Reconstruction of falsified computer logs for digital forensics investigations

Digital forensics investigations aim to find evidence that helps confirm or disprove a hypothesis about an alleged computer-based crime. However, the ease with which computer-literate criminals can falsify computer event logs makes the prosecutor's job highly challenging. Given a log which is suspected to have been falsified or tampered with, a prosecutor is obliged to provide a convincing explanation for how the log may have been created. Here we focus on showing how a suspect computer event log can be transformed into a hypothesised actual sequence of events, consistent with independent, trusted sources of event orderings. We present two algorithms which allow the effort involved in falsifying logs to be quantified, as a function of the number of `moves' required to transform the suspect log into the hypothesised one, thus allowing a prosecutor to assess the likelihood of a particular falsification scenario. The first algorithm always produces an optimal solution but, for reasons of efficiency, is suitable for short event logs only. To deal with the massive amount of data typically found in computer event logs, we also present a second heuristic algorithm which is considerably more efficient but may not always generate an optimal outcome.

Multi-sensor tracking using a scalable condensation filter

Surveillance and tracking systems typically use a single colour modality for their input. These systems work well in controlled conditions but often fail with low lighting, shadowing, smoke, dust, unstable backgrounds or when the foreground object is of similar colouring to the background. With advances in technology and manufacturing techniques, sensors that allow us to see into the thermal infrared spectrum are becoming more affordable. By using modalities from both the visible and thermal infrared spectra, we are able to obtain more information from a scene and overcome the problems associated with using visible light only for surveillance and tracking. Thermal images are not affected by lighting or shadowing and are not overtly affected by smoke, dust or unstable backgrounds. We propose and evaluate three approaches for fusing visual and thermal images for person tracking. We also propose a modified condensation filter to track and aid in the fusion of the modalities. We compare the proposed fusion schemes with using the visual and thermal domains on their own, and demonstrate that significant improvements can be achieved by using multiple modalities.

Multi-spectral fusion for surveillance systems

Surveillance systems such as object tracking and abandoned object detection systems typically rely on a single modality of colour video for their input. These systems work well in controlled conditions but often fail when low lighting, shadowing, smoke, dust or unstable backgrounds are present, or when the objects of interest are a similar colour to the background. Thermal images are not affected by lighting changes or shadowing, and are not overtly affected by smoke, dust or unstable backgrounds. However, thermal images lack colour information which makes distinguishing between different people or objects of interest within the same scene difficult. ----- By using modalities from both the visible and thermal infrared spectra, we are able to obtain more information from a scene and overcome the problems associated with using either modality individually. We evaluate four approaches for fusing visual and thermal images for use in a person tracking system (two early fusion methods, one mid fusion and one late fusion method), in order to determine the most appropriate method for fusing multiple modalities. We also evaluate two of these approaches for use in abandoned object detection, and propose an abandoned object detection routine that utilises multiple modalities. To aid in the tracking and fusion of the modalities we propose a modified condensation filter that can dynamically change the particle count and features used according to the needs of the system. ----- We compare tracking and abandoned object detection performance for the proposed fusion schemes and the visual and thermal domains on their own. Testing is conducted using the OTCBVS database to evaluate object tracking, and data captured in-house to evaluate the abandoned object detection. Our results show that significant improvement can be achieved, and that a middle fusion scheme is most effective.

Object tracking using multiple motion modalities

This paper presents an object tracking system that utilises a hybrid multi-layer motion segmentation and optical flow algorithm. While many tracking systems seek to combine multiple modalities such as motion and depth or multiple inputs within a fusion system to improve tracking robustness, current systems have avoided the combination of motion and optical flow. This combination allows the use of multiple modes within the object detection stage. Consequently, different categories of objects, within motion or stationary, can be effectively detected utilising either optical flow, static foreground or active foreground information. The proposed system is evaluated using the ETISEO database and evaluation metrics and compared to a baseline system utilising a single mode foreground segmentation technique. Results demonstrate a significant improvement in tracking results can be made through the incorporation of the additional motion information.

Labelled silhouettes for human pose estimation

This paper proposes a new method of using foreground silhouette images for human pose estimation. Labels are introduced to the silhouette images, providing an extra layer of information that can be used in the model fitting process. The pixels in the silhouettes are labelled according to the corresponding body part in the model of the current fit, with the labels propagated into the silhouette of the next frame to be used in the fitting for the next frame. Both single and multi-view implementations are detailed, with results showing performance improvements over only using standard unlabelled silhouettes.

Evaluation of aerial remote sensing techniques for vegetation management in power line corridors

The following paper presents an evaluation of airborne sensors for use in vegetation management in powerline corridors. Three integral stages in the management process are addressed including, the detection of trees, relative positioning with respect to the nearest powerline and vegetation height estimation. Image data, including multi-spectral and high resolution, are analyzed along with LiDAR data captured from fixed wing aircraft. Ground truth data is then used to establish the accuracy and reliability of each sensor thus providing a quantitative comparison of sensor options. Tree detection was achieved through crown delineation using a Pulse-Coupled Neural Network (PCNN) and morphologic reconstruction applied to multi-spectral imagery. Through testing it was shown to achieve a detection rate of 96%, while the accuracy in segmenting groups of trees and single trees correctly was shown to be 75%. Relative positioning using LiDAR achieved a RMSE of 1.4m and 2.1m for cross track distance and along track position respectively, while Direct Georeferencing achieved RMSE of 3.1m in both instances. The estimation of pole and tree heights measured with LiDAR had a RMSE of 0.4m and 0.9m respectively, while Stereo Matching achieved 1.5m and 2.9m. Overall a small number of poles were missed with detection rates of 98% and 95% for LiDAR and Stereo Matching.

A model for computer profiling

This paper discusses the use of models in automatic computer forensic analysis, and proposes and elaborates on a novel model for use in computer profiling, the computer profiling object model. The computer profiling object model is an information model which models a computer as objects with various attributes and inter-relationships. These together provide the information necessary for a human investigator or an automated reasoning engine to make judgements as to the probable usage and evidentiary value of a computer system. The computer profiling object model can be implemented so as to support automated analysis to provide an investigator with the information needed to decide whether manual analysis is required.

Vision-based topological mapping and localisation

Competent navigation in an environment is a major requirement for an autonomous mobile robot to accomplish its mission. Nowadays, many successful systems for navigating a mobile robot use an internal map which represents the environment in a detailed geometric manner. However, building, maintaining and using such environment maps for navigation is difficult because of perceptual aliasing and measurement noise. Moreover, geometric maps require the processing of huge amounts of data which is computationally expensive. This thesis addresses the problem of vision-based topological mapping and localisation for mobile robot navigation. Topological maps are concise and graphical representations of environments that are scalable and amenable to symbolic manipulation. Thus, they are well-suited for basic robot navigation applications, and also provide a representational basis for the procedural and semantic information needed for higher-level robotic tasks. In order to make vision-based topological navigation suitable for inexpensive mobile robots for the mass market we propose to characterise key places of the environment based on their visual appearance through colour histograms. The approach for representing places using visual appearance is based on the fact that colour histograms change slowly as the field of vision sweeps the scene when a robot moves through an environment. Hence, a place represents a region of the environment rather than a single position. We demonstrate in experiments using an indoor data set, that a topological map in which places are characterised using visual appearance augmented with metric clues provides sufficient information to perform continuous metric localisation which is robust to the kidnapped robot problem. Many topological mapping methods build a topological map by clustering visual observations to places. However, due to perceptual aliasing observations from different places may be mapped to the same place representative in the topological map. A main contribution of this thesis is a novel approach for dealing with the perceptual aliasing problem in topological mapping. We propose to incorporate neighbourhood relations for disambiguating places which otherwise are indistinguishable. We present a constraint based stochastic local search method which integrates the approach for place disambiguation in order to induce a topological map. Experiments show that the proposed method is capable of mapping environments with a high degree of perceptual aliasing, and that a small map is found quickly. Moreover, the method of using neighbourhood information for place disambiguation is integrated into a framework for topological off-line simultaneous localisation and mapping which does not require an initial categorisation of visual observations. Experiments on an indoor data set demonstrate the suitability of our method to reliably localise the robot while building a topological map.

Is there an optimal board size?

This research quantitatively examines the determinants of board size and the consequence it has on the performance of large companies in Australia. In line with international and the prevalent United States research the results suggest that there is no significant relationship between board size and their subsequent performance. In examining whether more complex operations require larger boards it was found that larger firms or firms with more lines of business tended to have more directors. Data analysis from the research supports the proposition that blockholders could affect management practices and that they enhances performance as measured by shareholder return.

Are East Asian companies benefiting from western board practices?

Since the Asian crisis, East Asian nations have strived to introduce corporate governance codes, directing companies how to best improve their corporate governance practices. However, these codes have not been universally accepted by East Asian companies. This study examines the adoption of major board-related corporate governance recommendations by large nonfinancial companies in seven East Asian nations and investigates whether improvements in these board governance mechanisms have been associated with increased operating performance and market value. The results indicate that family-owned companies started with worse board governance and have been least likely to improve their board governance since the crisis. Overall, bigger, faster growing, non-family-owned companies with less concentrated ownership have been more likely to improve their board governance. Splitting of the positions of Chairman and CEO, creation of audit and nomination committees and improvements in overall board governance were found to have a positive relationship with subsequent operating performance and/or market value.

One-time-password-authenticated key exchange

To reduce the damage of phishing and spyware attacks, banks, governments, and other security-sensitive industries are deploying one-time password systems, where users have many passwords and use each password only once. If a single password is compromised, it can be only be used to impersonate the user once, limiting the damage caused. However, existing practical approaches to one-time passwords have been susceptible to sophisticated phishing attacks. ---------- We give a formal security treatment of this important practical problem. We consider the use of one-time passwords in the context of password-authenticated key exchange (PAKE), which allows for mutual authentication, session key agreement, and resistance to phishing attacks. We describe a security model for the use of one-time passwords, explicitly considering the compromise of past (and future) one-time passwords, and show a general technique for building a secure one-time-PAKE protocol from any secure PAKE protocol. Our techniques also allow for the secure use of pseudorandomly generated and time-dependent passwords.

Studio game-on

The studio-gameon event was supported by the Institute of the Creative Industries and Innovation and the Faculty of IT as part of the State Library of Queensland GAME ON exhibition (ex Barbican, UK) The studio produced a full game in six weeks. It was a curated event, a live web-based exhibition, a performance for the public and the team produced a digital / creative work which is available for download. The studio enabled a team of students to experience the pressures of a real game studio within the space of the precincts but also very much in the public eye. It was a physical hypothesis of the University's mantra - "for the real world" statement: Studio GameOn is an opportunity running alongside the GAME ON exhibition at the State Library of Queensland. The exhibition itself is open to the public from November 17th through to February 15th. The studio runs from January 5th to February 13th 2009. The Studio GameOn challenge? To put together a team of game developers and make a playable game in six weeks! The studio-game on team consists of a group of game developers in training - the team members are all students who are either half-way through or completing a qualification in game design and all its elements - we have designers, artists, programmers and productionteam members. We are also fortunate to have an Industry Board consisting of local Queensland Games professionals: John Passfield (Red Sprite Studios), Adrian Cook (WIldfire Studios) and Duncan Curtis and Marko Grgic (The 3 Blokes). We also invite the public to play with us - there is an ideas box both on-site at the State Library and a number of ways to communicate with us on this studio website.

Food insecurity in Brisbane : the single mother’s struggle

Using a feminist reflexive approach this paper reports on interviews with single mother’s in the Brisbane area about their experiences with food shopping and household food security. Preliminary findings suggest that most experience significant stress around the amount of money they have available for food. As the price of food and other costs of living increase, the only budget item that is flexible – groceries - is squeezed tighter. All women expressed a reluctance to ask for help from strangers at agencies instead relying on the support of family and friends to keep them food secure. Sometimes family and friends had no spare resources to help or were not aware of the extent their friend or relative might be struggling. The increased risks of poverty and food insecurity mean many go without as feeding the children takes precedence. The quality of their diets is variable with many reporting on aiming for quantity rather than being concerned with nutritional balance. Exhaustion and stress from being over-committed doing three roles, mother, father and housekeeper was self-identified as a key factor leading to mental health conditions such as depression, burnout and break down. Female single parent households are vulnerable to reducing welfare benefits as children grow or child support changes. Current policy forces single parents out to work but many can only manage part-time work for lower wages and are barely able to cope with this extra burden often resenting the reduction in benefits it brings. Public perceptions, derision and the notions of choice surrounding single parenting leave the cohort divided and silent for fear of reprisals. In my investigation issues arise about welfare policy that keep benefits low and workplace patriarchal power that can contribute to systemic poverty and the widening of the gender gap in poverty. So far analysis suggests a better support system around community food security including some hands on home help services, nutritional information, cooking classes, community gardening and other social capital building activities are needed for these women in order to avoid long-term health problems and help them better care for the next generation.

On the use of different spatial reference frames for movement control

Previous work has shown that amplitude and direction are two independently controlled parameters of aimed arm movements, and performance, therefore, suffers when they must be decomposed into Cartesian coordinates. We now compare decomposition into different coordinate systems. Subjects pointed at visual targets in 2-D with a cursor, using a two-axis joystick or two single-axis joysticks. In the latter case, joystick axes were aligned with the subjects’ body axes, were rotated by –45°, or were oblique (i.e., one axis was in an egocentric frame and the other was rotated by –45°). Cursor direction always corresponded to joystick direction. We found that compared with the two-axis joystick, responses with single-axis joysticks were slower and less accurate when the axes were oriented egocentrically; the deficit was even more pronounced when the axes were rotated and was most pronounced when they were oblique. This confirms that decomposition of motor commands is computationally demanding and documents that this demand is lowest for egocentric, higher for rotated, and highest for oblique coordinates. We conclude that most current vehicles use computationally demanding man–machine interfaces.

Modelling the broadband wireless channel in rural Australia

The internet infrastructure which supports high data rates has a major impact on the Australian economy and the world. However, in rural Australia, the provision of broadband services to an internet dispersed population over a large geographical area with low population densities remains both an economic and technical challenge [1]. Furthermore, the implementation of currently available technologies such as fibre-to-the-premise (FTTP), 3G, 4G and WiMAX seems to be impractical, considering the low population density that is distributed in a large area. Therefore, new paradigms and innovative telecommunication technologies need to be explored to overcome the challenges of providing faster and more reliable broadband internet services to internet dispersed rural areas. The research project implements an innovative Multi-User- Single-Antenna for MIMO (MUSA-MIMO) technology using the spectrum currently allocated to analogue TV. MUSAMIMO technology can be considered as a special case of MIMO technology, which is beneficial when provisioning reliable and high-speed communication channels. Particularly, the abstract describes the development of a novel MUSA-MIMO channel model that takes into account temporal variations in the rural wireless environment. This can be considered as a novel approach tailor-made to rural Australia for provisioning efficient wireless broadband communications.