Introduction to Security Onion

Security Onion is a Network Security Manager (NSM) platform that provides multiple Intrusion Detection Systems (IDS) including Host IDS (HIDS) and Network IDS (NIDS). Many types of data can be acquired using Security Onion for analysis. This includes data related to: Host, Network, Session, Asset, Alert and Protocols. Security Onion can be implemented as a standalone deployment with server and sensor included or with a master server and multiple sensors allowing for the system to be scaled as required. Many interfaces and tools are available for management of the system and analysis of data such as Sguil, Snorby, Squert and Enterprise Log Search and Archive (ELSA). These interfaces can be used for analysis of alerts and captured events and then can be further exported for analysis in Network Forensic Analysis Tools (NFAT) such as NetworkMiner, CapME or Xplico. The Security Onion platform also provides various methods of management such as Secure SHell (SSH) for management of server and sensors and Web client remote access. All of this with the ability to replay and analyse example malicious traffic makes the Security Onion a suitable low cost alternative for Network Security Management. In this paper, we have a feature and functionality review for the Security Onion in terms of: types of data, configuration, interface, tools and system management.

Automated Software Debugging Using Hybrid Static/Dynamic Analysis

With the increasing complexity of today's software, the software development process is becoming highly time and resource consuming. The increasing number of software configurations, input parameters, usage scenarios, supporting platforms, external dependencies, and versions plays an important role in expanding the costs of maintaining and repairing unforeseeable software faults. To repair software faults, developers spend considerable time in identifying the scenarios leading to those faults and root-causing the problems. While software debugging remains largely manual, it is not the case with software testing and verification. The goal of this research is to improve the software development process in general, and software debugging process in particular, by devising techniques and methods for automated software debugging, which leverage the advances in automatic test case generation and replay. In this research, novel algorithms are devised to discover faulty execution paths in programs by utilizing already existing software test cases, which can be either automatically or manually generated. The execution traces, or alternatively, the sequence covers of the failing test cases are extracted. Afterwards, commonalities between these test case sequence covers are extracted, processed, analyzed, and then presented to the developers in the form of subsequences that may be causing the fault. The hypothesis is that code sequences that are shared between a number of faulty test cases for the same reason resemble the faulty execution path, and hence, the search space for the faulty execution path can be narrowed down by using a large number of test cases. To achieve this goal, an efficient algorithm is implemented for finding common subsequences among a set of code sequence covers. Optimization techniques are devised to generate shorter and more logical sequence covers, and to select subsequences with high likelihood of containing the root cause among the set of all possible common subsequences. A hybrid static/dynamic analysis approach is designed to trace back the common subsequences from the end to the root cause. A debugging tool is created to enable developers to use the approach, and integrate it with an existing Integrated Development Environment. The tool is also integrated with the environment's program editors so that developers can benefit from both the tool suggestions, and their source code counterparts. Finally, a comparison between the developed approach and the state-of-the-art techniques shows that developers need only to inspect a small number of lines in order to find the root cause of the fault. Furthermore, experimental evaluation shows that the algorithm optimizations lead to better results in terms of both the algorithm running time and the output subsequence length.

Whiteness and news: the interlocking social construction of "realities"

This dissertation examines how mainstream U.S. journalism consistently serves white racial interests and the racial status quo, or what I call white incumbency, despite its push for diversity and its stated aims to improve coverage of nonwhite communities. It is based on an in-depth ethnographic study of two daily newspapers and extensive one-on-one interviews with 61 journalists. I found that although journalists strongly identify with the need for more diverse coverage in newspapers, they emphasize individual and personal stories that avoid recognition of historical racial power imbalances, exhibiting what Ruth Frankenberg calls power-evasive race cognizance. Journalists also demonstrate a number of often contradictory identifications and self-understandings about themselves and their work, such as commitments to diversity and not taking sides, but these conflicts are almost always resolved in favor of white incumbency. Journalistic conventions and practices, such as the watchdog function and its emphasis on public institutions, routinely produce stories that replay and reinforce racial hegemony by portraying nonwhites as problems or people seeking “special privileges.” Also, journalistic repertoires about those conventions and practices avoid interrogations of journalists’ ongoing complicity in the maintenance of white incumbency.

Life design counseling: A study on client's operations for meaning construction

This study evaluated the adequacy of the micro-theory of client operations to explain meaning construction during Life Design Counseling. Four adolescents were interviewed about their second counseling session. Their recollections were stimulated through the replay of counseling videotapes. The resulting transcribed interviews were qualitatively analyzed. Results confirmed a sequence of client operations evolving from the symbolic representation of experience and reflexive self-examination towards making new realizations and revisioning self. Moreover, clients reported negative and positive session moments evidencing that clients' attention and activity during the session was not restricted to meaning construction operations. Practical implications for life design counseling are derived from the results and discussed.

Life Design Counseling: A study on client's operations for meaning construction

This study evaluates the adequacy of the micro-theory of client operations to explain meaning construction in Life Design Counseling. Four adolescents were interviewed on their second counseling session. Their recollections were stimulated through the replay of counseling videotapes and the resulting transcribed interviews were qualitatively analyzed. Results confirmed a sequence of client operations evolving from the symbolic representation of experience and reflexive self-examination towards making new realizations and revisioning self. Moreover, clients reported negative and positive session moments evidencing that clients’ attention and activity during the session was not restricted to meaning construction operations. Practical implications for life design counseling are derived from the results and discussed.

Reconsidering the role of recorded audio as a rich, flexible and engaging learning space

Audio needs to be recognised as an integral medium capable of extending education’s formal and informal, virtual and physical learning spaces. This paper reconsiders the value of educational podcasting through a review of literature and a module case study. It argues that a pedagogical understanding is needed and challenges technology-centred or teacher-centred understandings of podcasting. It considers the diverse methods being used that enhance and redefine podcasting as a medium for student-centred active learning. The case study shows how audio created a rich learning space by meaningfully connecting tutors, students and those beyond the existing formal study space. The approaches used can be categorised as new types of learning activity, extended connected activity, relocated activity, and recorded ‘captured’ activity which promote learner replay and re-engagement. The paper concludes that the educational use of the recorded voice needs to be reconsidered and reconceptualised so that audio is valued as a manageable, immediate, flexible, potent and engaging medium.