Effective network security monitoring: from attribution to target-centric monitoring

Network security monitoring remains a challenge. As global networks scale up, in terms of traffic, volume and speed, effective attribution of cyber attacks is increasingly difficult. The problem is compounded by a combination of other factors, including the architecture of the Internet, multi-stage attacks and increasing volumes of nonproductive traffic. This paper proposes to shift the focus of security monitoring from the source to the target. Simply put, resources devoted to detection and attribution should be redeployed to efficiently monitor for targeting and prevention of attacks. The effort of detection should aim to determine whether a node is under attack, and if so, effectively prevent the attack. This paper contributes by systematically reviewing the structural, operational and legal reasons underlying this argument, and presents empirical evidence to support a shift away from attribution to favour of a target-centric monitoring approach. A carefully deployed set of experiments are presented and a detailed analysis of the results is achieved.

Dynalog: an automated dynamic analysis framework for characterizing android applications

Android is becoming ubiquitous and currently has the largest share of the mobile OS market with billions of application downloads from the official app market. It has also become the platform most targeted by mobile malware that are becoming more sophisticated to evade state-of-the-art detection approaches. Many Android malware families employ obfuscation techniques in order to avoid detection and this may defeat static analysis based approaches. Dynamic analysis on the other hand may be used to overcome this limitation. Hence in this paper we propose DynaLog, a dynamic analysis based framework for characterizing Android applications. The framework provides the capability to analyse the behaviour of applications based on an extensive number of dynamic features. It provides an automated platform for mass analysis and characterization of apps that is useful for quickly identifying and isolating malicious applications. The DynaLog framework leverages existing open source tools to extract and log high level behaviours, API calls, and critical events that can be used to explore the characteristics of an application, thus providing an extensible dynamic analysis platform for detecting Android malware. DynaLog is evaluated using real malware samples and clean applications demonstrating its capabilities for effective analysis and detection of malicious applications.

Reducing child conduct disordered behaviour and improving parent mental health in disadvantaged families: a 12 month follow-up and cost analysis of a parenting intervention

The effectiveness of the Incredible Years Basic parent programme (IYBP) in reducing child conduct problems and improving parent competencies and mental health was examined in a 12-month follow-up. Pre- to post-intervention service use and related costs were also analysed. A total of 103 families and their children (aged 32–88 months), who previously participated in a randomised controlled trial of the IYBP, took part in a 12-month follow-up assessment. Child and parent behaviour and well-being were measured using psychometric and observational measures. An intention-to-treat analysis was carried out using a one-way repeated measures ANOVA. Pairwise comparisons were subsequently conducted to determine whether treatment outcomes were sustained 1 year post-baseline assessment. Results indicate that post-intervention improvements in child conduct problems, parenting behaviour and parental mental health were maintained. Service use and associated costs continued to decline. The results indicate that parent-focused interventions, implemented in the early years, can result in improvements in child and parent behaviour and well-being 12 months later. A reduced reliance on formal services is also indicated.

Exploring the effects of a universal classroom management training programme on teacher and child behaviour: a group randomised controlled trial and cost analysis

Teachers frequently struggle to cope with conduct problems in the classroom. The aim of this study was to assess the effectiveness of the Incredible Years Teacher Classroom Management Training Programme for improving teacher competencies and child adjustment. The study involved a group randomised controlled trial which included 22 teachers and 217 children (102 boys and 115 girls). The average age of children included in the study was 5.3 years (standard deviation = 0.89). Teachers were randomly allocated to an intervention group (n = 11 teachers; 110 children) or a waiting-list control group (n = 11; 107 children). The sample also included 63 ‘high-risk’ children (33 intervention; 30 control), who scored above the cut-off (>12) on the Strengths and Difficulties Questionnaire for abnormal socioemotional and behavioural difficulties. Teacher and child behaviours were assessed at baseline and 6 months later using psychometric and observational measures. Programme delivery costs were also analysed. Results showed positive changes in teachers’ self-reported use of positive classroom management strategies (effect size = 0.56), as well as negative classroom management strategies (effect size = −0.43). Teacher reports also highlight improvements in the classroom behaviour of the high-risk group of children, while the estimated cost of delivering the Incredible Years Teacher Classroom Management Training Programme was modest. However, analyses of teacher and child observations were largely non-significant. A need for further research exploring the effectiveness and cost-effectiveness of the Incredible Years Teacher Classroom Management Training Programme is indicated.

Characterisation of polyethylene powders for rotational moulding and effect of powder size and shape on densification behaviour

The particle size, shape and distribution of a range of rotational moulding polyethylenes (PEs) ground to powder was investigated using a novel visual data acquisition and analysis system (TP Picture®), developed by Total Petrochemicals. Differences in the individual particle shape factors of the powder samples were observed and correlations with the grinding conditions were determined. When heated, the bubble dissolution behaviour of the same powders was investigated and the shape factor correlated with densification rate, bubble size and bubble distribution.

Study into the densification behaviour of polyethylenes for rotational moulding

The melting and densification behaviour of a range of Polyethylenes (PEs) produced from 2 different catalysts, Ziegler-Natta and Metallocene types, were investigated using a novel visual data acquisition and analysis system (TP Picture®), developed by Total Petrochemicals Research Feluy [1]. Differences in the dissolution behaviour of the bubbles were observed and correlations with the material density, densification rate, bubble size / distribution and MFI were determined.

Interactive visual analysis of population study data

Otto-von-Guericke-Universität Magdeburg, Fakultät für Informatik, Dissertation, 2015

Bayesian Methods for Inferring Gene Regulatory Networks

Thesis (Ph.D.)--University of Washington, 2016-08

RACIAL/ETHNIC VARIABILITY IN THE EFFECT OF RADIATION ON SECOND PRIMARY THYROID CANCER IN CHILDREN: ANALYSIS USING SURVEILLANCE EPIDEMIOLOGY AND END RESULTS DATA

Increases in pediatric thyroid cancer incidence could be partly due to previous clinical intervention. This retrospective cohort study used 1973-2012 data from the Surveillance Epidemiology and End Results program to assess the association between previous radiation therapy exposure in development of second primary thyroid cancer (SPTC) among 0-19-year-old children. Statistical analysis included the calculation of summary statistics and univariable and multivariable logistic regression analysis. Relative to no previous radiation therapy exposure, cases exposed to radiation had 2.46 times the odds of developing SPTC (95% CI: 1.39-4.34). After adjustment for sex and age at diagnosis, Hispanic children who received radiation therapy for a first primary malignancy had 3.51 times the odds of developing SPTC compared to Hispanic children who had not received radiation therapy, [AOR=3.51, 99% CI: 0.69-17.70, p=0.04]. These findings support the development of age-specific guidelines for the use of radiation based interventions among children with and without cancer.

Outcome analysis of intracorneal ring segments for the treatment of keratoconus based on visual, refractive, and aberrometric impairment

PURPOSE: To analyze the outcomes of intracorneal ring segment (ICRS) implantation for the treatment of keratoconus based on preoperative visual impairment. DESIGN: Multicenter, retrospective, nonrandomized study. METHODS: A total of 611 eyes of 361 keratoconic patients were evaluated. Subjects were classified according to their preoperative corrected distance visual acuity (CDVA) into 5 different groups: grade I, CDVA of 0.90 or better; grade II, CDVA equal to or better than 0.60 and worse than 0.90; grade III, CDVA equal to or better than 0.40 and worse than 0.60; grade IV, CDVA equal to or better than 0.20 and worse than 0.40; and grade plus, CDVA worse than 0.20. Success and failure indices were defined based on visual, refractive, corneal topographic, and aberrometric data and evaluated in each group 6 months after ICRS implantation. RESULTS: Significant improvement after the procedure was observed regarding uncorrected distance visual acuity in all grades (P < .05). CDVA significantly decreased in grade I (P < .01) but significantly increased in all other grades (P < .05). A total of 37.9% of patients with preoperative CDVA 0.6 or better gained 1 or more lines of CDVA, whereas 82.8% of patients with preoperative CDVA 0.4 or worse gained 1 or more lines of CDVA (P < .01). Spherical equivalent and keratometry readings showed a significant reduction in all grades (P ≤ .02). Corneal higher-order aberrations did not change after the procedure (P ≥ .05). CONCLUSIONS: Based on preoperative visual impairment, ICRS implantation provides significantly better results in patients with a severe form of the disease. A notable loss of CDVA lines can be expected in patients with a milder form of keratoconus.

Analysis of the moisture effect on the mechanical behaviour of an adhesively bonded joint under proportional multi-axial loads

The objective of the study is to identify the 3D behaviour of an adhesive in an assembly, and to take into account the effect of ageing in a marine environment. To that end, three different tests were employed. Gravimetric analyses were used to determine the water diffusion kinetics in the adhesive. Bulk tensile tests were performed to highlight the effects of humid ageing on the adhesive behaviour. Modified Arcan tests were performed for several ageing times to obtain the experimental database which was necessary to identify constitutive models. A Mahnken-Schlimmer type model was determined for the unaged state according to a procedure developed in a previous study. This identification used inverse techniques. It was based on the unaged modified Arcan results and on a coupling between an optimisation routine and finite-element analysis. Then, a global inverse identification procedure was developed. Its aim was to relate the unaged parameters to the moisture concentration and overcome the difficulties usually associated with ageing of bonded assemblies in a humid environment: a non-uniformity of the stress state and a gradient of mechanical properties in the adhesive. This procedure was similar to the one used in the first part but needed modified Arcan results for several ageing times. It also required an initial assumption for the evolution of the Mahnken-Schlimmer parameters with the moisture concentration.

An interpretative phenomenological analysis of the lived experience of suicidal behaviour

Background: In Scotland, suicide prevention is a major public health challenge, with two people, on average, dying every day due to suicide. Any efforts to prevent suicide should be aided by research. Existing research on suicide is dominated by quantitative research that has largely focused on providing explanatory accounts of suicidal phenomena. Research providing rich and detailed accounts of suicidal behaviour among individuals who have directly experienced it is growing but remains relatively embryonic. This study sought to supplement existing understanding of attempted suicide specifically by exploring the processes, meaning and context of suicidal experiences among individuals with a history of attempted suicide. Methods: The study used a retrospective qualitative design with semi-structured in-depth interviews. Participants were patients (n=7) from a community mental health service in Glasgow, Scotland who had attempted suicide within the previous 12-month period. The interviews were transcribed verbatim and were analysed for recurrent themes using interpretative phenomenological analysis (IPA). Results: Three super-ordinate themes, each with inter-related sub-themes, emerged from the analysis. 1) “Intentions”: This theme explored different motives for suicide, including providing relief from upsetting feelings; a way of establishing control; and a means of communicating with others. 2) “The Suicidal Journey”: This theme explored how individuals’ thinking can change when they are suicidal, including feeling overwhelmed by a build-up of distress and a narrowing of their perspective. 3) “Suicidal Dissonance”: This theme explored how people can feel conflicted about suicide and can be fearful of the consequences of their suicidal behaviour. Conclusion: Participants’ accounts were dominated by experience of significant adversity and psychological suffering. These accounts provided valuable insights into the suicidal process, highlighting implications for clinical practice and future research.

A Visual Analytics Approach to Comparing Cohorts of Event Sequences

Sequences of timestamped events are currently being generated across nearly every domain of data analytics, from e-commerce web logging to electronic health records used by doctors and medical researchers. Every day, this data type is reviewed by humans who apply statistical tests, hoping to learn everything they can about how these processes work, why they break, and how they can be improved upon. To further uncover how these processes work the way they do, researchers often compare two groups, or cohorts, of event sequences to find the differences and similarities between outcomes and processes. With temporal event sequence data, this task is complex because of the variety of ways single events and sequences of events can differ between the two cohorts of records: the structure of the event sequences (e.g., event order, co-occurring events, or frequencies of events), the attributes about the events and records (e.g., gender of a patient), or metrics about the timestamps themselves (e.g., duration of an event). Running statistical tests to cover all these cases and determining which results are significant becomes cumbersome. Current visual analytics tools for comparing groups of event sequences emphasize a purely statistical or purely visual approach for comparison. Visual analytics tools leverage humans' ability to easily see patterns and anomalies that they were not expecting, but is limited by uncertainty in findings. Statistical tools emphasize finding significant differences in the data, but often requires researchers have a concrete question and doesn't facilitate more general exploration of the data. Combining visual analytics tools with statistical methods leverages the benefits of both approaches for quicker and easier insight discovery. Integrating statistics into a visualization tool presents many challenges on the frontend (e.g., displaying the results of many different metrics concisely) and in the backend (e.g., scalability challenges with running various metrics on multi-dimensional data at once). I begin by exploring the problem of comparing cohorts of event sequences and understanding the questions that analysts commonly ask in this task. From there, I demonstrate that combining automated statistics with an interactive user interface amplifies the benefits of both types of tools, thereby enabling analysts to conduct quicker and easier data exploration, hypothesis generation, and insight discovery. The direct contributions of this dissertation are: (1) a taxonomy of metrics for comparing cohorts of temporal event sequences, (2) a statistical framework for exploratory data analysis with a method I refer to as high-volume hypothesis testing (HVHT), (3) a family of visualizations and guidelines for interaction techniques that are useful for understanding and parsing the results, and (4) a user study, five long-term case studies, and five short-term case studies which demonstrate the utility and impact of these methods in various domains: four in the medical domain, one in web log analysis, two in education, and one each in social networks, sports analytics, and security. My dissertation contributes an understanding of how cohorts of temporal event sequences are commonly compared and the difficulties associated with applying and parsing the results of these metrics. It also contributes a set of visualizations, algorithms, and design guidelines for balancing automated statistics with user-driven analysis to guide users to significant, distinguishing features between cohorts. This work opens avenues for future research in comparing two or more groups of temporal event sequences, opening traditional machine learning and data mining techniques to user interaction, and extending the principles found in this dissertation to data types beyond temporal event sequences.

The Portuguese offline consumer behaviour

Even though much attention has been paid to online consumer behavior, academic studies are deficient in comprehending offline consumer behavior. This study offers a survey of reflections concerning the Portuguese offline consumer behavior by observing how Portuguese adult consumers engage, embrace and act throughout the offline world, i.e., the offline media channels and the customer decision-making process at a store in regard of digital nativity, education and gender. Drawing on an online questionnaire and using a convenience sample of 471 respondents, data was analyzed using descriptive analysis and independent sample t-test analysis. The results observed indicate Portuguese consumers prefer calling or going to a store when they have an operational problem, value the credit card security at a store and that Portuguese females highly value touching and feeling the product at a store. Finally, implications for academics and marketeers are discussed.