Using honeypots to analyse anomalous Internet activities

Monitoring Internet traffic is critical in order to acquire a good understanding of threats to computer and network security and in designing efficient computer security systems. Researchers and network administrators have applied several approaches to monitoring traffic for malicious content. These techniques include monitoring network components, aggregating IDS alerts, and monitoring unused IP address spaces. Another method for monitoring and analyzing malicious traffic, which has been widely tried and accepted, is the use of honeypots. Honeypots are very valuable security resources for gathering artefacts associated with a variety of Internet attack activities. As honeypots run no production services, any contact with them is considered potentially malicious or suspicious by definition. This unique characteristic of the honeypot reduces the amount of collected traffic and makes it a more valuable source of information than other existing techniques. Currently, there is insufficient research in the honeypot data analysis field. To date, most of the work on honeypots has been devoted to the design of new honeypots or optimizing the current ones. Approaches for analyzing data collected from honeypots, especially low-interaction honeypots, are presently immature, while analysis techniques are manual and focus mainly on identifying existing attacks. This research addresses the need for developing more advanced techniques for analyzing Internet traffic data collected from low-interaction honeypots. We believe that characterizing honeypot traffic will improve the security of networks and, if the honeypot data is handled in time, give early signs of new vulnerabilities or breakouts of new automated malicious codes, such as worms. The outcomes of this research include: • Identification of repeated use of attack tools and attack processes through grouping activities that exhibit similar packet inter-arrival time distributions using the cliquing algorithm; • Application of principal component analysis to detect the structure of attackers’ activities present in low-interaction honeypots and to visualize attackers’ behaviors; • Detection of new attacks in low-interaction honeypot traffic through the use of the principal component’s residual space and the square prediction error statistic; • Real-time detection of new attacks using recursive principal component analysis; • A proof of concept implementation for honeypot traffic analysis and real time monitoring.

The mobile Internet and small business : an exploratory study of needs, uses and adoption with full-adopters of technology

The technological environment in which contemporary small and medium-sized enterprises (SMEs) operate can only be described as dynamic. The exponential rate of technological change, characterised by perceived increases in the benefits associated with various technologies, shortening product life cycles and changing standards, provides for the SME a complex and challenging operational context. The primary aim of this research was to concentrate on those SMEs that had already adopted technology in order to identify their needs for the new mobile data technologies (MDT), the mobile Internet. The research design utilised a mixed approach whereby both qualitative and quantitative data was collected to address the question. Overall, the needs of these SMEs for MDT can be conceptualised into three areas where the technology will assist business practices; communication, eCommerce and security.

Business on-line? An empirical study of factors leading to the adoption of Internet technologies by Australian SMEs

E-commerce technologies such as a website, email and the use of web browsers enables access to large amounts of information, facilitates communication and provides niche companies with an effective mechanism for competing with larger organisations world-wide. However recent literature has shown Australian SMEs have been slow in the uptake of these technologies. The aim of this research was to determine which factors were important in impacting on small firms' decision making in respect of information technology and e-commerce adoption. Findings indicate that generally the more a firm was concerned about its competitive position such a firm was likely to develop a web site. Moreover the 'Industry and Skill Demands' dimension suggested that as the formal education of the owner/manager increased, coupled with the likelihood that the firm was in the transport and storage or communication services industries, and realising the cost of IT adoption was in effect an investment, then such a firm would be inclined to develop a web site.

Factors affecting entry-level Internet technology adoption by small business in Australia : evidence from three cases

The adoption of Internet technologies by the small business sector (SMEs)The adoption of Internet technologies by the small business sector is important to their on-going survival. Yet, given the opportunities and benefits that Internet technologies can provide it has been shown that Australian small businesses are relatively slow in adopting them. This paper develops a model from recent literature on the facilitators and inhibitors to the adoption of Internet technologies by small business. Cross-case analysis of findings from three case studies are presented. Findings indicate that perceived lack of business benefit, mistrust of the IT industry and lack of understanding of Internet technologies are major inhibitors to Internet adoption by small business.

Who needs it? An exploratory investigation into the reaction of small and medium enterprises to mobile data technologies

The technological environment in which contemporary small and medium-sized enterprises (SMEs) operate can only be described as dynamic. The seemingly exponential nature of technological change, characterised by perceived increases in the benefits associated with various technologies, shortening product life cycles and changing standards, provides for the small and medium-sized enterprise a complex and challenging operational context. The development of infrastructures capable of supporting the Wireless Application Protocol (WAP)and associated 'wireless' applications represents the latest generation of technological innovation with potential appeal to SMEs and end-users alike. The primary aim of this research was to understand the mobile data technology needs of SMEs in a regional setting. The research was especially concerned with perceived needs across three market segments; non-adopters of new technology, partial-adopters of new technology and full-adopters of new technology. Working with an industry partner, focus groups were conducted with each of these segments with the discussions focused on the use of the latest WP products and services. Some of the results are presented in this paper.

Framework for the long-term operation of a mobile robot via the Internet

This paper describes an autonomous docking system and web interface that allows long-term unaided use of a sophisticated robot by untrained web users. These systems have been applied to the biologically inspired RatSLAM system as a foundation for testing both its long-term stability and its practicality. While docking and web interface systems already exist, this system allows for a significantly larger margin of error in docking accuracy due to the mechanical design, thereby increasing robustness against navigational errors. Also a standard vision sensor is used for both long-range and short-range docking, compared to the many systems that require both omni-directional cameras and high resolution Laser range finders for navigation. The web interface has been designed to accommodate the significant delays experienced on the Internet, and to facilitate the non- Cartesian operation of the RatSLAM system.

Generation next : post-cinema Australian moviemaking, innovation and implications for cultural policy

The Australian screen industries are a leading domestic creative industry sector at a crossroad. New production, distribution and exhibition technologies are challenging traditional models of ‘filmmaking’. For the screen industries to remain competitive they must renovate business models for an emerging marketplace. This paper is a preliminary examination of three key aspects of next generation filmmaking: post-cinema approaches to screen production, emerging production and business models, and issues for policy.

Next Generation ‘Filmmaking’: New Markets, New Methods and New Business Models

Digital production and distribution technologies may create new opportunities for filmmaking in Australia. A culture of new approaches to filmmaking is emerging driven by ‘next generation filmmakers’ who are willing to consider new business models: from online web series to short films produced for mobile phones. At the same time cultural representation itself is transforming within an interactive, social media driven environment. Yet there is very little research into next generation filmmaking. The aim of this paper is to scope and discuss three key aspects of next generation filmmaking, namely: digital trends in film distribution and marketing; processes and strategies of ‘next generation’ filmmakers; and case studies of viable next generation business models and filmmaking practices. We conclude with a brief examination of the implications for media and cultural policy which suggests the future possibility of a rapprochement between creative industries discourse and cultural policy.

Anticipatory timing in algorithmic rhythm generation

Generative music algorithms frequently operate by making musical decisions in a sequence, with each step of the sequence incorporating the local musical context in the decision process. The context is generally a short window of past musical actions. What is not generally included in the context is future actions. For real-time systems this is because the future is unknown. Offline systems also frequently utilise causal algorithms either for reasons of efficiency [1] or to simulate perceptual constraints [2]. However, even real-time agents can incorporate knowledge of their own future actions by utilising some form of planning. We argue that for rhythmic generation the incorporation of a limited form of planning - anticipatory timing - offers a worthwhile trade-off between musical salience and efficiency. We give an example of a real-time generative agent - the Jambot - that utilises anticipatory timing for rhythmic generation. We describe its operation, and compare its output with and without anticipatory timing.

Transition pedagogy : a third generation approach to FYE : a case study of policy and practice for the higher education sector

Current research and practice related to the first year experience (FYE) of commencing higher education students are still mainly piecemeal rather than institution-wide with institutions struggling to achieve cross-institutional integration, coordination and coherence of FYE policy and practice. Drawing on a decade of FYE-related research including an ALTC Senior Fellowship and evidence at a large Australian metropolitan university, this paper explores how one institution has addressed that issue by tracing the evolution and maturation of strategies that ultimately conceptualize FYE as “everybody's business.” It is argued that, when first generation co-curricular and second generation curricular approaches are integrated and implemented through an intentionally designed curriculum by seamless partnerships of academic and professional staff in a whole-of-institution transformation, we have a third generation approach labelled here as transition pedagogy. It is suggested that transition pedagogy provides the optimal vehicle for dealing with the increasingly diverse commencing student cohorts by facilitating a sense of engagement, support and belonging. What is presented here is an example of transition pedagogy in action.

Monitoring and analysis of internet traffic targeting unused address spaces

Today’s evolving networks are experiencing a large number of different attacks ranging from system break-ins, infection from automatic attack tools such as worms, viruses, trojan horses and denial of service (DoS). One important aspect of such attacks is that they are often indiscriminate and target Internet addresses without regard to whether they are bona fide allocated or not. Due to the absence of any advertised host services the traffic observed on unused IP addresses is by definition unsolicited and likely to be either opportunistic or malicious. The analysis of large repositories of such traffic can be used to extract useful information about both ongoing and new attack patterns and unearth unusual attack behaviors. However, such an analysis is difficult due to the size and nature of the collected traffic on unused address spaces. In this dissertation, we present a network traffic analysis technique which uses traffic collected from unused address spaces and relies on the statistical properties of the collected traffic, in order to accurately and quickly detect new and ongoing network anomalies. Detection of network anomalies is based on the concept that an anomalous activity usually transforms the network parameters in such a way that their statistical properties no longer remain constant, resulting in abrupt changes. In this dissertation, we use sequential analysis techniques to identify changes in the behavior of network traffic targeting unused address spaces to unveil both ongoing and new attack patterns. Specifically, we have developed a dynamic sliding window based non-parametric cumulative sum change detection techniques for identification of changes in network traffic. Furthermore we have introduced dynamic thresholds to detect changes in network traffic behavior and also detect when a particular change has ended. Experimental results are presented that demonstrate the operational effectiveness and efficiency of the proposed approach, using both synthetically generated datasets and real network traces collected from a dedicated block of unused IP addresses.

Testing of a distributed generation system with a virtual grid

The paper proposes a solution for testing of a physical distributed generation system (DGs) along with a computer simulated network. The computer simulated network is referred as the virtual grid in this paper. Integration of DG with the virtual grid provides broad area of testing of power supplying capability and dynamic performance of a DG. It is shown that a DG can supply a part of load power while keeping Point of Common Coupling (PCC) voltage magnitude constant. To represent the actual load, a universal load along with power regenerative capability is designed with the help of voltage source converter (VSC) that mimics the load characteristic. The overall performance of the proposed scheme is verified using computer simulation studies.

The question concerning (internet) time

Spatial representations, metaphors and imaginaries (cyberspace, web pages) have been the mainstay of internet research for a long time. Instead of repeating these themes, this paper seeks to answer the question of how we might understand the concept of time in relation to internet research. After a brief excursus on the general history of the concept, this paper proposes three different approaches to the conceptualisation of internet time. The common thread underlying all the approaches is the notion of time as an assemblage of elements such as technical artefacts, social relations and metaphors. By drawing out time in this way, the paper addresses the challenge of thinking of internet time as coexistence, a clash of fluxes, metaphors, lived experiences and assemblages. In other words, this paper proposes a way to articulate internet time as a multiplicity.

Internet-Based Interventions for Psychological Problems

Presentation about internet based interventions for depression, substance and alcohol abuse.