Data preprocessing for anomaly based network intrusion detection : a review

Data preprocessing is widely recognized as an important stage in anomaly detection. This paper reviews the data preprocessing techniques used by anomaly-based network intrusion detection systems (NIDS), concentrating on which aspects of the network traffic are analyzed, and what feature construction and selection methods have been used. Motivation for the paper comes from the large impact data preprocessing has on the accuracy and capability of anomaly-based NIDS. The review finds that many NIDS limit their view of network traffic to the TCP/IP packet headers. Time-based statistics can be derived from these headers to detect network scans, network worm behavior, and denial of service attacks. A number of other NIDS perform deeper inspection of request packets to detect attacks against network services and network applications. More recent approaches analyze full service responses to detect attacks targeting clients. The review covers a wide range of NIDS, highlighting which classes of attack are detectable by each of these approaches. Data preprocessing is found to predominantly rely on expert domain knowledge for identifying the most relevant parts of network traffic and for constructing the initial candidate set of traffic features. On the other hand, automated methods have been widely used for feature extraction to reduce data dimensionality, and feature selection to find the most relevant subset of features from this candidate set. The review shows a trend toward deeper packet inspection to construct more relevant features through targeted content parsing. These context sensitive features are required to detect current attacks.

Towards a provably secure DoS-Resilient key exchange protocol with perfect forward secrecy

Just Fast Keying (JFK) is a simple, efficient and secure key exchange protocol proposed by Aiello et al. (ACM TISSEC, 2004). JFK is well known for its novel design features, notably its resistance to denial-of-service (DoS) attacks. Using Meadows’ cost-based framework, we identify a new DoS vulnerability in JFK. The JFK protocol is claimed secure in the Canetti-Krawczyk model under the Decisional Diffie-Hellman (DDH) assumption. We show that security of the JFK protocol, when reusing ephemeral Diffie-Hellman keys, appears to require the Gap Diffie-Hellman (GDH) assumption in the random oracle model. We propose a new variant of JFK that avoids the identified DoS vulnerability and provides perfect forward secrecy even under the DDH assumption, achieving the full security promised by the JFK protocol.

Practical client puzzles in the standard model

Client puzzles are cryptographic problems that are neither easy nor hard to solve. Most puzzles are based on either number theoretic or hash inversions problems. Hash-based puzzles are very efficient but so far have been shown secure only in the random oracle model; number theoretic puzzles, while secure in the standard model, tend to be inefficient. In this paper, we solve the problem of constucting cryptographic puzzles that are secure int he standard model and are very efficient. We present an efficient number theoretic puzzle that satisfies the puzzle security definition of Chen et al. (ASIACRYPT 2009). To prove the security of our puzzle, we introduce a new variant of the interval discrete logarithm assumption which may be of independent interest, and show this new problem to be hard under reasonable assumptions. Our experimental results show that, for 512-bit modulus, the solution verification time of our proposed puzzle can be up to 50x and 89x faster than the Karame-Capkum puzzle and the Rivest et al.'s time-lock puzzle respectively. In particular, the solution verification tiem of our puzzle is only 1.4x slower than that of Chen et al.'s efficient hash based puzzle.

Victims Speak: Comparing Child Sexual Abusers and Their Victims Accounts of Offence Circumstances

This article presents findings from a longitudinal study. The research aimed to explore the effectiveness of a treatment program for offenders which lasted for three years. The research design was structured around the program with interviews and psychometric testing undertaken at key points in time with the same group of respondents. View all notes that sought to evaluate a treatment program for child sexual abusers. A triangulated methodological approach was adopted drawing upon quantitative and qualitative methodological techniques. The focus here is upon one element of this research. 2 2The quantitative element of this research will be published shortly but is referred to in the following reports Davidson 2000, 2003 [research funded by the National Probation Service]. Psychometric testing was undertaken over a four-year period with the men attending the treatment program to explore shifts in the extent of denial, blame attribution, and victim empathy over time. Offender cognitive distortions, general health, and self-esteem were also explored via psychometric testing. An interview-administered survey was undertaken with all sex offenders registered with the Probation Service (those on probation and in custody) in order to gather demographic data, and 117 of 150 offenders responded. View all notes Ninety-one in-depth interviews were conducted over a four-year period with a small, nonrandom sample of twenty-one male offenders who had been convicted of sexual offenses against children. All of the men were subject to probation orders with a psychiatric condition (Criminal Justice Act, 1991). One of the aims of this element of the research was to explore the extent to which evidence of denial could be found in offenders’ accounts of offense circumstance and also to explore the extent to which offenders minimized the nature and extent of abuse perpetrated. Offenders’ accounts of offense circumstances were compared to victim statements, and stark differences emerge. These findings have considerable implications for treatment practice with sex offenders, where victims’ perceptions could be used to directly confront offender denial and minimization.

They Say You are a Danger But You Are Not: Representations and Construction of the Moral Self in Narratives of 'Dangerous Individuals'

This article is based on an analysis of narratives of 26 offenders with mental health problems living in the United Kingdom. It explores the impact of an ascribed dangerous status and the construction of the self as moral and responsible in response to this label with reference to the literature on denial, deviance disavowal and other “techniques of neutralization” and Goffman's presentation of self. Two dominant strands are identified in relation to the construction of moral self-hood: “Not my fault” and “Good at heart” narratives. “Techniques of neutralization” are widely drawn on, particularly denial of responsibility in the “Not my fault” narratives that seek to explain anti-social behavior with reference to external forces such as a hostile environment inhibiting their ability to control their lives. In contrast, “Good at heart” narratives draw on the essentially good and moral nature of the inner-self. Both are used as evidence of sharing and adhering to moral norms in order to present an acceptable and credible self.

Multimodal and monomodal discourses of marketization in higher education : power, ideology, and the absence of the image

The ubiquity of multimodality in hypermedia environments is undeniable. Bezemer and Kress (2008) have argued that writing has been displaced by image as the central mode for representation. Given the current technical affordances of digital technology and user-friendly interfaces that enable the ease of multimodal design, the conspicuous absence of images in certain domains of cyberspace is deserving of critical analysis. In this presentation, I examine the politics of discourses implicit within hypertextual spaces, drawing textual examples from a higher education website. I critically examine the role of writing and other modes of production used in what Fairclough (1993) refers to as discourses of marketisation in higher education, tracing four pervasive discourses of teaching and learning in the current economy: i) materialization, ii) personalization, iii) technologisation, and iv) commodification (Fairclough, 1999). Each of these arguments is supported by the critical analysis of multimodal texts. The first is a podcast highlighting the new architectonic features of a university learning space. The second is a podcast and transcript of a university Open Day interview with prospective students. The third is a time-lapse video showing the construction of a new science and engineering precinct. These three multimodal texts contrast a final web-based text that exhibits a predominance of writing and the powerful absence or silencing of the image. I connect the weightiness of words and the function of monomodality in the commodification of discourses, and its resistance to the multimodal affordances of web-based technologies, and how this is used to establish particular sets of subject positions and ideologies through which readers are constrained to occupy. Applying principles of critical language study by theorists that include Fairclough, Kress, Lemke, and others whose semiotic analysis of texts focuses on the connections between language, power, and ideology, I demonstrate how the denial of image and the privileging of written words in the multimodality of cyberspace is an ideological effect to accentuate the dominance of the institution.

Children’s rights in India : parents’ and teachers’ attitudes, knowledge and perceptions

Individuals’ attitudes influence their behaviour towards children, including whether children’s rights and welfare are promoted. The attitudes generally present in a society shape a culture of how children are perceived and treated. This study explored the attitudes and knowledge of 300 Indian parents and teachers regarding children’s rights, and their perceptions about whether selected rights were secured in reality. Findings revealed that most parents and teachers had positive attitudes about children’s rights, including rights to health and education, and freedom from child marriage and inappropriate work. Yet, about one quarter of participants did not think children should have the rights to freedom of expression and association. Knowledge of laws promoting children’s rights was poor. Most parents and teachers perceived a denial of seven key rights in Indian children’s lived experience. Overall, fijindings suggest a need to heighten awareness of children’s rights and needs, which can improve attitudes towards the treatment of children. Effforts to heighten awareness and attitudes towards children’s rights are needed across society and in key sectors to enhance children’s lived experience.

Modelling web-server Flash Events

A Flash Event (FE) represents a period of time when a web-server experiences a dramatic increase in incoming traffic, either following a newsworthy event that has prompted users to locate and access it, or as a result of redirection from other popular web or social media sites. This usually leads to network congestion and Quality-of-Service (QoS) degradation. These events can be mistaken for Distributed Denial-of-Service (DDoS) attacks aimed at disrupting the server. Accurate detection of FEs and their distinction from DDoS attacks is important, since different actions need to be undertaken by network administrators in these two cases. However, lack of public domain FE datasets hinders research in this area. In this paper we present a detailed study of flash events and classify them into three broad categories. In addition, the paper describes FEs in terms of three key components: the volume of incoming traffic, the related source IP-addresses, and the resources being accessed. We present such a FE model with minimal parameters and use publicly available datasets to analyse and validate our proposed model. The model can be used to generate different types of FE traffic, closely approximating real-world scenarios, in order to facilitate research into distinguishing FEs from DDoS attacks.

Ensemble-based DDoS detection and mitigation model

This work-in-progress paper presents an ensemble-based model for detecting and mitigating Distributed Denial-of-Service (DDoS) attacks, and its partial implementation. The model utilises network traffic analysis and MIB (Management Information Base) server load analysis features for detecting a wide range of network and application layer DDoS attacks and distinguishing them from Flash Events. The proposed model will be evaluated against realistic synthetic network traffic generated using a software-based traffic generator that we have developed as part of this research. In this paper, we summarise our previous work, highlight the current work being undertaken along with preliminary results obtained and outline the future directions of our work.

The late discovery of adoptive and donor insemination offspring status : ethical implications for conceptual understandings of the ‘best interests of the child’ principle

Late discovery is a term used to describe the experience of discovering the truth of one’s genetic origins as an adult. Following discovery, late discoverers face a lack of recognition and acknowledgment of their concerns from family, friends, community and institutions. They experience pain, anger, loss, grief and frustration. This presentation shares the findings of the first qualitative study of both late discovery of adoptive and donor insemination offspring (heterosexual couple use only) experiences. It is also the first study of late discovery experiences undertaken from an ethical perspective. While this study recruited new participants, it also included an ethical re-analysis of existing late discovery accounts across both practices. The findings of this study (a) draws links between past adoption and current donor insemination (heterosexual couple only) practices, (b) reveals that late discoverers are demanding acknowledgment and recognition of the particularity of their experiences, and (c) offers insights into conceptual understandings of the ‘best interests of the child’ principle. These insights derive from the lived experiences of those whose biological and social worlds have been sundered and secrecy and denial of difference used to conceal this. It suggests that acknowledging the equal moral status of the child may be useful in strengthening conceptual understandings of the ‘best interests of the child’ principle. This equal moral status involves ensuring that personal autonomy and the ability to exercise free will is protected; that the integrity of the relationships of trust expected and demanded between parent/s and children is defended and supported; and that equal access to normative socio-cultural practices, that is; non-fictionalised birth certificates and open records, is guaranteed.

Welfare reform, surveillance and new paternalism

This paper discusses the situation of welfare claimants, often constructed as faulty citizens and flawed welfare subjects. Many are on the receiving end of complex, multi-layered forms of surveillance aimed at securing socially responsible and compliant behaviours. In Australia, as in other Western countries, neoliberal economic regimes with their harsh and often repressive treatment of welfare recipients operate in tandem with a burgeoning and costly arsenal of CCTV and other surveillance and governance assemblages. The Australian Government’s Centrelink BasicsCard is but one example of welfare surveillance, whereby a percentage of a welfare claimant’s allowances must be spent on ‘approved’ items. The BasicsCard which has perhaps slipped under the radar of public discussion and is expanding nationally, raises significant questions about whether it is possible to encourage people to take responsibility for themselves if they no longer have real control over the most important aspects of their lives. Resistance and critical feedback, particularly from Indigenous people, points to a loss of dignity around the imposition of income management, operational complexity and denial of individual agency in using the BasicsCard, alongside the contradiction of apparently becoming ‘self-reliant’ through being income managed by the welfare state. This paper highlights the lack of solid evidence for the implementation/imposition of the BasicsCard and points to the importance of developing critically based research to inform the enactment of evidence based policy, also acting as a touchstone for governmental accountability. In highlighting issues around the BasicsCard this paper makes a contribution to the largely under discussed area of income management and the growth of welfare surveillance in Australia.

The factor structure of the COPE Questionnaire in a sample of clinically depressed and anxious adults

The Coping Orientation to Problems Experienced is a multidimensional scale designed to assess how people respond to stress. The COPE has been validated in a variety of populations displaying variations in factor structure. However, in terms of mental health populations, it has only been validated in alcohol-dependent samples. This paper investigated the factor structure of the COPE in a sample of adults diagnosed with depression and anxiety. Two hundred and seventy-one patients attending cognitive behaviour therapy for anxiety and depression completed the COPE. Confirmatory factor analysis found a poor fit for both lower order and higher order factors based upon the Lyne and Roger (2000) study. Exploratory factor analyses identified six primary subscales (Active Planning, Social Support, Denial, Acceptance, Disengagement, Restraint) which explained approximately 60% of the variance in coping. These 6 subscales may assist researchers and clinicians to validly measure coping in anxious and depressed adults.

Trait anxiety and coping strategies among ballet dancers

This study examined relationships between competitive trait anxiety and coping strategies among ballet dancers. Participants were 104 classical dancers (81 females and 23 males) ranging in age from 15 to 35 years (mean 19.4 years; SD 3.8 years) from three professional ballet companies, two private dance schools, and two university dance courses in Australia. Participants completed the Modified COPE scale and the Sport Anxiety Scale. Trait anxiety scores, in particular for somatic anxiety and worry, were significant predictors of 7 of the 12 coping strategies (wishful thinking, r2 = 42.3%; selfblame, r2 = 35.7%; suppression of competing activities, r2 = 27.1%; venting of emotions, r2 = 23.2%; denial, r2 = 17.7%; effort, r2 = 16.6%; active coping, r2 = 14.3%). Approximately 96% of dancers could be classified correctly as high or low trait-anxious from their reported coping style. No significant effects of gender or status (professional versus students) were found. Findings showed that high trait-anxious athletes tend to use more maladaptive, emotion-focused coping strategies compared with low trait-anxious athletes; a tendency that has been proposed to lead to negative performance effects. Dancers who are by nature anxious about performance may need special attention to help them to learn to cope with performance-related stress. Med Probl Perform Art 18:59–64, 2003.

Cryptographic techniques for managing computational effort

Availability has become a primary goal of information security and is as significant as other goals, in particular, confidentiality and integrity. Maintaining availability of essential services on the public Internet is an increasingly difficult task in the presence of sophisticated attackers. Attackers may abuse limited computational resources of a service provider and thus managing computational costs is a key strategy for achieving the goal of availability. In this thesis we focus on cryptographic approaches for managing computational costs, in particular computational effort. We focus on two cryptographic techniques: computational puzzles in cryptographic protocols and secure outsourcing of cryptographic computations. This thesis contributes to the area of cryptographic protocols in the following ways. First we propose the most efficient puzzle scheme based on modular exponentiations which, unlike previous schemes of the same type, involves only a few modular multiplications for solution verification; our scheme is provably secure. We then introduce a new efficient gradual authentication protocol by integrating a puzzle into a specific signature scheme. Our software implementation results for the new authentication protocol show that our approach is more efficient and effective than the traditional RSA signature-based one and improves the DoSresilience of Secure Socket Layer (SSL) protocol, the most widely used security protocol on the Internet. Our next contributions are related to capturing a specific property that enables secure outsourcing of cryptographic tasks in partial-decryption. We formally define the property of (non-trivial) public verifiability for general encryption schemes, key encapsulation mechanisms (KEMs), and hybrid encryption schemes, encompassing public-key, identity-based, and tag-based encryption avors. We show that some generic transformations and concrete constructions enjoy this property and then present a new public-key encryption (PKE) scheme having this property and proof of security under the standard assumptions. Finally, we combine puzzles with PKE schemes for enabling delayed decryption in applications such as e-auctions and e-voting. For this we first introduce the notion of effort-release PKE (ER-PKE), encompassing the well-known timedrelease encryption and encapsulated key escrow techniques. We then present a security model for ER-PKE and a generic construction of ER-PKE complying with our security notion.

What should I say?: Qualitative findings on dilemmas in palliative care nursing

The nursing literature suggests that talking and listening to patients about issues associated with death and dying, is both important and difficult, and may be improved with training. This discussion presents the results of recent nursing research to confirm, and elaborate on, this theme. In this research participants touched on many central issues in communicating with patients that included articulating a sense of discomfort and inadequacy about the whole process, detailing the innumerable blocks to open communication [e.g., interference, denial, unrealistic optimism, resistance, collusion and anger] and sharing their sense of success and failure. The insights of nurses who participated in this research testify to the ongoing need to prioritize the development of nursing skills and support in this challenging but important area.