Quality metrics for assessing security-critical computer programs

Existing secure software development principles tend to focus on coding vulnerabilities, such as buffer or integer overflows, that apply to individual program statements, or issues associated with the run-time environment, such as component isolation. Here we instead consider software security from the perspective of potential information flow through a program’s object-oriented module structure. In particular, we define a set of quantifiable "security metrics" which allow programmers to quickly and easily assess the overall security of a given source code program or object-oriented design. Although measuring quality attributes of object-oriented programs for properties such as maintainability and performance has been well-covered in the literature, metrics which measure the quality of information security have received little attention. Moreover, existing securityrelevant metrics assess a system either at a very high level, i.e., the whole system, or at a fine level of granularity, i.e., with respect to individual statements. These approaches make it hard and expensive to recognise a secure system from an early stage of development. Instead, our security metrics are based on well-established compositional properties of object-oriented programs (i.e., data encapsulation, cohesion, coupling, composition, extensibility, inheritance and design size), combined with data flow analysis principles that trace potential information flow between high- and low-security system variables. We first define a set of metrics to assess the security quality of a given object-oriented system based on its design artifacts, allowing defects to be detected at an early stage of development. We then extend these metrics to produce a second set applicable to object-oriented program source code. The resulting metrics make it easy to compare the relative security of functionallyequivalent system designs or source code programs so that, for instance, the security of two different revisions of the same system can be compared directly. This capability is further used to study the impact of specific refactoring rules on system security more generally, at both the design and code levels. By measuring the relative security of various programs refactored using different rules, we thus provide guidelines for the safe application of refactoring steps to security-critical programs. Finally, to make it easy and efficient to measure a system design or program’s security, we have also developed a stand-alone software tool which automatically analyses and measures the security of UML designs and Java program code. The tool’s capabilities are demonstrated by applying it to a number of security-critical system designs and Java programs. Notably, the validity of the metrics is demonstrated empirically through measurements that confirm our expectation that program security typically improves as bugs are fixed, but worsens as new functionality is added.

Characterisation and source identification of selected pollutants in house dust

House dust is a heterogeneous matrix, which contains a number of biological materials and particulate matter gathered from several sources. It is the accumulation of a number of semi-volatile and non-volatile contaminants. The contaminants are trapped and preserved. Therefore, house dust can be viewed as an archive of both the indoor and outdoor air pollution. There is evidence to show that on average, people tend to stay indoors most of the time and this increases exposure to house dust. The aims of this investigation were to: " assess the levels of Polycyclic Aromatic Hydrocarbons (PAHs), elements and pesticides in the indoor environment of the Brisbane area; " identify and characterise the possible sources of elemental constituents (inorganic elements), PAHs and pesticides by means of Positive Matrix Factorisation (PMF); and " establish the correlations between the levels of indoor air pollutants (PAHs, elements and pesticides) with the external and internal characteristics or attributes of the buildings and indoor activities by means of multivariate data analysis techniques. The dust samples were collected during the period of 2005-2007 from homes located in different suburbs of Brisbane, Ipswich and Toowoomba, in South East Queensland, Australia. A vacuum cleaner fitted with a paper bag was used as a sampler for collecting the house dust. A survey questionnaire was filled by the house residents which contained information about the indoor and outdoor characteristics of their residences. House dust samples were analysed for three different pollutants: Pesticides, Elements and PAHs. The analyses were carried-out for samples of particle size less than 250 µm. The chemical analyses for both pesticides and PAHs were performed using a Gas Chromatography Mass Spectrometry (GC-MS), while elemental analysis was carried-out by using Inductively-Coupled Plasma-Mass Spectroscopy (ICP-MS). The data was subjected to multivariate data analysis techniques such as multi-criteria decision-making procedures, Preference Ranking Organisation Method for Enrichment Evaluations (PROMETHEE), coupled with Geometrical Analysis for Interactive Aid (GAIA) in order to rank the samples and to examine data display. This study showed that compared to the results from previous works, which were carried-out in Australia and overseas, the concentrations of pollutants in house dusts in Brisbane and the surrounding areas were relatively very high. The results of this work also showed significant correlations between some of the physical parameters (types of building material, floor level, distance from industrial areas and major road, and smoking) and the concentrations of pollutants. Types of building materials and the age of houses were found to be two of the primary factors that affect the concentrations of pesticides and elements in house dust. The concentrations of these two types of pollutant appear to be higher in old houses (timber houses) than in the brick ones. In contrast, the concentrations of PAHs were noticed to be higher in brick houses than in the timber ones. Other factors such as floor level, and distance from the main street and industrial area, also affected the concentrations of pollutants in the house dust samples. To apportion the sources and to understand mechanisms of pollutants, Positive Matrix Factorisation (PMF) receptor model was applied. The results showed that there were significant correlations between the degree of concentration of contaminants in house dust and the physical characteristics of houses, such as the age and the type of the house, the distance from the main road and industrial areas, and smoking. Sources of pollutants were identified. For PAHs, the sources were cooking activities, vehicle emissions, smoking, oil fumes, natural gas combustion and traces of diesel exhaust emissions; for pesticides the sources were application of pesticides for controlling termites in buildings and fences, treating indoor furniture and in gardens for controlling pests attacking horticultural and ornamental plants; for elements the sources were soil, cooking, smoking, paints, pesticides, combustion of motor fuels, residual fuel oil, motor vehicle emissions, wearing down of brake linings and industrial activities.

Perceptions of charities and the ultimate gift : the use of the Repertory Test to elicit salient bequest decision criteria

This paper reports a practitioner/academic collaboration that sought to identify the attributes salient in the decision-making process of individuals considering a charitable bequest in Australia. Philanthropy scholars concur that bequest making behaviour is generally not well understood or researched and is fertile terrain for new enquiry. They urge scholars and practitioners to integrate learning from other relevant disciplines to reveal new insights and understandings into why so many individuals elect to make a testamentary gift to a charity in their will or other planned giving instrument. This research draws on the branding literature; and effectively trialed the use of Kelly’s (1955) Repertory Test from clinical psychology, the results of which will provide researchers and charity marketing practitioners with an enhanced understanding of bequest decision criteria.

Librarian 2.0 : it’s all in the attitude!

In 2006 Stephen Abram stated that we must “become librarian 2.0 now”. But what is librarian 2.0? This pa- per will present the results of a project that identified the skills, knowledge and attributes required by the successful librarian in the web 2.0 world (and be- yond!). Eighty-one Australian librarians participated in a series of 14 focus groups. Eight themes emerged: technology, communication, team work, user focus, business savvy, evidence based practice, learning, and personal traits.

Risky business : managing creative practice postgraduates through HDR programs

In Australia, as elsewhere, universities are being encouraged to grow their postgraduate research candidature base while at the same time there is increasing pressure on resources with which to manage the burgeoning groups. In this environment HDR supervision strategies are seen as increasingly important as research managers seek the best possible ‘fit’ for an applicant: the candidate who will provide a sound return on investment and demonstrate endurance in the pursuit of a timely completion. As research managers know, the admissions process can be a risky business. The process may be tested further in the context of the new models of doctoral cohort supervision that are being discussed in the higher degree research management sector. The focus of this paper is an examination of the results of investigations of two models of postgraduate cohort supervision in the creative arts Master of Arts research program at QUT with a view to identifying attributes that may be useful for the formation of cohort models of supervision in the doctoral area.

A classification framework for design-build variants from an operational perspective

Design-build (DB) is a generic form of construction procurement, and, rather than simply representing a single system, it has evolved in practice into a variety of forms, each of which is similar to, and yet different from each other. Although the importance of selecting an appropriate DB variant has been widely accepted, difficulties occur in practice due to the multiplicity of terms and concepts used. What is needed is some kind of taxonomy or framework within which the individual variants can be placed and their relative attributes identified and understood. Through a comprehensive literature review and content analysis, this paper establishes a systematic classification framework for DB variants based on their operational attributes. In addition to providing much needed support for decision-making, this classification framework provides client/owners with perspectives to understand and examine different categories of DB variants from an operational perspective.

Hierarchical modeling of perceived collision risks in port fairways

Navigational collisions are one of the major safety concerns in many seaports. Despite the extent of recent works done on port navigational safety research, little is known about harbor pilot’s perception of collision risks in port fairways. This paper uses a hierarchical ordered probit model to investigate associations between perceived risks and the geometric and traffic characteristics of fairways and the pilot attributes. Perceived risk data, collected through a risk perception survey conducted among the Singapore port pilots, are used to calibrate the model. Intra-class correlation coefficient justifies use of the hierarchical model in comparison with an ordinary model. Results show higher perceived risks in fairways attached to anchorages, and in those featuring sharper bends and higher traffic operating speeds. Lesser risks are perceived in fairways attached to shoreline and confined waters, and in those with one-way traffic, traffic separation scheme, cardinal marks and isolated danger marks. Risk is also found to be perceived higher in night.

Root cause analysis with enriched process logs

In the field of process mining, the use of event logs for the purpose of root cause analysis is increasingly studied. In such an analysis, the availability of attributes/features that may explain the root cause of some phenomena is crucial. Currently, the process of obtaining these attributes from raw event logs is performed more or less on a case-by-case basis: there is still a lack of generalized systematic approach that captures this process. This paper proposes a systematic approach to enrich and transform event logs in order to obtain the required attributes for root cause analysis using classical data mining techniques, the classification techniques. This approach is formalized and its applicability has been validated using both self-generated and publicly-available logs.

Disputes in Everyday Life : Social and Moral Orders of Children and Young People

"The research presented in this volume has been undertaken in a range of settings and across ages, to display the rich, varied, and complex aspects of children and young people's everyday lives. The papers contribute to understanding children's disputes, framed as forms of social practice, by closely examining children's talk and interaction in disputes to offer insight into how they arrange their social lives within the context of school, home, neighborhood, correctional, and cafe settings. As such, this volume contributes to an emerging body of edited volumes that investigate children and young people's everyday interactions (Cromdal, 2009; Cromdal & Tholander, in press; Gardner & Forrester, 2010; Goodwin & Kyratzis, 2007; Hutchby & Moran-Ellis, 1998). Each paper has been peer reviewed, by respected researchers of the field, in some cases authors of this volume, and revised. We also thank Charlotte Cobb-Moore who so ably assisted in the final preparation of the manuscripts."---publisher website

Potential retrofitting of existing campus buildings to green buildings

Green building is building that the focus is to maximize the energy efficiency and resources used. While, retrofitting is the process of renovate or refurnish the existing building. Therefore by retrofit existing buildings that comply with green building requirement, it improves the environmental attributes of the buildings. In Malaysia, existing buildings and its communities contribute over 40% of green house gases to the environment. This paper describes a study that explores the potential to retrofit existing campus buildings that response to sustainable green building standard. A validation survey was carried out and the data collected was analysed using SPSS in order to confirm the significance of retrofitting Universiti Teknologi Malaysia (UTM) buildings toward green building initiative. The results show that all the twenty eight identified green elements recorded average index of higher than 3.5 which means that there is significant needs to retrofit the existing buildings to green buildings. This study concludes that it is urgently need for the campus to response to green building requirements in order to achieve higher energy effeciency and this can be done through effective etrofitting of existing buildings.

Analysis of involved parties in port water conflicts

With increasing rate of shipping traffic, the risk of collisions in busy and congested port waters is expected to rise. However, due to low collision frequencies it is difficult to analyze such risk in a sound statistical manner. This study aims at examining the occurrence of traffic conflicts in order to understand the characteristics of vessels involved in navigational hazards. A binomial logit model was employed to evaluate the association of vessel attributes and the kinematic conditions with conflict severity levels. Results show a positive association for vessels of small gross tonnage, overall vessel length, vessel height and draft with conflict risk. Conflicts involving a pair of dynamic vessels sailing at low speeds also have similar effects.

Promoting law student well-being through a first year law subject

-First, the incidence of psychological distress in law students is uncomfortably high. -Second, we cannot identify with precision the exact factors that are causing this psychological distress. -Third, cross sectional studies (by themselves) cannot tell us whether it is law school that is creating these levels of psychological distress, or whether prospective law students already possess these attributes. -Fourth, if law school is somehow causing or contributing to this psychological distress, cross sectional studies (by themselves) cannot tell us when in the law degree psychological distress is most likely to occur.

Fully private revocable predicate encryption

We introduce the concept of Revocable Predicate Encryption (RPE), which extends current predicate encryption setting with revocation support: private keys can be used to decrypt an RPE ciphertext only if they match the decryption policy (defined via attributes encoded into the ciphertext and predicates associated with private keys) and were not revoked by the time the ciphertext was created. We formalize the notion of attribute hiding in the presence of revocation and propose an RPE scheme, called AH-RPE, which achieves attribute-hiding under the Decision Linear assumption in the standard model. We then present a stronger privacy notion, termed full hiding, which further cares about privacy of revoked users. We propose another RPE scheme, called FH-RPE, that adopts the Subset Cover Framework and offers full hiding under the Decision Linear assumption in the standard model. The scheme offers very flexible privacy-preserving access control to encrypted data and can be used in sender-local revocation scenarios.

A toolbox for animal call recognition

Monitoring the natural environment is increasingly important as habit degradation and climate change reduce theworld’s biodiversity.We have developed software tools and applications to assist ecologists with the collection and analysis of acoustic data at large spatial and temporal scales.One of our key objectives is automated animal call recognition, and our approach has three novel attributes. First, we work with raw environmental audio, contaminated by noise and artefacts and containing calls that vary greatly in volume depending on the animal’s proximity to the microphone. Second, initial experimentation suggested that no single recognizer could dealwith the enormous variety of calls. Therefore, we developed a toolbox of generic recognizers to extract invariant features for each call type. Third, many species are cryptic and offer little data with which to train a recognizer. Many popular machine learning methods require large volumes of training and validation data and considerable time and expertise to prepare. Consequently we adopt bootstrap techniques that can be initiated with little data and refined subsequently. In this paper, we describe our recognition tools and present results for real ecological problems.

Deviance and Crime: Theory, Research and Policy

This book sensitizes the reader to the fact that there is substantial disagreement within the academic community, and among policymakers and the general public, over what behaviors, conditions (e.g., physical attributes), and people should be designated as deviant or criminal. Normative conceptions, the societal reaction/labeling approach, and the critical approach are offered as frameworks within which to study these definitions. A comprehensive explanation of theory and social policy on deviance is constructed.