Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Building Information Modelling for FM at Sydney Opera House

“SOH see significant benefit in digitising its drawings and operation and maintenance manuals. Since SOH do not currently have digital models of the Opera House structure or other components, there is an opportunity for this national case study to promote the application of Digital Facility Modelling using standardized Building Information Models (BIM)”. The digital modelling element of this project examined the potential of building information models for Facility Management focusing on the following areas: • The re-usability of building information for FM purposes • BIM as an Integrated information model for facility management • Extendibility of the BIM to cope with business specific requirements • Commercial facility management software using standardised building information models • The ability to add (organisation specific) intelligence to the model • A roadmap for SOH to adopt BIM for FM The project has established that BIM – building information modelling - is an appropriate and potentially beneficial technology for the storage of integrated building, maintenance and management data for SOH. Based on the attributes of a BIM, several advantages can be envisioned: consistency in the data, intelligence in the model, multiple representations, source of information for intelligent programs and intelligent queries. The IFC – open building exchange standard – specification provides comprehensive support for asset and facility management functions, and offers new management, collaboration and procurement relationships based on sharing of intelligent building data. The major advantages of using an open standard are: information can be read and manipulated by any compliant software, reduced user “lock in” to proprietary solutions, third party software can be the “best of breed” to suit the process and scope at hand, standardised BIM solutions consider the wider implications of information exchange outside the scope of any particular vendor, information can be archived as ASCII files for archival purposes, and data quality can be enhanced as the now single source of users’ information has improved accuracy, correctness, currency, completeness and relevance. SOH current building standards have been successfully drafted for a BIM environment and are confidently expected to be fully developed when BIM is adopted operationally by SOH. There have been remarkably few technical difficulties in converting the House’s existing conventions and standards to the new model based environment. This demonstrates that the IFC model represents world practice for building data representation and management (see Sydney Opera House – FM Exemplar Project Report Number 2005-001-C-3, Open Specification for BIM: Sydney Opera House Case Study). Availability of FM applications based on BIM is in its infancy but focussed systems are already in operation internationally and show excellent prospects for implementation systems at SOH. In addition to the generic benefits of standardised BIM described above, the following FM specific advantages can be expected from this new integrated facilities management environment: faster and more effective processes, controlled whole life costs and environmental data, better customer service, common operational picture for current and strategic planning, visual decision-making and a total ownership cost model. Tests with partial BIM data – provided by several of SOH’s current consultants – show that the creation of a SOH complete model is realistic, but subject to resolution of compliance and detailed functional support by participating software applications. The showcase has demonstrated successfully that IFC based exchange is possible with several common BIM based applications through the creation of a new partial model of the building. Data exchanged has been geometrically accurate (the SOH building structure represents some of the most complex building elements) and supports rich information describing the types of objects, with their properties and relationships.

Managing infrastructure transitions : a complex adaptive systems perspective

Engineering assets such as roads, rail, bridges and other forms of public works are vital to the effective functioning of societies {Herder, 2006 #128}. Proficient provision of this physical infrastructure is therefore one of the key activities of government {Lædre, 2006 #123}. In order to ensure engineering assets are procured and maintained on behalf of citizens, government needs to devise the appropriate policy and institutional architecture for this purpose. The changing institutional arrangements around the procurement of engineering assets are the focus of this paper. The paper describes and analyses the transition to new, more collaborative forms of procurement arrangements which are becoming increasingly prevalent in Australia and other OECD countries. Such fundamental shifts from competitive to more collaborative approaches to project governance can be viewed as a major transition in procurement system arrangements. In many ways such changes mirror the shift from New Public Management, with its emphasis on the use of market mechanisms to achieve efficiencies {Hood, 1991 #166}, towards more collaborative approaches to service delivery, such as those under network governance arrangements {Keast, 2007 #925}. However, just as traditional forms of procurement in a market context resulted in unexpected outcomes for industry, such as a fragmented industry afflicted by chronic litigation {Dubois, 2002 #9}, the change to more collaborative forms of procurement is unlikely to be a panacea to the problems of procurement, and may well also have unintended consequences. This paper argues that perspectives from complex adaptive systems (CAS) theory can contribute to the theory and practice of managing system transitions. In particular the concept of emergence provides a key theoretical construct to understand the aggregate effect that individual project governance arrangements can have upon the structure of specific industries, which in turn impact individual projects. Emergence is understood here as the macro structure that emerges out of the interaction of agents in the system {Holland, 1998 #100; Tang, 2006 #51}.

Daddies, assistants and foolsbdifferentiation of male representations in present-day advertising.

This paper explores the way men are represented in present-day advertising. Most gender related studies have concentrated in studying women in advertising and claim that men are still represented as the dominant gender and in more active, independent and functional roles than women. This paper asks whether this still holds for advertising in the beginning of 21st century. Many cultural changes may have broken the earlier stereotypes, for example changes in the family life, attitudes toward various sexual identities, concepts of masculinity and femininity, and changes in cultural style.

When the object speaks, a postcolonial encounter : anthropological, representations and Aboriginal's women's self-presentations

As an Aboriginal woman currently reviewing feminist literature in Australia, I have found that representations of Aboriginal women's gender have been generated predominantly by women anthropologists. Australian feminists utilise this literature in their writing and teaching and accept its truths without question; the most often quoted ethnographic text is Diane Bell's Daughters of the Dreaming (1983a).1 Feminists' lack of critical engagement with this literature implies that they are content to accept women anthropologists' representations because Aboriginal women are not central to their constructions of feminism.2 Instead the Aboriginal woman is positioned on the margins, a symbol of difference; a reminder that it is feminists who are the bearers of true womanhood.

The organisation of action in complex neurobiological systems

This chapter elucidates key ideas behind neurocomputational and ecological dynamics and perspectives of understanding the organisation of action in complex neurobiological systems. The need to study the close link between neurobiological systems and their environments (particularly their sensory and movement subsystems and the surrounding energy sources) is advocated. It is proposed how degeneracy in complex neurobiological systems provides the basis for functional variability in organisation of action. In such systems processes of cognition and action facilitate the specific interactions of each performer with particular task and environmental constraints.

Increasing stochastic perturbations enhances acquisition and learning of complex sport movements

Traditionally, the aquisition of skills and sport movement has been characterised by numerous repetitions of presumed model movement pattern to be acquired by learners. This approach has been questioned by research identifying the presence of individualised movement patterns and the low probability of occurrence of two identical movements within and between individuals. In contrast, the differential learning approach claims advantage for incurring variability in the learning process by adding stochastic perturbations during practice. These ideas are exemplified by data from a high jump experiment which compared the effectiveness of classical and a differential training approach with pre-post test design. Results showed clear advantages for the group with additional stochastic perturbation during the aquisition phase in comparison to classically trained athletes. Analogies to similar phenomenological effects in the neurobiological literature are discussed.