Digital Commons Network^™

Zero Trust And Advanced Persistent Threats: Who Will Win The War?, Bilge Karabacak, Todd Whittaker

All Faculty and Staff Scholarship

Advanced Persistent Threats (APTs) are state-sponsored actors who break into computer networks for political or industrial espionage. Because of the nature of cyberspace and ever-changing sophisticated attack techniques, it is challenging to prevent and detect APT attacks. 2020 United States Federal Government data breach once again showed how difficult to protect networks from targeted attacks. Among many other solutions and techniques, zero trust is a promising security architecture that might effectively prevent the intrusion attempts of APT actors. In the zero trust model, no process insider or outside the network is trusted by default. Zero trust is also called perimeterless …

Considerations For Radio Frequency Fingerprinting Across Multiple Frequency Channels, Jose A. Gutierrez Del Arroyo, Brett J. Borghetti, Michael A. Temple

Faculty Publications

Radio Frequency Fingerprinting (RFF) is often proposed as an authentication mechanism for wireless device security, but application of existing techniques in multi-channel scenarios is limited because prior models were created and evaluated using bursts from a single frequency channel without considering the effects of multi-channel operation. Our research evaluated the multi-channel performance of four single-channel models with increasing complexity, to include a simple discriminant analysis model and three neural networks. Performance characterization using the multi-class Matthews Correlation Coefficient (MCC) revealed that using frequency channels other than those used to train the models can lead to a deterioration in performance from …

A Critical Comparison Of Brave Browser And Google Chrome Forensic Artefacts, Stuart Berham, Sarah Morris

Journal of Digital Forensics, Security and Law

Digital forensic practitioners are tasked with the identification, recovery and analysis of Internet browser artefacts which may have been used in the pursuit of committing a civil or criminal offence. This research paper critically compares the most downloaded browser, Google Chrome, against an increasingly popular Chromium browser known as Brave, said to offer privacy-by-default. With increasing forensic caseloads, data complexity, and requirements for method validation to satisfy ISO 17025 accreditation, recognising the similarities and differences between the browsers, developed on the same underlying technology is essential. The paper describes a series of conducted experiments and subsequent analysis to identify artefacts …

Technical Analysis Of Thanos Ransomware, Ikuromor Ogiriki, Christopher Beck, Vahid Heydari

College of Science & Mathematics Departmental Research

Ransomware is a developing menace that encrypts users’ files and holds the decryption key hostage until the victim pays a ransom. This particular class of malware has been in charge of extortion hundreds of millions of dollars every year. Adding to the problem, generating new variations is cheap. Therefore, new malware can detect antivirus and intrusion detection systems and evade them or manifest in ways to make themselves undetectable. We must first understand the characteristics and behavior of various varieties of ransomware to create and construct effective security mechanisms to combat them. This research presents a novel dynamic and behavioral …

Malware Binary Image Classification Using Convolutional Neural Networks, John Kiger, Shen-Shyang Ho, Vahid Heydari

College of Science & Mathematics Departmental Research

The persistent shortage of cybersecurity professionals combined with enterprise networks tasked with processing more data than ever before has led many cybersecurity experts to consider automating some of the most common and time-consuming security tasks using machine learning. One of these cybersecurity tasks where machine learning may prove advantageous is malware analysis and classification. To evade traditional detection techniques, malware developers are creating more complex malware. This is achieved through more advanced methods of code obfuscation and conducting more sophisticated attacks. This can make the manual process of analyzing malware an infinitely more complex task. Furthermore, the proliferation of malicious …

Performance Of Heterogeneous Multi-Agent Systems With Applications In Combined Arms, Robert J. Wilson

Theses and Dissertations

Multi-agent systems show great potential for solving problems in complex and dynamic domains. Such systems comprise multiple individual entities called agents. Agents possessing the same behavior or physical form are called homogeneous while agents which differ in these respects are termed heterogeneous. The overall behavior of the system emerges from the many interactions of its component agents. Most multi-agent systems research to date focuses on systems of homogeneous agents, but recent work suggests that heterogeneous agents may improve system performance in certain tasks. This research examines the impact of heterogeneity on multi-agent system effectiveness and investigates the application of multi-agent …

Team Air Combat Using Model-Based Reinforcement Learning, David A. Mottice

Theses and Dissertations

We formulate the first generalized air combat maneuvering problem (ACMP), called the MvN ACMP, wherein M friendly AUCAVs engage against N enemy AUCAVs, developing a Markov decision process (MDP) model to control the team of M Blue AUCAVs. The MDP model leverages a 5-degree-of-freedom aircraft state transition model and formulates a directed energy weapon capability. Instead, a model-based reinforcement learning approach is adopted wherein an approximate policy iteration algorithmic strategy is implemented to attain high-quality approximate policies relative to a high performing benchmark policy. The ADP algorithm utilizes a multi-layer neural network for the value function approximation regression mechanism. One-versus-one …

Smoothing Of Convolutional Neural Network Classifications, Glen R. Drumm

Theses and Dissertations

Smoothing convolutional neural networks is investigated. When intermittent and random false predictions happen, a technique of average smoothing is applied to smooth out the incorrect predictions. While a simple problem environment shows proof of concept, obstacles remain for applying such a technique to a more operationally complex problem.

Autonomous And Resilient Management Of All-Source Sensors For Navigation Integrity: A Comparison And Analysis, Niles A. Tate

Theses and Dissertations

When navigating using Global Navigation Satellite Systems (GNSS), multiple/redundant, synchronous pseudorange measurements are readily available. However, when navigating in a GNSS degraded and/or denied region, this is not guaranteed. In response to this challenge, the ANT Center developed a framework known as Autonomous and Resilient Management of All-source Sensors (ARMAS). The ARMAS framework is designed to be resilient towards data corruption caused from mismodeled, uncalibrated, and faulty sensors. This thesis further expands on this work by performing a comparison against a Residual-Based Receiver Autonomous Integrity Monitoring (RBRAIM) scheme using simulated and real flight data to evaluate each systems performance.

Obsolescence: Evaluating An Educational Serious Game On Artificial Intelligence Impacts To Military Strategic Goals, Timothy C. Kokotajlo

Theses and Dissertations

Artificial Intelligence (AI) threatens to bring significant disruption to all aspects of military operations. This research develops a Serious Game (SG) and assessment methodology to provide education on the mindsets required for engaging with disruptive AI technologies. The game, Obsolescence, teaches strategic-level concepts recommended to the Department of Defense (DoD) from a compilation of reports on the current and future state of AI and warfighting. The methodology for assessing the educational value of Obsolescence addresses common challenges such as subjective reporting, control groups, population sizes, and measuring abstract or high levels of learning. The games proposed educational value is tested …

Cybersecurity Risk In U.S. Critical Infrastructure: An Analysis Of Publicly Available U.S. Government Alerts And Advisories, Zachary Lanz

International Journal of Cybersecurity Intelligence & Cybercrime

As threat actor operations become increasingly sophisticated and emphasize the targeting of critical infrastructure and services, the need for cybersecurity information sharing will continue to grow. Escalating demand for cyber threat intelligence and information sharing across the cybersecurity community has resulted in the need to better understand the information produced by reputable sources such as U.S. CISA Alerts and ICS-CERT advisories. The text analysis program, Profiler Plus, is used to extract information from 1,574 U.S. government alerts and advisories to develop visualizations and generate enhanced insights into different cyber threat actor types, the tactics which can be used for cyber …

Subject Matter Experts’ Feedback On Experimental Procedures To Measure User’S Judgment Errors In Social Engineering Attacks, Tommy Pollock, Yair Levy, Wei Li, Ajoy Kumar

Journal of Cybersecurity Education, Research and Practice

Distracted users can fail to correctly distinguish the differences between legitimate and malicious emails or search engine results. Mobile phone users can have a more challenging time identifying malicious content due to the smaller screen size and the limited security features in mobile phone applications. Thus, the main goal of this research study was to design, develop, and validate a set of field experiments to assess user’s judgment when exposed to two types of simulated social engineering attacks: phishing and Potentially Malicious Search Engine Results (PMSER), based on the interaction of the environment (distracting vs. non-distracting) and type of device …

A Taxonomy Of Cyberattacks Against Critical Infrastructure, Miloslava Plachkinova, Ace Vo

Journal of Cybersecurity Education, Research and Practice

The current study proposes a taxonomy to organize existing knowledge on cybercrimes against critical infrastructure such as power plants, water treatment facilities, dams, and nuclear facilities. Routine Activity Theory is used to inform a three-dimensional taxonomy with the following dimensions: hacker motivation (likely offender), cyber, physical, and cyber-physical components of any cyber-physical system (suitable target), and security (capable guardian). The focus of the study is to develop and evaluate the classification tool using Design Science Research (DSR) methodology. Publicly available data was used to evaluate the utility and usability of the proposed artifact by exploring three possible scenarios – Stuxnet, …

Track Deception Modeling Method Based On Multi-Jammer Cooperation, Wang Rui, Xiangyang Li, Zhili Zhang, Hongguang Ma

Journal of System Simulation

Abstract: The false track generated by the jammer formation is an effective interference measure against networked radars. This paper starts from the basic principle of false track generation and presents the model of the measurement error of the radar for the false track and the control error of the jammer formation. It also presents an analysis of the effects of these errors on the false track. The effectiveness of the false track is further analyzed through the confrontation scenario between the rectangular front formation of a certain type of equipment and networked radars. The simulation results show that the false …

Improved Ant Colony Optimization Algorithm For Jamming Resource Allocation, Qingyun Wang, Dezhong Jiao, Shi Shuo, Genyan Peng, Junhua Sun, Yuxin Duan

Journal of System Simulation

Abstract: Ant Colony Optimization (ACO) is a new intelligence optimization algorithm. When applied to jamming resource allocation, the velocity of convergence in optimization process is slow and the probability of obtaining the global optimal solution is low. In order to raise the efficiency of jamming resource allocation and the probability of getting global optimal solution, the attenuation factor is improved to a variable that changes according to the exponential function in optimization process. The attenuation factor is taken as a relatively small value in the initial search phase, and increases monotonically and exponentially as the number of iterations increases. Simulation …

Can Lethal Autonomous Weapons Be Just?, Noreen L. Herzfeld, Robert H. Latiff

Computer Science Faculty Publications

In 2018 the United States Department of Defense (DoD) created a new Joint Artificial Intelligence Center to study the adoption of AI by the military. Their strategy, outlined in a document entitled, “Harnessing AI to Advance Our Security and Prosperity,” proposes to accelerate the adoption of AI in the military by fostering a culture of experimentation and calculated risk taking, noting that AI will change the character of the future battlefield and, even more, the pace of battle. Is there any way to ensure that this future battlefield will be just? Can the age-old precepts of just warfare help guide …

Deepfakes: Ai Technology Of The Future, Hosanna Root

Cybersecurity Undergraduate Research Showcase

Deepfakes technology’s danger stems from its ability to create realistic but fake synthesized media that people often identify as something that is real. With this powerful technology in the wrong hands, deepfakes can cause devastating havoc through information warfare, election campaign disruptions, and more, creating distrust in society. Disinformation is already rampant today, even without wide deployments of deepfakes, which is concerning given the fact that deepfakes’ nefarious full potentials are yet to be reached.

Speciation And Nucleation Of An(Iv) In Aqueous Media, Saikot Mazumder

Dissertations and Theses

Actinide molecular metal oxides are a family of clusters composed of a variable number of An(IV) centers connected through a network of oxygen and hydroxide ligands with many potential applications in nuclear waste reprocessing and environmental remediation. However, our knowledge regarding the aqueous speciation of actinide ions and their preferred nucleation pathway to form high nuclearity clusters is limited compared to their transition metal counterparts. Here, we present a computational study on the speciation and nucleation of actinide ions up to 4+ in aqueous media in the presence of zwitterionic glycine ligands. Both eight and nine coordinated species were considered. …

Anatomy Of An Internet Hijack And Interception Attack: A Global And Educational Perspective, Ben A. Scott, Michael N. Johnstone, Patryk Szewczyk

Annual ADFSL Conference on Digital Forensics, Security and Law

The Internet’s underlying vulnerable protocol infrastructure is a rich target for cyber crime, cyber espionage and cyber warfare operations. The stability and security of the Internet infrastructure are important to the function of global matters of state, critical infrastructure, global e-commerce and election systems. There are global approaches to tackle Internet security challenges that include governance, law, educational and technical perspectives. This paper reviews a number of approaches to these challenges, the increasingly surgical attacks that target the underlying vulnerable protocol infrastructure of the Internet, and the extant cyber security education curricula; we find the majority of predominant cyber security …

Cyber Whistleblowers: The Black Sheep Of Whistleblowing?, Andrew Wisniewski Jr.

Cybersecurity Undergraduate Research Showcase

From the Introduction:

Contrary to popular belief, this paper argues that cyber whistleblowing can contribute to a greater cyber security posture. However, this requires the development of clearer legal obligations and protections for cyber whistleblowers. This paper will explore the psychology behind whistleblowing, the effectiveness of whistleblowing in a cybersecurity context, how to create a safer and more transparent environment for whistleblowers and companies, and how current laws contribute to cyber whistleblowing.

Toward A Student-Ready Cybersecurity Program: Findings From A Survey Of Stem-Students, Lora Pitman, Brian K. Payne, Tancy Vandecar-Burdin, Lenora Thorbjornsen

Journal of Cybersecurity Education, Research and Practice

As the number of available cybersecurity jobs continues to grow, colleges strive to offer to their cybersecurity students an environment which will make them sufficiently prepared to enter the workforce after graduation. This paper explores the academic and professional needs of STEM-students in various higher education institutions across Virginia and how cybersecurity programs can cater to these needs. It also seeks to propose an evidence-based approach for improving the existing cybersecurity programs so that they can become more inclusive and student-ready. A survey of 251 college students in four higher-education institutions in Virginia showed that while there are common patterns …

Strategies Using Threat Intelligence To Detect Advanced Persistent Threats: A Qualitative Case Study, Melisa A. Joyner

Walden Dissertations and Doctoral Studies

Advanced persistent threats (APTs) targeting critical infrastructures can adversely impact human lives. Cyber security analysts are concerned with APT attacks because they make it challenging to defend critical infrastructures. Grounded in routines activity theory (RAT), the purpose of this qualitative exploratory multiple case study was to explore strategies cybersecurity analysts use to defend critical infrastructures from APT attacks. Data were collected through interviews with 8 participants and documents from two organizations. Participants were required to have experience analyzing network traffic on a critical infrastructure network, one year of cyber threat hunting experience, prior or current knowledge of cyber threat intelligence …

An Exploration On Apts In Biocybersecurity And Cyberbiosecurity, Xavier-Lewis Palmer, Lucas Potter, Saltuk Karahan

School of Cybersecurity Faculty Publications

Novel and complex digital threats that are increasingly interwoven with means and products of biology that can affect society. Much work in Biocybersecurity/Cyberbiosecurity (BCS/CBS) discuss vulnerabilities, but few deeply address malicious actor varieties as attacks at this intersection are new. The path to those attacks remains mostly theoretical, presenting considerable difficulty to accomplish in practical scenarios. In terms of advanced persistent threats (APTs) this of course needs to change as biomanufacturing facilities are at risk, considering Covid-19 and other potential pandemics. Further attacks are not out of reach and thus we must start to imagine how BCS APTs may appear. …

The Amorphous Nature Of Hackers: An Exploratory Study, Kento Yasuhara, Daniel Walnycky, Ibrahim Baggili, Ahmed Alhishwan

Annual ADFSL Conference on Digital Forensics, Security and Law

In this work, we aim to better understand outsider perspectives of the hacker community through a series of situation based survey questions. By doing this, we hope to gain insight into the overall reputation of hackers from participants in a wide range of technical and non-technical backgrounds. This is important to digital forensics since convicted hackers will be tried by people, each with their own perception of who hackers are. Do cyber crimes and national security issues negatively affect people’s perceptions of hackers? Does hacktivism and information warfare positively affect people’s perception of hackers? Do individual personality factors affect one’s …

Effect Of Freestream Noise On Hypersonic Crossflow-Induced Boundary-Layer Transition, Andrew Bustard, Thomas J. Juliano, Harrison B. Yates, Mark Noftz, Joseph Jewell

Publications

Between the windward and leeward rays, boundary-layer transition on cones at angle of attack in hypersonic flow is dominated by the crossflow instability [1, 2], wherein stationary and/or traveling crossflow vortices develop and can breakdown into turbulence [3]. Stationary crossflow modes are caused by surface roughness or any other steady forcing and produce disturbances that are fixed in place on the surface [3–6]. Stationary vortices create a generalized inflection point in the velocity profile that is inviscidly unstable [7]. This distorted mean flow develops secondary instabilities, whose growth and breakdown is one path to turbulence [8–10]. Traveling crossflow modes are …

On Implementing And Testing The Rsa Algorithm, Kien Trung Le

Senior Independent Study Theses

In this work, we give a comprehensive introduction to the RSA cryptosystem, implement it in Java, and compare it empirically to three other RSA implementations. We start by giving an overview of the field of cryptography, from its primitives to the composite constructs used in the field. Then, the paper presents a basic version of the RSA algorithm. With this information in mind, we discuss several problems with this basic conception of RSA, including its speed and some potential attacks that have been attempted. Then, we discuss possible improvements that can make RSA runs faster and more secure. On the …

Exploring Cyberterrorism, Topic Models And Social Networks Of Jihadists Dark Web Forums: A Computational Social Science Approach, Vivian Fiona Guetler

Graduate Theses, Dissertations, and Problem Reports (ETD)

This three-article dissertation focuses on cyber-related topics on terrorist groups, specifically Jihadists’ use of technology, the application of natural language processing, and social networks in analyzing text data derived from terrorists' Dark Web forums. The first article explores cybercrime and cyberterrorism. As technology progresses, it facilitates new forms of behavior, including tech-related crimes known as cybercrime and cyberterrorism. In this article, I provide an analysis of the problems of cybercrime and cyberterrorism within the field of criminology by reviewing existing literature focusing on (a) the issues in defining terrorism, cybercrime, and cyberterrorism, (b) ways that cybercriminals commit a crime in …

Asymmetrical Trusted Technology Networks In Developing Economies: A Case Study On Critical Infrastructure In Bhutan, Pratima Pradhan, Bal Subba, Thinley Jamtsho, Ganga Ram Ghimiray, David M. Cook

Research outputs 2022 to 2026

Developing Nations are subject to amplified challenges in terms of the integration of technology, and the exposure to non-domestic opportunism from larger neighboring economies. These challenges are recognizable as asymmetrical differences between what is seen as the normative list of critical infrastructures, and the specialisms that can dominate an emerging economy with early maturity technology networks. This paper discusses the case of Bhutan and demonstrates the need for strengthened approaches to trusted networks to ensure the reliability and continuity of the Nation's critical infrastructures. The paper also links the importance of trusted information sharing networks as part of an overarching …

Anatomy Of An Internet Hijack And Interception Attack: A Global And Educational Perspective, Ben A. Scott, Michael N. Johnstone, Patryk Szewczyk

Research outputs 2022 to 2026

The Internet’s underlying vulnerable protocol infrastructure is a rich target for cyber crime, cyber espionage and cyber warfare operations. The stability and security of the Internet infrastructure are important to the function of global matters of state, critical infrastructure, global e-commerce and election systems. There are global approaches to tackle Internet security challenges that include governance, law, educational and technical perspectives. This paper reviews a number of approaches to these challenges, the increasingly surgical attacks that target the underlying vulnerable protocol infrastructure of the Internet, and the extant cyber security education curricula; we find the majority of predominant cyber security …

An Analysis Of Significant Cyber Incidents And The Impact On The Past, Present, And Future, Seth E. Smith

Cybersecurity Undergraduate Research Showcase

This report discusses data collected on significant cybersecurity incidents from the early 2000s to present. The first part of the report addresses previously discussed information, data, and literature (e.g. case studies), pertinent to cybersecurity incidents. The findings from this study are framed by scholarly sources and information from the Federal Bureau of Investigation, a number of notable universities, and literature online, of which all support information discussed within this report. The second part of the report discusses data compiled upon analyzing significant cyber incidents and events from the Center for Strategic and International Affairs (CSIS). Finally, the last portion of …