Data preprocessing for anomaly based network intrusion detection : a review

Data preprocessing is widely recognized as an important stage in anomaly detection. This paper reviews the data preprocessing techniques used by anomaly-based network intrusion detection systems (NIDS), concentrating on which aspects of the network traffic are analyzed, and what feature construction and selection methods have been used. Motivation for the paper comes from the large impact data preprocessing has on the accuracy and capability of anomaly-based NIDS. The review finds that many NIDS limit their view of network traffic to the TCP/IP packet headers. Time-based statistics can be derived from these headers to detect network scans, network worm behavior, and denial of service attacks. A number of other NIDS perform deeper inspection of request packets to detect attacks against network services and network applications. More recent approaches analyze full service responses to detect attacks targeting clients. The review covers a wide range of NIDS, highlighting which classes of attack are detectable by each of these approaches. Data preprocessing is found to predominantly rely on expert domain knowledge for identifying the most relevant parts of network traffic and for constructing the initial candidate set of traffic features. On the other hand, automated methods have been widely used for feature extraction to reduce data dimensionality, and feature selection to find the most relevant subset of features from this candidate set. The review shows a trend toward deeper packet inspection to construct more relevant features through targeted content parsing. These context sensitive features are required to detect current attacks.

Using complex network metrics to predict the persistence of metapopulations with asymmetric connectivity patterns

Almost all metapopulation modelling assumes that connectivity between patches is only a function of distance, and is therefore symmetric. However, connectivity will not depend only on the distance between the patches, as some paths are easy to traverse, while others are difficult. When colonising organisms interact with the heterogeneous landscape between patches, connectivity patterns will invariably be asymmetric. There have been few attempts to theoretically assess the effects of asymmetric connectivity patterns on the dynamics of metapopulations. In this paper, we use the framework of complex networks to investigate whether metapopulation dynamics can be determined by directly analysing the asymmetric connectivity patterns that link the patches. Our analyses focus on “patch occupancy” metapopulation models, which only consider whether a patch is occupied or not. We propose three easily calculated network metrics: the “asymmetry” and “average path strength” of the connectivity pattern, and the “centrality” of each patch. Together, these metrics can be used to predict the length of time a metapopulation is expected to persist, and the relative contribution of each patch to a metapopulation’s viability. Our results clearly demonstrate the negative effect that asymmetry has on metapopulation persistence. Complex network analyses represent a useful new tool for understanding the dynamics of species existing in fragmented landscapes, particularly those existing in large metapopulations.

Issues and concerns of microscopic calibration process at different network levels : case study of Pacific Motorway

Calibration process in micro-simulation is an extremely complicated phenomenon. The difficulties are more prevalent if the process encompasses fitting aggregate and disaggregate parameters e.g. travel time and headway. The current practice in calibration is more at aggregate level, for example travel time comparison. Such practices are popular to assess network performance. Though these applications are significant there is another stream of micro-simulated calibration, at disaggregate level. This study will focus on such microcalibration exercise-key to better comprehend motorway traffic risk level, management of variable speed limit (VSL) and ramp metering (RM) techniques. Selected section of Pacific Motorway in Brisbane will be used as a case study. The discussion will primarily incorporate the critical issues encountered during parameter adjustment exercise (e.g. vehicular, driving behaviour) with reference to key traffic performance indicators like speed, lane distribution and headway; at specific motorway points. The endeavour is to highlight the utility and implications of such disaggregate level simulation for improved traffic prediction studies. The aspects of calibrating for points in comparison to that for whole of the network will also be briefly addressed to examine the critical issues such as the suitability of local calibration at global scale. The paper will be of interest to transport professionals in Australia/New Zealand where micro-simulation in particular at point level, is still comparatively a less explored territory in motorway management.

Issues and concerns of microscopic calibration process at different network levels : case study of pacific motorway

Calibration process in micro-simulation is an extremely complicated phenomenon. The difficulties are more prevalent if the process encompasses fitting aggregate and disaggregate parameters e.g. travel time and headway. The current practice in calibration is more at aggregate level, for example travel time comparison. Such practices are popular to assess network performance. Though these applications are significant there is another stream of micro-simulated calibration, at disaggregate level. This study will focus on such micro-calibration exercise-key to better comprehend motorway traffic risk level, management of variable speed limit (VSL) and ramp metering (RM) techniques. Selected section of Pacific Motorway in Brisbane will be used as a case study. The discussion will primarily incorporate the critical issues encountered during parameter adjustment exercise (e.g. vehicular, driving behaviour) with reference to key traffic performance indicators like speed, land distribution and headway; at specific motorway points. The endeavour is to highlight the utility and implications of such disaggregate level simulation for improved traffic prediction studies. The aspects of calibrating for points in comparison to that for whole of the network will also be briefly addressed to examine the critical issues such as the suitability of local calibration at global scale. The paper will be of interest to transport professionals in Australia/New Zealand where micro-simulation in particular at point level, is still comparatively a less explored territory in motorway management.

Improved sensorimotor adaptation after exhaustive exercise is accompanied by altered brain activity

Acute exercise has been shown to exhibit different effects on human sensorimotor behavior; however, the causes and mechanisms of the responses are often not clear. The primary aim of the present study was to determine the effects of incremental running until exhaustion on sensorimotor performance and adaptation in a tracking task. Subjects were randomly assigned to a running group (RG), a tracking group (TG), or a running followed by tracking group (RTG), with 10 subjects assigned to each group. Treadmill running velocity was initially set at 2.0 m s− 1, increasing by 0.5 m s− 1 every 5 min until exhaustion. Tracking consisted of 35 episodes (each 40 s) where the subjects' task was to track a visual target on a computer screen while the visual feedback was veridical (performance) or left-right reversed (adaptation). Resting electroencephalographic (EEG) activity was recorded before and after each experimental condition (running, tracking, rest). Tracking performance and the final amount of adaptation did not differ between groups. However, task adaptation was significantly faster in RTG compared to TG. In addition, increased alpha and beta power were observed following tracking in TG but not RTG although exhaustive running failed to induce significant changes in these frequency bands. Our results suggest that exhaustive running can facilitate adaptation processes in a manual tracking task. Attenuated cortical activation following tracking in the exercise condition was interpreted to indicate cortical efficiency and exercise-induced facilitation of selective central processes during actual task demands.

The future of the internet economy : addressing challenges facing the implementation of the Australian national broadband network

Innovation is vital for the future of Australia.s internet economy. Innovations rely on businesses. ability to innovate. Businesses. ability to innovate relies on their employees. The more these individual end users engage in the internet economy, the better businesses. engagement will be. The less these individual end users engage, the less likely a business is to engage and innovate. This means, for the internet economy to function at its fullest potential, it is essential that individual Australians have the capacity to engage with it and participate in it. The Australian federal government is working to facilitate the internet economy through policies, legislation and practices that implement high-speed broadband. The National Broadband Network will be a vital tool for Australia.s internet economy. Its .chief importance¡® is that it will provide faster internet access speeds that will facilitate access to internet services and content. However, an appropriate infrastructure and internet speed is only part of the picture. As the Organisation for Economic Co-operation and Development identified, appropriate government policies are also needed to ensure that vital services are more accessible by consumers. The thesis identifies essential theories and principles underpinning the internet economy and from which the concept of connectedness is developed. Connectedness is defined as the ability of end users to connect with internet content and services, other individuals and organisations, and government. That is, their ability to operate in the internet economy. The NBN will be vital in ensuring connectedness into the future. What is not currently addressed by existing access regimes is how to facilitate end user access capacity and participation. The thesis concludes by making recommendations to the federal government as to what the governing principles of the Australian internet economy should include in order to enable individual end user access capacity.

The evidence-based development of an intervention to address the information needs of adults newly diagnosed with primary brain tumours and their carers

Adults diagnosed with primary brain tumours often experience physical, cognitive and neuropsychiatric impairments and decline in quality of life. Although disease and treatment-related information is commonly provided to cancer patients and carers, newly diagnosed brain tumour patients and their carers report unmet information needs. Few interventions have been designed or proven to address these information needs. Accordingly, a three-study research program, that incorporated both qualitative and quantitative research methods, was designed to: 1) identify and select an intervention to improve the provision of information, and meet the needs of patients with a brain tumour; 2) use an evidence-based approach to establish the content, language and format for the intervention; and 3) assess the acceptability of the intervention, and the feasibility of evaluation, with newly diagnosed brain tumour patients. Study 1: Structured concept mapping techniques were undertaken with 30 health professionals, who identified strategies or items for improving care, and rated each of 42 items for importance, feasibility, and the extent to which such care was provided. Participants also provided data to interpret the relationship between items, which were translated into ‘maps’ of relationships between information and other aspects of health care using multidimensional scaling and hierarchical cluster analysis. Results were discussed by participants in small groups and individual interviews to understand the ratings, and facilitators and barriers to implementation. A care coordinator was rated as the most important strategy by health professionals. Two items directly related to information provision were also seen as highly important: "information to enable the patient or carer to ask questions" and "for doctors to encourage patients to ask questions". Qualitative analyses revealed that information provision was individualised, depending on patients’ information needs and preferences, demographic variables and distress, the characteristics of health professionals who provide information, the relationship between the individual patient and health professional, and influenced by the fragmented nature of the health care system. Based on quantitative and qualitative findings, a brain tumour specific question prompt list (QPL) was chosen for development and feasibility testing. A QPL consists of a list of questions that patients and carers may want to ask their doctors. It is designed to encourage the asking of questions in the medical consultation, allowing patients to control the content, and amount of information provided by health professionals. Study 2: The initial structure and content of the brain tumour specific QPL developed was based upon thematic analyses of 1) patient materials for brain tumour patients, 2) QPLs designed for other patient populations, and 3) clinical practice guidelines for the psychosocial care of glioma patients. An iterative process of review and refinement of content was undertaken via telephone interviews with a convenience sample of 18 patients and/or carers. Successive drafts of QPLs were sent to patients and carers and changes made until no new topics or suggestions arose in four successive interviews (saturation). Once QPL content was established, readability analyses and redrafting were conducted to achieve a sixth-grade reading level. The draft QPL was also reviewed by eight health professionals, and shortened and modified based on their feedback. Professional design of the QPL was conducted and sent to patients and carers for further review. The final QPL contained questions in seven colour-coded sections: 1) diagnosis; 2) prognosis; 3) symptoms and problems; 4) treatment; 5) support; 6) after treatment finishes; and 7) the health professional team. Study 3: A feasibility study was conducted to determine the acceptability of the QPL and the appropriateness of methods, to inform a potential future randomised trial to evaluate its effectiveness. A pre-test post-test design was used with a nonrandomised control group. The control group was provided with ‘standard information’, the intervention group with ‘standard information’ plus the QPL. The primary outcome measure was acceptability of the QPL to participants. Twenty patients from four hospitals were recruited a median of 1 month (range 0-46 months) after diagnosis, and 17 completed baseline and follow-up interviews. Six participants would have preferred to receive the information booklet (standard information or QPL) at a different time, most commonly at diagnosis. Seven participants reported on the acceptability of the QPL: all said that the QPL was helpful, and that it contained questions that were useful to them; six said it made it easier to ask questions. Compared with control group participants’ ratings of ‘standard information’, QPL group participants’ views of the QPL were more positive; the QPL had been read more times, was less likely to be reported as ‘overwhelming’ to read, and was more likely to prompt participants to ask questions of their health professionals. The results from the three studies of this research program add to the body of literature on information provision for brain tumour patients. Together, these studies suggest that a QPL may be appropriate for the neuro-oncology setting and acceptable to patients. The QPL aims to assist patients to express their information needs, enabling health professionals to better provide the type and amount of information that patients need to prepare for treatment and the future. This may help health professionals meet the challenge of giving patients sufficient information, without providing ‘too much’ or ‘unnecessary’ information, or taking away hope. Future studies with rigorous designs are now needed to determine the effectiveness of the QPL.

A preliminary theory of dark network resilience

A crucial contemporary policy question for governments across the globe is how to cope with international crime and terrorist networks. Many such “dark” networks—that is, networks that operate covertly and illegally—display a remarkable level of resilience when faced with shocks and attacks. Based on an in-depth study of three cases (MK, the armed wing of the African National Congress in South Africa during apartheid; FARC, the Marxist guerrilla movement in Colombia; and the Liberation Tigers of Tamil Eelam, LTTE, in Sri Lanka), we present a set of propositions to outline how shocks impact dark network characteristics (resources and legitimacy) and networked capabilities (replacing actors, linkages, balancing integration and differentiation) and how these in turn affect a dark network's resilience over time. We discuss the implications of our findings for policymakers.

An actor-network research frame for analysing complex socio-technical situations

This paper presents a “research frame” which we have found useful in analyzing complex socio- technical situations. The research frame is based on aspects of actor-network theory: “interressment”, “enrollment”, “points of passage” and the “trial of strength”. Each of these aspects are described in turn, making clear their purpose in the overall research frame. Having established the research frame it is used to analyse two examples. First, the use of speech recognition technology is examined in two different contexts, showing how to apply the frame to compare and contrast current situations. Next, a current medical consultation context is described and the research frame is used to consider how it could change with innovative technology. In both examples, the research frame shows that the use of an artefact or technology must be considered together with the context in which it is used.

Resilience of a corrupt police network : the first and second jokes in Queensland

Resilient organised crime groups survive and prosper despite law enforcement activity, criminal competition and market forces. Corrupt police networks, like any other crime network, must contain resiliency characteristics if they are to continue operation and avoid being closed down through detection and arrest of their members. This paper examines the resilience of a large corrupt police network, namely The Joke which operated in the Australian state of Queensland for a number of decades. The paper uses social network analysis tools to determine the resilient characteristics of the network. This paper also assumes that these characteristics will be different to those of mainstream organised crime groups because the police network operates within an established policing agency rather than as an independent entity hiding within the broader community.

Analysis for the use of cumulative plots for travel time estimation on signalized network

This paper provides fundamental understanding for the use of cumulative plots for travel time estimation on signalized urban networks. Analytical modeling is performed to generate cumulative plots based on the availability of data: a) Case-D, for detector data only; b) Case-DS, for detector data and signal timings; and c) Case-DSS, for detector data, signal timings and saturation flow rate. The empirical study and sensitivity analysis based on simulation experiments have observed the consistency in performance for Case-DS and Case-DSS, whereas, for Case-D the performance is inconsistent. Case-D is sensitive to detection interval and signal timings within the interval. When detection interval is integral multiple of signal cycle then it has low accuracy and low reliability. Whereas, for detection interval around 1.5 times signal cycle both accuracy and reliability are high.

The promise and possibilities of music, digital media and National Broadband Network

In this article I would like to examine the promise and possibilities of music, digital media and National Broadband Network. I will do this based on concepts that have emerged from a study undertaken by Professor Andrew Brown and I that categorise technologies into what we term representational technologies and technologies with agency