Improved cryptanalysis of the Common Scrambling Algorithm Stream Cipher

This paper provides a fresh analysis of the widely-used Common Scrambling Algorithm Stream Cipher (CSA-SC). Firstly, a new representation of CSA-SC with a state size of only 89 bits is given, a significant reduction from the 103 bit state of a previous CSA-SC representation. Analysis of this 89-bit representation demonstrates that the basis of a previous guess-and-determine attack is flawed. Correcting this flaw increases the complexity of that attack so that it is worse than exhaustive key search. Although that attack is not feasible, the reduced state size of our representation makes it obvious that CSA-SC is vulnerable to several generic attacks, for which feasible parameters are given.

A forward and backward secure key management in wireless sensor networks for PCS/SCADA

Process Control Systems (PCSs) or Supervisory Control and Data Acquisition (SCADA) systems have recently been added to the already wide collection of wireless sensor networks applications. The PCS/SCADA environment is somewhat more amenable to the use of heavy cryptographic mechanisms such as public key cryptography than other sensor application environments. The sensor nodes in the environment, however, are still open to devastating attacks such as node capture, which makes designing a secure key management challenging. In this paper, a key management scheme is proposed to defeat node capture attack by offering both forward and backward secrecies. Our scheme overcomes the pitfalls which Nilsson et al.'s scheme suffers from, and is not more expensive than their scheme.

Twisted Edwards curves revisited

This paper introduces fast algorithms for performing group operations on twisted Edwards curves, pushing the recent speed limits of Elliptic Curve Cryptography (ECC) forward in a wide range of applications. Notably, the new addition algorithm uses for suitably selected curve constants. In comparison, the fastest point addition algorithms for (twisted) Edwards curves stated in the literature use . It is also shown that the new addition algorithm can be implemented with four processors dropping the effective cost to . This implies an effective speed increase by the full factor of 4 over the sequential case. Our results allow faster implementation of elliptic curve scalar multiplication. In addition, the new point addition algorithm can be used to provide a natural protection from side channel attacks based on simple power analysis (SPA).

Faster group operations on elliptic curves

This paper improves implementation techniques of Elliptic Curve Cryptography. We introduce new formulae and algorithms for the group law on Jacobi quartic, Jacobi intersection, Edwards, and Hessian curves. The proposed formulae and algorithms can save time in suitable point representations. To support our claims, a cost comparison is made with classic scalar multiplication algorithms using previous and current operation counts. Most notably, the best speeds are obtained from Jacobi quartic curves which provide the fastest timings for most scalar multiplication strategies benefiting from the proposed 12M + 5S + 1D point doubling and 7M + 3S + 1D point addition algorithms. Furthermore, the new addition algorithm provides an efficient way to protect against side channel attacks which are based on simple power analysis (SPA). Keywords: Efficient elliptic curve arithmetic,unified addition, side channel attack.

Accidental amenity

Landscape in Australian multi-unit residential developments has passed through a number of phases. Can we make the successes more intentional than serendipitous? When did the block of flats become renamed "multi-unit residential"? Perhaps it coincided with a realization by Australians that medium - and high-density urban housing was neither an attack on the quarter-acre block nor a synonym for public housing. Higher densities allow people to participate in the city, and the expansion of unit-based housing represents Australians' growing love of cities for their urban and cosmopolitan values. As our attitude to the city has changed, so have the types of multi-unit residential stock changed - in their spatial qualities as well as their role in the landscape.

Characterising anomalous events using change point correlation on unsolicited network traffic

Monitoring unused or dark IP addresses offers opportunities to extract useful information about both on-going and new attack patterns. In recent years, different techniques have been used to analyze such traffic including sequential analysis where a change in traffic behavior, for example change in mean, is used as an indication of malicious activity. Change points themselves say little about detected change; further data processing is necessary for the extraction of useful information and to identify the exact cause of the detected change which is limited due to the size and nature of observed traffic. In this paper, we address the problem of analyzing a large volume of such traffic by correlating change points identified in different traffic parameters. The significance of the proposed technique is two-fold. Firstly, automatic extraction of information related to change points by correlating change points detected across multiple traffic parameters. Secondly, validation of the detected change point by the simultaneous presence of another change point in a different parameter. Using a real network trace collected from unused IP addresses, we demonstrate that the proposed technique enables us to not only validate the change point but also extract useful information about the causes of change points.

AITPM Email Newsletter Volume 0905, June 2009 : President's Message

President’s Message Hello fellow AITPM members, Due to three colliding forces of nature I find myself writing this month’s message from home – today, I am still getting over a persistent virus that seemed to set in just after returning from Singapore a couple of weeks ago, which my diabetes won’t let me get away with too easily (no Kermit the Frog swine flu jokes please). Combine this with a very wet day in Brisbane – in fact the wettest for 20 years (how can we complain, except for flash flooding?). And in Queensland today is a state school teachers’ strike, so one half of our brood is over watching TV. Family snapshots aside, the biggest news for our industry of late is the $8.5 billion announced in the Federal Budget for transport infrastructure projects; many “shovel ready”, but some – and fortunate for our profession – desktop ready. This newsletter provides nationwide coverage on the transport infrastructure aspects of the Federal Budget. We’ll need a bit more time to carefully look at the ensuing State Budgets’ announcements. Regarding the federal budget announcements, I am pleased to see serious attention being paid to upgrading the M1 system – I hope to see a motorway standard facility connecting Adelaide to at least Rockhampton in my lifetime. But some other important roads are of course missing out in this particular budget. Various levels of commitment are being made to urban passenger rail – some project significant while others planning significant. Enhancement of suburban rail is important across the capitals and Australia’s medium sized cities such as the Gold Coast and Newcastle. Not much on road safety initiatives jumped out at me, but I believe it is implied in the large road projects and in some of the detail elsewhere. I do believe it’s about time a ‘Vision Zero’ style policy is adopted at the National level, since any death is unacceptable on the road, just as it is in any other workplace. So, overall some good news on building transport infrastructure to keep the economy purring during this recession, and strongly supporting it during future boom times. The other edge to the sword, of course, is that we tax payers will be paying a considerable amount for borrowings for these projects over a long period of time. I close again in reminding everyone again that AITPM’s flagship event, the 2009 AITPM National Conference, Traffic Beyond Tomorrow, is being held in Adelaide from 5 to 7 August. www.aitpm.com has all of the details about how to register, sponsor a booth, session, etc. Best regards all, Jon Bunker

Improved detection and tracking of objects in surveillance video

Surveillance networks are typically monitored by a few people, viewing several monitors displaying the camera feeds. It is then very difficult for a human operator to effectively detect events as they happen. Recently, computer vision research has begun to address ways to automatically process some of this data, to assist human operators. Object tracking, event recognition, crowd analysis and human identification at a distance are being pursued as a means to aid human operators and improve the security of areas such as transport hubs. The task of object tracking is key to the effective use of more advanced technologies. To recognize an event people and objects must be tracked. Tracking also enhances the performance of tasks such as crowd analysis or human identification. Before an object can be tracked, it must be detected. Motion segmentation techniques, widely employed in tracking systems, produce a binary image in which objects can be located. However, these techniques are prone to errors caused by shadows and lighting changes. Detection routines often fail, either due to erroneous motion caused by noise and lighting effects, or due to the detection routines being unable to split occluded regions into their component objects. Particle filters can be used as a self contained tracking system, and make it unnecessary for the task of detection to be carried out separately except for an initial (often manual) detection to initialise the filter. Particle filters use one or more extracted features to evaluate the likelihood of an object existing at a given point each frame. Such systems however do not easily allow for multiple objects to be tracked robustly, and do not explicitly maintain the identity of tracked objects. This dissertation investigates improvements to the performance of object tracking algorithms through improved motion segmentation and the use of a particle filter. A novel hybrid motion segmentation / optical flow algorithm, capable of simultaneously extracting multiple layers of foreground and optical flow in surveillance video frames is proposed. The algorithm is shown to perform well in the presence of adverse lighting conditions, and the optical flow is capable of extracting a moving object. The proposed algorithm is integrated within a tracking system and evaluated using the ETISEO (Evaluation du Traitement et de lInterpretation de Sequences vidEO - Evaluation for video understanding) database, and significant improvement in detection and tracking performance is demonstrated when compared to a baseline system. A Scalable Condensation Filter (SCF), a particle filter designed to work within an existing tracking system, is also developed. The creation and deletion of modes and maintenance of identity is handled by the underlying tracking system; and the tracking system is able to benefit from the improved performance in uncertain conditions arising from occlusion and noise provided by a particle filter. The system is evaluated using the ETISEO database. The dissertation then investigates fusion schemes for multi-spectral tracking systems. Four fusion schemes for combining a thermal and visual colour modality are evaluated using the OTCBVS (Object Tracking and Classification in and Beyond the Visible Spectrum) database. It is shown that a middle fusion scheme yields the best results and demonstrates a significant improvement in performance when compared to a system using either mode individually. Findings from the thesis contribute to improve the performance of semi-automated video processing and therefore improve security in areas under surveillance.

Intrusion detection techniques in wireless local area networks

This research investigates wireless intrusion detection techniques for detecting attacks on IEEE 802.11i Robust Secure Networks (RSNs). Despite using a variety of comprehensive preventative security measures, the RSNs remain vulnerable to a number of attacks. Failure of preventative measures to address all RSN vulnerabilities dictates the need for a comprehensive monitoring capability to detect all attacks on RSNs and also to proactively address potential security vulnerabilities by detecting security policy violations in the WLAN. This research proposes novel wireless intrusion detection techniques to address these monitoring requirements and also studies correlation of the generated alarms across wireless intrusion detection system (WIDS) sensors and the detection techniques themselves for greater reliability and robustness. The specific outcomes of this research are: A comprehensive review of the outstanding vulnerabilities and attacks in IEEE 802.11i RSNs. A comprehensive review of the wireless intrusion detection techniques currently available for detecting attacks on RSNs. Identification of the drawbacks and limitations of the currently available wireless intrusion detection techniques in detecting attacks on RSNs. Development of three novel wireless intrusion detection techniques for detecting RSN attacks and security policy violations in RSNs. Development of algorithms for each novel intrusion detection technique to correlate alarms across distributed sensors of a WIDS. Development of an algorithm for automatic attack scenario detection using cross detection technique correlation. Development of an algorithm to automatically assign priority to the detected attack scenario using cross detection technique correlation.

Science and subjectivity

Science has been under attack in the last thirty years, and recently a number of prominent scientists have been busy fighting back. Here, an argument is presented that the `science wars' stem from an unreasonably strict adherence to the reductive method on the part of science, but that weakening this stance need not imply a lapse into subjectivity. One possible method for formalising the description of non-separable, contextually dependent complex systems is presented. This is based upon a quantum-like approach.

Telcagepant is a new oral treatment for migraine

Background : Migraine is a common cause of disability. Many subjects (30 – 40%) do not respond to the 5-HT 1B/1D agonists (the triptans) commonly used in the treatment of migraine attacks. Calcitonin gene-related protein (CGRP) receptor antagonism is a new approach to the treatment of migraine attacks. Objectives/methods : This evaluation is of a Phase III clinical trial comparing telcagepant, an orally active CGRP receptor antagonist, with zolmitriptan in subjects during an attack of migraine. Results : Telcagepant 300 mg has a similar efficacy to zolmitriptan in relieving pain, phonophobia, photophobia, and nausea. Telcagepant was better tolerated than zolmitriptan. Conclusions : The initial Phase III clinical trial results with telcagepant are promising but several further clinical trials are needed to determine the place of telcagepant in the treatment of migraine attacks

Detecting and characterising malicious executable payloads

Buffer overflow vulnerabilities continue to prevail and the sophistication of attacks targeting these vulnerabilities is continuously increasing. As a successful attack of this type has the potential to completely compromise the integrity of the targeted host, early detection is vital. This thesis examines generic approaches for detecting executable payload attacks, without prior knowledge of the implementation of the attack, in such a way that new and previously unseen attacks are detectable. Executable payloads are analysed in detail for attacks targeting the Linux and Windows operating systems executing on an Intel IA-32 architecture. The execution flow of attack payloads are analysed and a generic model of execution is examined. A novel classification scheme for executable attack payloads is presented which allows for characterisation of executable payloads and facilitates vulnerability and threat assessments, and intrusion detection capability assessments for intrusion detection systems. An intrusion detection capability assessment may be utilised to determine whether or not a deployed system is able to detect a specific attack and to identify requirements for intrusion detection functionality for the development of new detection methods. Two novel detection methods are presented capable of detecting new and previously unseen executable attack payloads. The detection methods are capable of identifying and enumerating the executable payload’s interactions with the operating system on the targeted host at the time of compromise. The detection methods are further validated using real world data including executable payload attacks.

"Has Gothic cake and eats it too : dreaming of Amelia" by Jaclyn Moriarty

Dreaming of Amelia (2009) recounts a small group of HSC students’ final year of high school. Told from multiple perspectives, the novel focuses on shifting senses of self, maturity, and agency as the protagonists move from adolescence to adulthood. The central conflict of the novel results from two ‘bad kids from the bad crowd at bad Brookfield High’ (blurb) transferring to wealthy private school, Ashbury; Amelia and Riley are scholarship students who do not fit with Ashbury’s profile of 'normal student' as it is understood by the school’s students or staff, and their presence in the school community forces many people to reassess their understanding of individual value (or, at least, that’s what the novel claims happens). In the shifting of perceptions, allegiances, and relationships, each of the main characters achieves a stronger sense of their identity, and Dreaming of Amelia is thus firmly located within the tradition of Young Adult (YA) literature, with all its stereotypes of adolescence.

Using honeypots to analyse anomalous Internet activities

Monitoring Internet traffic is critical in order to acquire a good understanding of threats to computer and network security and in designing efficient computer security systems. Researchers and network administrators have applied several approaches to monitoring traffic for malicious content. These techniques include monitoring network components, aggregating IDS alerts, and monitoring unused IP address spaces. Another method for monitoring and analyzing malicious traffic, which has been widely tried and accepted, is the use of honeypots. Honeypots are very valuable security resources for gathering artefacts associated with a variety of Internet attack activities. As honeypots run no production services, any contact with them is considered potentially malicious or suspicious by definition. This unique characteristic of the honeypot reduces the amount of collected traffic and makes it a more valuable source of information than other existing techniques. Currently, there is insufficient research in the honeypot data analysis field. To date, most of the work on honeypots has been devoted to the design of new honeypots or optimizing the current ones. Approaches for analyzing data collected from honeypots, especially low-interaction honeypots, are presently immature, while analysis techniques are manual and focus mainly on identifying existing attacks. This research addresses the need for developing more advanced techniques for analyzing Internet traffic data collected from low-interaction honeypots. We believe that characterizing honeypot traffic will improve the security of networks and, if the honeypot data is handled in time, give early signs of new vulnerabilities or breakouts of new automated malicious codes, such as worms. The outcomes of this research include: • Identification of repeated use of attack tools and attack processes through grouping activities that exhibit similar packet inter-arrival time distributions using the cliquing algorithm; • Application of principal component analysis to detect the structure of attackers’ activities present in low-interaction honeypots and to visualize attackers’ behaviors; • Detection of new attacks in low-interaction honeypot traffic through the use of the principal component’s residual space and the square prediction error statistic; • Real-time detection of new attacks using recursive principal component analysis; • A proof of concept implementation for honeypot traffic analysis and real time monitoring.

Planning and evaluation

Introduction: The core business of public health is to protect and promote health in the population. Public health planning is the means to maximise these aspirations. Health professionals develop plans to address contemporary health priorities as the evidence about changing patterns of mortality and morbidity is presented. Officials are also alert to international trends in patterns of disease that have the potential to affect the health of Australians. Integrated planning and preparation is currently underway involving all emergency health services, hospitals and population health units to ensure Australia's quick and efficient response to any major infectious disease outbreak, such as avian influenza (bird flu). Public health planning for the preparations for the Sydney Olympics and Paralympic Games in 2000 took almost three years. ‘Its major components included increased surveillance of communicable disease; presentations to sentinel emergency departments; medical encounters at Olympic venues; cruise ship surveillance; environmental and food safety inspections; bioterrorism surveillance and global epidemic intelligence’ (Jorm et al 2003, 102). In other words, the public health plan was developed to ensure food safety, hospital capacity, safe crowd control, protection against infectious diseases, and an integrated emergency and disaster plan. We have national and state plans for vaccinating children against infectious diseases in childhood; plans to promote dental health for children in schools; and screening programs for cervical, breast and prostate cancer. An effective public health response to a change in the distribution of morbidity and mortality requires planning. All levels of government plan for the public’s health. Local governments (councils) ensure healthy local environments to protect the public’s health. They plan parks for recreation, construct traffic-calming devices near schools to prevent childhood accidents, build shade structures and walking paths, and even embed drafts/chess squares in tables for people to sit and play. Environmental Health officers ensure food safety in restaurants and measure water quality. These public health measures attempt to promote the quality of life of residents. Australian and state governments produce plans that protect and promote health through various policy and program initiatives and innovations. To be effective, program plans need to be evaluated. However, building an integrated evaluation plan into a program plan is often forgotten, as planning and evaluation are seen as two distinct entities. Consequently, it is virtually impossible to measure, with any confidence, the extent to which a program has achieved its goals and objectives. This chapter introduces you to the concepts of public health program planning and evaluation. Case studies and reflection questions are presented to illustrate key points. As various authors use different terminology to describe the same concepts/actions of planning and evaluation, the glossary at the back of this book will help you to clarify the terms used in this chapter.