Abstracting and correlating heterogeneous events to detect complex scenarios

The research presented in this thesis addresses inherent problems in signaturebased intrusion detection systems (IDSs) operating in heterogeneous environments. The research proposes a solution to address the difficulties associated with multistep attack scenario specification and detection for such environments. The research has focused on two distinct problems: the representation of events derived from heterogeneous sources and multi-step attack specification and detection. The first part of the research investigates the application of an event abstraction model to event logs collected from a heterogeneous environment. The event abstraction model comprises a hierarchy of events derived from different log sources such as system audit data, application logs, captured network traffic, and intrusion detection system alerts. Unlike existing event abstraction models where low-level information may be discarded during the abstraction process, the event abstraction model presented in this work preserves all low-level information as well as providing high-level information in the form of abstract events. The event abstraction model presented in this work was designed independently of any particular IDS and thus may be used by any IDS, intrusion forensic tools, or monitoring tools. The second part of the research investigates the use of unification for multi-step attack scenario specification and detection. Multi-step attack scenarios are hard to specify and detect as they often involve the correlation of events from multiple sources which may be affected by time uncertainty. The unification algorithm provides a simple and straightforward scenario matching mechanism by using variable instantiation where variables represent events as defined in the event abstraction model. The third part of the research looks into the solution to address time uncertainty. Clock synchronisation is crucial for detecting multi-step attack scenarios which involve logs from multiple hosts. Issues involving time uncertainty have been largely neglected by intrusion detection research. The system presented in this research introduces two techniques for addressing time uncertainty issues: clock skew compensation and clock drift modelling using linear regression. An off-line IDS prototype for detecting multi-step attacks has been implemented. The prototype comprises two modules: implementation of the abstract event system architecture (AESA) and of the scenario detection module. The scenario detection module implements our signature language developed based on the Python programming language syntax and the unification-based scenario detection engine. The prototype has been evaluated using a publicly available dataset of real attack traffic and event logs and a synthetic dataset. The distinct features of the public dataset are the fact that it contains multi-step attacks which involve multiple hosts with clock skew and clock drift. These features allow us to demonstrate the application and the advantages of the contributions of this research. All instances of multi-step attacks in the dataset have been correctly identified even though there exists a significant clock skew and drift in the dataset. Future work identified by this research would be to develop a refined unification algorithm suitable for processing streams of events to enable an on-line detection. In terms of time uncertainty, identified future work would be to develop mechanisms which allows automatic clock skew and clock drift identification and correction. The immediate application of the research presented in this thesis is the framework of an off-line IDS which processes events from heterogeneous sources using abstraction and which can detect multi-step attack scenarios which may involve time uncertainty.

Harmonising procurement policy environment - identifying key themes towards the development of a conceptual model

Capital works procurement and its regulatory policy environment within a country can be complex entities. For example, by virtue of Australia’s governmental division between the Commonwealth, states and local jurisdictions and the associated procurement networks and responsibilities at each level, the tendering process is often convoluted. There are four inter-related key themes identified in the literature in relation to procurement disharmony, including decentralisation, risk & risk mitigation, free trade & competition, and tendering costs. This paper defines and discusses these key areas of conflict that adversely impact upon the business environments of industry through a literature review, policy analysis and consultation with capital works procurement stakeholders. The aim of this national study is to identify policy differences between jurisdictions in Australia, and ascertain whether those differences are a barrier to productivity and innovation. This research forms an element of a broader investigation with an aim of developing efficient, effective and nationally harmonised procurement systems. Keywords: capital works, procurement policy reform Acknowledgement: The research described in this paper carried out by the Australian Cooperative Research Centre for Construction Innovation.

A visualisation framework for collaborative virtual environment usage information

Due to the popularity of modern Collaborative Virtual Environments, there has been a related increase in their size and complexity. Developers therefore need visualisations that expose usage patterns from logged data, to understand the structures and dynamics of these complex environments. This chapter presents a new framework for the process of visualising virtual environment usage data. Major components, such as an event model, designer task model and data acquisition infrastructure are described. Interface and implementation factors are also developed, along with example visualisation techniques that make use of the new task and event model. A case study is performed to illustrate a typical scenario for the framework, and its benefits to the environment development team.

On the affinity of Chuaria–Tawuia complex : a multidisciplinary study

In this study, biometric and structural engineering tool have been used to examine a possible relationship within Chuaria–Tawuia complex and micro-FTIR (Fourier Transform Infrared Spectroscopy) analyses to understand the biological affinity of Chuaria circularis Walcott, collected from the Mesoproterozoic Suket Shales of the Vindhyan Supergroup and the Neoproterozoic Halkal Shales of the Bhima Group of peninsular India. Biometric analyses of well preserved carbonized specimens show wide variation in morphology and uni-modal distribution. We believe and demonstrate to a reasonable extent that C. circularis most likely was a part of Tawuia-like cylindrical body of algal origin. Specimens with notch/cleft and overlapping preservation, mostly recorded in the size range of 3–5 mm, are of special interest. Five different models proposed earlier on the life cycle of C. circularis are discussed. A new model, termed as ‘Hybrid model’ based on present multidisciplinary study assessing cylindrical and spherical shapes suggesting variable cell wall strength and algal affinity is proposed. This model discusses and demonstrates varied geometrical morphologies assumed by Chuaria and Tawuia, and also shows the inter-relationship of Chuaria–Tawuia complex. Structural engineering tool (thin walled pressure vessel theory) was applied to investigate the implications of possible geometrical shapes (sphere and cylinder), membrane (cell wall) stresses and ambient pressure environment on morphologically similar C. circularis and Tawuia. The results suggest that membrane stresses developed on the structures similar to Chuaria–Tawuia complex were directly proportional to radius and inversely proportional to the thickness in both cases. In case of hollow cylindrical structure, the membrane stresses in circumferential direction (hoop stress) are twice of the longitudinal direction indicating that rupture or fragmentation in the body of Tawuia would have occurred due to hoop stress. It appears that notches and discontinuities seen in some of the specimens of Chuaria may be related to rupture suggesting their possible location in 3D Chuaria. The micro-FTIR spectra of C. circularis are characterized by both aliphatic and aromatic absorption bands. The aliphaticity is indicated by prominent alkyl group bands between 2800–3000 and 1300–1500 cm−1. The prominent absorption signals at 700–900 cm−1 (peaking at 875 and 860 cm−1) are due to aromatic CH out of plane deformation. A narrow, strong band is centred at 1540 cm−1 which could be COOH band. The presence of strong aliphatic bands in FTIR spectra suggests that the biogeopolymer of C. circularis is of aliphatic nature. The wall chemistry indicates the presence of ‘algaenan’—a biopolymer of algae.

Reading the environment : narrative constructions of ecological subjectivities in Australian children's literature

Ways in which humans engage with the environment have always provided a rich source of material for writers and illustrators of Australian children's literature. Currently, readers are confronted with a multiplicity of complex, competing and/or complementing networks of ideas, theories and emotions that provide narratives about human engagement with the environment at a particular historical moment. This study, entitled Reading the Environment: Narrative Constructions of Ecological Subjectivities in Australian Children's Literature, examines how a representative sample of Australian texts (19 picture books and 4 novels for children and young adults published between 1995 and 2006) constructs fictional ecological subjects in the texts, and offers readers ecological subject positions inscribed with contemporary environmental ideologies. The conceptual framework developed in this study identifies three ideologically grounded positions that humans may assume when engaging with the environment. None of these positions clearly exists independently of any other, nor are they internally homogeneous. Nevertheless they can be categorised as: (i) human dominion over the environment with little regard for environmental degradation (unrestrained anthropocentrism); (ii) human consideration for the environment driven by understandings that humans need the environment to survive (restrained anthropocentrism); and (iii) human deference towards the environment guided by understandings that humans are no more important than the environment (ecocentrism). iv The transdisciplinary methodological approach to textual analysis used in this thesis draws on ecocriticism, narrative theories, visual semiotics, ecofeminism and postcolonialism to discuss the difficulties and contradictions in the construction of the positions offered. Each chapter of textual analysis focuses on the construction of subjectivities in relation to one of the positions identified in the conceptual framework. Chapter 5 is concerned with how texts highlight the negative consequences of human dominion over the environment, or, in the words of this study, living with ecocatastrophe. Chapter 6 examines representations of restrained anthropocentrism in its contemporary form, that is, sustainability. Chapter 7 examines representations of ecocentrism, a radical position with inherent difficulties of representation. According to the analysis undertaken, the focus texts convey the subtleties and complexities of human engagement with the environment and advocate ways of viewing and responding to contemporary unease about the environment. The study concludes that these ways of viewing and responding conform to and/or challenge dominant socio-cultural and political-economic opinions regarding the environment. This study, the first extended work of its kind, makes an original contribution to ecocritical study of Australian children's literature. By undertaking a comprehensive analysis of how texts for children represent human engagement with the environment at a time when important environmental concerns pose significant threats to human existence, I hope to contribute new knowledge to an area of children's literature research that to date has been significantly under-represented.

Complex modelling of open system design for sustainable architecture

This paper argues a model of complex system design for sustainable architecture within a framework of entropy evolution. The spectrum of sustainable architecture consists of the efficient use of energy and material resource in life-cycle of buildings, the active involvement of the occupants in micro-climate control within buildings, and the natural environmental context. The interactions of the parameters compose a complex system of sustainable architectural design, of which the conventional linear and fragmented design technologies are insufficient to indicate holistic and ongoing environmental performance. The complexity theory of dissipative structure states a microscopic formulation of open system evolution, which provides a system design framework for the evolution of building environmental performance towards an optimization of sustainability in architecture.

Investigating users’ intuitive interaction with complex artefacts

This paper examines the role of intuition in the way that people operate unfamiliar devices. Intuition is a type of cognitive processing that is often non-conscious and utilises stored experiential knowledge. Intuitive interaction involves the use of knowledge gained from other products and/or experiences. Two initial experimental studies revealed that prior exposure to products employing similar features helped participants to complete set tasks more quickly and intuitively, and that familiar features were intuitively used more often than unfamiliar ones. A third experiment confirmed that performance is affected by a person's level of familiarity with similar technologies, and also revealed that appearance (shape, size and labelling of features) seems to be the variable that most affects time spent on a task and intuitive uses during that time. Age also seems to have an effect. These results and their implications are discussed.

Experience mapping : producing spatially continuous environment representations using RatSLAM

RatSLAM is a system for vision-based Simultaneous Localisation and Mapping (SLAM) inspired by models of the rodent hippocampus. The system can produce stable representations of large complex environments during robot experiments in both indoor and outdoor environments. These representations are both topological and metric in nature, and can involve multiple representations of the same place as well as discontinuities. In this paper we describe a new technique known as experience mapping that can be used online with the RatSLAM system to produce world representations known as experience maps. These maps group together multiple place representations and are spatially continuous. A number of experiments have been conducted in simulation and a real world office environment. These experiments demonstrate the high degree to which experience maps are representative of the spatial arrangement of the environment.

Design Optimisation of UAVs Systems achieved on a Framework Environment via Evolution and Game Theory

Over recent years, Unmanned Air Vehicles or UAVs have become a powerful tool for reconnaissance and surveillance tasks. These vehicles are now available in a broad size and capability range and are intended to fly in regions where the presence of onboard human pilots is either too risky or unnecessary. This paper describes the formulation and application of a design framework that supports the complex task of multidisciplinary design optimisation of UAVs systems via evolutionary computation. The framework includes a Graphical User Interface (GUI), a robust Evolutionary Algorithm optimiser named HAPEA, several design modules, mesh generators and post-processing capabilities in an integrated platform. These population –based algorithms such as EAs are good for cases problems where the search space can be multi-modal, non-convex or discontinuous, with multiple local minima and with noise, and also problems where we look for multiple solutions via Game Theory, namely a Nash equilibrium point or a Pareto set of non-dominated solutions. The application of the methodology is illustrated on conceptual and detailed multi-criteria and multidisciplinary shape design problems. Results indicate the practicality and robustness of the framework to find optimal shapes and trade—offs between the disciplinary analyses and to produce a set of non dominated solutions of an optimal Pareto front to the designer.

Complex Urban Systems

Presentation about research projects that build understanding of urban design and interactions and plan for future opportunities. What do we need to model?

Organisational challenges in understanding and implementing effective buiness continuity management strategies in a complex and critical organisation : an airport case study

With the increasing complexity of modern day threats and the growing sophistication of interlinked and interdependent operating environments, Business Continuity Management (BCM) has emerged as a new discipline, offering a strategic approach to safeguarding organisational functions. Of significant interest is the application of BCM frameworks and strategies within critical infrastructure, and in particular the aviation industry. Given the increased focus on security and safety for critical infrastructures, research into the adoption of BCM principles within an airport environment provides valuable management outcomes and research into a previously neglected area of inquisition. This research has used a single case study methodology to identify possible impediments to BCM adoption and implementation by the Brisbane Airport Corporation (BAC). It has identified a number of misalignments between the required breadth of focus for a BCM program, identified differing views on specific roles and responsibilities required during a major disruptive event and illustrated the complexities of the Brisbane Airport which impede the understanding and implementation of effective Business Continuity Management Strategies.

The use of phase in complex spectrum subtraction for robust speech recognition

In this paper we propose a new method for utilising phase information by complementing it with traditional magnitude-only spectral subtraction speech enhancement through Complex Spectrum Subtraction (CSS). The proposed approach has the following advantages over traditional magnitude-only spectral subtraction: (a) it introduces complementary information to the enhancement algorithm; (b) it reduces the total number of algorithmic parameters, and; (c) is designed for improving clean speech magnitude spectra and is therefore suitable for both automatic speech recognition (ASR) and speech perception applications. Oracle-based ASR experiments verify this approach, showing an average of 20% relative word accuracy improvements when accurate estimates of the phase spectrum are available. Based on sinusoidal analysis and assuming stationarity between observations (which is shown to be better approximated as the frame rate is increased), this paper also proposes a novel method for acquiring the phase information called Phase Estimation via Delay Projection (PEDEP). Further oracle ASR experiments validate the potential for the proposed PEDEP technique in ideal conditions. Realistic implementation of CSS with PEDEP shows performance comparable to state of the art spectral subtraction techniques in a range of 15-20 dB signal-to-noise ratio environments. These results clearly demonstrate the potential for using phase spectra in spectral subtractive enhancement applications, and at the same time highlight the need for deriving more accurate phase estimates in a wider range of noise conditions.

The effects of cognitive ageing on the use of complex interfaces

This paper discusses an experiment investigating the effects of cognitive ageing and prior-experience with technology on using complex interfaces intuitively. Overall 37 participants, between the ages of 18 to 83, participated in this study. All participants were assessed for their cognitive abilities and prior-experience with technology. It was anticipated that the Central Executive function (a component of Working Memory) would emerge as one of the important cognitive functions in using complex interfaces. This was found to be the case with the strongest negative correlation occurring between sustained attention (one of the functions of the Central Executive), the time to complete the task and number of errors made by the participants.

A model for integrating clinical care and basic science research, and pitfalls of performing complex research projects for addressing a clinical challenge

The collaboration of clinicians with basic science researchers is crucial for addressing clinically relevant research questions. In order to initiate such mutually beneficial relationships, we propose a model where early career clinicians spend a designated time embedded in established basic science research groups, in order to pursue a postgraduate qualification. During this time, clinicians become integral members of the research team, fostering long term relationships and opening up opportunities for continuing collaboration. However, for these collaborations to be successful there are pitfalls to be avoided. Limited time and funding can lead to attempts to answer clinical challenges with highly complex research projects characterised by a large number of "clinical" factors being introduced in the hope that the research outcomes will be more clinically relevant. As a result, the complexity of such studies and variability of its outcomes may lead to difficulties in drawing scientifically justified and clinically useful conclusions. Consequently, we stress that it is the basic science researcher and the clinician's obligation to be mindful of the limitations and challenges of such multi-factorial research projects. A systematic step-by-step approach to address clinical research questions with limited, but highly targeted and well defined research projects provides the solid foundation which may lead to the development of a longer term research program for addressing more challenging clinical problems. Ultimately, we believe that it is such models, encouraging the vital collaboration between clinicians and researchers for the work on targeted, well defined research projects, which will result in answers to the important clinical challenges of today.