Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

A database ATP simulated waveforms of shunt reactor switching cases with vacuum breakers on motor circuits

This paper presents a database ATP (Alternative Transient Program) simulated waveforms for shunt reactor switching cases with vacuum breakers in motor circuits following interruption of the starting current. The targeted objective is to provide multiple reignition simulated data for diagnostic and prognostic algorithms development, but also to help ATP users with practical study cases and component data compilation for shunt reactor switching. This method can be easily applied with different data for the different dielectric curves of circuit-breakers and networks. This paper presents design details, discusses some of the available cases and the advantages of such simulated data.

Increase in particle number emissions from motor vehicles due to interruption of steady traffic flow

We assess the increase in particle number emissions from motor vehicles driving at steady speed when forced to stop and accelerate from rest. Considering the example of a signalized pedestrian crossing on a two-way single-lane urban road, we use a complex line source method to calculate the total emissions produced by a specific number and mix of light petrol cars and diesel passenger buses and show that the total emissions during a red light is significantly higher than during the time when the light remains green. Replacing two cars with one bus increased the emissions by over an order of magnitude. Considering these large differences, we conclude that the importance attached to particle number emissions in traffic management policies be reassessed in the future.

Sport marketing on Fortune Global 500 websites

This research investigates how the world’s leading companies, the Fortune Global 500, use sportsrelated terms and phrases on their Web site. An automated process mirrored leading transnational corporations’ Web presence and then searched their sites. Analysis of about four gigabytes of Webbased text revealed regional and industry differences in how the world’s largest corporations use sports terms on their sites.

The influence of instructions and body-scaling as constraints on decision-making processes in team sports

Team games conceptualized as dynamical systems engender a view of emergent decision-making behaviour under constraints, although specific effects of instructional and body-scaling constraints have yet to be verified empirically. For this purpose, we studied the effects of task and individual constraints on decision-making processes in basketball. Eleven experienced female players performed 350 trials in 1 vs. 1 sub-phases of basketball in which an attacker tried to perturb the stable state of a dyad formed with a defender (i.e. break the symmetry). In Experiment 1, specific instructions (neutral, risk taking or conservative) were manipulated to observe effects on emergent behaviour of the dyadic system. When attacking players were given conservative instructions, time to cross court mid-line and variability of the attacker's trajectory were significantly greater. In Experiment 2, body-scaling of participants was manipulated by creating dyads with different height relations. When attackers were considerably taller than defenders, there were fewer occurrences of symmetry-breaking. When attackers were considerably shorter than defenders, time to cross court mid-line was significantly shorter than when dyads were composed of athletes of similar height or when attackers were considerably taller than defenders. The data exemplify how interacting task and individual constraints can influence emergent decision-making processes in team ball games.

Difference-based meta-analytic procedures for between-participant and/or within-participant designs : a tutorial review for sports and exercise scientists

The aim of this paper is to provide a contemporary summary of statistical and non-statistical meta-analytic procedures that have relevance to the type of experimental designs often used by sport scientists when examining differences/change in dependent measure(s) as a result of one or more independent manipulation(s). Using worked examples from studies on observational learning in the motor behaviour literature, we adopt a random effects model and give a detailed explanation of the statistical procedures for the three types of raw score difference-based analyses applicable to between-participant, within-participant, and mixed-participant designs. Major merits and concerns associated with these quantitative procedures are identified and agreed methods are reported for minimizing biased outcomes, such as those for dealing with multiple dependent measures from single studies, design variation across studies, different metrics (i.e. raw scores and difference scores), and variations in sample size. To complement the worked examples, we summarize the general considerations required when conducting and reporting a meta-analysis, including how to deal with publication bias, what information to present regarding the primary studies, and approaches for dealing with outliers. By bringing together these statistical and non-statistical meta-analytic procedures, we provide the tools required to clarify understanding of key concepts and principles.

Constraints on the complete optimization of human motion

In sport and exercise biomechanics, forward dynamics analyses or simulations have frequently been used in attempts to establish optimal techniques for performance of a wide range of motor activities. However, the accuracy and validity of these simulations is largely dependent on the complexity of the mathematical model used to represent the neuromusculoskeletal system. It could be argued that complex mathematical models are superior to simple mathematical models as they enable basic mechanical insights to be made and individual-specific optimal movement solutions to be identified. Contrary to some claims in the literature, however, we suggest that it is currently not possible to identify the complete optimal solution for a given motor activity. For a complete optimization of human motion, dynamical systems theory implies that mathematical models must incorporate a much wider range of organismic, environmental and task constraints. These ideas encapsulate why sports medicine specialists need to adopt more individualized clinical assessment procedures in interpreting why performers' movement patterns may differ.

Characterising anomalous events using change point correlation on unsolicited network traffic

Monitoring unused or dark IP addresses offers opportunities to extract useful information about both on-going and new attack patterns. In recent years, different techniques have been used to analyze such traffic including sequential analysis where a change in traffic behavior, for example change in mean, is used as an indication of malicious activity. Change points themselves say little about detected change; further data processing is necessary for the extraction of useful information and to identify the exact cause of the detected change which is limited due to the size and nature of observed traffic. In this paper, we address the problem of analyzing a large volume of such traffic by correlating change points identified in different traffic parameters. The significance of the proposed technique is two-fold. Firstly, automatic extraction of information related to change points by correlating change points detected across multiple traffic parameters. Secondly, validation of the detected change point by the simultaneous presence of another change point in a different parameter. Using a real network trace collected from unused IP addresses, we demonstrate that the proposed technique enables us to not only validate the change point but also extract useful information about the causes of change points.

Australian Association for Exercise and Sport Science position stand : optimising cancer outcomes through exercise

Cancer represents a major public health concern in Australia. Causes of cancer are multifactorial with lack of physical activity being considered one of the known risk factors, particularly for breast and colorectal cancers. Participating in exercise has also been associated with benefits during and following treatment for cancer, including improvements in psychosocial and physical outcomes, as well as better compliance with treatment regimens, reduced impact of disease symptoms and treatment-related side effects, and survival benefits for particular cancers. The general exercise prescription for people undertaking or having completed cancer treatment is of low to moderate intensity, regular frequency (3-5 times/week) for at least 20 minutes per session, involving aerobic, resistance or mixed exercise types. Future work needs to push the boundaries of this exercise prescription, so that we can better understand what constitutes optimal, desirable and necessary frequency, duration, intensity and type, and how specific characteristics of the individual (e.g., age, cancer type, treatment, presence of specific symptoms) influence this prescription. What follows is a summary of the cancer and exercise literature, in particular the purpose of exercise following diagnosis of cancer, the potential benefits derived by cancer patients and survivors from participating in exercise programs, and exercise prescription guidelines and contraindications or considerations for exercise prescription with this special population. This report represents the position stand of the Australian Association of Exercise and Sport Science on exercise and cancer recovery and has the purpose of guiding Accredited Exercise Physiologists in their work with cancer patients.

Vision, functional and cognitive determinants of motor vehicle incidents in older drivers

Background: The proportion of older individuals in the driving population is predicted to increase in the next 50 years. This has important implications for driving safety as abilities which are important for safe driving, such as vision (which accounts for the majority of the sensory input required for driving), processing ability and cognition have been shown to decline with age. The current methods employed for screening older drivers upon re-licensure are also vision based. This study, which investigated social, behavioural and professional aspects involved with older drivers, aimed to determine: (i) if the current visual standards in place for testing upon re-licensure are effective in reducing the older driver fatality rate in Australia; (ii) if the recommended visual standards are actually implemented as part of the testing procedures by Australian optometrists; and (iii) if there are other non-standardised tests which may be better at predicting the on-road incident-risk (including near misses and minor incidents) in older drivers than those tests recommended in the standards. Methods: For the first phase of the study, state-based age- and gender-stratified numbers of older driver fatalities for 2000-2003 were obtained from the Australian Transportation Safety Bureau database. Poisson regression analyses of fatality rates were considered by renewal frequency and jurisdiction (as separate models), adjusting for possible confounding variables of age, gender and year. For the second phase, all practising optometrists in Australia were surveyed on the vision tests they conduct in consultations relating to driving and their knowledge of vision requirements for older drivers. Finally, for the third phase of the study to investigate determinants of on-road incident risk, a stratified random sample of 600 Brisbane residents aged 60 years and were selected and invited to participate using an introductory letter explaining the project requirements. In order to capture the number and type of road incidents which occurred for each participant over 12 months (including near misses and minor incidents), an important component of the prospective research study was the development and validation of a driving diary. The diary was a tool in which incidents that occurred could be logged at that time (or very close in time to which they occurred) and thus, in comparison with relying on participant memory over time, recall bias of incident occurrence was minimised. Association between all visual tests, cognition and scores obtained for non-standard functional tests with retrospective and prospective incident occurrence was investigated. Results: In the first phase,rivers aged 60-69 years had a 33% lower fatality risk (Rate Ratio [RR] = 0.75, 95% CI 0.32-1.77) in states with vision testing upon re-licensure compared with states with no vision testing upon re-licensure, however, because the CIs are wide, crossing 1.00, this result should be regarded with caution. However, overall fatality rates and fatality rates for those aged 70 years and older (RR=1.17, CI 0.64-2.13) did not differ between states with and without license renewal procedures, indicating no apparent benefit in vision testing legislation. For the second phase of the study, nearly all optometrists measured visual acuity (VA) as part of a vision assessment for re-licensing, however, 20% of optometrists did not perform any visual field (VF) testing and only 20% routinely performed automated VF on older drivers, despite the standards for licensing advocating automated VF as part of the vision standard. This demonstrates the need for more effective communication between the policy makers and those responsible for carrying out the standards. It may also indicate that the overall higher driver fatality rate in jurisdictions with vision testing requirements is resultant as the tests recommended by the standards are only partially being conducted by optometrists. Hence a standardised protocol for the screening of older drivers for re-licensure across the nation must be established. The opinions of Australian optometrists with regard to the responsibility of reporting older drivers who fail to meet the licensing standards highlighted the conflict between maintaining patient confidentiality or upholding public safety. Mandatory reporting requirements of those drivers who fail to reach the standards necessary for driving would minimise potential conflict between the patient and their practitioner, and help maintain patient trust and goodwill. The final phase of the PhD program investigated the efficacy of vision, functional and cognitive tests to discriminate between at-risk and safe older drivers. Nearly 80% of the participants experienced an incident of some form over the prospective 12 months, with the total incident rate being 4.65/10 000 km. Sixty-three percent reported having a near miss and 28% had a minor incident. The results from the prospective diary study indicate that the current vision screening tests (VA and VF) used for re-licensure do not accurately predict older drivers who are at increased odds of having an on-road incident. However, the variation in visual measurements of the cohort was narrow, also affecting the results seen with the visual functon questionnaires. Hence a larger cohort with greater variability should be considered for a future study. A slightly lower cognitive level (as measured with the Mini-Mental State Examination [MMSE]) did show an association with incident involvement as did slower reaction time (RT), however the Useful-Field-of-View (UFOV) provided the most compelling results of the study. Cut-off values of UFOV processing (>23.3ms), divided attention (>113ms), selective attention (>258ms) and overall score (moderate/ high/ very high risk) were effective in determining older drivers at increased odds of having any on-road incident and the occurrence of minor incidents. Discussion: The results have shown that for the 60-69 year age-group, there is a potential benefit in testing vision upon licence renewal. However, overall fatality rates and fatality rates for those aged 70 years and older indicated no benefit in vision testing legislation and suggests a need for inclusion of screening tests which better predict on-road incidents. Although VA is routinely performed by Australian optometrists on older drivers renewing their licence, VF is not. Therefore there is a need for a protocol to be developed and administered which would result in standardised methods conducted throughout the nation for the screening of older drivers upon re-licensure. Communication between the community, policy makers and those conducting the protocol should be maximised. By implementing a standardised screening protocol which incorporates a level of mandatory reporting by the practitioner, the ethical dilemma of breaching patient confidentiality would also be resolved. The tests which should be included in this screening protocol, however, cannot solely be ones which have been implemented in the past. In this investigation, RT, MMSE and UFOV were shown to be better determinants of on-road incidents in older drivers than VA and VF, however, as previously mentioned, there was a lack of variability in visual status within the cohort. Nevertheless, it is the recommendation from this investigation, that subject to appropriate sensitivity and specificity being demonstrated in the future using a cohort with wider variation in vision, functional performance and cognition, these tests of cognition and information processing should be added to the current protocol for the screening of older drivers which may be conducted at licensing centres across the nation.

The organisation of action in complex neurobiological systems

This chapter elucidates key ideas behind neurocomputational and ecological dynamics and perspectives of understanding the organisation of action in complex neurobiological systems. The need to study the close link between neurobiological systems and their environments (particularly their sensory and movement subsystems and the surrounding energy sources) is advocated. It is proposed how degeneracy in complex neurobiological systems provides the basis for functional variability in organisation of action. In such systems processes of cognition and action facilitate the specific interactions of each performer with particular task and environmental constraints.

Interpersonal coordination tendencies, decision-making and information governing dynamics in rugby union

In this chapter, ideas from ecological psychology and nonlinear dynamics are integrated to characterise decision-making as an emergent property of self-organisation processes in the interpersonal interactions that occur in sports teams. A conceptual model is proposed to capture constraints on dynamics of decisions and actions in dyadic systems, which has been empirically evaluated in simulations of interpersonal interactions in team sports. For this purpose, co-adaptive interpersonal dynamics in team sports such as rubgy union have been studied to reveal control parameter and collective variable relations in attacker-defender dyads. Although interpersonal dynamics of attackers and defenders in 1 vs 1 situations showed characteristics of chaotic attractors, the informational constraints of rugby union typically bounded dyadic systems into low dimensional attractors. Our work suggests that the dynamics of attacker-defender dyads can be characterised as an evolving sequence since players' positioning and movements are connected in diverse ways over time.

Information for regulating action in sport : metastability and emergence of tactical solutions under ecological constraints

The aims of this chapter are twofold. First, we show how experiments related to nonlinear dynamical systems theory can bring about insights on the interconnectedness of different information sources for action. These include the amount of information as emphasised in conventional models of cognition and action in sport and the nature of perceptual information typically emphasised in the ecological approach. The second aim was to show how, through examining the interconnectedness of these information sources, one can study the emergence of novel tactical solutions in sport; and design experiments where tactical/decisional creativity can be observed. Within this approach it is proposed that perceptual and affective information can be manipulated during practice so that the athlete's cognitive and action systems can be transposed to a meta-stable dynamical performance region where the creation of novel action information may reside.

Optimisation of performance in top level athletes : an action-based coping approach : a commentary

INTRODUCTION In their target article, Yuri Hanin and Muza Hanina outlined a novel multidisciplinary approach to performance optimisation for sport psychologists called the Identification-Control-Correction (ICC) programme. According to the authors, this empirically-verified, psycho-pedagogical strategy is designed to improve the quality of coaching and consistency of performance in highly skilled athletes and involves a number of steps including: (i) identifying and increasing self-awareness of ‘optimal’ and ‘non-optimal’ movement patterns for individual athletes; (ii) learning to deliberately control the process of task execution; and iii), correcting habitual and random errors and managing radical changes of movement patterns. Although no specific examples were provided, the ICC programme has apparently been successful in enhancing the performance of Olympic-level athletes. In this commentary, we address what we consider to be some important issues arising from the target article. We specifically focus attention on the contentious topic of optimization in neurobiological movement systems, the role of constraints in shaping emergent movement patterns and the functional role of movement variability in producing stable performance outcomes. In our view, the target article and, indeed, the proposed ICC programme, would benefit from a dynamical systems theoretical backdrop rather than the cognitive scientific approach that appears to be advocated. Although Hanin and Hanina made reference to, and attempted to integrate, constructs typically associated with dynamical systems theoretical accounts of motor control and learning (e.g., Bernstein’s problem, movement variability, etc.), these ideas required more detailed elaboration, which we provide in this commentary.

Youth, Sport and the Social Inclusion Agenda

The purpose of this paper is to assess aspects of the British Government's attempts to use sporting participation as a vehicle to re-integrate socially disadvantaged, excluded and 'at-risk' youth into mainstream society. A number of organisations, policy-makers, commentators, and practitioners with a stake in the 'sport and social inclusion agenda' were interviewed. General agreement was found on a number of points: that the field was overly crowded with policies, programmes and initiatives; that the field worked in a 'bottom-up' way, with the most significant factor determining success being effective local workers with good networks and cultural access; that the dichotomising rhetoric of inclusion/exclusion was counter-productive; that the notion of the 'at-risk youth' was problematic and unhelpful; and that they all now dealt with a marketplace, where 'clients' had to be enrolled in their own reformation. There was also disagreement on a number of points: that policy acts as a relatively accurate template for practice, as opposed to the argument that it was simply regarded as a cluster of suggestions for practice; that policy was exceptionally piecemeal in its formulation and application, as opposed to regarding policy as necessarily targeted and dispersed; and that the inclusion agenda was largely politically driven and transitory, as opposed to the optimistic view that it had become ingrained in local practice. Finally, the paper examines some issues that are the most likely points of contribution by researchers in the area: that more research needs to be done on the processes of identity formation associated with participation in sport; that more effective programme evaluation needs to be done for such forms of governmental intervention to work properly; and that the relationship between different kinds of physical activity and social and personal change needs to be more thoroughly theorised.