Thesis (MBA.) -- University of Limpopo, 2016 / Project systems allow project managers to carry out work in a professional and well organised manner. These systems are created and maintained to advance project performance. Eskom spends a lot of resources on the creation and maintenance of project systems. The literature on project systems shows that, in spite of advancement in project managements processes, systems and tools, project success has not significantly improved. This problem raises questions about the value and effectiveness of project systems. Therefore this paper reports about the correlation between the degree of project manager’s compliance to project systems and project performance in Eskom Distribution Limpopo Operating Unit. The study looked at the performance of 10 projects and used empirical data on designers, planners, managers and project managers working in Eskom Distribution LOU to measure the compliance level of employees to project systems when carrying out the 10 chosen projects or any other projects not listed. A total of 45 completed questionnaires were analysed. Correlation analysis tests found a negative correlation between project manager’s project systems compliance level and project performance in terms of schedule and cost. The conclusion found was that as the compliance level on project systems increases, project performance decreases. Meaning there is an inversely proportional relationship between project system compliance level and project performance. Additionally, a lower level of knowledge than expected on the project managers, designers, and planners was found. Keywords: Project performance, Project systems, Correlation, Adherence,

Följande kombinerade studie är gjord på Region Jönköping tillsammans med kvalitetsregistret Senior Alert. Eftersom Senior Alert har en upplevelse att registret inte används i den utsträckning de själva önskar ville de ta reda på om detta var en sanningsenlig upplevelse och vad det i så fall fanns för orsaker till detta. Studien startade med en kvalitativ studie för att sedan skapa en bredare förståelse genom en kvantitativ enkät för att slutligen återigen göra en kvalitativ intervju med användare av registret för att skapa en djupare förståelse. Resultaten visade på att registret hade ett antal nyckelpunkter som kom att bli väsentliga för hur den teoretiska grunden och diskussionen skulle komma att utformas. Dessa nyckelord är Rutiner och arbetsprocess, Ledarskap, Utbildning och lärande samt Ålderns betydelse. Som senare kom att diskuteras i förhållande till tidigare forskning samt de valda teorierna, Sensemaking theory och Mintzbergs samordningsmekanismer. Detta kunde konstateras vara sådant som skulle kunna utvecklas för att göra användningen av registret samt innehållet mer komplett. Utifrån detta kan slutsatsen konstateras vara att det krävs en högre grad av samordning, tydligare ledarskap och mer utbildning inom Senior Alert och dess funktioner. Detta för att skapa mer kunskap och uppfylla Senior Alerts syfte att kunna föra pålitlig statistik på den information som samlas in och hämtas ur registret.

Intrusion Detection Systems (IDSs) are designed to monitor a networked environment and generate alerts whenever abnormal activities are detected. The number of these alerts can be very large making their evaluation by security analysts a difficult task. The management is complicated by the need to configure the different components of alert evaluation systems. In addition, IDS alert management techniques, such as clustering and correlation, suffer from involving unrelated alerts in their processes and consequently provide results that are inaccurate and difficult to manage. Thus, the tuning of an IDS alert management system in order to provide optimal results remains a major challenge, which is further complicated by the large spectrum of potential attacks the system can be subject to. This thesis considers the specification and configuration issues of FuzMet, a novel IDS alert management system which employs several metrics and a fuzzy-logic based approach for scoring and prioritizing alerts. In addition, it features an alert rescoring technique that leads to a further reduction of the number of alerts. We study the impact of different configurations of the proposed metrics on the accuracy and completeness of the alert scores generated by FuzMet. Our approach is validated using the 2000 DARPA intrusion detection scenario specific datasets and comparative results between the Snort IDS alert scoring and FuzMet alert prioritization scheme are presented. A considerable number of simulations were conducted in order to determine the optimal configuration of FuzMet with selected simulation results presented and analyzed.

Intrusion Detection Systems (IDSs) are designed to monitor a networked environment and generate alerts whenever abnormal activities are detected. The number of these alerts can be very large making their evaluation by security analysts a difficult task. The management is complicated by the need to configure the different components of alert evaluation systems. In addition, IDS alert management techniques, such as clustering and correlation, suffer from involving unrelated alerts in their processes and consequently provide results that are inaccurate and difficult to manage. Thus, the tuning of an IDS alert management system in order to provide optimal results remains a major challenge, which is further complicated by the large spectrum of potential attacks the system can be subject to. This thesis considers the specification and configuration issues of FuzMet, a novel IDS alert management system which employs several metrics and a fuzzy-logic based approach for scoring and prioritizing alerts. In addition, it features an alert rescoring technique that leads to a further reduction of the number of alerts. We study the impact of different configurations of the proposed metrics on the accuracy and completeness of the alert scores generated by FuzMet. Our approach is validated using the 2000 DARPA intrusion detection scenario specific datasets and comparative results between the Snort IDS alert scoring and FuzMet alert prioritization scheme are presented. A considerable number of simulations were conducted in order to determine the optimal configuration of FuzMet with selected simulation results presented and analyzed.

Deploying a large number of information security (INFOSEC) systems can provide in-depth protection for systems and networks. However, the sheer number of security alerts output by security sensors can overwhelm security analysts from performing effective analysis and taking timely response. Therefore, alert correlation is the core component in a security management system. Most of existing alert correlation techniques depend on a priori and hard-coded domain knowledge that lead to their limited capabilities of detecting new attack strategies. These approaches also focus more on the aggregation and analysis of raw security alerts, and build basic or low-level attack scenarios. This thesis focuses on discovering novel attack strategies with analysis of security alerts. Our framework helps security administrator aggregate redundant alerts, intelligently correlate security alerts, analyze attack strategies, and take appropriate actions against forthcoming attacks. In alert correlation, we have developed an integrated correlation system with three complementary correlation mechanisms. We have developed a probabilistic-based correlation engine that incorporates domain knowledge to correlate alerts that have direct causal relationship. We have developed a statistical analysis-based and a temporal analysis-based correlation engines to discover attack transition patterns in which attack steps do not have direct causal relationship in terms of security and performance measure but exhibit statistical and temporal patterns. We construct attack scenarios and conduct attack path analysis based on the correlation results. Security analysts are presented with aggregated information on attack strategies from the integrated correlation system. In attack plan recognition, we address the challenges of identifying attacker's high-level strategies and intentions as well as predicting upcoming attacks. We apply graph-based techniques to correlating isolated attack scenarios derived from low-level alert correlation based on their relationship in attack plans. We conduct probabilistic inference to evaluate the likelihood of attack goal(s) and predict potential upcoming attacks based on observed attack activities. We evaluate our algorithms using DARPA's Grand Challenge Problem (GCP) data sets and live traffic data collected from our backbone network. The results show that our approach can effectively discover novel attack strategies, provide a quantitative analysis of attack scenarios and identify attack plans.

Made available in DSpace on 2014-06-12T15:57:37Z (GMT). No. of bitstreams: 2 arquivo3214_1.pdf: 3789743 bytes, checksum: 5121a8308f93d20405e932f1e9bab193 (MD5) license.txt: 1748 bytes, checksum: 8a4605be74aa9ea9d79846c1fba20a33 (MD5) Previous issue date: 2010 / Universidade Federal do Amazonas / Um breve exame do atual tráfego Internet mostra uma mistura de serviços conhecidos e desconhecidos, novas e antigas aplicações, tráfego legítimo e ilegítimo, dados solicitados e não solicitados, tráfego altamente relevante ou simplesmente indesejado. Entre esses, o tráfego Internet não desejado tem se tornado cada vez mais prejudicial para o desempenho e a disponibilidade de serviços, tornando escasso os recursos das redes. Tipicamente, este tipo de tráfego é representado por spam, phishing, ataques de negação de serviço (DoS e DDoS), vírus e worms, má configuração de recursos e serviços, entre outras fontes. Apesar dos diferentes esforços, isolados e/ou coordenados, o tráfego Internet não desejado continua a crescer. Primeiramente, porque representa uma vasta gama de aplicações de usuários, dados e informações com diferentes objetivos. Segundo, devido a ineficácia das atuais soluções em identificar e reduzir este tipo de tráfego. Por último, uma definição clara do que é não desejado tráfego precisa ser feita. A fim de solucionar estes problemas e motivado pelo nível atingido pelo tráfego não desejado, esta tese apresenta: 1. Um estudo sobre o universo do tráfego Internet não desejado, apresentado definições, discussões sobre contexto e classificação e uma série de existentes e potencias soluções. 2. Uma metodologia para identificar tráfego não desejado baseada em orquestração. OADS (Orchestration Anomaly Detection System) é uma plataforma única para a identificação de tráfego não desejado que permite um gerenciamento cooperativa e integrado de métodos, ferramentas e soluções voltadas a identificação de tráfego não desejado. 3. O projeto e implementação de soluções modulares integráveis a metodologia proposta. A primeira delas é um sistema de suporte a recuperação de informações na Web (WIRSS), chamado OADS Miner ou simplesmente ARAPONGA, cuja função é reunir informações de segurança sobre vulnerabilidades, ataques, intrusões e anomalias de tráfego disponíveis na Web, indexá-las eficientemente e fornecer uma máquina de busca focada neste tipo de informação. A segunda, chamada Alert Pre- Processor, é um esquema que utilize uma técnica de cluster para receber múltiplas fontes de alertas, agregá-los e extrair aqueles mais relevantes, permitindo correlações e possivelmente a percepção das estratégias usadas em ataques. A terceira e última é um mecanismo de correlação e fusão de alertas, FER Analyzer, que utilize a técnica de descoberta de episódios frequentes (FED) para encontrar sequências de alertas usadas para confirmar ataques e possivelmente predizer futuros eventos. De modo a avaliar a proposta e suas implementações, uma série de experimentos foram conduzidos com o objetivo de comprovar a eficácia e precisão das soluções

Volcano early warning systems are used globally to communicate volcano-related information to diverse stakeholders ranging from specific user groups to the general public, or both. Within the framework of a volcano early warning system, Volcano Alert Level (VAL) systems are commonly used as a simple communication tool to inform society about the status of activity at a specific volcano. Establishing a VAL system that is effective for multiple volcanoes can be challenging, given that each volcano has specific behavioural characteristics. New Zealand has a wide range of volcano types and geological settings, including rhyolitic calderas capable of very large eruptions (>500 km 3 ) and frequent unrest episodes, explosive andesitic stratovolcanoes, and effusive basaltic eruptions at both caldera and volcanic field settings. There is also a range in eruption frequency, requiring the VAL system to be used for both frequently active ‘open-vent’ volcanoes, and reawakening ‘closed-vent’ volcanoes. Furthermore, New Zealand’s volcanoes are situated in a variety of risk settings ranging from the Auckland Volcanic Field, which lies beneath a city of 1.4 million people; to Mt. Ruapehu, the location of popular ski fields that are occasionally impacted by ballistics and lahars, and produces tephra that falls in distant cities. These wide-ranging characteristics and their impact on society provide opportunities to learn from New Zealand’s experience with VAL systems, and the adoption of a standardised single VAL system for all of New Zealand’s volcanoes following a review in 2014. This chapter outlines the results of qualitative research conducted in 2010–2014 with key stakeholders and scientists, including from the volcano observatory at GNS Science, to ensure that the resulting standardised VAL system is an effective communication tool. A number of difficulties were faced in revising the VAL system so that it remains effective for all of the volcanic settings that exist in New Zealand. If warning products are standardised too much, end-user decision making and action can be limited when unusual situations occur, e.g., there may be loss of specific relevance in the alert message. Specific decision-making should be based on more specific parameters than the VAL alone, however wider VAL system standardisation can increase credibility, a known requirement for effective warning, by ensuring that warning sources are clear, trusted and widely understood. With a credible source, user groups are less likely to look for alternatives or confirmation, leading to faster action. Here we consider volcanic warnings within the wider concept of end-to-end multi-hazard early warning systems including detection, evaluation, notification, decision-making and action elements (based on Carsell et al. 2004).

, / El presente trabajo ofrece una propuesta de solución tecnológica al problema asociado a la violencia contra la mujer en el Perú. El proyecto realizo un diagnóstico del tiempo promedio de atención, en base a un estudio, de los principales canales de prevención y denuncia existentes. Del estudio realizado se pudo determinar que existen elevados tiempos de atención y asimetrías de información entre los diferentes actores del sistema de prevención y protección a la mujer. La solución propuesta, propone reducir al tiempo mínimo necesario para la atención y detención de un acto de violencia hacia la mujer brindando una reacción inmediata al evento. Complementando el proceso de proceso del proyecto hemos usamos componentes electrónicos de bajo costo y sistemas acordes y existentes en el mercado actual. La solución agrupa componentes tecnológicos propiamente configurados tanto en hardware como en software para realizar el seguimiento de la violencia, el cual se compone principalmente de la siguiente configuración: 1) Un dispositivo ‘wearable’, alertando a un grupo determinado de personas previamente agregadas, familiares, conocidos o personas dispuestas a ayudar, 2) Un sistema de comunicación, la alerta en tiempo real la cual que por medio de señales a una plataforma Cloud son distribuidos a una aplicación móvil y pagina web. La solución fue validada en un CEM ubicada en una comisaría de la policía nacional en la provincia del Callao, Distrito de Ventanilla. El proyecto busca contribuir con la disminución del tiempo de respuesta de ayuda a las mujeres víctimas y la asimetría de información en las organizaciones públicas que se ven involucradas. / This work offers a proposal for a technological solution to the problem associated with violence against women in Peru. The project made a diagnosis of the average attention time, based on a study, of the main existing prevention and reporting channels. From the study carried out, it was possible to determine that there are high attention times and information asymmetries between the different actors in the prevention and protection system for women. The proposed solution proposes to reduce to the minimum time necessary for the attention and arrest of an act of violence against women, providing an immediate reaction to the event. Complementing the process of the project process we have used low-cost electronic components and systems that are consistent and existing in the current market. The solution groups properly configured technological components in both hardware and software to track violence, which mainly consists of the following configuration: 1) A 'wearable' device, alerting a specific group of previously added people, family members , acquaintances or people willing to help, 2) A communication system, the alert in real time which through signals to a Cloud platform are distributed to a mobile application and website. The solution was validated at a CEM located in a national police station in the Callao province, Ventanilla District. The project seeks to contribute to reducing the response time to help women victims and the asymmetry of information in the public organizations that are involved. / Tesis

The threat of bioterrorism forces the public health infrastructure to focus attention on overall issues related to challenges posed by emerging and re-emerging infectious diseases. There is a crucial need to strengthen existing surveillance systems and to validate real-time approaches to surveillance that can provide timely alerts of epidemics whether they occur naturally or through a bioterrorism attack. The purpose of this study is to implement and evaluate a bioterrorism syndromic surveillance system called BioDefend™, to determine if the system could detect a potential epidemic/bioterrorism attack within 24-36 hours, more rapidly than it would be identified by routine health surveillance. This sentinel surveillance study was conducted in theme parks, theme park referral hospitals and clinics, and a military hospital and clinics in the Central Florida area. A six-month period of baseline data collection was completed at all surveillance sites for the purposes of serving as the comparison for the test period. The test period comsisted of five months and served to validate the system. The baseline was also used to identify normal illness trends and seasonality patterns so that thresholds could be established on which to determine significant syndromic aberrations. The web-based reporting system enabled near real-time data entry. The syndromic and demographic information then was processed in an automated analysis system to provide a mechanism for alerting surveillance sites when significant rises in reported syndromes and/or clinic/hospital daily visits exceeded the established thresholds. A pocket PC/phone device enabled staff to receive notification of alerts 24/7. The surveillance system was evaluated by comparing regional, state, and national surveillance data to equivalent syndromic data reported from BioDefend™. After comparing these data, it was determined that the BioDefend™ system detected two epidemics of public health importance more than one month before they were identified through routine regional and state, regional, and national surveillance methods. The specific syndromes identified earlier than the State of Florida surveillance were “gastroenteritis” and “influenza-like illness.” This study has examined whether or not the BioDefend™ surveillance system is useful in the context of the above referenced surveillance sites, and whether it could serve as a national model for syndromic surveillance.

A gap of knowledge lies within the hazard of extreme heat within the United States and the public’s response and perception of their own vulnerability. Even with constant communication from meteorologist at the National Weather Service and within the broadcast industry, there are still ongoing issues which include the possibility that ambient air temperature from fixed sites do not accurately reflect what the general population is experiencing, that the thresholds for excessive heat warnings are not appropriate, and that the most vulnerable individuals do not have the knowledge, and/or ability to protect themselves when extreme heat does occur. Assessment of the spatial pattens of heat alerts across the United States, mortality risks associated with extreme heat, and days above alert thresholds between 2010 to 2021 will be utilized to exhibit cities and regions where thresholds could be inappropriate and to reveal the most vulnerable between regions within this period.