedded or designed in structural systems. This paper highlights some of the research pertaining to seismic protection of building structures, rollover protective structures and effects of vehicular impact and blast on key elements in structures that could propagate catastrophic and disproportionate collapse.

Detecting distributed Denial-of-Service attacks and Flash Events

This thesis investigates and develops techniques for accurately detecting Internet-based Distributed Denial-of-Service (DDoS) Attacks where an adversary harnesses the power of thousands of compromised machines to disrupt the normal operations of a Web-service provider, resulting in significant down-time and financial losses. This thesis also develops methods to differentiate these attacks from similar-looking benign surges in web-traffic known as Flash Events (FEs). This thesis also addresses an intrinsic challenge in research associated with DDoS attacks, namely, the extreme scarcity of public domain datasets (due to legal and privacy issues) by developing techniques to realistically emulate DDoS attack and FE traffic.

Vulnerability and damage analysis of reinforced concrete framed buildings subjected to near field blast events

Terrorists usually target high occupancy iconic and public buildings using vehicle borne incendiary devices in order to claim a maximum number of lives and cause extensive damage to public property. While initial casualties are due to direct shock by the explosion, collapse of structural elements may extensively increase the total figure. Most of these buildings have been or are built without consideration of their vulnerability to such events. Therefore, the vulnerability and residual capacity assessment of buildings to deliberately exploded bombs is important to provide mitigation strategies to protect the buildings' occupants and the property. Explosive loads and their effects on a building have therefore attracted significant attention in the recent past. Comprehensive and economical design strategies must be developed for future construction. This research investigates the response and damage of reinforced concrete (RC) framed buildings together with their load bearing key structural components to a near field blast event. Finite element method (FEM) based analysis was used to investigate the structural framing system and components for global stability, followed by a rigorous analysis of key structural components for damage evaluation using the codes SAP2000 and LS DYNA respectively. The research involved four important areas in structural engineering. They are blast load determination, numerical modelling with FEM techniques, material performance under high strain rate and non-linear dynamic structural analysis. The response and damage of a RC framed building for different blast load scenarios were investigated. The blast influence region for a two dimensional RC frame was investigated for different load conditions and identified the critical region for each loading case. Two types of design methods are recommended for RC columns to provide superior residual capacities. They are RC columns detailing with multi-layer steel reinforcement cages and a composite columns including a central structural steel core. These are to provide post blast gravity load resisting capacity compared to typical RC column against a catastrophic collapse. Overall, this research broadens the current knowledge of blast and residual capacity analysis of RC framed structures and recommends methods to evaluate and mitigate blast impact on key elements of multi-storey buildings.

Doctoral research training : encouraging timely completion – case study reflections of one university on how it supports a vibrant research training culture

This is a case study of a young university striving to generate and sustain a vibrant Research Training culture. The university’s research training framework is informed by a belief in a project management approach to achieving successful research candidature. This has led to the definition and reporting of key milestones during candidature. In turn, these milestones have generated a range of training programs to support Higher Degree Research (HDR) students to meet these milestones in a timely fashion. Each milestone focuses on a specific set of skills blended with supporting the development of different parts of the doctoral thesis. Data on student progress and completion has provided evidence in highlighting the role that the milestones and training are playing in supporting timely completion. A university-wide reporting cycle generated data on the range of workshops and training provided to Higher Degree Research students and supervisors. The report provided details of thesis topic and format, as well as participation in research training events and participant evaluation of those events. Analysis of the data led to recommendations and comments on the strengths and weaknesses of the current research training program. Discussion considered strategies and drivers for enhancements into the future. In particular, the paper reflects on the significant potential role of centrally curated knowledge systems to support HDR student and supervisor access, and engagement and success. The research training program was developed using blended learning as a model. It covered face-to-face workshops as well as online modules. These were supplemented by web portals that offered a range of services to inform and educate students and supervisors and included opportunities for students to interact with each other. Topics ranged from the research life cycle, writing and publication, ethics, managing research data, managing copyright, and project management to use of software and the University’s Code of Conduct for Research. The challenges discussed included: How to reach off campus students and those studying in external modes? How best to promote events to potential participants? How long and what format is best for face-to-face sessions? What online resources best supplement face-to-face offerings? Is there a place for peer-based learning and what form should this take? These questions are raised by a relatively young university seeking to build and sustain a vibrant research culture. The rapid growth in enrolments in recent years has challenged previous one-to-one models of support. This review of research training is timely in seeking strategies to address changing research training support capacity and student needs. Part of the discussion will focus on supervisory training, noting that good supervision is the one remaining place where one-to-one support is provided. Ensuring that supervisors are appropriately equipped to address student expectations is considered in the context of the research training provisions. The paper concludes with reflection on the challenges faced, and recommended ways forward as the number of research students grows into the future.