Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Managing infrastructure transitions : a complex adaptive systems perspective

Engineering assets such as roads, rail, bridges and other forms of public works are vital to the effective functioning of societies {Herder, 2006 #128}. Proficient provision of this physical infrastructure is therefore one of the key activities of government {Lædre, 2006 #123}. In order to ensure engineering assets are procured and maintained on behalf of citizens, government needs to devise the appropriate policy and institutional architecture for this purpose. The changing institutional arrangements around the procurement of engineering assets are the focus of this paper. The paper describes and analyses the transition to new, more collaborative forms of procurement arrangements which are becoming increasingly prevalent in Australia and other OECD countries. Such fundamental shifts from competitive to more collaborative approaches to project governance can be viewed as a major transition in procurement system arrangements. In many ways such changes mirror the shift from New Public Management, with its emphasis on the use of market mechanisms to achieve efficiencies {Hood, 1991 #166}, towards more collaborative approaches to service delivery, such as those under network governance arrangements {Keast, 2007 #925}. However, just as traditional forms of procurement in a market context resulted in unexpected outcomes for industry, such as a fragmented industry afflicted by chronic litigation {Dubois, 2002 #9}, the change to more collaborative forms of procurement is unlikely to be a panacea to the problems of procurement, and may well also have unintended consequences. This paper argues that perspectives from complex adaptive systems (CAS) theory can contribute to the theory and practice of managing system transitions. In particular the concept of emergence provides a key theoretical construct to understand the aggregate effect that individual project governance arrangements can have upon the structure of specific industries, which in turn impact individual projects. Emergence is understood here as the macro structure that emerges out of the interaction of agents in the system {Holland, 1998 #100; Tang, 2006 #51}.

Paramedic knowledge of infectious disease aetiology and transmission in an Australian Emergency Medical System

Introduction: Paramedics and other emergency health workers are exposed to infectious disease particularly when undertaking exposure-prone procedures as a component of their everyday practice. This study examined paramedic knowledge of infectious disease aetiology and transmission in the pre-hospital care environment.--------- Methods: A mail survey of paramedics from an Australian ambulance service (n=2274) was conducted.--------- Results: With a response rate of 55.3% (1258/2274), the study demonstrated that paramedic knowledge of infectious disease aetiology and modes of transmission was poor. Of the 25 infectious diseases included in the survey, only three aetiological agents were correctly identified by at least 80% of respondents. The most accurate responses for aetiology of individual infectious diseases were for HIV/AIDS (91.4%), influenza (87.4%), and hepatitis B (85.7%). Poorest results were observed for pertussis, infectious mononucleosis, leprosy, dengue fever, Japanese B encephalitis and vancomycin resistant enterococcus (VRE), all with less than half the sample providing a correct response. Modes of transmission of significant infectious diseases were also assessed. Most accurate responses were found for HIV/AIDS (85.8%), salmonella (81.9%) and influenza (80.1%). Poorest results were observed for infectious mononucleosis, diphtheria, shigella, Japanese B encephalitis, vancomycin resistant enterococcus, meningococcal meningitis, rubella and infectious mononucleosis, with less than a third of the sample providing a correct response.--------- Conclusions: Results suggest that knowledge of aetiology and transmission of infectious disease is generally poor amongst paramedics. A comprehensive in-service education infection control programs for paramedics with emphasis on infectious disease aetiology and transmission is recommended.

Predicting behaviour to reduce stroke risk in at-risk populations : the role of beliefs

Aims: Changing behaviour to reduce stroke risk is a difficult prospect made particularly complex because of psychological factors. This study examined predictors of intentions and behaviours to reduce stroke risk in a sample of at-risk individuals, seeking to find how knowledge and health beliefs influenced both intention and actual behaviour to reduce stroke risk. Methods: A repeated measures design was used to assess behavioural intentions at time 1 (T1) and subsequent behaviour (T2). One hundred and twenty six respondents completed an online survey at T1, and behavioural follow-up data were collected from approximately 70 participants 1 month later. Predictors were stroke knowledge, demographic variables, and beliefs about stroke that were derived from an expanded health belief model. Dependent measures were: exercise and weight loss, and intention to engage in these behaviours to reduce stroke risk. Findings: Multiple hierarchical regression analyses showed that, for exercise and weight loss respectively, different health beliefs predicted intention to control stroke risk. The most important exercise-related health beliefs were benefits, susceptibility, and self-efficacy; for weight loss, the most important beliefs were barriers, and to a lesser degree, susceptibility and subjective norm. Conclusions: Health beliefs may play an important role in stroke prevention, particularly beliefs about susceptibility because these emerged for both behaviours. Stroke education and prevention programmes that selectively target the health beliefs relevant to specific behaviours may prove most efficacious.

The organisation of action in complex neurobiological systems

This chapter elucidates key ideas behind neurocomputational and ecological dynamics and perspectives of understanding the organisation of action in complex neurobiological systems. The need to study the close link between neurobiological systems and their environments (particularly their sensory and movement subsystems and the surrounding energy sources) is advocated. It is proposed how degeneracy in complex neurobiological systems provides the basis for functional variability in organisation of action. In such systems processes of cognition and action facilitate the specific interactions of each performer with particular task and environmental constraints.

Increasing stochastic perturbations enhances acquisition and learning of complex sport movements

Traditionally, the aquisition of skills and sport movement has been characterised by numerous repetitions of presumed model movement pattern to be acquired by learners. This approach has been questioned by research identifying the presence of individualised movement patterns and the low probability of occurrence of two identical movements within and between individuals. In contrast, the differential learning approach claims advantage for incurring variability in the learning process by adding stochastic perturbations during practice. These ideas are exemplified by data from a high jump experiment which compared the effectiveness of classical and a differential training approach with pre-post test design. Results showed clear advantages for the group with additional stochastic perturbation during the aquisition phase in comparison to classically trained athletes. Analogies to similar phenomenological effects in the neurobiological literature are discussed.

The problem of measurement indeterminacy in complex neurobiological movement systems

In the study of complex neurobiological movement systems, measurement indeterminacy has typically been overcome by imposing artificial modelling constraints to reduce the number of unknowns (e.g., reducing all muscle, bone and ligament forces crossing a joint to a single vector). However, this approach prevents human movement scientists from investigating more fully the role, functionality and ubiquity of coordinative structures or functional motor synergies. Advancements in measurement methods and analysis techniques are required if the contribution of individual component parts or degrees of freedom of these task-specific structural units is to be established, thereby effectively solving the indeterminacy problem by reducing the number of unknowns. A further benefit of establishing more of the unknowns is that human movement scientists will be able to gain greater insight into ubiquitous processes of physical self-organising that underpin the formation of coordinative structures and the confluence of organismic, environmental and task constraints that determine the exact morphology of these special-purpose devices.

Corneal confocal microscopy : a novel noninvasive means to diagnose neuropathy in patients with Fabry disease

ABSTRACT: Neuropathy is a cause of significant disability in patients with Fabry disease, yet its diagnosis is difficult. In this study we compared the novel noninvasive techniques of corneal confocal microscopy (CCM) to quantify small-fiber pathology, and non-contact corneal esthesiometry (NCCA) to quantify loss of corneal sensation, with established tests of neuropathy in patients with Fabry disease. Ten heterozygous females with Fabry disease not on enzyme replacement therapy (ERT), 6 heterozygous females, 6 hemizygous males on ERT, and 14 age-matched, healthy volunteers underwent detailed quantification of neuropathic symptoms, neurological deficits, neurophysiology, quantitative sensory testing (QST), NCCA, and CCM. All patients with Fabry disease had significant neuropathic symptoms and an elevated Mainz score. Peroneal nerve amplitude was reduced in all patients and vibration perception threshold was elevated in both male and female patients on ERT. Cold sensation (CS) threshold was significantly reduced in both male and female patients on ERT (P < 0.02), but warm sensation (WS)and heat-induced pain (HIP) were only significantly increased in males onERT (P<0.01). However, corneal sensation assessed withNCCAwas significantly reduced in female (P < 0.02) and male (P < 0.04) patients on ERT compared with control subjects. According to CCM, corneal nerve fiber and branch density was significantly reduced in female (P < 0.03) and male (P < 0.02) patients on ERT compared with control subjects. Furthermore, the severity of neuropathic symptoms and the neurological component of the Mainz Severity Score Index correlated significantly with QSTand CCM. This study shows that CCM and NCCA provide a novel means to detect early nerve fiber damage and dysfunction, respectively, in patients with Fabry disease.

Monitoring the Performance of Complex Projects from Multiple Perspectives over Multiple Time Frames

When complex projects go wrong they can go horribly wrong with severe financial consequences. We are undertaking research to develop leading performance indicators for complex projects, metrics to provide early warning of potential difficulties. The assessment of success of complex projects can be made by a range of stakeholders over different time scales, against different levels of project results: the project’s outputs at the end of the project; the project’s outcomes in the months following project completion; and the project’s impact in the years following completion. We aim to identify leading performance indicators, which may include both success criteria and success factors, and which can be measured by the project team during project delivery to forecast success as assessed by key stakeholders in the days, months and years following the project. The hope is the leading performance indicators will act as alarm bells to show if a project is diverting from plan so early corrective action can be taken. It may be that different combinations of the leading performance indicators will be appropriate depending on the nature of project complexity. In this paper we develop a new model of project success, whereby success is assessed by different stakeholders over different time frames against different levels of project results. We then relate this to measurements that can be taken during project delivery. A methodology is described to evaluate the early parts of this model. Its implications and limitations are described. This paper describes work in progress.

Fingerprinting of complex mixtures with the use of high performance liquid chromatography, inductively coupled plasma atomic emission spectroscopy and chemometrics

The molecular and metal profile fingerprints were obtained from a complex substance, Atractylis chinensis DC—a traditional Chinese medicine (TCM), with the use of the high performance liquid chromatography (HPLC) and inductively coupled plasma atomic emission spectroscopy (ICP-AES) techniques. This substance was used in this work as an example of a complex biological material, which has found application as a TCM. Such TCM samples are traditionally processed by the Bran, Cut, Fried and Swill methods, and were collected from five provinces in China. The data matrices obtained from the two types of analysis produced two principal component biplots, which showed that the HPLC fingerprint data were discriminated on the basis of the methods for processing the raw TCM, while the metal analysis grouped according to the geographical origin. When the two data matrices were combined into a one two-way matrix, the resulting biplot showed a clear separation on the basis of the HPLC fingerprints. Importantly, within each different grouping the objects separated according to their geographical origin, and they ranked approximately in the same order in each group. This result suggested that by using such an approach, it is possible to derive improved characterisation of the complex TCM materials on the basis of the two kinds of analytical data. In addition, two supervised pattern recognition methods, K-nearest neighbors (KNNs) method, and linear discriminant analysis (LDA), were successfully applied to the individual data matrices—thus, supporting the PCA approach.

Ghrelin gene-related peptides : multifunctional endocrine/autocrine modulators in health and disease

Ghrelin is a multi-functional peptide hormone which affects various processes including growth hormone and insulin release, appetite regulation, gut motility, metabolism and cancer cell proliferation. Ghrelin is produced in the stomach and in other normal and pathological cell types. It may act as an endocrine or autocrine/paracrine factor. The ghrelin gene encodes a precursor protein, preproghrelin, from which ghrelin and other potentially active peptides are derived by alternative mRNA splicing and/or proteolytic processing. The metabolic role of the peptide obestatin, derived from the preproghrelin C-terminal region, is controversial. However, it has direct effects on cancer cell proliferation. The regulation of ghrelin expression and the mechanisms through which the peptide products arise are unclear. We have recently re-examined the organisation of the ghrelin gene and identified several novel exons and transcripts. One transcript, which lacks the ghrelin-coding region of preproghrelin, contains the coding sequence of obestatin. Furthermore, we have identified an overlapping gene on the antisense strand of ghrelin, GHRLOS, which generates transcripts that may function as non-coding regulatory RNAs or code for novel, short bioactive peptides. The identification of these novel ghrelin-gene related transcripts and peptides raises critical questions regarding their physiological function and their role in obesity, diabetes and cancer.

Clinical efficacy and safety of zoledronic acid in osteoporosis and Paget's disease

Osteoporosis and Paget’s bone disease are the most common diseases of the bone. In addition to glucocorticoid treatment, there are many other secondary causes of osteoporosis. Bisphosphonates are used to treat these bone conditions. Zoledronic acid is the most potent bisphosphonate at inhibiting bone resorption. In osteoporosis, zoledronic acid increases bone mineral density for at least 1 year following a single intravenous administration. The efficacy and safety of zoledronic acid in the treatment of osteoporosis and Paget’s bone disease are reviewed. This article also covers the studies of the effects of zoledronic acid in the bone loss associated with the secondary osteoporosis.

Vitamin D in health and disease : an insight into traditional functions and new roles for the 'sunshine vitamin'

Vitamin D is unique among the vitamins in that humans can synthesize it via the action of UV radiation upon the skin. This combined with its ability to act on specific target tissues via Vitamin D Receptor’s (VDR) make its classification as a steroid hormone more appropriate. While Vitamin D deficiency is a recognized problem in some northern latitude countries, recent studies have shown even in sunny countries such as Australia, vitamin D deficiency may be more prevalent than first thought. Vitamin D is most well known for its role in bone health, however, the discovery of VDR’s on a wide variety of tissue types has also opened up roles for vitamin D far beyond traditional bone health. These include possible associations with autoimmune diseases such as multiple sclerosis and inflammatory bowel diseases, cancer, cardiovascular diseases and muscle strength. Firstly, this paper presents an overview of the two sources of vitamin D: exposure to ultraviolet-B radiation and food sources of vitamin D, with particular focus on both Australian and international studies on dietary vitamin D intake and national fortification strategies. Secondly, the paper reviews recent epidemiological and experimental evidence linking vitamin D and its role in health and disease for the major conditions linked to suboptimal vitamin D, while identifying significant gaps in the research and possible future directions for research.

Linkage and heritability analysis of migraine symptom groupings: A comparison of three different clustering methods on twin data

Migraine is a painful disorder for which the etiology remains obscure. Diagnosis is largely based on International Headache Society criteria. However, no feature occurs in all patients who meet these criteria, and no single symptom is required for diagnosis. Consequently, this definition may not accurately reflect the phenotypic heterogeneity or genetic basis of the disorder. Such phenotypic uncertainty is typical for complex genetic disorders and has encouraged interest in multivariate statistical methods for classifying disease phenotypes. We applied three popular statistical phenotyping methods—latent class analysis, grade of membership and grade of membership “fuzzy” clustering (Fanny)—to migraine symptom data, and compared heritability and genome-wide linkage results obtained using each approach. Our results demonstrate that different methodologies produce different clustering structures and non-negligible differences in subsequent analyses. We therefore urge caution in the use of any single approach and suggest that multiple phenotyping methods be used.

Inequalities in cardiovascular disease mortality : the role of behavioural, physiological and social risk factors

Background: While the relationship between socioeconomic disadvantage and cardiovascular disease (CVD) is well established, the role that traditional cardiovascular risk factors play in this association remains unclear. We examined the association between education attainment and CVD mortality and the extent to which behavioural, social and physiological factors explained this relationship. Methods: Adults (n=38 355) aged 40-69 years living in Melbourne, Australia were recruited in 1990-1994. Subjects with baseline CVD risk factor data ascertained through questionnaire and physical measurement were followed for an average of 9.4 years with CVD deaths verified by review of medical records and autopsy reports. Results: CVD mortality was higher for those with primary education only compared to those who had completed tertiary education, with a hazard ratio (HR) of 1.66 (95% confidence interval [CI] 1.11-2.49) after adjustment for age, country of birth and gender. Those from the lowest educated group had a more adverse cardiovascular risk factor profile compared to the highest educated group, and adjustment for these risk factors reduced the HR to 1.18 (95% CI 0.78-1.77). In analysis of individual risk factors, smoking and waist circumference explained most of the difference in CVD mortality between the highest and lowest education groups. Conclusions: Most of the excess CVD mortality in lower socioeconomic groups can be explained by known risk factors, particularly smoking and overweight. While targeting cardiovascular risk factors should not divert efforts from addressing the underlying determinants of health inequalities, it is essential that known risk factors are addressed effectively among lower socioeconomic groups.