M. Tech. Business Information Systems / The adoption of Information and Communication Technology (ICT) solutions offer several potentials for most organisations (private and public) such as enabling effectiveness, efficiency, competitive advantage among others. As a result, we have seen several IT solutions implemented not only by private sectors but also by the backbone of public entities in the drive for efficiencies in service delivery such as the South African (SA) government. The SA government adopted Open Source Software (OSS) with the aim to reduce IT services cost, less dependencies on imported technology, skills, and flexibility. The SA government was less successful in achieving this aim due to OSS implementation challenges. These challenges among other things include support, funding, training, awareness, and human factors. In the midst of the OSS challenges, a potential alternative to address the same objectives aimed by OSS is Cloud Computing adoption. Cloud Computing is the latest phenomena that promises better potentials especially IT cost reduction, effectiveness and efficiency of IT services. The purpose of this study is to explore the feasibility of Cloud Computing adoption in SA government as a cost effective approach for IT services.

Most of the attacks and fraudulent activities on the Internet are carried out by malware. In particular, botnets, as state-of-the-art malware, are now considered as the largest threat to Internet security. In this thesis, we focus on addressing the botnet detection problem in an enterprise-like network environment. We present a comprehensive correlation-based framework for multi-perspective botnet detection consisting of detection technologies demonstrated in four complementary systems: BotHunter, BotSniffer, BotMiner, and BotProbe. The common thread of these systems is correlation analysis, i.e., vertical correlation (dialog correlation), horizontal correlation, and cause-effect correlation. All these Bot* systems have been evaluated in live networks and/or real-world network traces. The evaluation results show that they can accurately detect real-world botnets for their desired detection purposes with a very low false positive rate. We find that correlation analysis techniques are of particular value for detecting advanced malware such as botnets. Dialog correlation can be effective as long as malware infections need multiple stages. Horizontal correlation can be effective as long as malware tends to be distributed and coordinated. In addition, active techniques can greatly complement passive approaches, if carefully used. We believe our experience and lessons are of great benefit to future malware detection.

Diss. (sammanfattning) Uppsala : Univ., 2003. / Härtill 6 uppsatser.

Thesis (M.Sc. (Computer Science)) - Rhodes University, 2008.

Thesis (M.S.)--Florida State University, 2005. / Advisor: Dr. Bruce A. Harvey, Florida State University, College of Engineering, Dept. of Electrical and Computer Engineering. Title and description from dissertation home page (viewed June 10, 2005). Document formatted into pages; contains vii, 73 pages. Includes bibliographical references.

Thesis (MEng)--Stellenbosch University, 2014. / ENGLISH ABSTRACT: Massively Multiplayer Online Games are large virtual worlds co-inhabited by players over the Internet. As up to thousands of players can be simultaneously connected to the game, the server and network architectures are required to scale e ciently. The traditional client/server model results in a heavy nancial burden for operation of the server. Various alternative architectures have been proposed as a replacement for the traditional model, but the adoption of these alternatives are slow as they present their own set of challenges. The proposed hybrid system is based on many di erent architectures and peer-topeer concepts that were reviewed in the literature. It aims to provide a compromise for existing, commercially successful MMOGs to introduce peer-to-peer components into their systems with no requirement of modi cation to their server or client software. With the system's design presented, the middleware software is implemented and deployed in a real, controlled environment alongside an Ultima Online game server and its clients. The movement game mechanic was distributed amongst the peers while the others remained the responsiblity of the server. A number of performance experiments are performed to measure the e ects of the modi ed system over the original client/server system on bandwidth, latency, and hardware impact. The results revealed an increase in the server bandwidth usage by 35%, slave bandwidth usage by 17% and supernode bandwiwdth usage by 3111%. The latencies of distributed server mechanics were reduced by up to 94%, while the non-distributed latencies were increased by up to 6000%. These results suggested that a system with absolutely no modi cation to the server is unlikely to provide the desired bene ts. However, with 2 minor modi cations to the server, the middleware is able to reduce both server load and player latencies. The server bandwidth can be reduced by 39%, while the supernode's bandwidth is increased only by 1296%. The distributed latencies maintain their reduction while non-distributed latencies remain unchanged from the C/S system. / AFRIKAANSE OPSOMMING: Massiewe Multispeler Aanlyn Speletjies (MMAS) is groot virtuele w^erelde op die Internet wat bewoon word deur spelers. Aangesien duisende spelers gelyktydig kan inskakel op die speletjie word daar verwag van die bediener en netwerk argitektuur om e ektief te skaleer om die groot hoeveelhede spelers te kan hanteer. Die traditionele kli ent/bediener model lei tot 'n groot nansi ele las vir die operateur van die bediener. Verskeie alternatiewe argitekture is al voorgestel om die tradisionele model te vervang, maar die aanvaarding en in gebruik neem van hierdie alternatiewe (soos eweknie-netwerke) is 'n stadige proses met sy eie stel uitdagings. Die voorgestelde hibriede stelsel is gebaseer op baie verskillende argitektuur- en eweknie konsepte wat in die literatuur oorweeg is. Die doel is om 'n kompromie vir bestaande komersieel suksesvolle MMASs te verskaf om eweknie komponente te implementeer sonder om die die bediener- of kli ent sagteware aan te pas. Met hierdie stelsel se ontwerp word die middelware sagteware ge mplementeer en gebruik in 'n regte, dog gekontroleerde omgewing, tesame met 'n Ultima Online bediener en sy kli ente. Die beweging speletjie meganisme word versprei onder die eweknie netwerk en die ander meganismes bly die verantwoordelikheid van die bediener. 'n Aantal eksperimente is ingespan om die e ek van die hibriede stelsel te meet op die oorspronklike kli ent/bediener stelsel, in terme van bandwydte, vertraging en impak op hardeware. Die resultate toon 'n toename van 35% in bediener-, 17% in slaaf-, en 3111% in supernodus bandwydte gebruik. Die vertraging van verspreide bediener meganismes neem af met tot 94%, terwyl onverspreide vertragings toeneem met tot 6000%. Hierdie resultate wys dat 'n stelsel wat geen aanpassing maak aan die bediener sagteware onwaarskynlik die gewenste voordele sal lewer. Deur egter 2 klein aanpassings toe te laat tot die bediener, is dit moontlik vir die hibriede stelsel om data las van die bediener en die speler se vertraging te verminder. Die bediener bandwydte kan met 39% verminder word, terwyl die supernodus bandwydte slegs met 1296% toeneem. Die verpreide vertragings handhaaf hul vermindering, terwyl die onverspreide vertragings onveranderd bly van die C/S stelsel.

Thesis (MSc (Mathematical Sciences. Computer Science))--University of Stellenbosch, 2009. / ENGLISH ABSTRACT: Since 2002 data tra c has overtaken voice tra c in volume [1]. Telecom / Network operators still generate most of their income carrying voice tra c. There is however a huge revenue potential in delivering reliable guaranteed data services. Network survivability and recovery from network failures are integral to network reliability. Due to the nature of the Internet, recovery from link failures needs to be distributed and dynamic in order to be scalable. Link failure recovery schemes are evaluated in terms of the survivability of the network, the optimal use of network resources, scalability, and the recovery time of such schemes. The need for recovery time to be improved is highlighted by real-time data tra c such as VoIP and video services carried over the Internet. The goal of this thesis is to examine existing link failure recovery schemes and evaluate the need for their extension, and to evaluate the performance of the proposed link failure recovery schemes. i / AFRIKAANSE OPSOMMING: Sedert 2002 het data verkeer die stem verkeer in volume verbygesteek [1]. Telekommunikasie / netwerk operateurs genereer egter steeds die meeste van hul inkomste met stem verkeer. Netwerk oorlewing en die herstel van netwerk mislukkings is integraal tot netwerk stabiliteit. Die samestelling van die Internet noodsaak dat die herstel van skakel mislukkings verspreid en dinamies van natuur moet wees. Die herstel-skema van skakel mislukkings word evalueer in terme van die oorleefbaarheid van die netwerk, die mees e ektiewe benutting van network bronne, aanpasbaarheid, en die herstel tydperk van die skema. Die vinnig moontlikste herstel tydperk word genoodsaak deur oombliklike data verkeer soos VoIP en beeld dienste wat oor die Internet gedra word. The doel van hierdie tesis is om bestaande skakel mislukking herstel skemas te evalueer, en dan verder ondersoek in te stel na hul uitbreiding. Daarna word die voorgestelde skakel mislukking skema se e ektiwiteit gemeet.

Data-centric security is significant in understanding, assessing and mitigating the various risks and impacts of sharing information outside corporate boundaries. Information generally leaves corporate boundaries through mobile devices. Mobile devices continue to evolve as multi-functional tools for everyday life, surpassing their initial intended use. This added capability and increasingly extensive use of mobile devices does not come without a degree of risk - hence the need to guard and protect information as it exists beyond the corporate boundaries and throughout its lifecycle. Literature on existing models crafted to protect data, rather than infrastructure in which the data resides, is reviewed. Technologies that organisations have implemented to adopt the data-centric model are studied. A utopian model that takes into account the shortcomings of existing technologies and deficiencies of common theories is proposed. Two sets of qualitative studies are reported; the first is a preliminary online survey to assess the ubiquity of mobile devices and extent of technology adoption towards implementation of data-centric model; and the second comprises of a focus survey and expert interviews pertaining on technologies that organisations have implemented to adopt the data-centric model. The latter study revealed insufficient data at the time of writing for the results to be statistically significant; however; indicative trends supported the assertions documented in the literature review. The question that this research answers is whether or not current technology implementations designed to mitigate risks from mobile devices, actually address business requirements. This research question, answered through these two sets qualitative studies, discovered inconsistencies between the technology implementations and business requirements. The thesis concludes by proposing a realistic model, based on the outcome of the qualitative study, which bridges the gap between the technology implementations and business requirements. Future work which could perhaps be conducted in light of the findings and the comments from this research is also considered.

Millions of users world-wide are sharing content using Peer-to-Peer (P2P) networks, such as Skype and Bit Torrent. While such new innovations undoubtedly bring benefits, there are nevertheless some associated threats. One of the main hazards is that P2P worms can penetrate the network, even from a single node and then spread rapidly. Understanding the propagation process of such worms has always been a challenge for researchers. Different techniques, such as simulations and analytical models, have been adopted in the literature. While simulations provide results for specific input parameter values, analytical models are rather more general and potentially cover the whole spectrum of given parameter values. Many attempts have been made to model the worm propagation process in P2P networks. However, the reported analytical models to-date have failed to cover the whole spectrum of all relevant parameters and have therefore resulted in high false-positives. This consequently affects the immunization and mitigation strategies that are adopted to cope with an outbreak of worms. The first key contribution of this thesis is the development of a susceptible, exposed, infectious, and Recovered (SEIR) analytical model for the worm propagation process in a P2P network, taking into account different factors such as the configuration diversity of nodes, user behaviour and the infection time-lag. These factors have not been considered in an integrated form previously and have been either ignored or partially addressed in state-of-the-art analytical models. Our proposed SEIR analytical model holistically integrates, for the first time, these key factors in order to capture a more realistic representation of the whole worm propagation process. The second key contribution is the extension of the proposed SEIR model to the mobile M-SEIR model by investigating and incorporating the role of node mobility, the size of the worm and the bandwidth of wireless links in the worm propagation process in mobile P2P networks. The model was designed to be flexible and applicable to both wired and wireless nodes. The third contribution is the exploitation of a promising modelling paradigm, Agent-based Modelling (ABM), in the P2P worm modelling context. Specifically, to exploit the synergies between ABM and P2P, an integrated ABM-Based worm propagation model has been built and trialled in this research for the first time. The introduced model combines the implementation of common, complex P2P protocols, such as Gnutella and GIA, along with the aforementioned analytical models. Moreover, a comparative evaluation between ABM and conventional modelling tools has been carried out, to demonstrate the key benefits of ease of real-time analysis and visualisation. As a fourth contribution, the research was further extended by utilizing the proposed SEIR model to examine and evaluate a real-world data set on one of the most recent worms, namely, the Conficker worm. Verification of the model was achieved using ABM and conventional tools and by then comparing the results on the same data set with those derived from developed benchmark models. Finally, the research concludes that the worm propagation process is to a great extent affected by different factors such as configuration diversity, user-behaviour, the infection time lag and the mobility of nodes. It was found that the infection propagation values derived from state-of-the-art mathematical models are hypothetical and do not actually reflect real-world values. In summary, our comparative research study has shown that infection propagation can be reduced due to the natural immunity against worms that can be provided by a holistic exploitation of the range of factors proposed in this work.

The proliferation of PALs (Public Access Locations) is fuelling the development of new standards, protocols, services, and applications for WLANs (Wireless Local Area Networks). PALs are set up at public locations to meet continually changing, multiservice, multi-protocol user requirements. This research investigates the essential infrastructural requirements that will enable further proliferation of PALs, and consequently facilitate ubiquitous computing. Based on these requirements, an extensible architectural framework for PAL management systems that inherently facilitates the provisioning of multiple services and multiple protocols on PALs is derived. The ensuing framework, which is called Xobogel, is based on the microkernel architectural pattern, and the IPDR (Internet Protocol Data Record) specification. Xobogel takes into consideration and supports the implementation of diverse business models for PALs, in respect of distinct environmental factors. It also facilitates next-generation network service usage accounting through a simple, flexible, and extensible XML based usage record. The framework is subsequently validated for service element extensibility and simplicity through the design, implementation, and experimental deployment of SEHS (Small Extensible Hotspot System), a system based on the framework. The robustness and scalability of the framework is observed to be sufficient for SMME deployment, withstanding the stress testing experiments performed on SEHS. The range of service element and charging modules implemented confirm an acceptable level of flexibility and extensibility within the framework.