Monitoring and analysis of internet traffic targeting unused address spaces

Today’s evolving networks are experiencing a large number of different attacks ranging from system break-ins, infection from automatic attack tools such as worms, viruses, trojan horses and denial of service (DoS). One important aspect of such attacks is that they are often indiscriminate and target Internet addresses without regard to whether they are bona fide allocated or not. Due to the absence of any advertised host services the traffic observed on unused IP addresses is by definition unsolicited and likely to be either opportunistic or malicious. The analysis of large repositories of such traffic can be used to extract useful information about both ongoing and new attack patterns and unearth unusual attack behaviors. However, such an analysis is difficult due to the size and nature of the collected traffic on unused address spaces. In this dissertation, we present a network traffic analysis technique which uses traffic collected from unused address spaces and relies on the statistical properties of the collected traffic, in order to accurately and quickly detect new and ongoing network anomalies. Detection of network anomalies is based on the concept that an anomalous activity usually transforms the network parameters in such a way that their statistical properties no longer remain constant, resulting in abrupt changes. In this dissertation, we use sequential analysis techniques to identify changes in the behavior of network traffic targeting unused address spaces to unveil both ongoing and new attack patterns. Specifically, we have developed a dynamic sliding window based non-parametric cumulative sum change detection techniques for identification of changes in network traffic. Furthermore we have introduced dynamic thresholds to detect changes in network traffic behavior and also detect when a particular change has ended. Experimental results are presented that demonstrate the operational effectiveness and efficiency of the proposed approach, using both synthetically generated datasets and real network traces collected from a dedicated block of unused IP addresses.

Green cane impact on sugar processing : ISSCT process workshop 2008

The ISSCT Process Section workshop held in Réunion 20–23 October 2008 was attended by 51 delegates from 10 countries. The theme was Green cane impact on sugar processing. The workshop provided a valuable and timely opportunity to review and discuss the impact on factory operations and performance from a green cane supply that could include significant levels of trash. It was particularly relevant to those mills that were considering options to boost their biomass intake for increased co-generation capacity. Several of the speakers related their experiences with processing ‘whole of crop’ cane supplies through the factory. Speakers detailed the problems and increased losses that were incurred when processing cane with high trash levels. The consensus of the delegates was that the best scenario would involve a cane-cleaning plant at the factory so that only clean cane would be processed through the factory. The forum recommended that more research was required to address the issues of increased impurities in the process streams associated with high trash levels. Site visits to the two factories and a cane-delivery station were arranged as part of the workshop.

Securing IEEE 802.11 wireless LANs

As the acceptance and popularity of wireless networking technologies has proliferated, the security of the IEEE 802.11 wireless local area network (WLAN) has advanced in leaps and bounds. From tenuous beginnings, where the only safe way to deploy a WLAN was to assume it was hostile and employ higherlayer information security controls, to the current state of the art, all manner of improvements have been conceived and many implemented. This work investigates some of the remaining issues surrounding IEEE 802.11 WLAN operation. While the inherent issues in WLAN deployments and the problems of the original Wired Equivalent Privacy (WEP) provisions are well known and widely documented, there still exist a number of unresolved security issues. These include the security of management and control frames and the data link layer protocols themselves. This research introduces a novel proposal to enhance security at the link layer of IEEE 802.11 WLANs and then conducts detailed theoretical and empirical investigation and analysis of the eects of such proposals. This thesis �rst de�nes the state of the art in WLAN technology and deployment, including an overview of the current and emerging standards, the various threats, numerous vulnerabilities and current exploits. The IEEE 802.11i MAC security enhancements are discussed in detail, along with the likely outcomes of the IEEE 802.11 Task Group W1, looking into protected management frames. The problems of the remaining unprotected management frames, the unprotected control frames and the unprotected link layer headers are reviewed and a solution is hypothesised, to encrypt the entire MAC Protocol Data Unit (MPDU), including the MAC headers, not just the MAC Service Data Unit (MSDU) commonly performed by existing protocols. The proposal is not just to encrypt a copy of the headers while still using cleartext addresses to deliver the frame, as used by some existing protocols to support the integrity and authenticity of the headers, but to pass the entire MPDU only as ciphertext to also support the con�dentiality of the frame header information. This necessitates the decryption of every received frame using every available key before a station can determine if it is the intended recipient. As such, this raises serious concerns as to the viability of any such proposal due to the likely impact on throughput and scalability. The bulk of the research investigates the impacts of such proposals on the current WLAN protocols. Some possible variations to the proposal are also provided to enhance both utility and speed. The viability this proposal with respect to the eect on network throughput is then tested using a well known and respected network simulation tool, along with a number of analysis tools developed speci�cally for the data generated here. The simulator's operation is �rst validated against recognised test outputs, before a comprehensive set of control data is established, and then the proposal is tested and and compared against the controls. This detailed analysis of the various simulations should be of bene�t to other researchers who need to validate simulation results. The analysis of these tests indicate areas of immediate improvement and so the protocols are adjusted and a further series of experiments conducted. These �nal results are again analysed in detail and �nal appraisals provided.

School-based strategies to address cyber bullying

Bullying and victimisation among school age children is recognised as a major public health problem. The Australian Covert Bullying Prevalence Study (ACBPS) reports that just over one quarter (27%) of school students aged 8 to 14 years were bullied and 9% bullied others on a frequent basis (every few weeks or more often) (Cross et al., 2009). Bullying is associated with a host of detrimental effects, including loneliness (Nansel, Overpeck, Pilla, & Ruan, 2001), low self‐esteem (Jankauskiene, Kardelis, Sukys, & Kardeliene, 2008; Salmivalli, Kaukiainen, Kaistaniemi, & Lagerspetz, 1999), anxiety, depression (Kaltiala‐Heino, Rimpela, Rantanen, & Rimpela, 2000), suicide ideation (Kaltiala‐Heino, Rimpela, Marttunen, Rimpela, & Rantanen, 1999), impaired academic achievement (Nansel et al., 2001), and poorer physical health (Wolke, Woods, Bloomfield, & Karstadt, 2001).

Early intervention music therapy : reporting on a 3-year project to address needs with at-risk families

Sing & Grow is an early intervention music therapy project presented to families with additional needs, or those at risk of experiencing disadvantage due to social and/or economic circumstances that may impact on their parenting experiences. The aim of the project is to provide short term music therapy programs to families in communities where access to such services may be limited. The program is strengths-based and focuses on building upon a parent’s capacity to relate to and respond to their child’s emotional and developmental needs.

The evidence-based development of an intervention to address the information needs of adults newly diagnosed with primary brain tumours and their carers

Adults diagnosed with primary brain tumours often experience physical, cognitive and neuropsychiatric impairments and decline in quality of life. Although disease and treatment-related information is commonly provided to cancer patients and carers, newly diagnosed brain tumour patients and their carers report unmet information needs. Few interventions have been designed or proven to address these information needs. Accordingly, a three-study research program, that incorporated both qualitative and quantitative research methods, was designed to: 1) identify and select an intervention to improve the provision of information, and meet the needs of patients with a brain tumour; 2) use an evidence-based approach to establish the content, language and format for the intervention; and 3) assess the acceptability of the intervention, and the feasibility of evaluation, with newly diagnosed brain tumour patients. Study 1: Structured concept mapping techniques were undertaken with 30 health professionals, who identified strategies or items for improving care, and rated each of 42 items for importance, feasibility, and the extent to which such care was provided. Participants also provided data to interpret the relationship between items, which were translated into ‘maps’ of relationships between information and other aspects of health care using multidimensional scaling and hierarchical cluster analysis. Results were discussed by participants in small groups and individual interviews to understand the ratings, and facilitators and barriers to implementation. A care coordinator was rated as the most important strategy by health professionals. Two items directly related to information provision were also seen as highly important: "information to enable the patient or carer to ask questions" and "for doctors to encourage patients to ask questions". Qualitative analyses revealed that information provision was individualised, depending on patients’ information needs and preferences, demographic variables and distress, the characteristics of health professionals who provide information, the relationship between the individual patient and health professional, and influenced by the fragmented nature of the health care system. Based on quantitative and qualitative findings, a brain tumour specific question prompt list (QPL) was chosen for development and feasibility testing. A QPL consists of a list of questions that patients and carers may want to ask their doctors. It is designed to encourage the asking of questions in the medical consultation, allowing patients to control the content, and amount of information provided by health professionals. Study 2: The initial structure and content of the brain tumour specific QPL developed was based upon thematic analyses of 1) patient materials for brain tumour patients, 2) QPLs designed for other patient populations, and 3) clinical practice guidelines for the psychosocial care of glioma patients. An iterative process of review and refinement of content was undertaken via telephone interviews with a convenience sample of 18 patients and/or carers. Successive drafts of QPLs were sent to patients and carers and changes made until no new topics or suggestions arose in four successive interviews (saturation). Once QPL content was established, readability analyses and redrafting were conducted to achieve a sixth-grade reading level. The draft QPL was also reviewed by eight health professionals, and shortened and modified based on their feedback. Professional design of the QPL was conducted and sent to patients and carers for further review. The final QPL contained questions in seven colour-coded sections: 1) diagnosis; 2) prognosis; 3) symptoms and problems; 4) treatment; 5) support; 6) after treatment finishes; and 7) the health professional team. Study 3: A feasibility study was conducted to determine the acceptability of the QPL and the appropriateness of methods, to inform a potential future randomised trial to evaluate its effectiveness. A pre-test post-test design was used with a nonrandomised control group. The control group was provided with ‘standard information’, the intervention group with ‘standard information’ plus the QPL. The primary outcome measure was acceptability of the QPL to participants. Twenty patients from four hospitals were recruited a median of 1 month (range 0-46 months) after diagnosis, and 17 completed baseline and follow-up interviews. Six participants would have preferred to receive the information booklet (standard information or QPL) at a different time, most commonly at diagnosis. Seven participants reported on the acceptability of the QPL: all said that the QPL was helpful, and that it contained questions that were useful to them; six said it made it easier to ask questions. Compared with control group participants’ ratings of ‘standard information’, QPL group participants’ views of the QPL were more positive; the QPL had been read more times, was less likely to be reported as ‘overwhelming’ to read, and was more likely to prompt participants to ask questions of their health professionals. The results from the three studies of this research program add to the body of literature on information provision for brain tumour patients. Together, these studies suggest that a QPL may be appropriate for the neuro-oncology setting and acceptable to patients. The QPL aims to assist patients to express their information needs, enabling health professionals to better provide the type and amount of information that patients need to prepare for treatment and the future. This may help health professionals meet the challenge of giving patients sufficient information, without providing ‘too much’ or ‘unnecessary’ information, or taking away hope. Future studies with rigorous designs are now needed to determine the effectiveness of the QPL.

Re-thinking how we plan to address technically complex problems : drawing on planning theory to guide practice in revision of land use plans in coastal high hazard zones

Queensland's new State Planning Policy for Coastal Protection, released in March and approved in April 2011 as part of the Queensland Coastal Plan, stipulates that local governments prepare and implement adaptation strategies for built up areas projected to be subject to coastal hazards between present day and 2100. Urban localities within the delineated coastal high hazard zone (as determined by models incorporating a 0.8 meter rise in sea level and a 10% increase in the maximum cyclone activity) will be required to re-evaluate their plans to accommodate growth, revising land use plans to minimise impacts of anticipated erosion and flooding on developed areas and infrastructure. While implementation of such strategies would aid in avoidance or minimisation of risk exposure, communities are likely to face significant challenges in such implementation, especially as development in Queensland is so intensely focussed upon its coasts with these new policies directing development away from highly desirable waterfront land. This paper examines models of planning theory to understand how we plan when faced with technically complex problems towards formulation of a framework for evaluating and improving practice.

Address terms in turn beginnings: Managing disalignment and disaffiliation in telephone counselling

This paper examines use of address terms by counsellors on a telephone counselling service for children and young people. Drawing on conversation analytic findings and methods, we show how personal names are used in the management of structural and interpersonal aspects of counselling interaction. Focusing on address terms in turn-beginnings - where a name is used as, or as part of, a preface - the analysis shows that address terms are used in turns that are not fitted with prior talk in terms of either the activity or affective stance of the client. We discuss two environments in which this practice is observed: in beginning turns that initiate a new action sequence, and in turns that challenge the client’s position. Our focus is on the use of client names in the context of producing disaligning or disaffiliative actions. In disaligned actions, counsellors produced sequentially disjunctive turns that regularly involved a return to a counselling agenda. In disaffiliative actions counsellors presented a stance that did not fit with the affective stance of the client in the prior turn, for instance, in disagreeing with or complimenting the client. The paper discusses how such turns invoke a counselling agenda and how name use is used in the management of rapport and trust in counselling interaction.

Privacy oriented access control for electronic health records

Security and privacy in electronic health record systems have been hindering the growth of e-health systems since their emergence. The development of policies that satisfy the security and privacy requirements of different stakeholders in healthcare has proven to be difficult. But, these requirements have to be met if the systems developed are to succeed in achieving their intended goals. Access control is a fundamental security barrier for securing data in healthcare information systems. In this paper we present an access control model for electronic health records. We address patient privacy requirements, confidentiality of private information and the need for flexible access for health professionals for electronic health records. We carefully combine three existing access control models and present a novel access control model for EHRs which satisfies requirements of electronic health records.

An exploration of the maturity model concept as a vehicle for higher education institutions to assess their capability to address student engagement : a work in progress

Gaining a competitive edge in the area of the engagement, success and retention of commencing students is a significant issue in higher education, made more so currently because of the considerable and increasing pressure on teaching and learning from the new standards framework and performance funding. This paper introduces the concept of maturity models (MMs) and their application to assessing the capability of higher education institutions (HEIs) to address student engagement, success and retention (SESR). A concise description of the features of maturity models is presented with reference to an SESR-MM currently being developed. The SESR-MM is proposed as a viable instrument for assisting HEIs in the management and improvement of their SESR activities.

The maturity model concept as framework for assessing the capability of higher education institutions to address student engagement, success and retention : new horizon or false dawn?

While the engagement, success and retention of first year students are ongoing issues in higher education, they are currently of considerable and increasing importance as the pressures on teaching and learning from the new standards framework and performance funding intensifies. This Nuts & Bolts presentation introduces the concept of a maturity model and its application to the assessment of the capability of higher education institutions to address student engagement, success and retention. Participants will be provided with (a) a concise description of the concept and features of a maturity model; and (b) the opportunity to explore the potential application of maturity models (i) to the management of student engagement and retention programs and strategies within an institution and (ii) to the improvement of these features by benchmarking across the sector.

Traffic-related fine and ultrafine particle exposures of professional drivers and illness : An opportunity to better link exposure science and epidemiology to address an occupational hazard?

Exposures to traffic-related air pollution (TRAP) can be particularly high in transport microenvironments (i.e. in and around vehicles) despite the short durations typically spent there. There is a mounting body of evidence that suggests that this is especially true for fine (b2.5 μm) and ultrafine (b100 nm, UF) particles. Professional drivers, who spend extended periods of time in transport microenvironments due to their job, may incur exposures markedly higher than already elevated non-occupational exposures. Numerous epidemiological studies have shown a raised incidence of adverse health outcomes among professional drivers, and exposure to TRAP has been suggested as one of the possible causal factors. Despite this, data describing the range and determinants of occupational exposures to fine and UF particles are largely conspicuous in their absence. Such information could strengthen attempts to define the aetiology of professional drivers' illnesses as it relates to traffic combustion-derived particles. In this article, we suggest that the drivers' occupational fine and UF particle exposures are an exemplar case where opportunities exist to better link exposure science and epidemiology in addressing questions of causality. The nature of the hazard is first introduced, followed by an overview of the health effects attributable to exposures typical of transport microenvironments. Basic determinants of exposure and reduction strategies are also described, and finally the state of knowledge is briefly summarised along with an outline of the main unanswered questions in the topic area.

Analysis of indirect message injection for MAC generation using stream ciphers

This paper presents a model for generating a MAC tag with a stream cipher using the input message indirectly. Several recent proposals represent instances of this model with slightly different options. We investigate the security of this model for different options, and identify cases which permit forgery attacks. Based on this, we present a new forgery attack on version 1.4 of 128-EIA3. Design recommendations to enhance the security of proposals following this general model are given.

A general model for MAC generation using direct injection

This paper presents a model for generating a MAC tag by injecting the input message directly into the internal state of a nonlinear filter generator. This model generalises a similar model for unkeyed hash functions proposed by Nakano et al. We develop a matrix representation for the accumulation phase of our model and use it to analyse the security of the model against man-in-the-middle forgery attacks based on collisions in the final register contents. The results of this analysis show that some conclusions of Nakano et al regarding the security of their model are incorrect. We also use our results to comment on several recent MAC proposals which can be considered as instances of our model and specify choices of options within the model which should prevent the type of forgery discussed here. In particular, suitable initialisation of the register and active use of a secure nonlinear filter will prevent an attacker from finding a collision in the final register contents which could result in a forged MAC.