Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Should mental health issues be addressed in primary care, and can it be done? Views of rural general practitioners in Queensland

Objective: The aim of this paper was to examine self-efficacy and perceived appropriateness among rural general practitioners (GPs) in regards to screening and intervention for physical, lifestyle and mental health issues. ----- Method: Fifty GPs from 25 practices in eight rural Queensland towns completed a written survey designed for the study. ----- Results: General practitioners rated opportunistic screening or assessment for smoking and for detection of relapse of mental disorders as the most appropriate, with even cardiovascular and diabetes risk falling behind these. Self-efficacy was highest for medical disorders for smoking assessment. It was significantly lower for alcohol, mental health issues, and addressing risks of physical disorder in people with mental disorders. ----- Conclusions: High appropriateness ratings suggest that current strategies to boost self-efficacy of GPs in addressing mental health issues are timely.

Intrusion detection techniques in wireless local area networks

This research investigates wireless intrusion detection techniques for detecting attacks on IEEE 802.11i Robust Secure Networks (RSNs). Despite using a variety of comprehensive preventative security measures, the RSNs remain vulnerable to a number of attacks. Failure of preventative measures to address all RSN vulnerabilities dictates the need for a comprehensive monitoring capability to detect all attacks on RSNs and also to proactively address potential security vulnerabilities by detecting security policy violations in the WLAN. This research proposes novel wireless intrusion detection techniques to address these monitoring requirements and also studies correlation of the generated alarms across wireless intrusion detection system (WIDS) sensors and the detection techniques themselves for greater reliability and robustness. The specific outcomes of this research are: A comprehensive review of the outstanding vulnerabilities and attacks in IEEE 802.11i RSNs. A comprehensive review of the wireless intrusion detection techniques currently available for detecting attacks on RSNs. Identification of the drawbacks and limitations of the currently available wireless intrusion detection techniques in detecting attacks on RSNs. Development of three novel wireless intrusion detection techniques for detecting RSN attacks and security policy violations in RSNs. Development of algorithms for each novel intrusion detection technique to correlate alarms across distributed sensors of a WIDS. Development of an algorithm for automatic attack scenario detection using cross detection technique correlation. Development of an algorithm to automatically assign priority to the detected attack scenario using cross detection technique correlation.

Detecting and characterising malicious executable payloads

Buffer overflow vulnerabilities continue to prevail and the sophistication of attacks targeting these vulnerabilities is continuously increasing. As a successful attack of this type has the potential to completely compromise the integrity of the targeted host, early detection is vital. This thesis examines generic approaches for detecting executable payload attacks, without prior knowledge of the implementation of the attack, in such a way that new and previously unseen attacks are detectable. Executable payloads are analysed in detail for attacks targeting the Linux and Windows operating systems executing on an Intel IA-32 architecture. The execution flow of attack payloads are analysed and a generic model of execution is examined. A novel classification scheme for executable attack payloads is presented which allows for characterisation of executable payloads and facilitates vulnerability and threat assessments, and intrusion detection capability assessments for intrusion detection systems. An intrusion detection capability assessment may be utilised to determine whether or not a deployed system is able to detect a specific attack and to identify requirements for intrusion detection functionality for the development of new detection methods. Two novel detection methods are presented capable of detecting new and previously unseen executable attack payloads. The detection methods are capable of identifying and enumerating the executable payload’s interactions with the operating system on the targeted host at the time of compromise. The detection methods are further validated using real world data including executable payload attacks.

Design and evaluation of an image analysis platform for low-power, low-bandwidth camera networks

We describe the design and evaluation of a platform for networks of cameras in low-bandwidth, low-power sensor networks. In our work to date we have investigated two different DSP hardware/software platforms for undertaking the tasks of compression and object detection and tracking. We compare the relative merits of each of the hardware and software platforms in terms of both performance and energy consumption. Finally we discuss what we believe are the ongoing research questions for image processing in WSNs.

Effects of lead exposure on hippocampal metabotropic glutamate receptor subtype 3 and 7 in developmental rats

Background A complete explanation of the mechanisms by which Pb2+ exerts toxic effects on developmental central nervous system remains unknown. Glutamate is critical to the developing brain through various subtypes of ionotropic or metabotropic glutamate receptors (mGluRs). Ionotropic N-methyl-D-aspartate receptors have been considered as a principal target in lead-induced neurotoxicity. The relationship between mGluR3/mGluR7 and synaptic plasticity had been verified by many recent studies. The present study aimed to examine the role of mGluR3/mGluR7 in lead-induced neurotoxicity. Methods Twenty-four adult and female rats were randomly selected and placed on control or 0.2% lead acetate during gestation and lactation. Blood lead and hippocampal lead levels of pups were analyzed at weaning to evaluate the actual lead content at the end of the exposure. Impairments of short -term memory and long-term memory of pups were assessed by tests using Morris water maze and by detection of hippocampal ultrastructural alterations on electron microscopy. The impact of lead exposure on mGluR3 and mGluR7 mRNA expression in hippocampal tissue of pups were investigated by quantitative real-time polymerase chain reaction and its potential role in lead neurotoxicity were discussed. Results Lead levels of blood and hippocampi in the lead-exposed rats were significantly higher than those in the controls (P < 0.001). In tests using Morris Water Maze, the overall decrease in goal latency and swimming distance was taken to indicate that controls had shorter latencies and distance than lead-exposed rats (P = 0.001 and P < 0.001 by repeated-measures analysis of variance). On transmission electron microscopy neuronal ultrastructural alterations were observed and the results of real-time polymerase chain reaction showed that exposure to 0.2% lead acetate did not substantially change gene expression of mGluR3 and mGluR7 mRNA compared with controls. Conclusion Exposure to lead before and after birth can damage short-term and long-term memory ability of young rats and hippocampal ultrastructure. However, the current study does not provide evidence that the expression of rat hippocampal mGluR3 and mGluR7 can be altered by systemic administration of lead during gestation and lactation, which are informative for the field of lead-induced developmental neurotoxicity noting that it seems not to be worthwhile to include mGluR3 and mGluR7 in future studies. Background

Evaluating sewage associated JCV and BKV polyomaviruses for sourcing human fecal pollution in a coastal river in Southeast Queensland Australia

In this study, the host-sensitivity and -specificity of JCV and BKV polyomaviruses were evaluated by testing wastewater/fecal samples from nine host groups in Southeast Queensland, Australia. The JCV and BKV polyomaviruses were detected in 48 human wastewater samples collected from the primary and secondary effluent suggesting high sensitivity of these viruses in human wastewater. Of the 81 animal wastewater/fecal samples tested, 80 were PCR negative for this marker. Only one sample from pig wastewater was positive. Nonetheless, the overall host-specificity of these viruses to differentiate between human and animal wastewater/fecal samples was 0.99. To our knowledge, this is the first study in Australia that reports the high specificity of JCV and BKV polyomaviruses. To evaluate the field application of these viruses to detect human fecal pollution, 20 environmental samples were collected from a coastal river. Of the 20 samples tested, 15% and 70% samples exceeded the regulatory guidelines for E. coli and enterococci levels for marine waters. In all, 5 (25%) samples were PCR positive for JCV and BKV indicated the presence of human fecal pollution in the studied river. The results suggest that JCV and BKV detection using PCR could be a useful tool for the identification of human sourced fecal pollution in coastal waters.

Fold back current control and admittance protection scheme for a distribution network containing distributed generators

Islanded operation, protection, reclosing and arc extinguishing are some of the challenging issues related to the connection of converter interfaced distributed generators (DGs) into a distribution network. The isolation of upstream faults in grid connected mode and fault detection in islanded mode using overcurrent devices are difficult. In the event of an arc fault, all DGs must be disconnected in order to extinguish the arc. Otherwise, they will continue to feed the fault, thus sustaining the arc. However, the system reliability can be increased by maximising the DG connectivity to the system: therefore, the system protection scheme must ensure that only the faulted segment is removed from the feeder. This is true even in the case of a radial feeder as the DG can be connected at various points along the feeder. In this paper, a new relay scheme is proposed which, along with a novel current control strategy for converter interfaced DGs, can isolate permanent and temporary arc faults. The proposed protection and control scheme can even coordinate with reclosers. The results are validated through PSCAD/EMTDC simulation and MATLAB calculations.

Structural health monitoring for long span bridges : Hong Kong experience and continuing onto Australia

Structural health monitoring has been accepted as a justified effort for long-span bridges, which are critical to a region's economic vitality. As the most heavily instrumented bridge project in the world, WASHMS - Wind And Structural Health Monitoring System has been developed and installed on the cable-supported bridges in Hong Kong (Wong and Ni 2009a). This chapter aims to share some of the experience gained through the operations and studies on the application of WASHMS. It is concluded that Structural Health Monitoring should be composed of two main components: Structural Performance Monitoring (SPM) and Structural Safety Evaluation (SSE). As an example to illustrate how the WASHMS could be used for structural performance monitoring, the layout of the sensory system installed on the Tsing Ma Bridge is briefly described. To demonstrate the two broad approaches of structural safety evaluation - Structural Health Assessment and Damage Detection, three examples in the application of SHM information are presented. These three examples can be considered as pioneer works for the research and development of the structural diagnosis and prognosis tools required by the structural health monitoring for monitoring and evaluation applications.

Situation Review of Barley Yellow Dwarf Virus in West Asia and North Africa

Symptoms of barley yellow dwarf (BYD) have been observed on cereals in nearly all countries of West Asia and North Africa. Its incidence. however, has varied during the last 15 years. Observations from field surveys are summarized. Since symptoms of barley yellow dwarf virus (BYDV) are of low diagnostic value, especially in wheat (Triticum aestivum L.), more precise qualitative and quantitative detection was derived by vector transmission and serology. In 1985 and 1986. preliminary surveys by enzyme-linked immunosorbent assay (ELlS A) indicated that BYDV incidence in the regions surveyed in Syria, Morocco, and Tunisia was around 7. 22. and 24%. respectively. By vector transmission PAV-, RPV-, and RMV-like isolates ofBYDV were identified in Morocco and the PAV-like isolate in Syria. By serology PAV-like isolates were identified in Ethiopia, Lebanon. Morocco. Syria. and Tunisia. and MA V-like isolates were identified from Morocco and Tunisia. The PAV-like type was the most common in all countries surveyed. Screening for BYDV resistance by natural infection has been carried out in a number of countries of the region during the last few years. Screening for resistance by aphid inoculation was initiated in Syria in 1986 at the International Center for Agricultural Research in the Dry Areas (ICARDA). Such screening is expected to follow in other countries of the region soon.

Development and validation of novel methods for microbial source tracking based on Escherichia coli as an indicator of water quality

Microbial pollution in water periodically affects human health in Australia, particularly in times of drought and flood. There is an increasing need for the control of waterborn microbial pathogens. Methods, allowing the determination of the origin of faecal contamination in water, are generally referred to as Microbial Source Tracking (MST). Various approaches have been evaluated as indicatorsof microbial pathogens in water samples, including detection of different microorganisms and various host-specific markers. However, until today there have been no universal MST methods that could reliably determine the source (human or animal) of faecal contamination. Therefore, the use of multiple approaches is frequently advised. MST is currently recognised as a research tool, rather than something to be included in routine practices. The main focus of this research was to develop novel and universally applicable methods to meet the demands for MST methods in routine testing of water samples. Escherichia coli was chosen initially as the object organism for our studies as, historically and globally, it is the standard indicator of microbial contamination in water. In this thesis, three approaches are described: single nucleotide polymorphism (SNP) genotyping, clustered regularly interspaced short palindromic repeats (CRISPR) screening using high resolution melt analysis (HRMA) methods and phage detection development based on CRISPR types. The advantage of the combination SNP genotyping and CRISPR genes has been discussed in this study. For the first time, a highly discriminatory single nucleotide polymorphism interrogation of E. coli population was applied to identify the host-specific cluster. Six human and one animal-specific SNP profile were revealed. SNP genotyping was successfully applied in the field investigations of the Coomera watershed, South-East Queensland, Australia. Four human profiles [11], [29], [32] and [45] and animal specific SNP profile [7] were detected in water. Two human-specific profiles [29] and [11] were found to be prevalent in the samples over a time period of years. The rainfall (24 and 72 hours), tide height and time, general land use (rural, suburban), seasons, distance from the river mouth and salinity show a lack of relashionship with the diversity of SNP profiles present in the Coomera watershed (p values > 0.05). Nevertheless, SNP genotyping method is able to identify and distinquish between human- and non-human specific E. coli isolates in water sources within one day. In some samples, only mixed profiles were detected. To further investigate host-specificity in these mixed profiles CRISPR screening protocol was developed, to be used on the set of E. coli, previously analysed for SNP profiles. CRISPR loci, which are the pattern of previous DNA coliphages attacks, were considered to be a promising tool for detecting host-specific markers in E. coli. Spacers in CRISPR loci could also reveal the dynamics of virulence in E. coli as well in other pathogens in water. Despite the fact that host-specificity was not observed in the set of E. coli analysed, CRISPR alleles were shown to be useful in detection of the geographical site of sources. HRMA allows determination of ‘different’ and ‘same’ CRISPR alleles and can be introduced in water monitoring as a cost-effective and rapid method. Overall, we show that the identified human specific SNP profiles [11], [29], [32] and [45] can be useful as marker genotypes globally for identification of human faecal contamination in water. Developed in the current study, the SNP typing approach can be used in water monitoring laboratories as an inexpensive, high-throughput and easy adapted protocol. The unique approach based on E. coli spacers for the search for unknown phage was developed to examine the host-specifity in phage sequences. Preliminary experiments on the recombinant plasmids showed the possibility of using this method for recovering phage sequences. Future studies will determine the host-specificity of DNA phage genotyping as soon as first reliable sequences can be acquired. No doubt, only implication of multiple approaches in MST will allow identification of the character of microbial contamination with higher confidence and readability.

Evaluating automatic road detection across a large aerial imagery collection

The automated extraction of roads from aerial imagery can be of value for tasks including mapping, surveillance and change detection. Unfortunately, there are no public databases or standard evaluation protocols for evaluating these techniques. Many techniques are further hindered by a reliance on manual initialisation, making large scale application of the techniques impractical. In this paper, we present a public database and evaluation protocol for the evaluation of road extraction algorithms, and propose an improved automatic seed finding technique to initialise road extraction, based on a combination of geometric and colour features.

Combined time- and space-resolved Raman spectrometer for the non-invasive depth profiling of chemical hazards

A time-resolved inverse spatially offset Raman spectrometer was constructed for depth profiling of Raman-active substances under both the lab and the field environments. The system operating principles and performance are discussed along with its advantages relative to traditional continuous wave spatially offset Raman spectrometer. The developed spectrometer uses a combination of space- and time-resolved detection in order to obtain high-quality Raman spectra from substances hidden behind coloured opaque surface layers, such as plastic and garments, with a single measurement. The time-gated spatially offset Raman spectrometer was successfully used to detect concealed explosives and drug precursors under incandescent and fluorescent background light as well as under daylight. The average screening time was 50 s per measurement. The excitation energy requirements were relatively low (20 mW) which makes the probe safe for screening hazardous substances. The unit has been designed with nanosecond laser excitation and gated detection, making it of lower cost and complexity than previous picosecond-based systems, to provide a functional platform for in-line or in-field sensing of chemical substances.

Deep Raman spectroscopy for the non-invasive standoff detection of concealed chemical threat agents

Deep Raman spectroscopy has been utilized for the standoff detection of concealed chemical threat agents from a distance of 15 meters under real life background illumination conditions. By using combined time and space resolved measurements, various explosive precursors hidden in opaque plastic containers were identified non-invasively. Our results confirm that combined time and space resolved Raman spectroscopy leads to higher selectivity towards the sub-layer over the surface layer as well as enhanced rejection of fluorescence from the container surface when compared to standoff spatially offset Raman spectroscopy. Raman spectra that have minimal interference from the packaging material and good signal-to-noise ratio were acquired within 5 seconds of measurement time. A new combined time and space resolved Raman spectrometer has been designed with nanosecond laser excitation and gated detection, making it of lower cost and complexity than picosecond-based laboratory systems.

An integrated approach for precise road reconstruction from aerial imagery and LiDAR data

Accurate and detailed road models play an important role in a number of geospatial applications, such as infrastructure planning, traffic monitoring, and driver assistance systems. In this thesis, an integrated approach for the automatic extraction of precise road features from high resolution aerial images and LiDAR point clouds is presented. A framework of road information modeling has been proposed, for rural and urban scenarios respectively, and an integrated system has been developed to deal with road feature extraction using image and LiDAR analysis. For road extraction in rural regions, a hierarchical image analysis is first performed to maximize the exploitation of road characteristics in different resolutions. The rough locations and directions of roads are provided by the road centerlines detected in low resolution images, both of which can be further employed to facilitate the road information generation in high resolution images. The histogram thresholding method is then chosen to classify road details in high resolution images, where color space transformation is used for data preparation. After the road surface detection, anisotropic Gaussian and Gabor filters are employed to enhance road pavement markings while constraining other ground objects, such as vegetation and houses. Afterwards, pavement markings are obtained from the filtered image using the Otsu's clustering method. The final road model is generated by superimposing the lane markings on the road surfaces, where the digital terrain model (DTM) produced by LiDAR data can also be combined to obtain the 3D road model. As the extraction of roads in urban areas is greatly affected by buildings, shadows, vehicles, and parking lots, we combine high resolution aerial images and dense LiDAR data to fully exploit the precise spectral and horizontal spatial resolution of aerial images and the accurate vertical information provided by airborne LiDAR. Objectoriented image analysis methods are employed to process the feature classiffcation and road detection in aerial images. In this process, we first utilize an adaptive mean shift (MS) segmentation algorithm to segment the original images into meaningful object-oriented clusters. Then the support vector machine (SVM) algorithm is further applied on the MS segmented image to extract road objects. Road surface detected in LiDAR intensity images is taken as a mask to remove the effects of shadows and trees. In addition, normalized DSM (nDSM) obtained from LiDAR is employed to filter out other above-ground objects, such as buildings and vehicles. The proposed road extraction approaches are tested using rural and urban datasets respectively. The rural road extraction method is performed using pan-sharpened aerial images of the Bruce Highway, Gympie, Queensland. The road extraction algorithm for urban regions is tested using the datasets of Bundaberg, which combine aerial imagery and LiDAR data. Quantitative evaluation of the extracted road information for both datasets has been carried out. The experiments and the evaluation results using Gympie datasets show that more than 96% of the road surfaces and over 90% of the lane markings are accurately reconstructed, and the false alarm rates for road surfaces and lane markings are below 3% and 2% respectively. For the urban test sites of Bundaberg, more than 93% of the road surface is correctly reconstructed, and the mis-detection rate is below 10%.