Protocol engineering for protection against denial-of-service attacks

Denial-of-service attacks (DoS) and distributed denial-of-service attacks (DDoS) attempt to temporarily disrupt users or computer resources to cause service un- availability to legitimate users in the internetworking system. The most common type of DoS attack occurs when adversaries °ood a large amount of bogus data to interfere or disrupt the service on the server. The attack can be either a single-source attack, which originates at only one host, or a multi-source attack, in which multiple hosts coordinate to °ood a large number of packets to the server. Cryptographic mechanisms in authentication schemes are an example ap- proach to help the server to validate malicious tra±c. Since authentication in key establishment protocols requires the veri¯er to spend some resources before successfully detecting the bogus messages, adversaries might be able to exploit this °aw to mount an attack to overwhelm the server resources. The attacker is able to perform this kind of attack because many key establishment protocols incorporate strong authentication at the beginning phase before they can iden- tify the attacks. This is an example of DoS threats in most key establishment protocols because they have been implemented to support con¯dentiality and data integrity, but do not carefully consider other security objectives, such as availability. The main objective of this research is to design denial-of-service resistant mechanisms in key establishment protocols. In particular, we focus on the design of cryptographic protocols related to key establishment protocols that implement client puzzles to protect the server against resource exhaustion attacks. Another objective is to extend formal analysis techniques to include DoS- resistance. Basically, the formal analysis approach is used not only to analyse and verify the security of a cryptographic scheme carefully but also to help in the design stage of new protocols with a high level of security guarantee. In this research, we focus on an analysis technique of Meadows' cost-based framework, and we implement DoS-resistant model using Coloured Petri Nets. Meadows' cost-based framework is directly proposed to assess denial-of-service vulnerabil- ities in the cryptographic protocols using mathematical proof, while Coloured Petri Nets is used to model and verify the communication protocols using inter- active simulations. In addition, Coloured Petri Nets are able to help the protocol designer to clarify and reduce some inconsistency of the protocol speci¯cation. Therefore, the second objective of this research is to explore vulnerabilities in existing DoS-resistant protocols, as well as extend a formal analysis approach to our new framework for improving DoS-resistance and evaluating the performance of the new proposed mechanism. In summary, the speci¯c outcomes of this research include following results; 1. A taxonomy of denial-of-service resistant strategies and techniques used in key establishment protocols; 2. A critical analysis of existing DoS-resistant key exchange and key estab- lishment protocols; 3. An implementation of Meadows's cost-based framework using Coloured Petri Nets for modelling and evaluating DoS-resistant protocols; and 4. A development of new e±cient and practical DoS-resistant mechanisms to improve the resistance to denial-of-service attacks in key establishment protocols.

Research Monograph : Sustainable Australia : Containing travel in master planned estates

Low density suburban development and excessive use of automobiles are associated with serious urban and environmental problems. These problems include traffic congestion, longer commuting times, high automobile dependency, air and water pollution, and increased depletion of natural resources. Master planned development suggests itself as a possible palliative for the ills of low density and high travel. The following study examines the patterns and dynamics of movement in a selection of master planned estates in Australia. The study develops new approaches for assessing the containment of travel within planned development. Its key aim is to clarify and map the relationships between trip generation and urban form and structure. The initial conceptual framework of the report is developed in a review of literature related to urban form and travel behaviour. These concepts are tested empirically in a pilot study of suburban travel activity in master planned estates. A geographical information systems (GIS) methodology is used to determine regional journey-to-work patterns and travel containment rates. Factors that influence self-containment patterns are estimated with a regression model. The key research findings of the pilot study are: - There is a strong relation between urban structural form and patterns of trip generation; - The travel self-containment of Australian master planned estates is lower than the scholarly literature implies would occur if appropriate planning principles to achieve sustainable urban travel were followed; - Proximity to the central business district, income level and education status are positively correlated with travel containment; - Master planned estates depend more on local and regional centres for employment than on the central business district; - The service sector is the major employer in and around master planned estates. It tends to provide part-time and casual employment rather than full-time employment; - Travel self-containment is negative correlated with car dependency. Master planned estates with less car dependent residents, and with good access to public transport, appear to be more self-contained and, consequently, more sustainable than the norm. This research is a useful preliminary examination of travel self-containment in Australian master planned estates. It by no means exhausts the subject. In future research we hope to further assess sustainable travel patterns with more detailed spatial analysis.

Effective web service discovery using a combination of a semantic model and a data mining technique

With the advent of Service Oriented Architecture, Web Services have gained tremendous popularity. Due to the availability of a large number of Web services, finding an appropriate Web service according to the requirement of the user is a challenge. This warrants the need to establish an effective and reliable process of Web service discovery. A considerable body of research has emerged to develop methods to improve the accuracy of Web service discovery to match the best service. The process of Web service discovery results in suggesting many individual services that partially fulfil the user’s interest. By considering the semantic relationships of words used in describing the services as well as the use of input and output parameters can lead to accurate Web service discovery. Appropriate linking of individual matched services should fully satisfy the requirements which the user is looking for. This research proposes to integrate a semantic model and a data mining technique to enhance the accuracy of Web service discovery. A novel three-phase Web service discovery methodology has been proposed. The first phase performs match-making to find semantically similar Web services for a user query. In order to perform semantic analysis on the content present in the Web service description language document, the support-based latent semantic kernel is constructed using an innovative concept of binning and merging on the large quantity of text documents covering diverse areas of domain of knowledge. The use of a generic latent semantic kernel constructed with a large number of terms helps to find the hidden meaning of the query terms which otherwise could not be found. Sometimes a single Web service is unable to fully satisfy the requirement of the user. In such cases, a composition of multiple inter-related Web services is presented to the user. The task of checking the possibility of linking multiple Web services is done in the second phase. Once the feasibility of linking Web services is checked, the objective is to provide the user with the best composition of Web services. In the link analysis phase, the Web services are modelled as nodes of a graph and an allpair shortest-path algorithm is applied to find the optimum path at the minimum cost for traversal. The third phase which is the system integration, integrates the results from the preceding two phases by using an original fusion algorithm in the fusion engine. Finally, the recommendation engine which is an integral part of the system integration phase makes the final recommendations including individual and composite Web services to the user. In order to evaluate the performance of the proposed method, extensive experimentation has been performed. Results of the proposed support-based semantic kernel method of Web service discovery are compared with the results of the standard keyword-based information-retrieval method and a clustering-based machine-learning method of Web service discovery. The proposed method outperforms both information-retrieval and machine-learning based methods. Experimental results and statistical analysis also show that the best Web services compositions are obtained by considering 10 to 15 Web services that are found in phase-I for linking. Empirical results also ascertain that the fusion engine boosts the accuracy of Web service discovery by combining the inputs from both the semantic analysis (phase-I) and the link analysis (phase-II) in a systematic fashion. Overall, the accuracy of Web service discovery with the proposed method shows a significant improvement over traditional discovery methods.

Being ethical : how process drama assists pre-service drama teachers to reflect on professional ethics

This research thesis focuses on the experiences of pre-service drama teachers and considers how process drama may assist them to reflect on key aspects of professional ethics such as mandatory codes or standards, principled moral reasoning, moral character, moral agency, and moral literacy. Research from higher education provides evidence that current pedagogical approaches used to prepare pre –professionals for practice in medicine, engineering, accountancy, business, psychology, counselling, nursing and education, rarely address the more holistic or affective dimensions of professional ethics such as moral character. Process drama, a form of educational drama, is a complex improvisational group experience that invites participants to create and assume roles, and select and manage symbols in order to create a fictional world exploring human experience. Many practitioners claim that process drama offers an aesthetic space to develop a deeper understanding of self and situations, expanding the participant’s consciousness and ways of knowing. However, little research has been conducted into the potential efficacy of process drama in professional ethics education for pre-professionals. This study utilizes practitioner research and case study to explore how process drama may contribute to the development of professional ethics education and pedagogy.

Rural and remote road safety study : final report

• Introduction: Concern and action for rural road safety is relatively new in Australia in comparison to the field of traffic safety as a whole. In 2003, a program of research was begun by the Centre for Accident Research and Road Safety - Queensland (CARRS-Q) and the Rural Health Research Unit (RHRU) at James Cook University to investigate factors contributing to serious rural road crashes in the North Queensland region. This project was funded by the Premier’s Department, Main Roads Department, Queensland Transport, QFleet, Queensland Rail, Queensland Ambulance Service, Department of Natural Resources and Queensland Police Service. Additional funding was provided by NRMA Insurance for a PhD scholarship. In-kind support was provided through the four hospitals used for data collection, namely Cairns Base Hospital, The Townsville Hospital, Mount Isa Hospital and Atherton Hospital.----- The primary aim of the project was to: Identify human factors related to the occurrence of serious traffic incidents in rural and remote areas of Australia, and to the trauma suffered by persons as a result of these incidents, using a sample drawn from a rural and remote area in North Queensland.----- The data and analyses presented in this report are the core findings from two broad studies: a general examination of fatalities and casualties from rural and remote crashes for the period 1 March 2004 until 30 June 2007, and a further linked case-comparison study of hospitalised patients compared with a sample of non-crash-involved drivers.----- • Method: The study was undertaken in rural North Queensland, as defined by the Australian Bureau of Statistics (ABS) statistical divisions of North Queensland, Far North Queensland and North-West Queensland. Urban areas surrounding Townsville, Thuringowa and Cairns were not included. The study methodology was centred on serious crashes, as defined by a resulting hospitalisation for 24 hours or more and/or a fatality. Crashes meeting this criteria within the North Queensland region between 1 March 2004 and 30 June 2007 were identified through hospital records and interviewed where possible. Additional data was sourced from coroner’s reports, the Queensland Transport road crash database, the Queensland Ambulance Service and the study hospitals in the region.----- This report is divided into chapters corresponding to analyses conducted on the collected crash and casualty data.----- Chapter 3 presents an overview of all crashes and casualties identified during the study period. Details are presented in regard to the demographics and road user types of casualties; the locations, times, types, and circumstances of crashes; along with the contributing circumstances of crashes.----- Chapter 4 presents the results of summary statistics for all casualties for which an interview was able to be conducted. Statistics are presented separately for drivers and riders, passengers, pedestrians and cyclists. Details are also presented separately for drivers and riders crashing in off-road and on-road settings. Results from questionnaire data are presented in relation to demographics; the experience of the crash in narrative form; vehicle characteristics and maintenance; trip characteristics (e.g. purpose and length of journey; periods of fatigue and monotony; distractions from driving task); driving history; alcohol and drug use; medical history; driving attitudes, intentions and behaviour; attitudes to enforcement; and experience of road safety advertising.----- Chapter 5 compares the above-listed questionnaire results between on-road crash-involved casualties and interviews conducted in the region with non-crash-involved persons. Direct comparisons as well as age and sex adjusted comparisons are presented.----- Chapter 6 presents information on those casualties who were admitted to one of the study hospitals during the study period. Brief information is given regarding the demographic characteristics of these casualties. Emergency services’ data is used to highlight the characteristics of patient retrieval and transport to and between hospitals. The major injuries resulting from the crashes are presented for each region of the body and analysed by vehicle type, occupant type, seatbelt status, helmet status, alcohol involvement and nature of crash. Estimates are provided of the costs associated with in-hospital treatment and retrieval.----- Chapter 7 describes the characteristics of the fatal casualties and the nature and circumstances of the crashes. Demographics, road user types, licence status, crash type and contributing factors for crashes are presented. Coronial data is provided in regard to contributing circumstances (including alcohol, drugs and medical conditions), cause of death, resulting injuries, and restraint and helmet use.----- Chapter 8 presents the results of a comparison between casualties’ crash descriptions and police-attributed crash circumstances. The relative frequency of contributing circumstances are compared both broadly within the categories of behavioural, environmental, vehicle related, medical and other groupings and specifically for circumstances within these groups.----- Chapter 9 reports on the associated research projects which have been undertaken on specific topics related to rural road safety.----- Finally, Chapter 10 reports on the conclusions and recommendations made from the program of research.---- • Major Recommendations : From the findings of these analyses, a number of major recommendations were made: + Male drivers and riders - Male drivers and riders should continue to be the focus of interventions, given their very high representation among rural and remote road crash fatalities and serious injuries.----- - The group of males aged between 30 and 50 years comprised the largest number of casualties and must also be targeted for change if there is to be a meaningful improvement in rural and remote road safety.----- + Motorcyclists - Single vehicle motorcycle crashes constitute over 80% of serious, on-road rural motorcycle crashes and need particular attention in development of policy and infrastructure.----- - The motorcycle safety consultation process currently being undertaken by Queensland Transport (via the "Motorbike Safety in Queensland - Consultation Paper") is strongly endorsed. As part of this process, particular attention needs to be given to initiatives designed to reduce rural and single vehicle motorcycle crashes.----- - The safety of off-road riders is a serious problem that falls outside the direct responsibility of either Transport or Health departments. Responsibility for this issue needs to be attributed to develop appropriate policy, regulations and countermeasures.----- + Road safety for Indigenous people - Continued resourcing and expansion of The Queensland Aboriginal Peoples and Torres Strait Islander Peoples Driver Licensing Program to meet the needs of remote and Indigenous communities with significantly lower licence ownership levels.----- - Increased attention needs to focus on the contribution of geographic disadvantage (remoteness) factors to remote and Indigenous road trauma.----- + Road environment - Speed is the ‘final common pathway’ in determining the severity of rural and remote crashes and rural speed limits should be reduced to 90km/hr for sealed off-highway roads and 80km/hr for all unsealed roads as recommended in the Austroads review and in line with the current Tasmanian government trial.----- - The Department of Main Roads should monitor rural crash clusters and where appropriate work with local authorities to conduct relevant audits and take mitigating action. - The international experts at the workshop reviewed the data and identified the need to focus particular attention on road design management for dangerous curves. They also indicated the need to maximise the use of audio-tactile linemarking (audible lines) and rumble strips to alert drivers to dangerous conditions and behaviours.----- + Trauma costs - In accordance with Queensland Health priorities, recognition should be given to the substantial financial costs associated with acute management of trauma resulting from serious rural and remote crashes.----- - Efforts should be made to develop a comprehensive, regionally specific costing formula for road trauma that incorporates the pre-hospital, hospital and post-hospital phases of care. This would inform health resource allocation and facilitate the evaluation of interventions.----- - The commitment of funds to the development of preventive strategies to reduce rural and remote crashes should take into account the potential cost savings associated with trauma.----- - A dedicated study of the rehabilitation needs and associated personal and healthcare costs arising from rural and remote road crashes should be undertaken.----- + Emergency services - While the study has demonstrated considerable efficiency in the response and retrieval systems of rural and remote North Queensland, relevant Intelligent Transport Systems technologies (such as vehicle alarm systems) to improve crash notification should be both developed and evaluated.----- + Enforcement - Alcohol and speed enforcement programs should target the period between 2 and 6pm because of the high numbers of crashes in the afternoon period throughout the rural region.----- + Drink driving - Courtesy buses should be advocated and schemes such as the Skipper project promoted as local drink driving countermeasures in line with the very high levels of community support for these measures identified in the hospital study.------ - Programs should be developed to target the high levels of alcohol consumption identified in rural and remote areas and related involvement in crashes.----- - Referrals to drink driving rehabilitation programs should be mandated for recidivist offenders.----- + Data requirements - Rural and remote road crashes should receive the same quality of attention as urban crashes. As such, it is strongly recommended that increased resources be committed to enable dedicated Forensic Crash Units to investigate rural and remote fatal and serious injury crashes.----- - Transport department records of rural and remote crashes should record the crash location using the national ARIA area classifications used by health departments as a means to better identifying rural crashes.----- - Rural and remote crashes tend to be unnoticed except in relatively infrequent rural reviews. They should receive the same level of attention and this could be achieved if fatalities and fatal crashes were coded by the ARIA classification system and included in regular crash reporting.----- - Health, Transport and Police agencies should collect a common, minimal set of data relating to road crashes and injuries, including presentations to small rural and remote health facilities.----- + Media and community education programmes - Interventions seeking to highlight the human contribution to crashes should be prioritised. Driver distraction, alcohol and inappropriate speed for the road conditions are key examples of such behaviours.----- - Promotion of basic safety behaviours such as the use of seatbelts and helmets should be given a renewed focus.----- - Knowledge, attitude and behavioural factors that have been identified for the hospital Brief Intervention Trial should be considered in developing safety campaigns for rural and remote people. For example challenging the myth of the dangerous ‘other’ or ‘non-local’ driver.----- - Special educational initiatives on the issues involved in rural and remote driving should be undertaken. For example the material used by Main Roads, the Australian Defence Force and local initiatives.

Business Service Management

Business Service Management describes the emerging discipline dedicated to the IT-enabled management of services as corporate assets. Business Service Management deals with the service orientation of the organisation and the provisioning and use of business services. The term business service describes an autonomous transformational capability that is offered to and consumed by external or internal customers for their benefit. The prefix ‘business’ stresses that such a service has a market value, requires the ability to be managed internally as a corporate asset and that its implementation is technology-agnostic. While business services (or so called capabilities) have attracted the attention of many vendors and organisations, a lack of understanding of the activities required for the successful management of such business services remains a critical issue. In order to fill this gap, a framework consisting of Service Lifecycle Management, Service Value Management, Service Relationship Management and Service Enablement is proposed. This Framework has the potential to provide organisations with the much needed guidance in their attempts to convert current IT-driven service initiatives into successful service-centric business models.

Multi-victim sexual assault : a case study in rural Australia

Objective: There is a paucity of information regarding cases of multi-victim sexual assault of children. The reported incidence suggests that these cases are rare. The aim of this paper is to provide practitioners with information about effective intervention strategies arising out of the direct experience of managing a case of multi-victim sexual assault in an Australian rural community. --------- Method: A descriptive, case-report methodology summarizing the investigation and intervention in a case of multi-victim sexual assault is reported. A community based intervention arising out of the disclosures of 21 male children is described. The intervention occurred at an individual, group, and community level using a coordinated multi-disciplinary team and natural helping networks. ---------- Results: The coordination of police and welfare services increased the communication flow to victims, their families, and the community. The case also demonstrated the utility in regularly briefing political and bureaucratic authorities as well as local officials about emergent issues. Coordinating political and bureaucratic responses was essential in obtaining ongoing support and sufficient researching to enable the effective delivery of services. ---------- Conclusions: Interventions were focused at an individual, group, and community level using a coordinated multi-disciplinary team and natural helping networks. This provided a choice of services which were sensitive to the case setting. Recommendations are offered for practitioners who are confronted with similar events. While this paper describes an approach for intervening in a case of multi-victim sexual assault, further empirical research is needed to enable service deliverers to efficaciously target interventions which offer choice to victims and their families.

Geek goddesses go to school : A study of female pre-service teachers in information technology courses

Various reasons have been proffered for female under-representation in tertiary information technology (IT) courses and the IT industry with most relating to cultural moirés. The 2006 Geek Goddess calendar was designed to alter IT’s “geeky image” and the term is used here to represent young women enrolled in pre-service IT teaching courses. Their special mix of IT and teaching draws on conflicting stereotypes and represents a micro-climate which is typically lost in studies of IT occupations because of the aggregation of all IT roles. This paper will report on a small-scale investigation of female students (N=25) at a university in Queensland (Australia) studying to become teachers of secondary IT subjects. They are entering the IT industry, gendered as a “male” occupation, through the safe space of teaching a discipline allied to feminine qualities of nurturing. They are “geek goddesses” who – perhaps to balance the masculine and feminine of these occupations - have decided to go to school rather than into corporations or government.

Service analysis : A critical assessment of the state of the art

The service-orientation paradigm has not only become prevalent in the software systems domain in recent years, but is also increasingly applied on the business level to restructure organisational capabilities. In this paper, we present the results of an extensive literature review of 30 approaches related to service identification and analysis for both domains. Based on the consolidation of a superset of comparison criteria for service-oriented methodologies found in related literature, we compare and evaluate the different characteristics of service engineering methods with a focus on service analysis. Although a close business and IT alignment is regarded as one of the core beneficial promises of service-orientation, our analysis suggests that there is a lack of unified, comprehensive methodology for service identification and analysis integrating and addressing both domains. Thus, we discuss how our results can inform directions for future research in this area.

Business and software service lifecycle management

Although the service-oriented paradigm has been well established in the technical domain for quite some time now, service governance is still considered a research gap. To ensure adequate governance, there is a necessity to manage services as first-class assets throughout the lifecycle. Now that the concept of ser-vice-orientation is also increasingly applied on the business level to structure an organisation’s capabili-ties, the problem has become an even bigger chal-lenge. This paper presents a generic business and software service lifecycle and aligns it with the com-mon management layers in organisations. Using ser-vice analysis as an example, it moreover illustrates how activities in the service lifecycle may vary on lower levels of granularity depending on the focus on business or software services.

Forensic challenges in service oriented architectures

Digital forensics relates to the investigation of a crime or other suspect behaviour using digital evidence. Previous work has dealt with the forensic reconstruction of computer-based activity on single hosts, but with the additional complexity involved with a distributed environment, a Web services-centric approach is required. A framework for this type of forensic examination needs to allow for the reconstruction of transactions spanning multiple hosts, platforms and applications. A tool implementing such an approach could be used by an investigator to identify scenarios of Web services being misused, exploited, or otherwise compromised. This information could be used to redesign Web services in order to mitigate identified risks. This paper explores the requirements of a framework for performing effective forensic examinations in a Web services environment. This framework will be necessary in order to develop forensic tools and techniques for use in service oriented architectures.

The role of natural ventilation in building sustainable subdivisions in south east Queensland

The objective of the consultative phase is to examine the role that natural ventilation has and can play in the subdivision planning process in SEQ. The Centre for Subtropical Design at QUT coordinated the consultative phase and has conducted a workshop, and interviews, with stakeholders including developers, land development consultants, land surveyors, urban designers and regulators, to identify current understanding of the impact of urban subdivision on natural ventilation, and the role of natural ventilation in achieving energy efficiency for dwellings. This report details the findings.

Learning, language and leadership : conduits to dynamic public service networks

Networks are having a profound impact on the way society is organised at the local, national and international level. Networks are not ‘business as usual’. The defining feature of networks and a key indicator for their success is the strength and quality of the interactions between members. This relational power of networks provides the mechanism to bring together previously dispersed and even competitive entities into a collective venture. Such an operating context demands the ability to work in a more horizontal, relational manner. In addition a social infrastructure must be formed that will support and encourage efforts to become more collaborative. This paper seeks to understand how network members come to know about working in networks, how they work on their relationships and create new meanings about the nature of their linked work. In doing so, it proposes that learning, language and leadership, herein defined as the ‘3Ls’ represent critical mediating aspects for networks.

Traps for the unwary : reform stories of private sector managers entering public service

The purpose of this research is to capture and interpret the stories of “outsider” managers who make the transition to the public sector. These experiences are considered in the context of efforts to shift public management culture in a direction consistent with meeting contemporary demands placed on public sector organisations. It is often noted that an important strategy for changing culture is the infusion of outsiders. Outsiders are thought to bring new perspectives that, through a dialectical process (Van de Ven 1995), create the potential for change. While there have been cross-sector comparisons (Broussine 1990; Silfvast 1994; Redman 1997), little attention has been given to the experience of those who make the transition in the context of efforts to reform public sector management culture. Not only is the infusion of private sector managers into the public sector a potential culture change strategy, it is also a personal experience for those who make the transition. Boundary crossing is typically an anxiety provoking experience (Van Maanen & Schein 1979) and the quality of this experience influences decisions to commit, engage, disengage or exit. The quality of the experience is likely to be affected by how the public organisation responds to people making this transition, that is, their investment in people processing (Saks 2007). The cost of recruitment and selection processes at middle and senior management levels warrants a greater research focus on this transition. In this paper we argue that the experiences of those who make the transition from private to public sectors has much to tell us about the traps that transition managers experience in making this change, the implications for injecting outsider managers as a strategy for achieving public management culture change, and how reform-oriented public organisations can manage the transitions of outsider managers into the public sector in order that best value might be achieved for both the individual and organisational change goals.