Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Contraceptive changes after reproductive events among Australian women born in 1973 to 1978: A longitudinal study from 1996 to 2009

Background Women change contraception as they try to conceive, space births, and limit family size. This longitudinal analysis examines contraception changes after reproductive events such as birth, miscarriage or termination among Australian women born from 1973 to 1978 to identify potential opportunities to increase the effectiveness of contraceptive information and service provision. Methods Between 1996 and 2009, 5,631 Australian women randomly sampled from the Australian universal health insurance (Medicare) database completed five self-report postal surveys. Three longitudinal logistic regression models were used to assess the associations between reproductive events (birth only, birth and miscarriage, miscarriage only, termination only, other multiple events, and no new event) and subsequent changes in contraceptive use (start using, stop using, switch method) compared with women who continued to use the same method. Results After women experienced only a birth, or a birth and a miscarriage, they were more likely to start using contraception. Women who experienced miscarriages were more likely to stop using contraception. Women who experienced terminations were more likely to switch methods. There was a significant interaction between reproductive events and time indicating more changes in contraceptive use as women reach their mid-30s. Conclusion Contraceptive use increases after the birth of a child, but decreases after miscarriage indicating the intention for family formation and spacing between children. Switching contraceptive methods after termination suggests these pregnancies were unintended and possibly due to contraceptive failure. Women’s contact with health professionals around the time of reproductive events provides an opportunity to provide contraceptive services.

Risk factors to predict the incidence of surgical adverse events following open or laparoscopic surgery for apparent early stage endometrial cancer: results from a randomised controlled trial

Aims: To identify risk factors for major Adverse Events (AEs) and to develop a nomogram to predict the probability of such AEs in individual patients who have surgery for apparent early stage endometrial cancer. Methods: We used data from 753 patients who were randomized to either total laparoscopic hysterectomy or total abdominal hysterectomy in the LACE trial. Serious adverse events that prolonged hospital stay or postoperative adverse events (using common terminology criteria 3+, CTCAE V3) were considered major AEs. We analyzed pre-surgical characteristics that were associated with the risk of developing major AEs by multivariate logistic regression. We identified a parsimonious model by backward stepwise logistic regression. The six most significant or clinically important variables were included in the nomogram to predict the risk of major AEs within 6 weeks of surgery and the nomogram was internally validated. Results: Overall, 132 (17.5%) patients had at least one major AE. An open surgical approach (laparotomy), higher Charlson’s medical co-morbidities score, moderately differentiated tumours on curettings, higher baseline ECOG score, higher body mass index and low haemoglobin levels were associated with AE and were used in the nomogram. The bootstrap corrected concordance index of the nomogram was 0.63 and it showed good calibration. Conclusions: Six pre-surgical factors independently predicted the risk of major AEs. This research might form the basis to develop risk reduction strategies to minimize the risk of AEs among patients undergoing surgery for apparent early stage endometrial cancer.

Detecting distributed Denial-of-Service attacks and Flash Events

This thesis investigates and develops techniques for accurately detecting Internet-based Distributed Denial-of-Service (DDoS) Attacks where an adversary harnesses the power of thousands of compromised machines to disrupt the normal operations of a Web-service provider, resulting in significant down-time and financial losses. This thesis also develops methods to differentiate these attacks from similar-looking benign surges in web-traffic known as Flash Events (FEs). This thesis also addresses an intrinsic challenge in research associated with DDoS attacks, namely, the extreme scarcity of public domain datasets (due to legal and privacy issues) by developing techniques to realistically emulate DDoS attack and FE traffic.

Detecting anomalous events at railway level crossings

Collisions between pedestrians and vehicles continue to be a major problem throughout the world. Pedestrians trying to cross roads and railway tracks without any caution are often highly susceptible to collisions with vehicles and trains. Continuous financial, human and other losses have prompted transport related organizations to come up with various solutions addressing this issue. However, the quest for new and significant improvements in this area is still ongoing. This work addresses this issue by building a general framework using computer vision techniques to automatically monitor pedestrian movements in such high-risk areas to enable better analysis of activity, and the creation of future alerting strategies. As a result of rapid development in the electronics and semi-conductor industry there is extensive deployment of CCTV cameras in public places to capture video footage. This footage can then be used to analyse crowd activities in those particular places. This work seeks to identify the abnormal behaviour of individuals in video footage. In this work we propose using a Semi-2D Hidden Markov Model (HMM), Full-2D HMM and Spatial HMM to model the normal activities of people. The outliers of the model (i.e. those observations with insufficient likelihood) are identified as abnormal activities. Location features, flow features and optical flow textures are used as the features for the model. The proposed approaches are evaluated using the publicly available UCSD datasets, and we demonstrate improved performance using a Semi-2D Hidden Markov Model compared to other state of the art methods. Further we illustrate how our proposed methods can be applied to detect anomalous events at rail level crossings.

Vulnerability and damage analysis of reinforced concrete framed buildings subjected to near field blast events

Terrorists usually target high occupancy iconic and public buildings using vehicle borne incendiary devices in order to claim a maximum number of lives and cause extensive damage to public property. While initial casualties are due to direct shock by the explosion, collapse of structural elements may extensively increase the total figure. Most of these buildings have been or are built without consideration of their vulnerability to such events. Therefore, the vulnerability and residual capacity assessment of buildings to deliberately exploded bombs is important to provide mitigation strategies to protect the buildings' occupants and the property. Explosive loads and their effects on a building have therefore attracted significant attention in the recent past. Comprehensive and economical design strategies must be developed for future construction. This research investigates the response and damage of reinforced concrete (RC) framed buildings together with their load bearing key structural components to a near field blast event. Finite element method (FEM) based analysis was used to investigate the structural framing system and components for global stability, followed by a rigorous analysis of key structural components for damage evaluation using the codes SAP2000 and LS DYNA respectively. The research involved four important areas in structural engineering. They are blast load determination, numerical modelling with FEM techniques, material performance under high strain rate and non-linear dynamic structural analysis. The response and damage of a RC framed building for different blast load scenarios were investigated. The blast influence region for a two dimensional RC frame was investigated for different load conditions and identified the critical region for each loading case. Two types of design methods are recommended for RC columns to provide superior residual capacities. They are RC columns detailing with multi-layer steel reinforcement cages and a composite columns including a central structural steel core. These are to provide post blast gravity load resisting capacity compared to typical RC column against a catastrophic collapse. Overall, this research broadens the current knowledge of blast and residual capacity analysis of RC framed structures and recommends methods to evaluate and mitigate blast impact on key elements of multi-storey buildings.

Incidence of paediatric fatal and non-fatal low speed vehicle run over events in Queensland, Australia : eleven year analysis

Background The purpose of this study was to estimate the incidence of fatal and non-fatal Low Speed Vehicle Run Over (LSVRO) events among children aged 0–15 years in Queensland, Australia, at a population level. Methods Fatal and non-fatal LSVRO events that occurred in children resident in Queensland over eleven calendar years (1999-2009) were identified using ICD codes, text description, word searches and medical notes clarification, obtained from five health related data bases across the continuum of care (pre-hospital to fatality). Data were manually linked. Population data provided by the Australian Bureau of Statistics were used to calculate crude incidence rates for fatal and non-fatal LSVRO events. Results There were 1611 LSVROs between 1999–2009 (IR = 16.87/100,000/annum). Incidence of non-fatal events (IR = 16.60/100,000/annum) was 61.5 times higher than fatal events (IR = 0.27/100,000/annum). LSVRO events were more common in boys (IR = 20.97/100,000/annum) than girls (IR = 12.55/100,000/annum), and among younger children aged 0–4 years (IR = 21.45/100000/annum; 39% or all events) than older children (5–9 years: IR = 16.47/100,000/annum; 10–15 years IR = 13.59/100,000/annum). A total of 896 (56.8%) children were admitted to hospital for 24 hours of more following an LSVRO event (IR = 9.38/100,000/annum). Total LSVROs increased from 1999 (IR = 14.79/100,000) to 2009 (IR = 18.56/100,000), but not significantly. Over the 11 year period, there was a slight (non –significant) increase in fatalities (IR = 0.37-0.42/100,000/annum); a significant decrease in admissions (IR = 12.39–5.36/100,000/annum), and significant increase in non-admissions (IR = 2.02-12.77/100,000/annum). Trends over time differed by age, gender and severity. Conclusion This is the most comprehensive, population-based epidemiological study on fatal and non-fatal LSVRO events to date. Results from this study indicate that LSVROs incur a substantial burden. Further research is required on the characteristics and risk factors associated with these events, in order to adequately inform injury prevention. Strategies are urgently required in order to prevent these events, especially among young children aged 0-4 years.

A systematic review of patient-reported outcome instruments of dermatologic adverse events associated with targeted cancer therapies

Purpose Dermatologic adverse events (dAEs) in cancer treatment are frequent with the use of targeted therapies. These dAEs have been shown to have significant impact on health-related quality of life (HRQoL). While standardized assessment tools have been developed for physicians to assess severity of dAEs, there is a discord between objective and subjective measures. The identification of patient-reported outcome (PRO) instruments useful in the context of targeted cancer therapies is therefore important in both the clinical and research settings for the overall evaluation of dAEs and their impact on HRQoL. Methods A comprehensive, systematic literature search of published articles was conducted by two independent reviewers in order to identify PRO instruments previously utilized in patient populations with dAEs from targeted cancer therapies. The identified PRO instruments were studied to determine which HRQoL issues relevant to dAEs were addressed, as well as the process of development and validation of these instruments. Results Thirteen articles identifying six PRO instruments met the inclusion criteria. Four instruments were general dermatology (Skindex-16©, Skindex-29©, Dermatology Life Quality Index (DLQI), and DIELH-24) and two were symptom-specific (functional assessment of cancer therapy-epidermal growth factor receptor inhibitor-18 (FACT-EGFRI-18) and hand-foot syndrome-14 (HFS-14)). Conclusions While there are several PRO instruments that have been tested in the context of targeted cancer therapy, additional work is needed to develop new instruments and to further validate the instruments identified in this study in patients receiving targeted therapies.

Adjustment of apnea-hypopnea index with severity of obstruction events enhances detection of sleep apnea patients with the highest risk of severe health consequences

Introduction Presently, the severity of obstructive sleep apnea (OSA) is estimated based on the apnea-hypopnea index (AHI). Unfortunately, AHI does not provide information on the severity of individual obstruction events. Previously, the severity of individual obstruction events has been suggested to be related to the outcome of the disease. In this study, we incorporate this information into AHI and test whether this novel approach would aid in discriminating patients with the highest risk. We hypothesize that the introduced adjusted AHI parameter provides a valuable supplement to AHI in the diagnosis of the severity of OSA. Methods This hypothesis was tested by means of retrospective follow-up (mean ± sd follow-up time 198.2 ± 24.7 months) of 1,068 men originally referred to night polygraphy due to suspected OSA. After exclusion of the 264 patients using CPAP, the remaining 804 patients were divided into normal (AHI < 5) and OSA (AHI ≥ 5) categories based on conventional AHI and adjusted AHI. For a more detailed analysis, the patients were divided into normal, mild, moderate, and severe OSA categories based on conventional AHI and adjusted AHI. Subsequently, the mortality and cardiovascular morbidity in these groups were determined. Results Use of the severity of individual obstruction events for adjustment of AHI led to a significant rearrangement of patients between severity categories. Due to this rearrangement, the number of deceased patients diagnosed to have OSA was increased when adjusted AHI was used as the diagnostic index. Importantly, risk ratios of all-cause mortality and cardiovascular morbidity were higher in moderate and severe OSA groups formed based on the adjusted AHI parameter than in those formed based on conventional AHI. Conclusions The adjusted AHI parameter was found to give valuable supplementary information to AHI and to potentially improve the recognition of OSA patients with the highest risk of mortality or cardiovascular morbidity.

Is there a role for pharmacists in multidisciplinary health-care teams at community outreach events for the homeless?

Homelessness is a significant public health problem. It is well-documented that people experiencing homelessness exhibit more serious illnesses and have poorer health than the general population. The provision of services and interventions by health-care professionals, including pharmacists, may make a simple yet important contribution to improved health outcomes in those experiencing homelessness, but evidence of roles and interventions is limited and variable. In Australia, the Queensland University of Technology Health Clinic connects with the homeless community by taking part in community outreach events. This paper provides details of one such event, as well as the roles, interventions and experiences of pharmacists. Participation and inclusion of pharmacists in a multidisciplinary health-care team approach at homeless outreach events should be supported and encouraged.

Turning up the Heat on Admissions: A Study of the Impacts of Extreme Heat Events on Tasmanian Hospital Admissions 2003-2010

Introduction: Extreme heat events (both heat waves and extremely hot days) are increasing in frequency and duration globally and cause more deaths in Australia than any other extreme weather event. Numerous studies have demonstrated a link between extreme heat events and an increased risk of morbidity and death. In this study, the researchers sought to identify if extreme heat events in the Tasmanian population were associated with any changes in emergency department admissions to the Royal Hobart Hospital (RHH) for the period 2003-2010. Methods: Non-identifiable RHH emergency department data and climate data from the Australian Bureau of Meteorology were obtained for the period 2003-2010. Statistical analyses were conducted using the computer statistical computer software ‘R’ with a distributed lag non-linear model (DLNM) package used to fit a quassi-Poisson generalised linear regression model. Results: This study showed that RR of admission to RHH during 2003-2010 was significant over temperatures of 24 C with a lag effect lasting 12 days and main effect noted one day after the extreme heat event. Discussion: This study demonstrated that extreme heat events have a significant impact on public hospital admissions. Two limitations were identified: admissions data rather than presentations data were used and further analysis could be done to compare types of admissions and presentations between heat and non-heat events. Conclusion: With the impacts of climate change already being felt in Australia, public health organisations in Tasmania and the rest of Australia need to implement adaptation strategies to enhance resilience to protect the public from the adverse health effects of heat events and climate change.

Detecting rare events using Kullback-Leibler divergence: A weakly supervised approach

Video surveillance infrastructure has been widely installed in public places for security purposes. However, live video feeds are typically monitored by human staff, making the detection of important events as they occur difficult. As such, an expert system that can automatically detect events of interest in surveillance footage is highly desirable. Although a number of approaches have been proposed, they have significant limitations: supervised approaches, which can detect a specific event, ideally require a large number of samples with the event spatially and temporally localised; while unsupervised approaches, which do not require this demanding annotation, can only detect whether an event is abnormal and not specific event types. To overcome these problems, we formulate a weakly-supervised approach using Kullback-Leibler (KL) divergence to detect rare events. The proposed approach leverages the sparse nature of the target events to its advantage, and we show that this data imbalance guarantees the existence of a decision boundary to separate samples that contain the target event from those that do not. This trait, combined with the coarse annotation used by weakly supervised learning (that only indicates approximately when an event occurs), greatly reduces the annotation burden while retaining the ability to detect specific events. Furthermore, the proposed classifier requires only a decision threshold, simplifying its use compared to other weakly supervised approaches. We show that the proposed approach outperforms state-of-the-art methods on a popular real-world traffic surveillance dataset, while preserving real time performance.

Analysis of Atmospheric Particle Formation Events

Atmospheric aerosol particle formation events can be a significant source for tropospheric aerosols and thus influence the radiative properties and cloud cover of the atmosphere. This thesis investigates the analysis of aerosol size distribution data containing particle formation events, describes the methodology of the analysis and presents time series data measured inside the Boreal forest. This thesis presents a methodology to identify regional-scale particle formation, and to derive the basic characteristics such as growth and formation rates. The methodology can also be used to estimate concentration and source rates of the vapour causing particle growth. Particle formation was found to occur frequently in the boreal forest area over areas covering up to hundreds of kilometers. Particle formation rates of boreal events were found to be of the order of 0.01-5 cm^-3 s^-1, while the nucleation rates of 1 nm particles can be a few orders of magnitude higher. The growth rates of over 3 nm sized particles were of the order of a few nanometers per hour. The vapor concentration needed to sustain such growth is of the order of 10^7--10^8 cm^-3, approximately one order of magnitude higher than sulphuric acid concentrations found in the atmosphere. Therefore, one has to assume that other vapours, such as organics, have a key role in growing newborn particles to sizes where they can become climatically active. Formation event occurrence shows a clear annual variation with peaks in summer and autumns. This variation is similar to the variation exhibited the obtained formation rates of particles. The growth rate, on the other hand, reaches its highest values during summer. This difference in the annual behavior, and the fact that no coupling between the growth and formation process could be identified, suggest that these processes might be different ones, and that both are needed for a particle formation burst to be observed.

First Measurement of the b-Jet Cross Section in Events with a W Boson in pp̅ Collisions at √s=1.96 TeV

The cross section for jets from b quarks produced with a W boson has been measured in ppbar collision data from 1.9/fb of integrated luminosity recorded by the CDF II detector at the Tevatron. The W+b-jets process poses a significant background in measurements of top quark production and prominent searches for the Higgs boson. We measure a b-jet cross section of 2.74 +- 0.27(stat.) +- 0.42(syst.) pb in association with a single flavor of leptonic W boson decay over a limited kinematic phase space. This measured result cannot be accommodated in several available theoretical predictions.

Search for New Bottomlike Quark Pair Decays QQ̅ →(tW∓)(t̅ W±) in Same-Charge Dilepton Events

We report the most restrictive direct limits on masses of fourth-generation down-type quarks b′, and quarklike composite fermions (B or T5/3), decaying promptly to tW∓. We search for a significant excess of events with two same-charge leptons (e, μ), several hadronic jets, and missing transverse energy. An analysis of data from pp̅ collisions with an integrated luminosity of 2.7  fb-1 collected with the CDF II detector at Fermilab yields no evidence for such a signal, setting mass limits mb′, mB>338  GeV/c2 and mT5/3>365  GeV/c2 at 95% confidence level.