Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Space-time variation of malaria incidence in Yunnan province, China

Abstract Background Understanding spatio-temporal variation in malaria incidence provides a basis for effective disease control planning and monitoring. Methods Monthly surveillance data between 1991 and 2006 for Plasmodium vivax and Plasmodium falciparum malaria across 128 counties were assembled for Yunnan, a province of China with one of the highest burdens of malaria. County-level Bayesian Poisson regression models of incidence were constructed, with effects for rainfall, maximum temperature and temporal trend. The model also allowed for spatial variation in county-level incidence and temporal trend, and dependence between incidence in June–September and the preceding January–February. Results Models revealed strong associations between malaria incidence and both rainfall and maximum temperature. There was a significant association between incidence in June–September and the preceding January–February. Raw standardised morbidity ratios showed a high incidence in some counties bordering Myanmar, Laos and Vietnam, and counties in the Red River valley. Clusters of counties in south-western and northern Yunnan were identified that had high incidence not explained by climate. The overall trend in incidence decreased, but there was significant variation between counties. Conclusion Dependence between incidence in summer and the preceding January–February suggests a role of intrinsic host-pathogen dynamics. Incidence during the summer peak might be predictable based on incidence in January–February, facilitating malaria control planning, scaled months in advance to the magnitude of the summer malaria burden. Heterogeneities in county-level temporal trends suggest that reductions in the burden of malaria have been unevenly distributed throughout the province.

Estimating indoor air quality using integrated 3D CAD building models

The indoor air quality (IAQ) in buildings is currently assessed by measurement of pollutants during building operation for comparison with air quality standards. Current practice at the design stage tries to minimise potential indoor air quality impacts of new building materials and contents by selecting low-emission materials. However low-emission materials are not always available, and even when used the aggregated pollutant concentrations from such materials are generally overlooked. This paper presents an innovative tool for estimating indoor air pollutant concentrations at the design stage, based on emissions over time from large area building materials, furniture and office equipment. The estimator considers volatile organic compounds, formaldehyde and airborne particles from indoor materials and office equipment and the contribution of outdoor urban air pollutants affected by urban location and ventilation system filtration. The estimated pollutants are for a single, fully mixed and ventilated zone in an office building with acceptable levels derived from Australian and international health-based standards. The model acquires its dimensional data for the indoor spaces from a 3D CAD model via IFC files and the emission data from a building products/contents emissions database. This paper describes the underlying approach to estimating indoor air quality and discusses the benefits of such an approach for designers and the occupants of buildings.

Defining reference service life : an open innovation approach

The endeavour to obtain estimates of durability of components for use in lifecycle assessment or costing and infrastructure and maintenance planning systems is large. The factor method and the reference service life concept provide a very valuable structure, but do not resolve the central dilemma of the need to derive an extensive database of service life. Traditional methods of estimating service life, such as dose functions or degradation models, can play a role in developing this database, however the scale of the problem clearly indicates that individual dose functions cannot be derived for each component in each different local and geographic setting. Thus, a wider range of techniques is required in order to devise reference service life. This paper outlines the approaches being taken in the Cooperative Research Centre for Construction Innovation project to predict reference service life. Approaches include the development of fundamental degradation and microclimate models, the development of a situation-based reasoning ‘engine’ to vary the ‘estimator’ of service life, and the development of a database on expert performance (Delphi study). These methods should be viewed as complementary rather than as discrete alternatives. As discussed in the paper, the situation-based reasoning approach in fact has the possibility of encompassing all other methods.

Validation of 3D models of the outer and inner surfaces of an ovine femur

The validation of Computed Tomography (CT) based 3D models takes an integral part in studies involving 3D models of bones. This is of particular importance when such models are used for Finite Element studies. The validation of 3D models typically involves the generation of a reference model representing the bones outer surface. Several different devices have been utilised for digitising a bone’s outer surface such as mechanical 3D digitising arms, mechanical 3D contact scanners, electro-magnetic tracking devices and 3D laser scanners. However, none of these devices is capable of digitising a bone’s internal surfaces, such as the medullary canal of a long bone. Therefore, this study investigated the use of a 3D contact scanner, in conjunction with a microCT scanner, for generating a reference standard for validating the internal and external surfaces of a CT based 3D model of an ovine femur. One fresh ovine limb was scanned using a clinical CT scanner (Phillips, Brilliance 64) with a pixel size of 0.4 mm2 and slice spacing of 0.5 mm. Then the limb was dissected to obtain the soft tissue free bone while care was taken to protect the bone’s surface. A desktop mechanical 3D contact scanner (Roland DG Corporation, MDX 20, Japan) was used to digitise the surface of the denuded bone. The scanner was used with the resolution of 0.3 × 0.3 × 0.025 mm. The digitised surfaces were reconstructed into a 3D model using reverse engineering techniques in Rapidform (Inus Technology, Korea). After digitisation, the distal and proximal parts of the bone were removed such that the shaft could be scanned with a microCT (µCT40, Scanco Medical, Switzerland) scanner. The shaft, with the bone marrow removed, was immersed in water and scanned with a voxel size of 0.03 mm3. The bone contours were extracted from the image data utilising the Canny edge filter in Matlab (The Mathswork).. The extracted bone contours were reconstructed into 3D models using Amira 5.1 (Visage Imaging, Germany). The 3D models of the bone’s outer surface reconstructed from CT and microCT data were compared against the 3D model generated using the contact scanner. The 3D model of the inner canal reconstructed from the microCT data was compared against the 3D models reconstructed from the clinical CT scanner data. The disparity between the surface geometries of two models was calculated in Rapidform and recorded as average distance with standard deviation. The comparison of the 3D model of the whole bone generated from the clinical CT data with the reference model generated a mean error of 0.19±0.16 mm while the shaft was more accurate(0.08±0.06 mm) than the proximal (0.26±0.18 mm) and distal (0.22±0.16 mm) parts. The comparison between the outer 3D model generated from the microCT data and the contact scanner model generated a mean error of 0.10±0.03 mm indicating that the microCT generated models are sufficiently accurate for validation of 3D models generated from other methods. The comparison of the inner models generated from microCT data with that of clinical CT data generated an error of 0.09±0.07 mm Utilising a mechanical contact scanner in conjunction with a microCT scanner enabled to validate the outer surface of a CT based 3D model of an ovine femur as well as the surface of the model’s medullary canal.

Hybrid system simulation of computer control applications over communication networks

Discrete event-driven simulations of digital communication networks have been used widely. However, it is difficult to use a network simulator to simulate a hybrid system in which some objects are not discrete event-driven but are continuous time-driven. A networked control system (NCS) is such an application, in which physical process dynamics are continuous by nature. We have designed and implemented a hybrid simulation environment which effectively integrates models of continuous-time plant processes and discrete-event communication networks by extending the open source network simulator NS-2. To do this a synchronisation mechanism was developed to connect a continuous plant simulation with a discrete network simulation. Furthermore, for evaluating co-design approaches in an NCS environment, a piggybacking method was adopted to allow the control period to be adjusted during simulations. The effectiveness of the technique is demonstrated through case studies which simulate a networked control scenario in which the communication and control system properties are defined explicitly.

Simulations of pollutant dispersion at toll plazas using three-dimensional CFD models

Toll plazas are particularly susceptible to build-ups of vehicle-emitted pollutants because vehicles pass through in low gear. To look at this, three-dimensional computational fluid dynamics simulations of pollutant dispersion are used on the standard k e turbulence model. The effects of wind speed, wind direction and topography on pollutant dispersion were discussed. The Wuzhuang toll plaza on the Hefei-Nanjing expressway is considered, and the effects of the retaining walls along both sides of the plaza on pollutant dispersion is analysed. There are greater pollutant concentrations near the tollbooths as the angle between the direction of the wind and traffic increases implying that retaining walls impede dispersion. The slope of the walls has little influence on the variations in pollutant concentration.

Determinants of listed property trust bond ratings : Australian evidence

Using artificial neural networks (ANN) and ordinal regression (OR) as alternative methods to predict LPT bond ratings, we examine the role that various financial and industry variables have on Listed Property Trust (LPT) bond ratings issued by Standard and Poor’s from 1999-2006. Our study shows that both OR and ANN provide robust alternatives to rating LPT bonds and that there are no significant differences in results between the two full models. OR results show that of the financial variables used in our models, debt coverage and financial leverage ratios have the most profound effect on LPT bond ratings. Further, ANN results show that 73.0% of LPT bond rating is attributable to financial variables and 23.0% to industry-based variables with office LPT sector accounting for 2.6%, retail LPT 10.9% and stapled management structure 13.5%.

An investigation of the social learning and symbolic interaction models for the development of self-concepts and self-esteem

Two studies were conducted to investigate empirical support for two models relating to the development of self-concepts and self-esteem in upper-primary school children. The first study investigated the social learning model by examining the relationship between mothers' and fathers' self-reported self-concepts and self-esteem and the self-reported self-concepts and self-esteem of their children. The second study investigated the symbolic interaction model by examining the relationship between children's perception of the frequency of positive and negative statements made by parents and their self-reported self-concepts and self-esteem. The results of these studies suggested that what parents say to their children and how they interact with them is more closely related to their children's self-perceptions than the role of modelling parental attitudes and behaviours. The findings highlight the benefits of parents talking positively to their children.

A review on degradation models in reliability analysis

With increasingly complex engineering assets and tight economic requirements, asset reliability becomes more crucial in Engineering Asset Management (EAM). Improving the reliability of systems has always been a major aim of EAM. Reliability assessment using degradation data has become a significant approach to evaluate the reliability and safety of critical systems. Degradation data often provide more information than failure time data for assessing reliability and predicting the remnant life of systems. In general, degradation is the reduction in performance, reliability, and life span of assets. Many failure mechanisms can be traced to an underlying degradation process. Degradation phenomenon is a kind of stochastic process; therefore, it could be modelled in several approaches. Degradation modelling techniques have generated a great amount of research in reliability field. While degradation models play a significant role in reliability analysis, there are few review papers on that. This paper presents a review of the existing literature on commonly used degradation models in reliability analysis. The current research and developments in degradation models are reviewed and summarised in this paper. This study synthesises these models and classifies them in certain groups. Additionally, it attempts to identify the merits, limitations, and applications of each model. It provides potential applications of these degradation models in asset health and reliability prediction.

A review on reliability models with covariates

Modern Engineering Asset Management (EAM) requires the accurate assessment of current and the prediction of future asset health condition. Suitable mathematical models that are capable of predicting Time-to-Failure (TTF) and the probability of failure in future time are essential. In traditional reliability models, the lifetime of assets is estimated using failure time data. However, in most real-life situations and industry applications, the lifetime of assets is influenced by different risk factors, which are called covariates. The fundamental notion in reliability theory is the failure time of a system and its covariates. These covariates change stochastically and may influence and/or indicate the failure time. Research shows that many statistical models have been developed to estimate the hazard of assets or individuals with covariates. An extensive amount of literature on hazard models with covariates (also termed covariate models), including theory and practical applications, has emerged. This paper is a state-of-the-art review of the existing literature on these covariate models in both the reliability and biomedical fields. One of the major purposes of this expository paper is to synthesise these models from both industrial reliability and biomedical fields and then contextually group them into non-parametric and semi-parametric models. Comments on their merits and limitations are also presented. Another main purpose of this paper is to comprehensively review and summarise the current research on the development of the covariate models so as to facilitate the application of more covariate modelling techniques into prognostics and asset health management.

Modelling urban public transit users' route choice behaviour: review and outlook

This paper reviews the main development of approaches to modelling urban public transit users’ route choice behaviour from 1960s to the present. The approaches reviewed include the early heuristic studies on finding the least cost transit route and all-or-nothing transit assignment, the bus common line problem and corresponding network representation methods, the disaggregate discrete choice models which are based on random utility maximization assumptions, the deterministic use equilibrium and stochastic user equilibrium transit assignment models, and the recent dynamic transit assignment models using either frequency or schedule based network formulation. In addition to reviewing past outcomes, this paper also gives an outlook into the possible future directions of modelling transit users’ route choice behaviour. Based on the comparison with the development of models for motorists’ route choice and traffic assignment problems in an urban road area, this paper points out that it is rewarding for transit route choice research to draw inspiration from the intellectual outcomes out of the road area. Particularly, in light of the recent advancement of modelling motorists’ complex road route choice behaviour, this paper advocates that the modelling practice of transit users’ route choice should further explore the complexities of the problem.

Is the Marlboro man the only alternative? The role of gender identity and self-construal salience in evaluations of male models

This research examines how men react to male models in print advertisements. In two experiments, we show that the gender identity of men influences their responses to advertisements featuring a masculine, feminine, or androgynous male model. In addition, we explore the extent to which men feel they will be classified by others as similar to the model as a mechanism for these effects. Specifically, masculine men respond most favorably to masculine models and are negative toward feminine models. In contrast, feminine men prefer feminine models when their private self is salient. Yet in a collective context, they prefer masculine models.These experiments shed light on how gender identity and self-construal influence male evaluations and illustrate the social pressure on men to endorse traditional masculine portrayals. We also present implications for advertising practice.

Self-referencing and consumer evaluations of larger-sized female models : a weight locus of control perspective

In two experiments, we show that the beliefs women have about the controllability of their weight (i.e., weight locus of control) influences their responses to advertisements featuring a larger-sized female model or a slim female model. Further, we examine self-referencing as a mechanism for these effects. Specifically, people who believe they can control their weight (“internals”), respond most favorably to slim models in advertising, and this favorable response is mediated by self-referencing. In contrast, people who feel powerless about their weight (“externals”), self-reference larger-sized models, but only prefer larger-sized models when the advertisement is for a non-fattening product. For fattening products, they exhibit a similar preference for larger-sized models and slim models. Together, these experiments shed light on the effect of model body size and the role of weight locus of control in influencing consumer attitudes.