Machine Learning and Probabilistic Methods for Network Security Assessment

Ph. D. ThesisComputer networks comprised of many hosts are vulnerable to cyber attacks. One attack can take the form of the exploitation of multiple vulnerabilities in the network along with lateral movement between hosts. In order to analyse the security of a network, it is common practice to run a vulnerability scan to report the presence of vulnerabilities in the network and prioritise them with an importance score. The scoring mechanism used primarily in the literature and in industry ignores how multiple vulnerabilities could be used in conjunction with one another to achieve a goal that previously was not possible. Attack graphs are a common solution to this problem, where a scan along with the topology of the network is turned into a graph that models how hosts and vulnerabilities can be connected. For a large network these attack graphs can be thousands of nodes in size, so in order to gain insight from them in an automated way, they can be turned into Bayesian attack graphs (BAGs) to model the security of the network probabilistically. The aim of this thesis is to work towards the automation of gathering insight from vulnerability scans of a network, primarily through the generation of BAGs. The main contributions of this thesis are as follows: 1. Creation of a unified formalism for the structure of BAGs and how other graphs can be translated into this formalism. 2. Classification of vulnerabilities using neural networks. 3. Design and evaluation of a novel technique for approximation in the computation of access probabilities in BAGs (referred to in the literature as the static analysis of BAGs) with no requirement for the base graph to be acyclic. 4. Implementation and comparison of three stochastic simulation techniques for inference on BAGs with evidence (referred to in the literature as the dynamic analysis of BAGs), enabling security measure evaluation and sensitivity analysis. 5. Demonstration of a sensitivity analysis for BAG priors and a novel method for quick computation of sensitivities that is more readily analysed than the traditional technique. 6. Development and demonstration of a fully containerised pipeline to automatically process vulnerability scans and generate the corresponding attack graph. With a single formalism for attack graphs, alongside an open-source attack graph generation pipeline, our work serves to enable future progress and collaboration in the field of processing vulnerability scans using attack graphs by simplifying the process of generating the graphs and having a mathematical basis for their evaluation. We design, implement, and evaluate various techniques for calculations on BAGs. For the process of computation of access probabilities we provide an algorithm that requires no processing or trimming of the initial graph, and for inference on BAGs we recommend likelihood weighting as the best performing sampling technique of the three we implement. We also show how inference techniques can be applied to sensitivity analysis on BAGs, and provide a new method that allows for more efficient and interpretable sensitivity analysis, enabling more productive research into the area in future. This research was originally undertaken in collaboration with XQ Cyber.EPSR

Real-world sustainability analysis of water and related energy saving schemes for the built environment

Ph. D. Thesis.Reduced mains water consumption and renewable electricity generation in the built environment are key sustainability challenges for a rapidly urbanising global population. This dissertation assessed the performance of various technological and management solutions for saving mains water and generating solar electricity in the urban environment. Three student accommodation blocks and two Green Gown Award winning buildings of Newcastle University in the UK, and India’s first 5-star Green Rating for Integrated Habitat Assessment (GRIHA) campus provided unique case studies for the real-world performance assessment of sustainability solutions such as smart sensor systems, rainwater harvesting systems, wastewater reclamation systems, ultralow water use appliances, and photovoltaic panel systems. The related mains water and grid electricity savings, operational and repair costs and payback periods for capital expenditures were collated. Interviews with building managers provided insight into asset management challenges. Recurring themes from the case studies were the high costs of rainwater harvesting systems, and significant water savings opportunities via better management which were revealed by consumption monitoring. In the Indian case study, better water management to address leakage, and more drought-tolerant landscaping in a semi-arid climate, could reduce blue water use by up to 52% and reduce operational costs by up to 23%. In the UK student accommodation case study, up to 50% of potable water use was caused by malfunctioning toilets. In the UK mixed use building case study (office/teaching/laboratory), significant performance gaps of green building assets arose from technical and social issues (pump failures, leakages, poor alignment of demand and supply with limited storage, low photovoltaic panel efficiency, poor user acceptance, etc.), but the consequences were exacerbated by inadequate asset management that resulted in long system downtimes. Overall, it was concluded that better monitoring, maintenance, and management are the most cost-effective ways of improving water use sustainability in the built environmen

Board Diversity and Women Directors’ Attributes: New Insights from Bank Risk, Stability and Stock Market Valuations with Evidence from Alternative Banking Models

PhD ThesisThis thesis investigates board diversity and its association with bank stability and market value, employing a unique sample drawn from countries operating dual banking systems (Islamic and conventional). Three studies are presented that examine comprehensive diversity indicators previously untested in the literature. Study 1 presents an assessment of measures of board diversity (gender, education, nationality) in relation to three bank measures of stability for listed and unlisted banks. Studies 2 and 3 focus on listed banks and board gender diversity, alongside unique attributes for women directors reflecting monitoring, independence, and leadership, considered together with financial expertise, nationality, and education in relation to stock market valuation (Study 2) and five measures of bank risk (Study 3). The findings from Study 1 provide strong evidence that banks with women directors and directors with doctorates exhibit high bank stability. In contrast, foreign directors are significantly negatively associated with bank stability. The effects of directors’ gender, nationality, and education on bank stability differ by bank type. Study 2 provides strong evidence that having women directors on the board is positively associated with bank value for conventional banks, but not for Islamic banks, as are independent women directors, those with a high level of education, and those holding accounting/finance qualifications. Women chairpersons have no significant association, but foreign women directors and those who graduated from foreign universities are negatively associated with bank value. Study 3 shows that the presence of women directors and independent women directors is negatively associated with bank risk. However, there is significant evidence that women directors with postgraduate degrees and those with accounting and finance qualifications significantly reduce bank risk in conventional banks, although this relationship only holds for market risk within Islamic banks. The findings offer valuable new insights and important policy implications for international banking research, investors, and regulators

Corporate Social Responsibility and Impression Management: The American Arabian Oil Company (Aramco), 1932–1974

Ph. D. ThesisThe principal aim of this thesis is to contribute towards the understanding of the corporate social responsibility (CSR) policy of the Arabian-American Oil Company (Aramco) in Saudi Arabia. Multinational corporations present a positive image of their economic and social activities to investors and society in order to justify their exploitation of natural resources. Given the importance of CSR activities in the twentieth century, this study examines the role played by CSR programmes in Aramco’s strategy to strengthen its position in the Kingdom. These programmes have contributed to economic and social development, but were also a mechanism used by the company to maintain control of Saudi oil assets. Using Aramco as a case study, contrasts are drawn between the public pronouncements of its management concerning CSR activities and actual events as documented in the literature, official papers and archive records. Furthermore, forty-two management statements in the company reports are analysed to identify and categorise any impression management techniques identified. The findings show that these activities did not stem from a philanthropic rationale but were necessary to enable Aramco to create the infrastructure to find, extract and control oil assets. As a consequence of these activities, racism and discrimination were part of the company’s system of hierarchical control. However, Aramco adopted assertive strategies to present a positive image of itself as a socially responsible company that was contributing to the economic and social development of Saudi Arabia. The adoption of a longitudinal, historical analysis of the interrelationship between CSR activities and impression management strategies provides a rich understanding of how companies seek to present images of themselves in changing economic and political environments. By drawing on evidence from major archive documents, the research contributes theoretical, methodological and data insights. The study extends our theoretical understanding of CSR activities in a historical context. Historians of business and entrepreneurship could provide insights into the development of CSR and how it has been strategically utilised by companies. In terms of methodological contribution, the study presents a novel theoretical lens to investigate the motivations for CSR in the twentieth century using the impression management strategy framework. Third, in terms of data contribution, the unique analysis of 42 historical reports from 1938 to 1974 is conducted with the computer-aided content analysis program DICTION 7.0.Tabuk Universit

Real-time performance diagnosis and evaluation of big data systems in cloud datacenters

PhD ThesisModern big data processing systems are becoming very complex in terms of largescale, high-concurrency and multiple talents. Thus, many failures and performance reductions only happen at run-time and are very difficult to capture. Moreover, some issues may only be triggered when some components are executed. To analyze the root cause of these types of issues, we have to capture the dependencies of each component in real-time. Big data processing systems, such as Hadoop and Spark, usually work in large-scale, highly-concurrent, and multi-tenant environments that can easily cause hardware and software malfunctions or failures, thereby leading to performance degradation. Several systems and methods exist to detect big data processing systems’ performance degradation, perform root-cause analysis, and even overcome the issues causing such degradation. However, these solutions focus on specific problems such as stragglers and inefficient resource utilization. There is a lack of a generic and extensible framework to support the real-time diagnosis of big data systems. Performance diagnosis and prediction of big data systems are highly complex as these frameworks are typically deployed in cloud data centers that are large-scale, highly concurrent, and follows a multi-tenant model. Several factors, including hardware heterogeneity, stochastic networks and application workloads may impact the performance of big data systems. The current state-of-the-art does not sufficiently address the challenge of determining complex, usually stochastic and hidden relationships between these factors. To handle performance diagnosis and evaluation of big data systems in cloud environments, this thesis proposes multilateral research towards monitoring and performance diagnosis and prediction in cloud-based large-scale distributed systems by involving a novel combination of an effective and efficient deployment pipeline.The key contributions of this dissertation are listed below: - i - • Designing a real-time big data monitoring system called SmartMonit that efficiently collects the runtime system information including computing resource utilization and job execution information and then interacts the collected information with the Execution Graph modeled as directed acyclic graphs (DAGs). • Developing AutoDiagn, an automated real-time diagnosis framework for big data systems, that automatically detects performance degradation and inefficient resource utilization problems, while providing an online detection and semi-online root-cause analysis for a big data system. • Designing a novel root-cause analysis technique/system called BigPerf for big data systems that analyzes and characterizes the performance of big data applications by incorporating Bayesian networks to determine uncertain and complex relationships between performance related factors. The key contributions of this dissertation are listed below: - i - • Designing a real-time big data monitoring system called SmartMonit that efficiently collects the runtime system information including computing resource utilization and job execution information and then interacts the collected information with the Execution Graph modeled as directed acyclic graphs (DAGs). • Developing AutoDiagn, an automated real-time diagnosis framework for big data systems, that automatically detects performance degradation and inefficient resource utilization problems, while providing an online detection and semi-online root-cause analysis for a big data system. • Designing a novel root-cause analysis technique/system called BigPerf for big data systems that analyzes and characterizes the performance of big data applications by incorporating Bayesian networks to determine uncertain and complex relationships between performance related factors. The key contributions of this dissertation are listed below: - i - • Designing a real-time big data monitoring system called SmartMonit that efficiently collects the runtime system information including computing resource utilization and job execution information and then interacts the collected information with the Execution Graph modeled as directed acyclic graphs (DAGs). • Developing AutoDiagn, an automated real-time diagnosis framework for big data systems, that automatically detects performance degradation and inefficient resource utilization problems, while providing an online detection and semi-online root-cause analysis for a big data system. • Designing a novel root-cause analysis technique/system called BigPerf for big data systems that analyzes and characterizes the performance of big data applications by incorporating Bayesian networks to determine uncertain and complex relationships between performance related factors.State of the Republic of Turkey and the Turkish Ministry of National Educatio

Performance modelling and analysis of systems under attack and misbehaviour

PhD ThesisComputing systems are growing increasingly complex, incorporating multiple interactive components. Performance is a critical attribute in evaluating computing systems. Most computing systems are now connected to networks, either private or public, raising concerns about vulnerability and exposure to threats and attacks. A secure system requires effective security protocols and techniques that do not negatively compromise performance. Analysing a system’s behaviour under attack and misbehaviour can assist in determining where a problem is located so as to direct additional resources appropriately. The overall aim of this thesis is to model the performance of secure systems where behaviour changes in response to attacks and misbehaviour. Performance Evaluation Process Algebra (PEPA) modelling is employed to convert formal security protocols and methods into formal performance models. This thesis addresses the impact and cost of cyber-attacks on the performance of webbased sales systems. PEPA models are proposed for two scenarios, with and without the attacks, to understand how the system behaves in different scenarios to provide a sustainable level of performance. It also explores the performance cost of a security protocol, an anonymous and failure resilient fair-exchange e-commerce protocol. The proposed PEPA models were formulated with and without anonymity in order to explore its overhead. Additionally, we modelled a basic protocol with no misbehviour, not requiring the active involvement of a Trusted Third Party (TTP), and an extended protocol, for which the TTP’s participation is essential to resolve disputes. These models provide an insight into the protocol’s behaviour and the associated performance cost. An attack graph is a popular method to support a defender in understanding an attacker’s behaviour. It also supports the defender in detecting possible threats, thereby improving a system’s security status. Developing a PEPA model version of an attack graph can advance understanding and identification of key risks, and assist the defender with implementing appropriate countermeasures. This thesis developed two methods to automate the generation of the PEPA model based on a pre-existing attack graph specification. The first method is simple, generating a single sequential component to represent both a system and an attacker. The second method has more potential, by generating a PEPA model with two sequential components representing a system and an attacker, as well as the system equation to define how they interact. The attacker component enables us to explicitly incorporate attacker skills into the model. We use case studies to demonstrate how the PEPA models generated are used to perform path analysis and sensitivity analysis, as well as estimate the time required for each path. The defender can use this to determine the amount of safe time remaining before the system is compromised, and rank the risk from all attack paths. In addition, we developed PEPA models for an attack graph considering two criteria: attacker expertise and the availability of exploit code to estimate time needed to breach the system. We proposed three attacker skill levels: beginner, intermediate, and expert. The adaptability of our proposed PEPA models were improved by incorporating learning behaviours for both attacker and defender, to demonstrate how this affects the time required to compromise the system. The models in this thesis demonstrate an approach to integrating security and performance concerns to advance understanding of system and attacker behaviour. The performance analysis undertaken indicates where problems may arise and additional resources needed. This analysis could be extended in the future to consider alternative design options and dynamic reconfiguration. Understanding the impact of attackers on system behaviour increases our ability to design systems that can adapt and tolerate attacks. This thesis represents an initial step toward greater understanding of the impact of attacks on system performance

Evaluation of a shorter 12h acetylcysteine regimen & development of a simpler acetylcysteine (SNAP) protocol for the treatment of paracetamol poisoning

PhD ThesisParacetamol is the commonest drug involved in hospital admissions with poisoning in the UK. Acetylcysteine (NAC) is the antidote of choice for treatment of paracetamol overdose, but the original 3-bag NAC regimen, designed in Edinburgh, is associated with infusion-related adverse reactions related to high peak plasma acetylcysteine concentrations from the high loading infusion of 600mg/kg/h. The Scottish and Newcastle Antiemetic Pre-treatment (SNAP) study has shown that a simpler 12 h regimen (SNAP) consisting of a reduced loading infusion rate of 50mg/kg/h, causes significantly fewer adverse reactions (1). The SNAP regimen was implemented in 3 UK hospitals with the approval of their local medicines management committees with prospective audit of clinical outcomes. In this thesis, I have compared the efficacy in preventing hepatotoxicity of a 12h (‘SNAP’) regimen with the conventional 21 h NAC regimen used to treat paracetamol poisoning, including in patients at high risk of developing hepatotoxicity. Secondly, I have developed and validated a simple clinical decision rule for safe discharge of patients at the end of the 12h NAC treatment. Thirdly, I have developed a simpler 12 h NAC (‘SNAP’) protocol and care pathway to facilitate implementation in clinical practice. The major findings and conclusions of the thesis are: i) development of hepatotoxicity (peak ALT >1000) and hepatic synthetic dysfunction (INR greater than 2) in patients treated with the SNAP regimen were not significantly different compared to the conventional regimen both in high-risk and low-risk patients (14.6% SNAP vs 15.2% standard, 95% CI, - 8.2 to 9.8), and (3.2% SNAP vs 2.6% standard, 95% CI, - 0.7 to 1.8), respectively; ii) paracetamol-aminotransferase multiplication product (APAP×AT) >1500 mg L-1× IU L-1 h is a predictor of hepatotoxicity in patients treated with NAC and an important confounding variable, particularly in patients presenting late (P=0.001); iii) The SNAP regimen can interfere with coagulation activity with a median INR increase of 0.3 from baseline, even in the absence of liver injury, indicating that re-measurement of the INR at least 24 h post exposure if there is no other evidence of hepatic injury can avoid unnecessary additional treatment with NAC; iv) a simple clinical decision rule (paracetamol <10 and ALT≤ ULN, and ALT not doubled or more than doubled from admission value) accurately predicted patients who were eligible to discharge safely after a shorter 12 h SNAP regimen with 100% positively predictive value, which can be used to facilitate earlier discharge of low-risk patients.Princess Norah bint Abdurahman University, Riyadh, Saudi Arabia, the Saudi Ministry of Education and the Saudi Cultural Bureau in Londo

Peptide gene expression profiles in response to fasting and re-feeding in hoarding and non-hoarding titmice species

Ph. D. Thesis.The avian appetite regulatory system has been continuously studied over the last decades but it is less well understood than the mammalian system. It has also been studied much more in domestic birds than in wild passerine species. This PhD aims to investigate the role of different neuropeptides as well as gut peptides in controlling and regulating the ingestive behaviours of songbirds. My aim was to pinpoint candidate peptide genes that may differentiate a hoarding from a non-hoarding bird species and I used non-hoarding great tits (Parus major) and blue tits (Cyanistes caeruleus) to make comparisons with a closely-related hoarding species, the coal tit (Periparus ater) In this context, I used molecular techniques combined with video analysis to quantify selected peptide gene mRNAs suspected from the literature to play a major role in controlling both food intake and hoarding behaviour. By identifying candidate peptide genes that respond to an individual’s nutritional state, I was able to make some distinctions between hoarding and non-hoarding species. I also established for the first time in passerines the tissue distribution of gene expression in the gut for cholecystokinin (CCK), proglucagon (GCG), insulin and peptide YY. Overall, this study suggests that proglucagon (GCG) both in the gut and the hindbrain, as well as hypothalamic agouti-related protein (AGRP) and pro-opiomelanocortin (POMC) gene expression could be used as neural signals reporting the nutritional state of titmice. Moreover, hypothalamic AGRP and POMC, and hindbrain GCG and POMC seem to be involved in the regulation of food hoarding in coal tits. These observations support observations from the hamster literature that peptides that are known to control and regulate food intake are also involved in food hoarding

Dysphagia in head and neck cancer patients in Kuwait

PhD ThesisIntroduction: Head and Neck Cancer (HNC) and its treatment often result in severe functional impairments, with dysphagia and related morbidities being serious and wellrecognised complications in the acute, chronic and late stages. These complications contribute to a decreased quality of life and decreased overall HNC survival. An active surveillance of swallowing function using appropriate swallowing outcome measures is needed throughout the continuum of care. HNC dysphagia has not been studied previously in Kuwait. Aims: The overall aim of this thesis is to investigate HNC dysphagia in Kuwait, with a longterm view to improve quality of life and reduce morbidity. Methods and results: Five studies were conducted using different research designs. The first study aimed to investigate the prevalence of HNC dysphagia. The results suggest that dysphagia is not properly assessed and therefore may be under-reported. The second study explored the experiences and unmet needs of patients with HNC in Kuwait using qualitative interviews. The interviews revealed that patients often experience adverse feelings as a result of their functional and physical pain, and they employ different strategies to deal with their symptoms. Furthermore, the findings suggest that patients have substantial unmet informational and supportive care needs. Studies three to five aimed to further explore swallowing outcome measures in order to develop a multi-dimensional Swallowing Outcomes Package to systematically collect outcomes for HNC patients in Kuwait. The Package comprises: the MD Anderson Dysphagia Inventory (MDADI), a patient self-report tool, which was translated and culturally adapted and showed satisfactory psychometric properties. Diet scales, and a measure of swallowing performance (the 100mL Water Swallow Test (WST)). Preparatory work established the factor structure of the MDADI and the minimal clinically important difference for the 100mL WST. Conclusion: This study identified gaps in HNC dysphagia management in Kuwait, and it highlights the importance of the systematic collection of swallowing outcomes to understand the impact of cancer treatments, monitor changes over time, and improve quality of life and decrease morbidit

Low Energy, Passive Acoustic Sensing for Wireless Underwater Monitoring Networks

Ph. D. ThesisThis thesis presents the research conducted to develop low energy passive acoustic monitoring (PAM) algorithms. There are many signal processing techniques and machine learning systems which are capable of detecting and classifying target signals. However, this project aims to produce PAM detection and classification results using a low energy budget. The benefit of using this approach is that physical devices can be developed and deployed in open sea for several months using only battery power. This opens up the deployment area to very deep water where power sources are not readily available. Using passive acoustic communication to relay the detection data produced by the algorithm, it is expected that these systems could form an underwater network of sensor nodes. There are three targets for passive acoustic detection/classification included in this thesis, which are motorised surface vessels, cetacean clicks and cetacean whistles. The surface vessel detection method is based on a low energy implementation of Detection of Envelope Modulation On Noise (DEMON). Vessels produce high frequency modulated noise during propeller cavitation which the DEMON method aims to extract for the purposes of automated detection. The vessel detector design has different approaches with mixtures of analogue and digital processing, continuous and duty-cycled sampling/processing. The detector has been integrated with a low cost/power acoustic modem platform to provide acoustic communication of data in near real time. The vessel detector has been deployed at 20m depth for a total of 84 days in the North Sea providing a large data set, which the results are based on. Open sea field trial results have shown the detection of single and multiple vessels with a 94% corroboration rate with local Automatic Identification System (AIS) data. Results have shown additional information about the detected vessel, such as the number of propeller blades, can been extracted solely based on the detection data. The attention to energy efficiency has led to an average power consumption of 11.4mW enabling long term deployments of up to 6 months using only four alkaline C cells. Additional battery packs and a modified enclosure could enable a longer deployment duration. As the detector was still deployed during the first UK lockdown, the impact of Covid-19 on North Sea fishing activity has been captured in the results. Cetacean click detection is based on identifying and classifying the high frequency impulsive click trains created by cetaceans during navigation and foraging. A low energy method of detecting these vocalisations is proposed alongside a statistical based method of classification. The algorithm developed was tested using real recordings of cetacean activity and comparisons have been conducted against a commercially available cetacean monitoring system. The results show that the energy efficient algorithm produces comparable results to the commercial system when real recordings are processed. The cetacean whistle detection algorithm is based on a low energy phase locked loop (PLL) technique. PLL methodology has been adapted for this project to aid in developing a low energy approach to detecting cetacean whistles by tracking the sweeps in frequency they produce. Results are based on offline processing using real recordings of these animals. The results have shown a 75% success rate when comparing against human analysis of the recording. Future work includes the further development of the cetacean related algorithms into fully deployable, battery-powered, nodes for open sea field trails. The future work related to vessel detection includes adding a tracking feature to the passive acoustic monitoring technology.Engineering and Physical Sciences Research Council (EPSRC