Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Defining the flammability of cylindrical metal rods through characterization of the thermal effects of the ignition promoter

All relevant international standards for determining if a metallic rod is flammable in oxygen utilize some form of “promoted ignition” test. In this test, for a given pressure, an overwhelming ignition source is coupled to the end of the test sample and the designation flammable or nonflammable is based upon the amount burned, that is, a burn criteria. It is documented that (1) the initial temperature of the test sample affects the burning of the test sample both (a) in regards to the pressure at which the sample will support burning (threshold pressure) and (b) the rate at which the sample is melted (regression rate of the melting interface); and, (2) the igniter used affects the test sample by heating it adjacent to the igniter as ignition occurs. Together, these facts make it necessary to ensure, if a metallic material is to be considered flammable at the conditions tested, that the burn criteria will exclude any region of the test sample that may have undergone preheating during the ignition process. A two-dimensional theoretical model was developed to describe the transient heat transfer occurring and resultant temperatures produced within this system. Several metals (copper, aluminum, iron, and stainless steel) and ignition promoters (magnesium, aluminum, and Pyrofuze®) were evaluated for a range of oxygen pressures between 0.69 MPa (100 psia) and 34.5 MPa (5,000 psia). A MATLAB® program was utilized to solve the developed model that was validated against (1) a published solution for a similar system and (2) against experimental data obtained during actual tests at the National Aeronautics and Space Administration White Sands Test Facility. The validated model successfully predicts temperatures within the test samples with agreement between model and experiment increasing as test pressure increases and/or distance from the promoter increases. Oxygen pressure and test sample thermal diffusivity were shown to have the largest effect on the results. In all cases evaluated, there is no significant preheating (above about 38°C/100°F) occurring at distances greater than 30 mm (1.18 in.) during the time the ignition source is attached to the test sample. This validates a distance of 30 mm (1.18 in.) above the ignition promoter as a burn length upon which a definition of flammable can be based for inclusion in relevant international standards (that is, burning past this length will always be independent of the ignition event for the ignition promoters considered here. KEYWORDS: promoted ignition, metal combustion, heat conduction, thin fin, promoted combustion, burn length, burn criteria, flammability, igniter effects, heat affected zone.

Electronic tendering: an industry perspective

The construction industry is categorised as being an information-intensive industry and described as one of the most important industries in any developed country, facing a period of rapid and unparalleled change (Industry Science Resources 1999) (Love P.E.D., Tucker S.N. et al. 1996). Project communications are becoming increasingly complex, with a growing need and fundamental drive to collaborate electronically at project level and beyond (Olesen K. and Myers M.D. 1999; Thorpe T. and Mead S. 2001; CITE 2003). Yet, the industry is also identified as having a considerable lack of knowledge and awareness about innovative information and communication technology (ICT) and web-based communication processes, systems and solutions which may prove beneficial in the procurement, delivery and life cycle of projects (NSW Government 1998; Kajewski S. and Weippert A. 2000). The Internet has debatably revolutionised the way in which information is stored, exchanged and viewed, opening new avenues for business, which only a decade ago were deemed almost inconceivable (DCITA 1998; IIB 2002). In an attempt to put these ‘new avenues of business’ into perspective, this report provides an overall ‘snapshot’ of current public and private construction industry sector opportunities and practices in the implementation and application of web-based ICT tools, systems and processes (e-Uptake). Research found that even with a reserved uptake, the construction industry and its participating organisations are making concerted efforts (fortunately with positive results) in taking up innovative forms of doing business via the internet, including e-Tendering (making it possible to manage the entire tender letting process electronically and online) (Anumba C.J. and Ruikar K. 2002; ITCBP 2003). Furthermore, Government (often a key client within the construction industry),and with its increased tendency to transact its business electronically, undoubtedly has an effect on how various private industry consultants, contractors, suppliers, etc. do business (Murray M. 2003) – by offering a wide range of (current and anticipated) e-facilities / services, including e-Tendering (Ecommerce 2002). Overall, doing business electronically is found to have a profound impact on the way today’s construction businesses operate - streamlining existing processes, with the growth in innovative tools, such as e-Tender, offering the construction industry new responsibilities and opportunities for all parties involved (ITCBP 2003). It is therefore important that these opportunities should be accessible to as many construction industry businesses as possible (The Construction Confederation 2001). Historically, there is a considerable exchange of information between various parties during a tendering process, where accuracy and efficiency of documentation is critical. Traditionally this process is either paper-based (involving large volumes of supporting tender documentation), or via a number of stand-alone, non-compatible computer systems, usually costly to both the client and contractor. As such, having a standard electronic exchange format that allows all parties involved in an electronic tender process to access one system only via the Internet, saves both time and money, eliminates transcription errors and increases speed of bid analysis (The Construction Confederation 2001). Supporting this research project’s aims and objectives, researchers set to determine today’s construction industry ‘current state-of-play’ in relation to e-Tendering opportunities. The report also provides brief introductions to several Australian and International e-Tender systems identified during this investigation. e-Tendering, in its simplest form, is described as the electronic publishing, communicating, accessing, receiving and submitting of all tender related information and documentation via the internet, thereby replacing the traditional paper-based tender processes, and achieving a more efficient and effective business process for all parties involved (NT Governement 2000; NT Government 2000; NSW Department of Commerce 2003; NSW Government 2003). Although most of the e-Tender websites investigated at the time, maintain their tendering processes and capabilities are ‘electronic’, research shows these ‘eTendering’ systems vary from being reasonably advanced to more ‘basic’ electronic tender notification and archiving services for various industry sectors. Research also indicates an e-Tender system should have a number of basic features and capabilities, including: • All tender documentation to be distributed via a secure web-based tender system – thereby avoiding the need for collating paperwork and couriers. • The client/purchaser should be able to upload a notice and/or invitation to tender onto the system. • Notification is sent out electronically (usually via email) for suppliers to download the information and return their responses electronically (online). • During the tender period, updates and queries are exchanged through the same e-Tender system. • The client/purchaser should only be able to access the tenders after the deadline has passed. • All tender related information is held in a central database, which should be easily searchable and fully audited, with all activities recorded. • It is essential that tender documents are not read or submitted by unauthorised parties. • Users of the e-Tender system are to be properly identified and registered via controlled access. In simple terms, security has to be as good as if not better than a manual tender process. Data is to be encrypted and users authenticated by means such as digital signatures, electronic certificates or smartcards. • All parties must be assured that no 'undetected' alterations can be made to any tender. • The tenderer should be able to amend the bid right up to the deadline – whilst the client/purchaser cannot obtain access until the submission deadline has passed. • The e-Tender system may also include features such as a database of service providers with spreadsheet-based pricing schedules, which can make it easier for a potential tenderer to electronically prepare and analyse a tender. Research indicates the efficiency of an e-Tender process is well supported internationally, with a significant number, yet similar, e-Tender benefits identified during this investigation. Both construction industry and Government participants generally agree that the implementation of an automated e-Tendering process or system enhances the overall quality, timeliness and cost-effectiveness of a tender process, and provides a more streamlined method of receiving, managing, and submitting tender documents than the traditional paper-based process. On the other hand, whilst there are undoubtedly many more barriers challenging the successful implementation and adoption of an e-Tendering system or process, researchers have also identified a range of challenges and perceptions that seem to hinder the uptake of this innovative approach to tendering electronically. A central concern seems to be that of security - when industry organisations have to use the Internet for electronic information transfer. As a result, when it comes to e-Tendering, industry participants insist these innovative tendering systems are developed to ensure the utmost security and integrity. Finally, if Australian organisations continue to explore the competitive ‘dynamics’ of the construction industry, without realising the current and future, trends and benefits of adopting innovative processes, such as e-Tendering, it will limit their globalising opportunities to expand into overseas markets and allow the continuation of international firms successfully entering local markets. As such, researchers believe increased knowledge, awareness and successful implementation of innovative systems and processes raises great expectations regarding their contribution towards ‘stimulating’ the globalisation of electronic procurement activities, and improving overall business and project performances throughout the construction industry sectors and overall marketplace (NSW Government 2002; Harty C. 2003; Murray M. 2003; Pietroforte R. 2003). Achieving the successful integration of an innovative e-Tender solution with an existing / traditional process can be a complex, and if not done correctly, could lead to failure (Bourn J. 2002).

Development of a biaxial compression device for biological samples : preliminary experimental results for a closed cell foam

Biological tissues are subjected to complex loading states in vivo and in order to define constitutive equations that effectively simulate their mechanical behaviour under these loads, it is necessary to obtain data on the tissue's response to multiaxial loading. Single axis and shear testing of biological tissues is often carried out, but biaxial testing is less common. We sought to design and commission a biaxial compression testing device, capable of obtaining repeatable data for biological samples. The apparatus comprised a sealed stainless steel pressure vessel specifically designed such that a state of hydrostatic compression could be created on the test specimen while simultaneously unloading the sample along one axis with an equilibrating tensile pressure. Thus a state of equibiaxial compression was created perpendicular to the long axis of a rectangular sample. For the purpose of calibration and commissioning of the vessel, rectangular samples of closed cell ethylene vinyl acetate (EVA) foam were tested. Each sample was subjected to repeated loading, and nine separate biaxial experiments were carried out to a maximum pressure of 204 kPa (30 psi), with a relaxation time of two hours between them. Calibration testing demonstrated the force applied to the samples had a maximum error of 0.026 N (0.423% of maximum applied force). Under repeated loading, the foam sample demonstrated lower stiffness during the first load cycle. Following this cycle, an increased stiffness, repeatable response was observed with successive loading. While the experimental protocol was developed for EVA foam, preliminary results on this material suggest that this device may be capable of providing test data for biological tissue samples. The load response of the foam was characteristic of closed cell foams, with consolidation during the early loading cycles, then a repeatable load-displacement response upon repeated loading. The repeatability of the test results demonstrated the ability of the test device to provide reproducible test data and the low experimental error in the force demonstrated the reliability of the test data.

Engaging, enraging public relations and the role of the other

The intention of this paper is to further the discussion around the development of theories of public relations by introducing to the mix the concept of the Other from the field of cultural studies. The development of discipline-specific theories as part of a “scholarly body of knowledge” (Wylie, 1994, p.2) – or at least a “unique” knowledge base (Parkinson, 2001) – has been suggested as one of the defining characteristics of a true profession. In the case of public relations, this is a development that has occurred relatively recently. Since public relations first began to emerge as a distinct practice in the early part of the 20th century, there has been a tendency to appropriate theories from other areas (such as organisational and media studies) to create a relevant theory base to explore, describe and predict public relations activities. However, these theories were often rarely more than a ‘best fit’ solution, and resulting areas of discrepancy led to much confusion surrounding the form and function of public relations. It could be argued therefore that the development of dedicated public relations theory – ideas that encompass the creation, maintenance and enhancement of relationships between organisations and publics as primary motivations – only began in the latter half of the 20th century with the work of people such as Grunig and Hunt, and latterly Ledingham and Bruning among others.

Estimating total cross sections from neutron-nucleus collisions using a simple functional form

Total cross sections for neutron scattering from nuclei, with energies ranging from 10 to 600 MeV and from many nuclei spanning the mass range 6Li to 238U, have been analyzed using a simple, three-parameter, functional form. The calculated cross sections are compared with results obtained by using microscopic (g-folding) optical potentials as well as with experimental data. The functional form reproduces those total cross sections very well. When allowance is made for Ramsauer-like effects in the scattering, the parameters of the functional form required vary smoothly with energy and target mass. They too can be represented by functions of energy and mass.

A surface plasmon resonance-based solution affinity assay for heparan sulfate-binding proteins

A surface plasmon resonance-based solution affinity assay is described for measuring the Kd of binding of heparin/heparan sulfate-binding proteins with a variety of ligands. The assay involves the passage of a pre-equilibrated solution of protein and ligand over a sensor chip onto which heparin has been immobilised. Heparin sensor chips prepared by four different methods, including biotin–streptavidin affinity capture and direct covalent attachment to the chip surface, were successfully used in the assay and gave similar Kd values. The assay is applicable to a wide variety of heparin/HS-binding proteins of diverse structure and function (e.g., FGF-1, FGF-2, VEGF, IL-8, MCP-2, ATIII, PF4) and to ligands of varying molecular weight and degree of sulfation (e.g., heparin, PI-88, sucrose octasulfate, naphthalene trisulfonate) and is thus well suited for the rapid screening of ligands in drug discovery applications.

Challenges faced by general practitioners and allied mental health services in providing mental health services in rural Queensland

Objective: To examine the views of rural practitioners concerning issues and challenges in mental health service delivery and possible solutions. Design: A qualitative study using individual semi-structured interviews. Setting: Eight general practices from eight rural Queensland towns, three rural mental health services and two non-government organisations, with interviews being conducted before recent changes in government-subsidised access to allied health practitioners. Participants: A sample of 37 GPs, 19 Queensland Health mental health staff and 18 participants from community organisations. Main outcome measures: Analysis of qualitative themes from questions about the key mental health issues facing the town, bow they might be addressed and what challenges would be faced in addressing them. Results: There was substantial consensus that there are significant problems with inter-service communication and liaison, and that improved collaboration and shared care will form a critical part of any effective solution. Differences between groups reflected differing organisational contexts and priorities, and limitations to the understanding each had of the challenges that other groups were facing. C onclusions: Improvements to mental health staffing and to access to allied health might increase the ability of GPs to meet the needs of less complex patients, but specific strategies to promote better integrated services are required to address the needs of rural and regional patients with complex mental health problems. The current study provides a baseline against which effects of recent initiatives to improve mental health care can be assessed.

Consonance in urban form : morphogenetic analysis of architectural elements within urban forms

"By understanding how places have evolved, we are better able to guide development and change in the urban fabric and avoid the incongruity created by so much of the modern environment" (MacCormac, R (1996), An anatomy of London, Built Environment, Dec 1996 This paper proposes a theory on the relevance of mapping the evolutionary aspects of historical urban form in order to develop a measure of evaluating architectural elements within urban forms, through to deriving parameters for new buildings. By adopting Conzen's identification of the tripartite division of urban form; the consonance inurban form of a particular palce resides in the elements and measurable values tha makeup the fine grain aggregates of urban form. The paper will demonstrate throughthe case study of Brisbane in Australia, a method of conveying these essential components that constitute a cities continuity of form and active usage. By presenting the past as a repository of urban form characteristics, it is argued that concise architectural responses that stem from such knowledge should result in an engaged urban landscape. The essential proposition is that urban morphology is a missing constituent in the process of urban design, and that the approach of the geographical discipline to the study of urban morphology holds the key to providing the evidence of urban growth characteristics, and this methodology suggests possibilities for an architectural approach that can comprehensively determine qualitative aspects of urban buildings. The relevance of this research lies in a potential to breach the limitations of current urban analysis whilst continuing the evolving currency of urban morphology as an integral practice in the design of our cities.

Understanding how to enhance business creativity

This PhD study examines some of what happens in an individual’s mind regarding creativity during problem solving within an organisational context. It presents innovations related to creative motivation, cognitive style and framing effects that can be applied by managers to enhance individual employee creativity within the organisation and thereby assist organisations to become more innovative. The project delivers an understanding of how to leverage natural changes in creative motivation levels during problem solving. This pattern of response is called Creative Resolve Response (CRR). The project also presents evidence of how framing effects can be used to influence decisions involving creative options in order to enhance the potential for managers get employees to select creative options more often for implementation. The study’s objectives are to understand: • How creative motivation changes during problem solving • How cognitive style moderates these creative motivation changes • How framing effects apply to decisions involving creative options to solve problems • How cognitive style moderate these framing effects The thesis presents the findings from three controlled experiments based around self reports during contrived problem solving and decision making situations. The first experiment suggests that creative motivation varies in a predictable and systematic way during problem solving as a function of the problem solver’s perception of progress. The second experiment suggests that there are specific framing effects related to decisions involving creativity. It seems that simply describing an alternative as innovative may activate perceptual biases that overcome risk based framing effects. The third experiment suggests that cognitive style moderates decisions involving creativity in complex ways. It seems that in some contexts, decision makers will prefer a creative option, regardless of their cognitive style, if this option is both outside the bounds of what is officially allowed and yet ultimately safe. The thesis delivers innovation on three levels: theoretical, methodological and empirical. The highlights of these findings are outlined below: 1. Theoretical innovation with the conceptualisation of Creative Resolve Response based on an extension of Amabile’s research regarding creative motivation. 2. Theoretical innovation linking creative motivation and Kirton’s research on cognitive style. 3. Theoretical innovation linking both risk based and attribute framing effects to cognitive style. 4. Methodological innovation for defining and testing preferences for creative solution implementation in the form of operationalised creativity decision alternatives. 5. Methodological innovation to identify extreme decision options by applying Shafir’s findings regarding attribute framing effects in reverse to create a test. 6. Empirical innovation with statistically significant research findings which indicate creative motivation varies in a systematic way. 7. Empirical innovation with statistically significant research findings which identify innovation descriptor framing effects 8. Empirical innovation with statistically significant research findings which expand understanding of Kirton’s cognitive style descriptors including the importance of safe rule breaking. 9. Empirical innovation with statistically significant research findings which validate how framing effects do apply to decisions involving operationalised creativity. Drawing on previous research related to creative motivation, cognitive style, framing effects and supervisor interactions with employees, this study delivers insights which can assist managers to increase the production and implementation of creativity in organisations. Hopefully this will result in organisations which are more innovative. Such organisations have the potential to provide ongoing economic and social benefits.

Cognitive assessment in closed head injury : stability, validity and parallel forms for two neuropsychological measures of recovery

Investigated the psychometric properties of the original and alternate sets of the Trail Making Test (TMT) and the Controlled Oral Word Association Test (COWAT; A. L. Benton and D. Hamsher, 1978) in 50 orthopedic and 15 closed head injured (1 yr after trauma) patients (aged 15–59 yrs). Although the alternate forms of both measures proved to be stable and consistent with each other in both groups, only the parallel sets of TMT reliably discriminated the clinical group from controls. Practice effects in the head injured were significant only for Trail B of TMT. Factor analysis of the control group's results identified Verbal Knowledge as a major contributor to performance on COWAT, whereas TMT was more dependent on Rapid Visual Search and Visuomotor Sequencing.

A Numerical Solution Using an Adaptively Preconditioned Lanczos Method for a Class of Linear Systems Related with the Fractional Poisson Equation

This study considers the solution of a class of linear systems related with the fractional Poisson equation (FPE) (−∇2)α/2φ=g(x,y) with nonhomogeneous boundary conditions on a bounded domain. A numerical approximation to FPE is derived using a matrix representation of the Laplacian to generate a linear system of equations with its matrix A raised to the fractional power α/2. The solution of the linear system then requires the action of the matrix function f(A)=A−α/2 on a vector b. For large, sparse, and symmetric positive definite matrices, the Lanczos approximation generates f(A)b≈β0Vmf(Tm)e1. This method works well when both the analytic grade of A with respect to b and the residual for the linear system are sufficiently small. Memory constraints often require restarting the Lanczos decomposition; however this is not straightforward in the context of matrix function approximation. In this paper, we use the idea of thick-restart and adaptive preconditioning for solving linear systems to improve convergence of the Lanczos approximation. We give an error bound for the new method and illustrate its role in solving FPE. Numerical results are provided to gauge the performance of the proposed method relative to exact analytic solutions.

XCFS - a novel approach for clustering XML documents using both the structure and the content

XML document clustering is essential for many document handling applications such as information storage, retrieval, integration and transformation. An XML clustering algorithm should process both the structural and the content information of XML documents in order to improve the accuracy and meaning of the clustering solution. However, the inclusion of both kinds of information in the clustering process results in a huge overhead for the underlying clustering algorithm because of the high dimensionality of the data. This paper introduces a novel approach that first determines the structural similarity in the form of frequent subtrees and then uses these frequent subtrees to represent the constrained content of the XML documents in order to determine the content similarity. The proposed method reduces the high dimensionality of input data by using only the structure-constrained content. The empirical analysis reveals that the proposed method can effectively cluster even very large XML datasets and outperform other existing methods.

Krylov subspace methods for approximating functions of symmetric positive definite matrices with applications to applied statistics and anomalous diffusion

Matrix function approximation is a current focus of worldwide interest and finds application in a variety of areas of applied mathematics and statistics. In this thesis we focus on the approximation of A^(-α/2)b, where A ∈ ℝ^(n×n) is a large, sparse symmetric positive definite matrix and b ∈ ℝ^n is a vector. In particular, we will focus on matrix function techniques for sampling from Gaussian Markov random fields in applied statistics and the solution of fractional-in-space partial differential equations. Gaussian Markov random fields (GMRFs) are multivariate normal random variables characterised by a sparse precision (inverse covariance) matrix. GMRFs are popular models in computational spatial statistics as the sparse structure can be exploited, typically through the use of the sparse Cholesky decomposition, to construct fast sampling methods. It is well known, however, that for sufficiently large problems, iterative methods for solving linear systems outperform direct methods. Fractional-in-space partial differential equations arise in models of processes undergoing anomalous diffusion. Unfortunately, as the fractional Laplacian is a non-local operator, numerical methods based on the direct discretisation of these equations typically requires the solution of dense linear systems, which is impractical for fine discretisations. In this thesis, novel applications of Krylov subspace approximations to matrix functions for both of these problems are investigated. Matrix functions arise when sampling from a GMRF by noting that the Cholesky decomposition A = LL^T is, essentially, a `square root' of the precision matrix A. Therefore, we can replace the usual sampling method, which forms x = L^(-T)z, with x = A^(-1/2)z, where z is a vector of independent and identically distributed standard normal random variables. Similarly, the matrix transfer technique can be used to build solutions to the fractional Poisson equation of the form ϕn = A^(-α/2)b, where A is the finite difference approximation to the Laplacian. Hence both applications require the approximation of f(A)b, where f(t) = t^(-α/2) and A is sparse. In this thesis we will compare the Lanczos approximation, the shift-and-invert Lanczos approximation, the extended Krylov subspace method, rational approximations and the restarted Lanczos approximation for approximating matrix functions of this form. A number of new and novel results are presented in this thesis. Firstly, we prove the convergence of the matrix transfer technique for the solution of the fractional Poisson equation and we give conditions by which the finite difference discretisation can be replaced by other methods for discretising the Laplacian. We then investigate a number of methods for approximating matrix functions of the form A^(-α/2)b and investigate stopping criteria for these methods. In particular, we derive a new method for restarting the Lanczos approximation to f(A)b. We then apply these techniques to the problem of sampling from a GMRF and construct a full suite of methods for sampling conditioned on linear constraints and approximating the likelihood. Finally, we consider the problem of sampling from a generalised Matern random field, which combines our techniques for solving fractional-in-space partial differential equations with our method for sampling from GMRFs.