Detecting and characterising malicious executable payloads

Buffer overflow vulnerabilities continue to prevail and the sophistication of attacks targeting these vulnerabilities is continuously increasing. As a successful attack of this type has the potential to completely compromise the integrity of the targeted host, early detection is vital. This thesis examines generic approaches for detecting executable payload attacks, without prior knowledge of the implementation of the attack, in such a way that new and previously unseen attacks are detectable. Executable payloads are analysed in detail for attacks targeting the Linux and Windows operating systems executing on an Intel IA-32 architecture. The execution flow of attack payloads are analysed and a generic model of execution is examined. A novel classification scheme for executable attack payloads is presented which allows for characterisation of executable payloads and facilitates vulnerability and threat assessments, and intrusion detection capability assessments for intrusion detection systems. An intrusion detection capability assessment may be utilised to determine whether or not a deployed system is able to detect a specific attack and to identify requirements for intrusion detection functionality for the development of new detection methods. Two novel detection methods are presented capable of detecting new and previously unseen executable attack payloads. The detection methods are capable of identifying and enumerating the executable payload’s interactions with the operating system on the targeted host at the time of compromise. The detection methods are further validated using real world data including executable payload attacks.

Can book-to-market and size be risk factors that predict economic growth in Asia's emerging economies?

We investigate whether the two 2 zero cost portfolios, SMB and HML, have the ability to predict economic growth for markets investigated in this paper. Our findings show that there are only a limited number of cases when the coefficients are positive and significance is achieved in an even more limited number of cases. Our results are in stark contrast to Liew and Vassalou (2000) who find coefficients to be generally positive and of a similar magnitude. We go a step further and also employ the methodology of Lakonishok, Shleifer and Vishny (1994) and once again fail to support the risk-based hypothesis of Liew and Vassalou (2000). In sum, we argue that search for a robust economic explanation for firm size and book-to-market equity effects needs sustained effort as these two zero cost portfolios do not represent economically relevant risk.

Exposure to particle number, surface area and PM concentrations in pizzerias

The aim of this work was to quantify exposure to particles emitted by wood-fired ovens in pizzerias. Overall, 15 microenvironments were chosen and analyzed in a 14-month experimental campaign. Particle number concentration and distribution were measured simultaneously using a Condensation Particle Counter (CPC), a Scanning Mobility Particle Sizer (SMPS), an Aerodynamic Particle Sizer (APS). The surface area and mass distributions and concentrations, as well as the estimation of lung deposition surface area and PM1 were evaluated using the SMPS-APS system with dosimetric models, by taking into account the presence of aggregates on the basis of the Idealized Aggregate (IA) theory. The fraction of inhaled particles deposited in the respiratory system and different fractions of particulate matter were also measured by means of a Nanoparticle Surface Area Monitor (NSAM) and a photometer (DustTrak DRX), respectively. In this way, supplementary data were obtained during the monitoring of trends inside the pizzerias. We found that surface area and PM1 particle concentrations in pizzerias can be very high, especially when compared to other critical microenvironments, such as the transport hubs. During pizza cooking under normal ventilation conditions, concentrations were found up to 74, 70 and 23 times higher than background levels for number, surface area and PM1, respectively. A key parameter is the oven shape factor, defined as the ratio between the size of the face opening in respect

Multi-version documents : A digitisation solution for textual cultural artefacts

Textual cultural heritage artefacts present two serious problems for the encoder: how to record different or revised versions of the same work, and how to encode conflicting perspectives of the text using markup. Both are forms of textual variation, and can be accurately recorded using a multi-version document, based on a minimally redundant directed graph that cleanly separates variation from content.

Individual agency as explanation of alliance development and change : a case study

Alliances, with other inter-organisational forms, have become a strategy of choice and necessity for both the private and public sectors. From initial formation, alliances develop and change in different ways, with research suggesting that many alliances will be terminated without their potential value being realised. Alliance process theorists address this phenomenon, seeking explanations as to why alliances unfold the way they do. However, these explanations have generally focussed on economic and structural determinants: empirically, little is known about how and why the agency of alliance actors shapes the alliance path. Theorists have suggested that current alliance process theory has provided valuable, but partial accounts of alliance development, which could be usefully extended by considering social and individual factors. The purpose of this research therefore was to extend alliance process theory by exploring individual agency as an explanation of alliance events and in doing so, reveal the potential of a multi-frame approach for understanding alliance process. Through an historical study of a single, rich case of alliance process, this thesis provided three explanations for the sequence of alliance events, each informed by a different theoretical perspective. The explanatory contribution of the Individual Agency (IA) perspective was distilled through juxtaposition with the perspectives of Environmental Determinism (ED) and Indeterminacy/Chance (I/C). The research produced a number of findings. First, it provided empirical support for the tentative proposition that the choices and practices of alliance actors are partially explanatory of alliance change and that these practices are particular to the alliance context. Secondly, the study found that examining the case through three theoretical frames provided a more complete explanation. Two propositions were put forward as to how individual agency can be theorised within this three-perspective framework. Finally, the case explained which alliance actors were required to shape alliance decision making in this case and why.

External auditors' reliance on internal auditing : further evidence.

Purpose – The purpose of this paper is to explore whether internal audit’s reporting relationship with the audit committee and the client’s business risk environment impact external auditors’ reliance on the work of internal audit. Design/methodology/approach – An experiment is conducted using a 2 £ 2 between-subjects design where we manipulate the above two factors at strong and weak levels. Participants are 66 audit partners, managers and seniors, all experienced with clients having internal audit functions. Findings – The results indicate that both factors affect external auditors’ reliance on work already undertaken by internal audit and their use of internal auditors (IA) as assistants. The results also indicate that external auditors are more likely to use internal audit for control evaluation tasks than for substantive tests of balances. The study does not find any significant interaction effects between the two factors. Originality/value – No prior studies have examined the influence of reporting relationship and client business risk on external auditors’ reliance decisions in the current governance environment. Further, the paper examines the impact of these factors on reliance on work already undertaken by internal audit and on using IA as assistants, with respect to both control evaluation work and substantive testing of balances.

A capability framework visualisation for multiple heterogeneous UAVs : from a mission commander's perspective

There is an increased interested in Uninhabited Aerial Vehicle (UAV) operations and research into advanced methods for commanding and controlling multiple heterogeneous UAVs. Research into areas of supervisory control has rapidly increased. Past research has investigated various approaches of autonomous control and operator limitation to improve mission commanders' Situation Awareness (SA) and cognitive workload. The aim of this paper is to address this challenge through a visualisation framework of UAV information constructed from Information Abstraction (IA). This paper presents the concept and process of IA, and the visualisation framework (constructed using IA), the concept associated with the Level Of Detail (LOD) indexing method, the visualisation of an example of the framework. Experiments will test the hypothesis that, the operator will be able to achieve increased SA and reduced cognitive load with the proposed framework.

Legal issues related to Accountable-eHealth systems in Australia

Information privacy requirements of patients and information requirements of healthcare providers (HCP) are competing concerns. Reaching a balance between these requirements have proven difficult but is crucial for the success of eHealth systems. The traditional approaches to information management have been preventive measures which either allow or deny access to information. We believe that this approach is inappropriate for a domain such as healthcare. We contend that introducing information accountability (IA) to eHealth systems can reach the aforementioned balance without the need for rigid information control. IA is a fairly new concept to computer science, hence; there are no unambiguously accepted principles as yet. But the concept delivers promising advantages to information management in a robust manner. Accountable-eHealth (AeH) systems are eHealth systems which use IA principles as the measure for privacy and information management. AeH systems face three main impediments; technological, social and ethical and legal. In this paper, we present the AeH model and focus on the legal aspects of AeH systems in Australia. We investigate current legislation available in Australia regarding health information management and identify future legal requirements if AeH systems are to be implemented in Australia.

Intra-amniotic ureaplasma infection : adverse outcomes vary depending on gestation

Background: Ureaplasmas are the most prevalent bacteria isolated from preterm deliveries and the prognosis for neonates varies depending on the gestation at delivery. Ureaplasmas vary their surface-exposed antigen (MBA, a virulence mechanism) during chronic intra-amniotic infections, but it is not known when changes first occur during gestation. Method: U. parvum serovar 3 (2x10e7CFU) was injected intra-amniotically (IA) into six experimental cohorts of pregnant ewes (of n=7), 3 days (d) or 7d before delivery at either: 100d, 124d or 140d gestation (term=145d). Control ewes received IA 10B broth. Fetuses were delivered surgically and ureaplasmas cultured from amniotic fluid (AF), chorioamnion, fetal lung (FL) and umbilical cord. Ureaplasmas were tested by western blot to demonstrate MBA variation. Results: The highest number of ureaplasmas were recovered from FL at 100d gestation after 3 days of infection (p<0.03). Six of 7(86%) 100d–3d FL demonstrated an ureaplasma MBA variant, but only 17% and 15% of FL showed an MBA variant after 3d infection at 124d and 140d gestation respectively. Greatest variation of the MBA occurred in AF and FL at 124d gestation after 7d infection. The least MBA variation was observed at 140d; however, at this time the most severe histological chorioamnionitis was observed. Conclusions: After intra-amniotic ureaplasma injections, higher numbers of ureaplasmas gained access to the FL at 100d gestation than observed at later gestations. This may exacerbate the adverse outcomes for neonates delivered early in gestation. In late gestation, ureaplasma MBA variation was minimal, but chorioamnionitis was the most severe. Adverse pregnancy outcomes associated with IA ureaplasma infection may vary depending on the duration of gestation, the number of ureaplasmas isolated from the fetal tissues and the degree of MBA variation.

Management of heterogeneous UAVs through a capability framework of UAV’s functional autonomy

An increased interest in utilising groups of Unmanned Aerial Vehicles (UAVs) with heterogeneous capabilities and autonomy is presenting the challenge to effectively manage such during missions and operations. This has been the focus of research in recent years, moving from a traditional UAV management paradigm of n-to-1 (n operators for one UAV, with n being at least two operators) toward 1-to-n (one operator, multiple UAVs). This paper has expanded on the authors’ previous work on UAV functional capability framework, by incorporating the concept of Functional Level of Autonomy (F-LOA) with two configurations: The lower F-LOA configuration contains sufficient information for the operator to generate solutions and make decisions to address perturbation events. Alternatively, the higher F-LOA configuration presents information reflecting on the F-LOA of the UAV, allowing the operator to interpret solutions and decisions generated autonomously, and decide whether to veto from this decision.

Modulation of LPS-induced chorioamnionitis by ureaplasma parvum in sheep chorioamnionitis in sheep

ABSTRACT Objective: Ureaplasma parvum colonization in the setting of polymicrobial flora is common in women with chorioamnionitis, and is a risk factor for preterm delivery and neonatal morbidity. We hypothesized that ureaplasma colonization of amniotic fluid will modulate chorioamnionitis induced by E.coli lipopolysaccharide (LPS). Methods: Sheep received intra-amniotic (IA) injections of media (control) or live ureaplasma either 7 or 70d before delivery. Another group received IA LPS 2d before delivery. To test for interactions, U.parvum exposed animals were challenged with IA LPS, and delivered 2d later. All animals were delivered preterm at 125±1 day gestation. Results: Both IA ureaplasmas and LPS induced leukocyte infiltration of chorioamnion. LPS greatly increased the expression of pro-inflammatory cytokines and myeloperoxidase in leukocytes, while ureaplasmas alone caused modest responses. Interestingly, 7d but not 70d ureaplasma exposure significantly downregulated LPS induced pro-inflammatory cytokines and myeloperoxidase expression in the chorioamnion. Conclusion: U.parvum can suppress LPS induced experimental chorioamnionitis.

Ureaplasma parvum multiple banded antigen (MBA) size variation - association with fetal inflammation in a sheep model (Published abstract)

Background: Ureaplasma species are the most prevalent isolates from women who deliver preterm. The MBA, a surface exposed lipoprotein, is a key virulence factor of ureaplasmas. We investigated MBA variation after chronic and acute intra-amniotic (IA) ureaplasma infections. Method: U. parvum serovar 3 (2x104 colony-forming-units) was injected IA into pregnant ewes at: 55 days gestation (d, term = 145d) (n=8); 117d (n=8) and 121d (n=8). Fetuses were delivered surgically (124d) and ureaplasmas cultured from amniotic fluid (AF), chorioamnion, fetal lung (FL) and umbilical cord were tested by western blot and PCR assays to demonstrate MBA and mba gene variation respectively. Tissue sections were sectioned and stained by haemotoxylin and eosin and inflammatory cell counts and pathology were reported (blinded to outcome). Results: Numerous MBA/mba variants were generated in vivo after chronic exposure to ureaplasma infection but after acute infection no variants (3d) or very few variants (7d) were generated. Identical MBA variants were detected within the AF and FL but different ureaplasma variants were detected within chorioamnion specimens. The severity of inflammation within chronically infected tissues varied between animals ranging from no inflammation to severe inflammation with/without fibrosis. Chorioamnion, FL and cord from the same animal demonstrated the same degree of inflammation. Conclusions: MBA/mba variation in vivo occurred after the initiation of the host immune response and we propose that ureaplasmas vary the MBA antigen to evade the host immune response. In some animals there was no inflammation despite colonisation with high numbers of ureaplasmas.

Mid-gestation intra-amniotic infection with Ureaplasma parvum is resolved within spiny mice (Acomys cahirinus) by term delivery: but caused chronic infection of fetal lungs and placentae

Background: Ureaplasma species in amniotic fluid at the time of second-trimester amniocentesis increases the risk of preterm birth, but most affected pregnancies continue to term (Gerber et al. J Infect Dis 2003). We aimed to model intra-amniotic (IA) ureaplasma infection in spiny mice, a species with a relatively long gestation (39 days) that allows investigation of the disposition and possible clearance of ureaplasmas in the feto-placental compartment. Method: Pregnant spiny mice received IA injections of U. parvum serovar 6 (10µL, 1x104 colony-forming-units in PBS) or 10B media (10µL; control) at 20 days (d) of gestation (term=39d). At 37d fetuses (n=3 ureaplasma, n=4 control) were surgically delivered and tissues were collected for; bacterial culture, ureaplasma mba and urease gene expression by PCR, tissue WBC counts and indirect fluorescent antibody (IFA) staining using anti-ureaplasma serovar 6 (rabbit) antiserum. Maternal and fetal plasma IgG was measured by Western blot. Results: Ureaplasmas were not detected by culture or PCR in fetal or maternal tissues but were visualized by IFA within placental and fetal lung tissues, in association with inflammatory changes and elevated WBC counts (p<0.0001). Anti-ureaplasma IgG was detected in maternal (2/2 tested) and fetal (1/2 tested) plasma but not in controls (0/3). Conclusions: IA injection of ureaplasmas in mid-gestation spiny mice caused persistent fetal lung and placental infection even though ureaplasmas were undetectable using standard culture or PCR techniques. This is consistent with resolution of IA infection, which may occur in human pregnancies that continue to term despite detection of ureaplasmas in mid-gestation.

Final-state effects in neutron Compton scattering measurements on zirconium deuteride and beryllium

We report inelastic neutron scattering measurements of the neutron Compton profile, J(y), for Be and for D in polycrystalline ZrD2 over a range of momentum transfers, q between 27 and 178 °A−1. The measurements were performed using the inverse geometry spectrometer eVS which is situated at the UK pulsed spallation neutron source ISIS. We have investigated deviations from impulse approximation (IA) scattering which are generically referred to as final state effects (FSEs) using a method described by Sears. This method allows both the magnitude and the q dependence of the FSE to be studied. Analysis of the measured data was compared with analysis of numerical simulations based on the harmonic approximation and good agreement was found for both ZrD2 and Be. Finally we have shown how (∇2V), where V is the interatomic potential, can be extracted from the antisymmetric component of J(y).

Accountable-eHealth systems : the next step forward for privacy

eHealth systems promise enviable benefits and capabilities for healthcare delivery. However, the technologies that make these capabilities possible introduce undesirable drawbacks such as information security related threats, which need to be appropriately addressed. Lurking in these threats are information privacy concerns. Addressing them has proven to be difficult because they often conflict with information access requirements of healthcare providers. Therefore, it is important to achieve an appropriate balance between these requirements. We contend that information accountability (IA) can achieve this balance. In this paper, we introduce accountable-eHealth (AeH) systems, which are eHealth systems that utilise IA as a measure of information privacy. We discuss how AeH system protocols can successfully achieve the aforementioned balance of requirements. As a means of implementation feasibility, we compare characteristics of AeH systems with Australia’s Personally Controlled Electronic Health Record (PCEHR) sys-tem and identify similarities and highlight the differences and the impact those differences would have to the eHealth domain.