title: Cyber security visualization effectiveness

authors: Garae, Jeffery

subjects: Cyber Security

abstract: Security visualization utilises predefined data attributes and translates them into visual nodes to form images for the purpose of communicating critical security information to targeted audiences. It is commonly used for two reasons: exploring and reporting purposes thus, sharing insights on suspected security events. However, the challenge of selecting the best visualization out of two or more visualization samples, regardless of existing limitations such as screen dimensions and visual complexities, required users to utilise certain measurement criteria. These criteria urge security visualization researchers, developers and users (viewers) to ask themselves the following two questions: What makes a security visualization effective? How do we measure visualization effectiveness in the context of investigating, analysing, understanding and reporting cyber security incidents?

This thesis explores a range of effectiveness measurement techniques for web and mobile platforms. We investigated existing effectiveness methods for the design, implementation and user observation phases in security visualizations. Consequently, we identified effectiveness criteria and metrics in applications include visual clarity, visibility, distortion rates and user cognitive response (viewing) times. With the goal of aiding decision making in cyber security operations, we provided a distinctive security visualization paradigm of a full-scale effectiveness measurement (SvEm framework) approach for both theoretical and user-centric visualization techniques. Our framework facilitates effectiveness through our SvEm algorithm thus, providing various interactive three-dimensional (3D) visualization applications to enhance both single and multi-user collaboration.

The SvEm framework involves several key components: (1) web/mobile display dimensions and resolution, (2) security incident entities, (3) user cognitive activators and alerts, (4) working memory load, (5) threat scoring system and (6) the colour usage management. To evaluate effectiveness in our framework, we developed several use cases: (1) VisualProgger - a real-time security visualization analytic application (web and mobile platforms), (2) a security visualization with augmented reality and (3) a security visualization for intelligence tracking and monitoring. In addition, we developed and documented a new security visualization guideline (a SCeeVis pre-standard) as part of the SvEm framework to aid with the design, implementation and observation environments.

This pre-standard further allowed us to develop our SCeeVis colour chaining standard and a new cognition and working memory (SvEm-CWML) instruction set to enhance the user’s cognition and perception process for security visualizations. As a result, our visualization application outputs effectiveness measurement by capturing and increasing the user's attention span through the process of reducing cognitive load, while increasing the viewer’s memory efficiency. Thus, users have a high potential to gain security insights from a given visualization. Our evaluation shows that, viewers perform better with the existence of prior knowledge of security events and if they operate in a comfortable visual environment. It has also indicated that circular visualization designs attracted and maintained the viewer’s attention. Finally, these discoveries have revealed new research directions for future work relating to effectiveness measurement in security visualization.

text: Cyber security visualization effectiveness Security visualization utilises predefined data attributes and translates them into visual nodes to form images for the purpose of communicating critical security information to targeted audiences. It is commonly used for two reasons: exploring and reporting purposes thus, sharing insights on suspected security events. However, the challenge of selecting the best visualization out of two or more visualization samples, regardless of existing limitations such as screen dimensions and visual complexities, required users to utilise certain measurement criteria. These criteria urge security visualization researchers, developers and users (viewers) to ask themselves the following two questions: What makes a security visualization effective? How do we measure visualization effectiveness in the context of investigating, analysing, understanding and reporting cyber security incidents?

This thesis explores a range of effectiveness measurement techniques for web and mobile platforms. We investigated existing effectiveness methods for the design, implementation and user observation phases in security visualizations. Consequently, we identified effectiveness criteria and metrics in applications include visual clarity, visibility, distortion rates and user cognitive response (viewing) times. With the goal of aiding decision making in cyber security operations, we provided a distinctive security visualization paradigm of a full-scale effectiveness measurement (SvEm framework) approach for both theoretical and user-centric visualization techniques. Our framework facilitates effectiveness through our SvEm algorithm thus, providing various interactive three-dimensional (3D) visualization applications to enhance both single and multi-user collaboration.

The SvEm framework involves several key components: (1) web/mobile display dimensions and resolution, (2) security incident entities, (3) user cognitive activators and alerts, (4) working memory load, (5) threat scoring system and (6) the colour usage management. To evaluate effectiveness in our framework, we developed several use cases: (1) VisualProgger - a real-time security visualization analytic application (web and mobile platforms), (2) a security visualization with augmented reality and (3) a security visualization for intelligence tracking and monitoring. In addition, we developed and documented a new security visualization guideline (a SCeeVis pre-standard) as part of the SvEm framework to aid with the design, implementation and observation environments.

This pre-standard further allowed us to develop our SCeeVis colour chaining standard and a new cognition and working memory (SvEm-CWML) instruction set to enhance the user’s cognition and perception process for security visualizations. As a result, our visualization application outputs effectiveness measurement by capturing and increasing the user's attention span through the process of reducing cognitive load, while increasing the viewer’s memory efficiency. Thus, users have a high potential to gain security insights from a given visualization. Our evaluation shows that, viewers perform better with the existence of prior knowledge of security events and if they operate in a comfortable visual environment. It has also indicated that circular visualization designs attracted and maintained the viewer’s attention. Finally, these discoveries have revealed new research directions for future work relating to effectiveness measurement in security visualization.

year: 2019

title: Late Holocene mud sedimentation and diagenesis in the Firth of Thames: Bentonites in the making

authors: Naish, Timothy R.

abstract: Late Holocene mud sedimentation in the southern Firth of Thames has been described from analysis of a number of shallow marine sediment cores. Three distinct lithofacies are distinguished on the basis of sediment texture and mineralogy. A laterally extensive greenish grey mud, typically bioturbated and massive, with sporadic uncorrelatable interbedded shell layers is termed the Firth of Thames mud facies. Nearer shore sediments are usually coarser and are subdivided into two facies: a siliciclastic sand facies (river mouth sand facies) comprising more prominent interbeds of sand in mud and associated with sedimentation at the mouth of the Waihou River; and a mixed terrigenous-carbonate gravel facies (delta fan gravel facies) associated with deposition on small delta fans adjacent to streams draining the Coromandel Range. The areal distribution of all three facies over the late Holocene has been controlled largely by northward progradation of the coastal Hauraki Lowland associated with the rapid sediment infilling of the Firth of Thames since sea level reached its present height 6500 y B.P. From seismic evidence the Holocene muds are up to 10m thick. The cores in this study penetrated only to 5.5m sub-bottom depth and yielded an oldest radiocarbon age of 5000 y B.P. The age data indicate an average rate of offshore vertical sediment accumulation of 1.5 mm/y. 

Up to 15 km of progradation of the southern shoreline of the coastal Hauraki Lowland has occurred over the late Holocene at an average rate of up to 2.5 m/y, notably from 3500 y B.P to 1200 y B.P. Progradation is evidenced by the occurrence of coarsening-upward sequences in nearer shore cores of the Firth of Thames, as well as their changing faunal composition, particularly the upward increase in abundance of the foraminifer Ammonia beccarri, a good indicator of brackish water conditions, which suggests a gradual seaward encroachment of the freshwater influence of the Waihou River over the late Holocene. Basal muds which are similar in composition to marine sediments of the Firth of Thames are overlain by peat dated at 6025 y B.P in a peat core from Kopouatai Peat Bog, and suggest that marine conditions existed in this inland region of the Hauraki Depression prior to 6025 y B.P. 

Muds range from silty clays to clayey silts and consist principally of volcanic glass, smectite and halloysite, with smaller amounts of other volcanic-derived siliciclasts and allophane and illite, as well as skeletal carbonate (mainly aragonite) and organic matter. A contemporaneous decrease in the abundance of volcanic glass (55-15 wt % down-core) and an increase in smectite concentration (8-45 wt % down-core) occurs with sub-bottom depth. Specific mineralogical analyses (XRD and IR) and evidence from scanning electron microscopy suggest the smectite is montmorillonitic in composition and authigenic in nature. Moreover, the absence of smectite in the bottom sediments of rivers draining the Hauraki Lowland precludes a detrital origin.

The diagenetic transformation of volcanic glass to smectite in sediments of the Firth of Thames is described by a sequential kinetic model which involves a parabolic dissolution coupled with a first order precipitation of smectite via the formation of an intermediate hydrated glass phase. The rate constant calculated from the sequential kinetic model is 3.35 x 10⁻⁴y⁻¹. The half-life of the glass is 1475 y, implying rapid early diagenetic alteration of volcanic glass to smectite to form late Holocene bentonitic deposits. Thermodynamic stability considerations imply that the first order precipitaion of smectite may be favoured by conditions of pH and Na⁺ activity typical of interstitial fluids having sea water salinity under mildly anoxic conditions.

text: Late Holocene mud sedimentation and diagenesis in the Firth of Thames: Bentonites in the making Late Holocene mud sedimentation in the southern Firth of Thames has been described from analysis of a number of shallow marine sediment cores. Three distinct lithofacies are distinguished on the basis of sediment texture and mineralogy. A laterally extensive greenish grey mud, typically bioturbated and massive, with sporadic uncorrelatable interbedded shell layers is termed the Firth of Thames mud facies. Nearer shore sediments are usually coarser and are subdivided into two facies: a siliciclastic sand facies (river mouth sand facies) comprising more prominent interbeds of sand in mud and associated with sedimentation at the mouth of the Waihou River; and a mixed terrigenous-carbonate gravel facies (delta fan gravel facies) associated with deposition on small delta fans adjacent to streams draining the Coromandel Range. The areal distribution of all three facies over the late Holocene has been controlled largely by northward progradation of the coastal Hauraki Lowland associated with the rapid sediment infilling of the Firth of Thames since sea level reached its present height 6500 y B.P. From seismic evidence the Holocene muds are up to 10m thick. The cores in this study penetrated only to 5.5m sub-bottom depth and yielded an oldest radiocarbon age of 5000 y B.P. The age data indicate an average rate of offshore vertical sediment accumulation of 1.5 mm/y. 

Up to 15 km of progradation of the southern shoreline of the coastal Hauraki Lowland has occurred over the late Holocene at an average rate of up to 2.5 m/y, notably from 3500 y B.P to 1200 y B.P. Progradation is evidenced by the occurrence of coarsening-upward sequences in nearer shore cores of the Firth of Thames, as well as their changing faunal composition, particularly the upward increase in abundance of the foraminifer Ammonia beccarri, a good indicator of brackish water conditions, which suggests a gradual seaward encroachment of the freshwater influence of the Waihou River over the late Holocene. Basal muds which are similar in composition to marine sediments of the Firth of Thames are overlain by peat dated at 6025 y B.P in a peat core from Kopouatai Peat Bog, and suggest that marine conditions existed in this inland region of the Hauraki Depression prior to 6025 y B.P. 

Muds range from silty clays to clayey silts and consist principally of volcanic glass, smectite and halloysite, with smaller amounts of other volcanic-derived siliciclasts and allophane and illite, as well as skeletal carbonate (mainly aragonite) and organic matter. A contemporaneous decrease in the abundance of volcanic glass (55-15 wt % down-core) and an increase in smectite concentration (8-45 wt % down-core) occurs with sub-bottom depth. Specific mineralogical analyses (XRD and IR) and evidence from scanning electron microscopy suggest the smectite is montmorillonitic in composition and authigenic in nature. Moreover, the absence of smectite in the bottom sediments of rivers draining the Hauraki Lowland precludes a detrital origin.

The diagenetic transformation of volcanic glass to smectite in sediments of the Firth of Thames is described by a sequential kinetic model which involves a parabolic dissolution coupled with a first order precipitation of smectite via the formation of an intermediate hydrated glass phase. The rate constant calculated from the sequential kinetic model is 3.35 x 10⁻⁴y⁻¹. The half-life of the glass is 1475 y, implying rapid early diagenetic alteration of volcanic glass to smectite to form late Holocene bentonitic deposits. Thermodynamic stability considerations imply that the first order precipitaion of smectite may be favoured by conditions of pH and Na⁺ activity typical of interstitial fluids having sea water salinity under mildly anoxic conditions.

year: 1990

title: The Mātauranga Māori in Mathematics Directive: Exploring the place of mātauranga Māori in Mathematics teaching and learning

authors: Williams, Jessica Elizabeth

subjects: mathematics education

abstract: This thesis explores issues concerning mātauranga Māori in mathematics teaching and learning here in Aotearoa. The Ministry of Education has directed that mana ōrite mō te mātauranga Māori be embedded in teaching, learning, and assessment. Thus, this research primarily aims to understand the development leading to the directive of including mātauranga Māori in education policies. For the English-medium secondary education settings, the second and third aims of this research are to explore what mātauranga Māori means to teachers of mathematics and to consider the connections between mātauranga Māori and mathematics teaching and learning. To investigate these aims, a semi-structured group discussion with four secondary mathematics teachers from an English-medium setting was conducted. The results of this thesis highlight the confusion and challenges secondary mathematics educators have toward defining, and subsequently, implementing mātauranga Māori in their classrooms. This thesis also found that there is enthusiasm and interest around learning how to ensure indigenous and marginalised learners reach their mathematics potential. Believing that indigenous worldviews have the potential to shift education outcomes for minority learners, this thesis adds to literature related to indigenous education, secondary mathematics education, and English-medium education of Māori learners.

text: The Mātauranga Māori in Mathematics Directive: Exploring the place of mātauranga Māori in Mathematics teaching and learning This thesis explores issues concerning mātauranga Māori in mathematics teaching and learning here in Aotearoa. The Ministry of Education has directed that mana ōrite mō te mātauranga Māori be embedded in teaching, learning, and assessment. Thus, this research primarily aims to understand the development leading to the directive of including mātauranga Māori in education policies. For the English-medium secondary education settings, the second and third aims of this research are to explore what mātauranga Māori means to teachers of mathematics and to consider the connections between mātauranga Māori and mathematics teaching and learning. To investigate these aims, a semi-structured group discussion with four secondary mathematics teachers from an English-medium setting was conducted. The results of this thesis highlight the confusion and challenges secondary mathematics educators have toward defining, and subsequently, implementing mātauranga Māori in their classrooms. This thesis also found that there is enthusiasm and interest around learning how to ensure indigenous and marginalised learners reach their mathematics potential. Believing that indigenous worldviews have the potential to shift education outcomes for minority learners, this thesis adds to literature related to indigenous education, secondary mathematics education, and English-medium education of Māori learners.

year: 2023