Using honeypots to analyse anomalous Internet activities

Monitoring Internet traffic is critical in order to acquire a good understanding of threats to computer and network security and in designing efficient computer security systems. Researchers and network administrators have applied several approaches to monitoring traffic for malicious content. These techniques include monitoring network components, aggregating IDS alerts, and monitoring unused IP address spaces. Another method for monitoring and analyzing malicious traffic, which has been widely tried and accepted, is the use of honeypots. Honeypots are very valuable security resources for gathering artefacts associated with a variety of Internet attack activities. As honeypots run no production services, any contact with them is considered potentially malicious or suspicious by definition. This unique characteristic of the honeypot reduces the amount of collected traffic and makes it a more valuable source of information than other existing techniques. Currently, there is insufficient research in the honeypot data analysis field. To date, most of the work on honeypots has been devoted to the design of new honeypots or optimizing the current ones. Approaches for analyzing data collected from honeypots, especially low-interaction honeypots, are presently immature, while analysis techniques are manual and focus mainly on identifying existing attacks. This research addresses the need for developing more advanced techniques for analyzing Internet traffic data collected from low-interaction honeypots. We believe that characterizing honeypot traffic will improve the security of networks and, if the honeypot data is handled in time, give early signs of new vulnerabilities or breakouts of new automated malicious codes, such as worms. The outcomes of this research include: • Identification of repeated use of attack tools and attack processes through grouping activities that exhibit similar packet inter-arrival time distributions using the cliquing algorithm; • Application of principal component analysis to detect the structure of attackers’ activities present in low-interaction honeypots and to visualize attackers’ behaviors; • Detection of new attacks in low-interaction honeypot traffic through the use of the principal component’s residual space and the square prediction error statistic; • Real-time detection of new attacks using recursive principal component analysis; • A proof of concept implementation for honeypot traffic analysis and real time monitoring.

Adaptive dual control of topic-based information retrieval

Information Retrieval is an important albeit imperfect component of information technologies. A problem of insufficient diversity of retrieved documents is one of the primary issues studied in this research. This study shows that this problem leads to a decrease of precision and recall, traditional measures of information retrieval effectiveness. This thesis presents an adaptive IR system based on the theory of adaptive dual control. The aim of the approach is the optimization of retrieval precision after all feedback has been issued. This is done by increasing the diversity of retrieved documents. This study shows that the value of recall reflects this diversity. The Probability Ranking Principle is viewed in the literature as the “bedrock” of current probabilistic Information Retrieval theory. Neither the proposed approach nor other methods of diversification of retrieved documents from the literature conform to this principle. This study shows by counterexample that the Probability Ranking Principle does not in general lead to optimal precision in a search session with feedback (for which it may not have been designed but is actively used). Retrieval precision of the search session should be optimized with a multistage stochastic programming model to accomplish the aim. However, such models are computationally intractable. Therefore, approximate linear multistage stochastic programming models are derived in this study, where the multistage improvement of the probability distribution is modelled using the proposed feedback correctness method. The proposed optimization models are based on several assumptions, starting with the assumption that Information Retrieval is conducted in units of topics. The use of clusters is the primary reasons why a new method of probability estimation is proposed. The adaptive dual control of topic-based IR system was evaluated in a series of experiments conducted on the Reuters, Wikipedia and TREC collections of documents. The Wikipedia experiment revealed that the dual control feedback mechanism improves precision and S-recall when all the underlying assumptions are satisfied. In the TREC experiment, this feedback mechanism was compared to a state-of-the-art adaptive IR system based on BM-25 term weighting and the Rocchio relevance feedback algorithm. The baseline system exhibited better effectiveness than the cluster-based optimization model of ADTIR. The main reason for this was insufficient quality of the generated clusters in the TREC collection that violated the underlying assumption.

Robust speech recognition using speech enhancement

Automatic Speech Recognition (ASR) has matured into a technology which is becoming more common in our everyday lives, and is emerging as a necessity to minimise driver distraction when operating in-car systems such as navigation and infotainment. In “noise-free” environments, word recognition performance of these systems has been shown to approach 100%, however this performance degrades rapidly as the level of background noise is increased. Speech enhancement is a popular method for making ASR systems more ro- bust. Single-channel spectral subtraction was originally designed to improve hu- man speech intelligibility and many attempts have been made to optimise this algorithm in terms of signal-based metrics such as maximised Signal-to-Noise Ratio (SNR) or minimised speech distortion. Such metrics are used to assess en- hancement performance for intelligibility not speech recognition, therefore mak- ing them sub-optimal ASR applications. This research investigates two methods for closely coupling subtractive-type enhancement algorithms with ASR: (a) a computationally-efficient Mel-filterbank noise subtraction technique based on likelihood-maximisation (LIMA), and (b) in- troducing phase spectrum information to enable spectral subtraction in the com- plex frequency domain. Likelihood-maximisation uses gradient-descent to optimise parameters of the enhancement algorithm to best fit the acoustic speech model given a word se- quence known a priori. Whilst this technique is shown to improve the ASR word accuracy performance, it is also identified to be particularly sensitive to non-noise mismatches between the training and testing data. Phase information has long been ignored in spectral subtraction as it is deemed to have little effect on human intelligibility. In this work it is shown that phase information is important in obtaining highly accurate estimates of clean speech magnitudes which are typically used in ASR feature extraction. Phase Estimation via Delay Projection is proposed based on the stationarity of sinusoidal signals, and demonstrates the potential to produce improvements in ASR word accuracy in a wide range of SNR. Throughout the dissertation, consideration is given to practical implemen- tation in vehicular environments which resulted in two novel contributions – a LIMA framework which takes advantage of the grounding procedure common to speech dialogue systems, and a resource-saving formulation of frequency-domain spectral subtraction for realisation in field-programmable gate array hardware. The techniques proposed in this dissertation were evaluated using the Aus- tralian English In-Car Speech Corpus which was collected as part of this work. This database is the first of its kind within Australia and captures real in-car speech of 50 native Australian speakers in seven driving conditions common to Australian environments.

Examination of social demographic status, disease status, health behaviours and quality of life in older Australians using the theory of planned behaviour model

The increase of life expectancy worldwide during the last three decades has increased age-related disability leading to the risk of loss of quality of life. How to improve quality of life including physical health and mental health for older people and optimize their life potential has become an important health issue. This study used the Theory of Planned Behaviour Model to examine factors influencing health behaviours, and the relationship with quality of life. A cross-sectional mailed survey of 1300 Australians over 50 years was conducted at the beginning of 2009, with 730 completed questionnaires returned (response rate 63%). Preliminary analysis reveals that physiological changes of old age, especially increasing waist circumference and co morbidity was closely related to health status, especially worse physical health summary score. Physical activity was the least adherent behaviour among the respondents compared to eating healthy food and taking medication regularly as prescribed. Increasing number of older people living alone with co morbidity of disease may be the barriers that influence their attitude and self control toward physical activity. A multidisciplinary and integrated approach including hospital and non hospital care is required to provide appropriate services and facilities toward older people.

Infrastructure Sustainability : Damage Assessment in Multiple-Girder Composite Bridges Using Vibration Characteristics

Assessing the structural health state of urban infrastructure is crucial in terms of infrastructure sustainability. This chapter uses dynamic computer simulation techniques to apply a procedure using vibration-based methods for damage assessment in multiple-girder composite bridges. In addition to changes in natural frequencies, this multi-criteria procedure incorporates two methods, namely, the modal flexibility and the modal strain energy method. Using the numerically simulated modal data obtained through finite element analysis software, algorithms based on modal flexibility and modal strain energy change, before and after damage, are obtained and used as the indices for the assessment of structural health state. The feasibility and capability of the approach is demonstrated through numerical studies of a proposed structure with six damage scenarios. It is concluded that the modal strain energy method is capable of application to multiple-girder composite bridges, as evidenced through the example treated in this chapter.

Quality of cause-of-death reporting using ICD-10 drowning codes : a descriptive study of 69 countries

Background: The systematic collection of high-quality mortality data is a prerequisite in designing relevant drowning prevention programmes. This descriptive study aimed to assess the quality (i.e., level of specificity) of cause-of-death reporting using ICD-10 drowning codes across 69 countries.---------- Methods: World Health Organization (WHO) mortality data were extracted for analysis. The proportion of unintentional drowning deaths coded as unspecified at the 3-character level (ICD-10 code W74) and for which the place of occurrence was unspecified at the 4th character (.9) were calculated for each country as indicators of the quality of cause-of-death reporting.---------- Results: In 32 of the 69 countries studied, the percentage of cases of unintentional drowning coded as unspecified at the 3-character level exceeded 50%, and in 19 countries, this percentage exceeded 80%; in contrast, the percentage was lower than 10% in only 10 countries. In 21 of the 56 countries that report 4-character codes, the percentage of unintentional drowning deaths for which the place of occurrence was unspecified at the 4th character exceeded 50%, and in 15 countries, exceeded 90%; in only 14 countries was this percentage lower than 10%.---------- Conclusion: Despite the introduction of more specific subcategories for drowning in the ICD-10, many countries were found to be failing to report sufficiently specific codes in drowning mortality data submitted to the WHO.

Improving automatic speaker verification using SVM techniques

Automatic recognition of people is an active field of research with important forensic and security applications. In these applications, it is not always possible for the subject to be in close proximity to the system. Voice represents a human behavioural trait which can be used to recognise people in such situations. Automatic Speaker Verification (ASV) is the process of verifying a persons identity through the analysis of their speech and enables recognition of a subject at a distance over a telephone channel { wired or wireless. A significant amount of research has focussed on the application of Gaussian mixture model (GMM) techniques to speaker verification systems providing state-of-the-art performance. GMM's are a type of generative classifier trained to model the probability distribution of the features used to represent a speaker. Recently introduced to the field of ASV research is the support vector machine (SVM). An SVM is a discriminative classifier requiring examples from both positive and negative classes to train a speaker model. The SVM is based on margin maximisation whereby a hyperplane attempts to separate classes in a high dimensional space. SVMs applied to the task of speaker verification have shown high potential, particularly when used to complement current GMM-based techniques in hybrid systems. This work aims to improve the performance of ASV systems using novel and innovative SVM-based techniques. Research was divided into three main themes: session variability compensation for SVMs; unsupervised model adaptation; and impostor dataset selection. The first theme investigated the differences between the GMM and SVM domains for the modelling of session variability | an aspect crucial for robust speaker verification. Techniques developed to improve the robustness of GMMbased classification were shown to bring about similar benefits to discriminative SVM classification through their integration in the hybrid GMM mean supervector SVM classifier. Further, the domains for the modelling of session variation were contrasted to find a number of common factors, however, the SVM-domain consistently provided marginally better session variation compensation. Minimal complementary information was found between the techniques due to the similarities in how they achieved their objectives. The second theme saw the proposal of a novel model for the purpose of session variation compensation in ASV systems. Continuous progressive model adaptation attempts to improve speaker models by retraining them after exploiting all encountered test utterances during normal use of the system. The introduction of the weight-based factor analysis model provided significant performance improvements of over 60% in an unsupervised scenario. SVM-based classification was then integrated into the progressive system providing further benefits in performance over the GMM counterpart. Analysis demonstrated that SVMs also hold several beneficial characteristics to the task of unsupervised model adaptation prompting further research in the area. In pursuing the final theme, an innovative background dataset selection technique was developed. This technique selects the most appropriate subset of examples from a large and diverse set of candidate impostor observations for use as the SVM background by exploiting the SVM training process. This selection was performed on a per-observation basis so as to overcome the shortcoming of the traditional heuristic-based approach to dataset selection. Results demonstrate the approach to provide performance improvements over both the use of the complete candidate dataset and the best heuristically-selected dataset whilst being only a fraction of the size. The refined dataset was also shown to generalise well to unseen corpora and be highly applicable to the selection of impostor cohorts required in alternate techniques for speaker verification.

Elucidating the links between UV radiation and vitamin D synthesis : using an in vitro model

Ultraviolet radiation (UV) is the carcinogen that causes the most common malignancy in humans – skin cancer. However, moderate UV exposure is essential for producing vitaminDin our skin. VitaminDincreases the absorption of calcium from the diet, and adequate calcium is necessary for the building and maintenance of bones. Thus, low levels of vitamin D can cause osteomalacia and rickets and contribute to osteoporosis. Emerging evidence also suggests vitamin D may protect against falls, internal cancers, psychiatric conditions, autoimmune diseases and cardiovascular diseases. Since the dominant source of vitamin D is sunlight exposure, there is a need to understand what is a “balanced” level of sun exposure to maintain an adequate level of vitamin D but minimise the risks of eye damage, skin damage and skin cancer resulting from excessive UV exposure. There are many steps in the pathway from incoming solar UV to the eventual vitamin D status of humans (measured as 25-hydroxyvitamin D in the blood), and our knowledge about many of these steps is currently incomplete. This project begins by investigating the levels of UV available for synthesising vitamin D, and how these levels vary across seasons, latitudes and times of the day. The thesis then covers experiments conducted with an in vitro model, which was developed to study several aspects of vitamin D synthesis. Results from the model suggest the relationship between UV dose and vitamin D is not linear. This is an important input into public health messages regarding ‘safe’ UV exposure: larger doses of UV, beyond a certain limit, may not continue to produce vitamin D; however, they will increase the risk of skin cancers and eye damage. The model also showed that, when given identical doses of UV, the amount of vitamin D produced was impacted by temperature. In humans, a temperature-dependent reaction must occur in the top layers of human skin, prior to vitamin D entering the bloodstream. The hypothesis will be raised that cooler temperatures (occurring in winter and at high latitudes) may reduce vitamin D production in humans. Finally, the model has also been used to study the wavelengths of UV thought to be responsible for producing vitamin D. It appears that vitamin D production is limited to a small range of UV wavelengths, which may be narrower than previously thought. Together, these results suggest that further research is needed into the ability of humans to synthesise vitamin D from sunlight. In particular, more information is needed about the dose-response relationship in humans and to investigate the proposed impact of temperature. Having an accurate action spectrum will also be essential for measuring the available levels of vitamin D-effective UV. As this research continues, it will contribute to the scientific evidence-base needed for devising a public health message that will balance the risks of excessive UV exposure with maintaining adequate vitamin D.

Venture creation and resource processes : using Bricolage sustainability ventures

Principal Topic: Resource decisions are critical to the venture creation process, which has important subsequent impacts on venture creation and performance (Boeker, 1989). Most entrepreneurs however, suffer substantial resource constraints in venture creation and during venture growth (Shepherd et al., 2000). Little is known about how high potential, sustainability ventures (the ventures of interest in this research), despite resource constraints, achieve continued venture persistence and venture success. One promising theory that explicitly links to resource constraints is a concept developed by Levi Strauss (1967) termed bricolage. Bricolage aligns with notions of resourcefulness: using what's on hand, through making do, and recombining resources for new or novel purposes (Baker & Nelson 2005). To the best of our knowledge, previous studies have not systematically investigated internal and external constraints, their combinations, and subsequent bricolage patterns. The majority of bricolage literature focuses on external environmental constraints (e.g. Wieck 1989; Baker & Nelson 2005), thereby paying less attention to in evaluating internal constraints (e.g. skills and capabilities) or constraint combinations. In this paper we focus on ventures that typically face resource-poor environments. High potential, nascent and young sustainability ventures are often created and developed with resource constraints and in some cases, have greater resource requirements owing to higher levels of technical sophistication of their products (Rothaermel & Deeds 2006). These ventures usually have high aspirations and potential for growth who ''seeks to meet the needs and aspirations without compromising the ability to meet those of the future'' (Brundtland Commission 1983). High potential ventures are increasingly attributed with a central role in the development of innovation, and employment in developed economies (Acs 2008). Further, increasing awareness of environmental and sustainability issues has fostered demand for business processes that reduce detrimental environmental impacts of global development (Dean & McMullen 2007) and more environmentally sensitive products and services: representing an opportunity for the development of ventures that seek to satisfy this demand through entrepreneurial action. These ventures may choose to ''make do'' with existing resources in developing resource combinations that produce the least impact on the environment. The continuous conflict between the greater requirements for resources and limited resource availability in high potential sustainable ventures, with the added complexity of balancing this with an uncompromising focus on using ''what's on hand'' to lessen environment impacts may make bricolage behaviours critical for these ventures. Research into bricolage behaviour is however, the exception rather than the rule (Cunha 2005). More research is therefore needed to further develop and extend this emerging concept, especially in the context of sustainability ventures who are committed to personal and social goals of resourcefulness. To date, however, bricolage has not been studied specifically among high potential sustainable ventures. This research seeks to develop an in depth understanding of the impact of internal and external constraints and their combinations on the mechanisms employed in bricolage behaviours in differing dynamic environments. The following research question was developed to investigate this: How do internal, external resource constraints (or their combinations) impact bricolage resource decisions in high potential sustainability ventures? ---------- Methodology/Key Propositions: 6 case studies will be developed utilizing survey data from the Comprehensive Australian Study of Entrepreneurial Emergence (CAUSEE) large-scale longitudinal study of new venture start-ups in Australia. Prior to commencing case studies, 6 scoping interviews were conducted with key stakeholders including industry members, established businesses and government to ensure practical relevance in case development. The venture is considered the unit of analysis with the key informant being the entrepreneur and other management team members where appropriate. Triangulation techniques are used in this research including semi-structured interviews, survey data, onsite visits and secondary documentation website analysis, resumes, and business plans. These 6 sustainability ventures have been selected based on different environmental dynamism conditions including a traditionally mature market (building industry) and a more dynamic, evolving industry (renewable energy/solar ventures). In evaluating multidisciplinary literature, we expect the following external constraints are critical including: technology constraints (seen through lock-in of incumbents existing technology), institutional regulation and standards, access to markets, knowledge and training to nascent and young venture bricolage processes. The case studies will investigate internal constraints including resource fungability, resource combination capabilities, translating complex science/engineering knowledge into salient, valuable market propositions, i.e. appropriate market outcomes, and leveraging relationships may further influence bricolage decisions. ---------- Results and Implications: Intended ventures have been identified within the CAUSEE sample and have agreed to participate and secondary data collection for triangulation purposes has already commenced. Data collection of the case studies commenced 27th of May 2009. Analysis is expected to be completed finalised by 25th September 2009. This paper will report on the pattern of resource constraints and its impact on bricolage behaviours: its subsequent impact on resource deployment within venture creation and venture growth. As such, this research extends the theory of bricolage through the systematic analysis of constraints on resource management processes in sustainability ventures. For practice, this research may assist in providing a better understanding of the resource requirements and processes needed for continued venture persistence and growth in sustainability ventures. In these times of economic uncertainty, a better understanding of the influence on constraints and bricolage: the interplay of behaviours, processes and outcomes may enable greater venture continuance and success.

Using virtual reality modelling in cultural management, archiving and research

This paper outlines how the Ortelia project’s 3D virtual reality models have the capacity to assist our understanding of sites of cultural heritage. The VR investigation of such spaces can be a valuable tool in 'real world' empirical research in theatre and spatiality. Through a demonstration of two of Ortelia's VR models (an art gallery and a theatre), we suggest how we might consider interpreting cultural space and sites as contributing significantly to cultural capital. We also introduce the potential for human interaction in such venues through motion-capture to discuss the potential for assessing how humans interact in such contexts.

Engaging students in large classes using Elluminate

The advancement of online teaching environments during the past several years presents an exciting opportunity to extend existing teaching methodologies. The software package known as Elluminate is one example of a virtual classroom, facilitating the provision of real time interaction, collaboration and group meetings. This paper will examine the use of Elluminate in the teaching of large classes. The use of such technology for large classes is of particular interest, as large classes are often, unfairly, associated with a reputation for being impersonal as well as notions of conveyor belt learning. In this paper the potential to extend teaching and learning opportunities using Elluminate, in the context of large classes, will be explored. It will be shown that the use of technology such as Elluminate can assist in providing students with a more flexible means of accessing academic support, as well as allowing for a customised delivery of course content so as to focus learning outcomes.

Collaborative business process modeling using 3D virtual environments

Process modeling is a complex organizational task that requires many iterations and communication between the business analysts and the domain specialists involved in the process modeling. The challenge of process modeling is exacerbated, when the process of modeling has to be performed in a cross-organizational, distributed environment. Some systems have been developed to support collaborative process modeling, all of which use traditional 2D interfaces. We present an environment for collaborative process modeling, using 3D virtual environment technology. We make use of avatar instantiations of user ego centres, to allow for the spatial embodiment of the user with reference to the process model. We describe an innovative prototype collaborative process modeling approach, implemented as a modeling environment in Second Life. This approach leverages the use of virtual environments to provide user context for editing and collaborative exercises. We present a positive preliminary report on a case study, in which a test group modelled a business process using the system in Second Life.

Fraud detection in ERP systems using scenario matching

ERP systems generally implement controls to prevent certain common kinds of fraud. In addition however, there is an imperative need for detection of more sophisticated patterns of fraudulent activity as evidenced by the legal requirement for company audits and the common incidence of fraud. This paper describes the design and implementation of a framework for detecting patterns of fraudulent activity in ERP systems. We include the description of six fraud scenarios and the process of specifying and detecting the occurrence of those scenarios in ERP user log data using the prototype software which we have developed. The test results for detecting these scenarios in log data have been verified and confirm the success of our approach which can be generalized to ERP systems in general.

Performance pressure an empirical analysis using world and Euro cups data

There is a notable shortage of empirical research directed at measuring the magnitude and direction of stress effects on performance in a controlled environment. One reason for this is the inherent difficulties in identifying and isolating direct performance measures for individuals. Additionally most traditional work environments contain a multitude of exogenous factors impacting individual performance, but controlling for all such factors is generally unfeasible (omitted variable bias). Moreover, instead of asking individuals about their self-reported stress levels we observe workers' behavior in situations that can be classified as stressful. For this reason we have stepped outside the traditional workplace in an attempt to gain greater controllability of these factors using the sports environment as our experimental space. We empirically investigate the relationship between stress and performance, in an extreme pressure situation (football penalty kicks) in a winner take all sporting environment (FIFA World Cup and UEFA European Cup competitions). Specifically, we examine all the penalty shootouts between 1976 and 2008 covering in total 16 events. The results indicate that extreme stressors can have a positive or negative impact on Individuals' performance. On the other hand, more commonly experienced stressors do not affect professionals' performances.

CC & Government Guide : Using Creative Commons 2.5 Australia Licences on Government Copyright Materials

This guide explains how copyright law applies to Australian government material, how copyright can be managed to facilitate beneficial open access practices by government, how CC licences can be used to achieve open access to government material, and provides practical step-by-step guidance for agencies and their officers on licensing and use of government copyright materials under CC 2.5 Australia licences.