Digital Commons Network^™

Utilizing Graphics Processing Units For Network Anomaly Detection, Jonathan D. Hersack

Theses and Dissertations

This research explores the benefits of using commonly-available graphics processing units (GPUs) to perform classification of network traffic using supervised machine learning algorithms. Two full factorial experiments are conducted using a NVIDIA GeForce GTX 280 graphics card. The goal of the first experiment is to create a baseline for the relative performance of the CPU and GPU implementations of artificial neural network (ANN) and support vector machine (SVM) detection methods under varying loads. The goal of the second experiment is to determine the optimal ensemble configuration for classifying processed packet payloads using the GPU anomaly detector. The GPU ANN achieves …

Effects Of Architecture On Information Leakage Of A Hardware Advanced Encryption Standard Implementation, Eric A. Koziel

Theses and Dissertations

Side-channel analysis (SCA) is a threat to many modern cryptosystems. Many countermeasures exist, but are costly to implement and still do not provide complete protection against SCA. A plausible alternative is to design the cryptosystem using architectures that are known to leak little information about the cryptosystem's operations. This research uses several common primitive architectures for the Advanced Encryption Standard (AES) and assesses the susceptibility of the full AES system to side-channel attack for various primitive configurations. A combined encryption/decryption core is also evaluated to determine if variation of high-level architectures affects leakage characteristics. These different configurations are evaluated under …

Creating Network Attack Priority Lists By Analyzing Email Traffic Using Predefined Profiles, Eric J. Merrit

Theses and Dissertations

Networks can be vast and complicated entities consisting of both servers and workstations that contain information sought by attackers. Searching for specific data in a large network can be a time consuming process. Vast amounts of data either passes through or is stored by various servers on the network. However, intermediate work products are often kept solely on workstations. Potential high value targets can be passively identified by comparing user email traffic against predefined profiles. This method provides a potentially smaller footprint on target systems, less human interaction, and increased efficiency of attackers. Collecting user email traffic and comparing each …

Ground Vehicle Navigation Using Magnetic Field Variation, Jeremiah A. Shockley

Theses and Dissertations

The Earth's magnetic field has been the bedrock of navigation for centuries. The latest research highlights the uniqueness of magnetic field measurements based on position due to large scale variations as well as localized perturbations. These observable changes in the Earth's magnetic field as a function of position provide distinct information which can be used for navigation. This dissertation describes ground vehicle navigation exploiting variation in Earth's magnetic field using a self-contained navigation system consisting of only a magnetometer and magnetic field maps. In order to achieve navigation, effective calibration enables repeatable magnetic field measurements from different vehicles and facilitates …

Novel Discretization Schemes For The Numerical Simulation Of Membrane Dynamics, Kyle F. Kolsti

Theses and Dissertations

Motivated by the demands of simulating flapping wings of Micro Air Vehicles, novel numerical methods were developed and evaluated for the dynamic simulation of membranes. For linear membranes, a mixed-form time-continuous Galerkin method was employed using trilinear space-time elements, and the entire space-time domain was discretized and solved simultaneously. For geometrically nonlinear membranes, the model incorporated two new schemes that were independently developed and evaluated. Time marching was performed using quintic Hermite polynomials uniquely determined by end-point jerk constraints. The single-step, implicit scheme was significantly more accurate than the most common Newmark schemes. For a simple harmonic oscillator, the scheme …

The Multiobjective Average Network Flow Problem: Formulations, Algorithms, Heuristics, And Complexity, Jeremy D. Jordan

Theses and Dissertations

Integrating value focused thinking with the shortest path problem results in a unique formulation called the multiobjective average shortest path problem. We prove this is NP-complete for general graphs. For directed acyclic graphs, an efficient algorithm and even faster heuristic are proposed. While the worst case error of the heuristic is proven unbounded, its average performance on random graphs is within 3% of the optimal solution. Additionally, a special case of the more general biobjective average shortest path problem is given, allowing tradeoffs between decreases in arc set cardinality and increases in multiobjective value; the algorithm to solve the average …

Effective Measurement Of Reliability Of Repairable Usaf Systems, Louis J. Hogge

Theses and Dissertations

The USAF generally does not know the reliability of its fielded repairable systems. The reported metric, Mean Time Between Failure (MTBF), is too lagging to be actionable in the best case, and is not representative of actual system reliability in the worst case. This thesis investigates the statistical techniques for measurement and analysis of the reliability of fielded repairable systems, which are very different than nonrepairables. To frame the investigation, a comparison is made between the generally accepted definitions and metrics and those used across the US Air Force (USAF). Reliability can be analyzed in four context areas: reliability prediction …

A Study Of Executable Model Based Systems Engineering From Dodaf Using Simulink, Weston J. Hanoka, Michael H. Ryan

Theses and Dissertations

Diagrams and visuals often cannot adequately capture a complex system’s architecture for analysis. The Department of Defense Architectural Framework (DoDAF), written to follow the Unified Modeling Language (UML), is a collection of mandated common architectural products for interoperability among the DoD components. In this study, DoDAF products from as-is Remotely Piloted Aircraft (RPA) Satellite Communication (SATCOM) systems have been utilized for the creation of executable architectures as part of an Executable Model Based Systems Engineering (EMBSE) process. EMBSE was achieved using Simulink, a software tool for modeling, simulating and analyzing dynamic systems.

This study has demonstrated that DoDAF products can …

Characteristics, Causes, And Evaluation Of Helicopter Particulate Obstruction, Michael P. Sullivan

Theses and Dissertations

A comprehensive approach to evaluation of rotorcraft brownout under degraded visual environmental conditions is presented. The results of a literature search covering the current state of brownout research are summarized. The brownout dust cloud generated by modern rotorcraft is analyzed and characterized using photographic and video data, coupled with examination of previous computer modeling techniques. A modeling analysis is performed in order to relate aircraft design and operating parameters to brownout dust cloud size is performed. The effect of vorticity in brownout dust cloud rollup is included. An augmented rating scale for pilot assessment is proposed for operational use, and …

Cfd Transient Simulation Of An Isolator Shock Train In A Scramjet Engine, Troy C. Hoeger

Theses and Dissertations

For hypersonic flight, the scramjet engine uses an isolator to contain the pre-combustion shock train formed by the pressure difference between the inlet and the combustion chamber. If this shock train were to reach the inlet, it would cause an engine unstart, disrupting the flow through the engine and leading to a loss of thrust and potential loss of the vehicle. Prior to this work, a Computational Fluid Dynamics (CFD) simulation of the isolator was needed for simulating and characterizing the isolator flow and for finding the relationship between back pressure and changes in the location of the leading edge …

Mapping Nuclear Fallout Using The Weather Research & Forecasting (Wrf) Model, Joseph C. Schofield

Theses and Dissertations

There are many models that attempt to predict transport & dispersion (T&D) of particulate matter in the sensible atmosphere. The majority of these existing models are unable to incorporate atmospheric processes such wet deposition through scavenging and cloud condensation nuclei (CCN) formation. To this end, the numerical weather prediction (NWP) model known as the Weather Research & Forecasting with Chemistry (WRF/Chem) Model is studied to determine its suitability as a potential tool for predicting particulate T&D following an atmospheric nuclear detonation. This is done by modifying relevant modules, originally designed to predict the settling of volcanic ash, such that a …

Ballistic Flash Characterization Of Entry-Side Flash, David J. Peyton

Theses and Dissertations

Aircraft survivability is a broad subject that encompasses many fields and subjects. An important part of aircraft survivability is fire prevention. Flashes created by ballistic impacts are a very real threat to aircraft because they can start fires or cause explosions. In an effort to better protect against these flashes, this study seeks to further the understanding and characterization of them. Recent research on this subject has been greatly helped by the use of high-speed video footage of flash events. This footage has led to new algorithms and methodologies for how to characterize a flash. A preliminary predictive model of …

Effects Of Front-Loading And Stagger Angle On Endwall Losses Of High Lift Low Pressure Turbine Vanes, M. Eric Lyall

Theses and Dissertations

Past efforts to reduce the airfoil count in low pressure turbines have produced high lift profiles with unacceptably high endwall loss. The purpose of the current work is to suggest alternative approaches for reducing endwall losses. The effects of the fluid mechanics and high lift profile geometry are considered. Mixing effects of the mean flow and turbulence fields are decoupled to show that mean flow shear in the endwall wake is negligible compared to turbulent shear, indicating that turbulence dissipation is the primary cause of total pressure loss. The mean endwall flow field does influence total pressure loss by causing …

The In-Transit Vigilant Covering Tour Problem Of Routing Unmanned Ground Vehicles, Huang Teng Tan

Theses and Dissertations

The routing of unmanned ground vehicles for the surveillance and protection of key installations is modeled as a new variant of the Covering Tour Problem (CTP). The CTP structure provides both the routing and target sensing components of the installation protection problem. Our variant is called the in-transit Vigilant Covering Tour Problem (VCTP) and considers not only the vertex cover but also the additional edge coverage capability of the unmanned ground vehicle while sensing in-transit between vertices. The VCTP is formulated as a Traveling Salesman Problem (TSP) with a dual set covering structure involving vertices and edges. An empirical study …

Eliciting A Sensemaking Process From Verbal Protocols Of Reverse Engineers, Adam R. Bryant, Robert F. Mills, Gilbert L. Peterson, Michael R. Grimaila

Faculty Publications

A process of sensemaking in reverse engineering was elicited from verbal protocols of reverse engineers as they investigated the assembly code of executable programs. Four participants were observed during task performance and verbal protocols were collected and analyzed from two of the participants to determine their problem-solving states and characterize likely transitions between those states. From this analysis, a high-level process of sensemaking is described which represents hypothesis generation and information-seeking behaviors in reverse engineering within a framework of goal-directed planning. Future work in validation and application of the process is discussed.

Design And Analysis Of A Dynamically Configured Log-Based Distributed Security Event Detection Methodology, Michael R. Grimaila, Justin M. Myers, Robert F. Mills, Gilbert L. Peterson

Faculty Publications

Military and defense organizations rely upon the security of data stored in, and communicated through, their cyber infrastructure to fulfill their mission objectives. It is essential to identify threats to the cyber infrastructure in a timely manner, so that mission risks can be recognized and mitigated. Centralized event logging and correlation is a proven method for identifying threats to cyber resources. However, centralized event logging is inflexible and does not scale well, because it consumes excessive network bandwidth and imposes significant storage and processing requirements on the central event log server. In this paper, we present a flexible, distributed event …

Half-Life Learning Curves In The Defense Acquisition Life Cycle, Adedeji B. Badiru

Faculty Publications

Learning curves are useful for assessing performance improvement due to the positive impact of learning. In recent years, the deleterious effects of forgetting have also been recognized. Workers experience forgetting or decline in performance over time. Consequently, contemporary learning curves have attempted to incorporate forgetting components into learning curves. An area of increasing interest is the study of how fast and how far the forgetting impact can influence overall performance. This article introduces the concept of half-life analysis of learning curves using the concept of growth and decay, with particular emphasis on applications in the defense acquisition process. The computational …

Using Modeling And Simulation To Examine The Benefits Of A Network Tasking Order, Matthew D. Compton, Kenneth M. Hopkinson, Gilbert L. Peterson, James T. Moore

Faculty Publications

The Global Information Grid (GIG) is the military’s computer and communications network which supports the myriad of military missions. Military missions are highly planned, passing through many hands in the strategy-to-task methodology to ensure completeness, accuracy, coordination, cohesion, and appropriateness. A benefit of this planning is the possibility to collect knowledge of future conditions that could be of use to network designers whose goals include optimizing and protecting the GIG. This advanced knowledge includes which networked military equipment will be involved, what their capabilities are, where they will be, when they will be there, and particulars on the required data …

Decentralized Riemannian Particle Filtering With Applications To Multi-Agent Localization, Martin J. Eilders

Theses and Dissertations

The primary focus of this research is to develop consistent nonlinear decentralized particle filtering approaches to the problem of multiple agent localization. A key aspect in our development is the use of Riemannian geometry to exploit the inherently non-Euclidean characteristics that are typical when considering multiple agent localization scenarios. A decentralized formulation is considered due to the practical advantages it provides over centralized fusion architectures. Inspiration is taken from the relatively new field of information geometry and the more established research field of computer vision. Differential geometric tools such as manifolds, geodesics, tangent spaces, exponential, and logarithmic mappings are used …

The White-Hat Bot: A Novel Botnet Defense Strategy, Tyrone C. Gubler

Theses and Dissertations

Botnets are a threat to computer systems and users around the world. Botmasters can range from annoying spam email propagators to nefarious criminals. These criminals attempt to take down networks or web servers through distributed denial-of-service attacks, to steal corporate secrets, or to launder money from individuals or corporations. As the number and severity of successful botnet attacks rise, computer security experts need to develop better early-detection and removal techniques to protect computer networks and individual computer users from these very real threats. I will define botnets and describe some of their common purposes and current uses. Next, I will …

Forensic Memory Analysis For Apple Os X, Andrew F. Hay

Theses and Dissertations

Analysis of raw memory dumps has become a critical capability in digital forensics because it gives insight into the state of a system that cannot be fully represented through traditional disk analysis. Interest in memory forensics has grown steadily in recent years, with a focus on the Microsoft Windows operating systems. However, similar capabilities for Linux and Apple OS X have lagged by comparison. The volafox open source project has begun work on structured memory analysis for OS X. The tool currently supports a limited set of kernel structures to parse hardware information, system build number, process listing, loaded kernel …

Enhancing Trust In The Smart Grid By Applying A Modified Exponentially Weighted Averages Algorithm, Andrew T. Kasperek

Theses and Dissertations

The main contribution of this thesis is the development and application of a modified Exponentially Weighted Moving Algorithm (EWMA) algorithm, and its ability to robustly function in the face varying numbers of bad (malicious or malfunctioning) Special Protection System (SPS) nodes. Simulation results support the use of the proposed modified EWMA reputation based trust module in SPSs within a smart grid environment. This modification results in the ability to easily maintain the system above the minimum acceptable frequency of 58.8 Hz at the 95% confidence interval, when challenged with test cases containing 5, 10 and 15 bad node test cases …

Vulnerability Analysis Of The Player Command And Control Protocol, John T. Hagen

Theses and Dissertations

The Player project is an open-source effort providing a control interface specification and software framework for abstracting robot hardware. This research presents five exploits that compromise vulnerabilities in Player's command and control protocol. The attacks exploit weaknesses in the ARP, IP, TCP and Player protocols to compromise the confidentially, integrity, and availability of communication between a Player client and server. The attacks assume a laptop is connected in promiscuous mode to the same Ethernet hub as the client and server in order to sniff all network traffic between them. This work also demonstrates that Internet Protocol Security (IPsec) is capable …

Cyberspace And Real-World Behavioral Relationships: Towards The Application Of Internet Search Queries To Identify Individuals At-Risk For Suicide, Casey C. Miller

Theses and Dissertations

The Internet has become an integral and pervasive aspect of society. Not surprisingly, the growth of ecommerce has led to focused research on identifying relationships between user behavior in cyberspace and the real world - retailers are tracking items customers are viewing and purchasing in order to recommend additional products and to better direct advertising. As the relationship between online search patterns and real-world behavior becomes more understood, the practice is likely to expand to other applications. Indeed, Google Flu Trends has implemented an algorithm that accurately charts the relationship between the number of people searching for flu-related topics on …

Detecting Hardware-Assisted Hypervisor Rootkits Within Nested Virtualized Environments, Daniel B. Morabito

Theses and Dissertations

Virtual machine introspection (VMI) is intended to provide a secure and trusted platform from which forensic information can be gathered about the true behavior of malware within a guest. However, it is possible for malware to escape a guest into the host and for hypervisor rootkits, such as BluePill, to stealthily transition a native OS into a virtualized environment. This research examines the effectiveness of selected detection mechanisms against hardware-assisted virtualization rootkits (HAV-R) within a nested virtualized environment. It presents the design, implementation, analysis, and evaluation of a hypervisor rootkit detection system which exploits both processor and translation lookaside buffer-based …

Process Flow Features As A Host-Based Event Knowledge Representation, Benhur E. Pacer

Theses and Dissertations

The detection of malware is of great importance but even non-malicious software can be used for malicious purposes. Monitoring processes and their associated information can characterize normal behavior and help identify malicious processes or malicious use of normal process by measuring deviations from the learned baseline. This exploratory research describes a novel host feature generation process that calculates statistics of an executing process during a window of time called a process flow. Process flows are calculated from key process data structures extracted from computer memory using virtual machine introspection. Each flow cluster generated using k-means of the flow features represents …

Cross Hallway Detection And Indoor Localization Using Flash Laser Detection And Ranging, Istvan M. Prileszky

Theses and Dissertations

A flash LADAR is investigated as a source of navigation information to support cross-hallway detection and relative localization. To accomplish this, a dynamic, flexible simulation was developed that simulated the LADAR and the noise of a LADAR system. Using simulated LADAR data, algorithms were developed that were shown to be effective at detecting cross hallways in simulated ideal environments and in simulated environments with noise. Relative position was determined in the same situations. A SwissRanger SR4000 flash LADAR was then used to collect real data and to verify algorithm performance in real environments. Hallway detection was shown to be possible …

Resource Provisioning In Large-Scale Self-Organizing Distributed Systems, M. Brent Reynolds

Theses and Dissertations

This dissertation researches the mathematical translation of resource provisioning policy into mathematical terms and parameters to solve the on-line service placement problem. A norm called the Provisioning Norm is introduced. Theorems presented in the work show the Provisioning Norm utility function and greedy, random, local search effectively and efficiently solve the on-line problem. Caching of placements is shown to reduce the cost of change but does not improve response time performance. The use of feedback control theory is shown to be effective at significantly improving performance but increases the cost of change. The theoretical results are verified using a decentralized, …

Multi-Observation Continuous Density Hidden Markov Models For Anomaly Detection In Full Motion Video, Matthew P. Ross

Theses and Dissertations

An increase in sensors on the battlefield produces an abundance of collected data that overwhelms the processing capability of the DoD. Automated Visual Surveillance (AVS) seeks to use machines to better exploit increased sensor data, such as by highlighting anomalies. In this thesis, we apply AVS to overhead Full Motion Video (FMV). We seek to automate the classification of soldiers in a simulated combat scenario into their agent types. To this end, we use Multi-Dimensional Continuous Density Hidden Markov Models (MOCDHMMs), a form of HMM which models a training dataset more precisely than simple HMMs. MOCDHMMs are theoretically developed but …

Implementation Of Branch-Point-Tolerant Wavefront Reconstructor For Strong Turbulence Compensation, Michael J. Steinbock

Theses and Dissertations

Branch points arise in optical transmissions due to strong atmospheric turbulence, long propagation paths, or a combination of both. Unfortunately, these conditions are very often present in desired operational scenarios for laser weapon systems, optical communication, and covert imaging, which suffer greatly when traditional adaptive optics systems either cannot sense branch points or implement non-optimal methods for sensing and correcting branch points. Previous research by Pellizzari presented a thorough analysis of various novel branch point tolerant reconstructors in the absence of noise. In this research a realistic model of the Air Force Institute of Technology's adaptive optics system is developed …