Open Access. Powered by Scholars. Published by Universities.®

Computer Engineering Commons

Open Access. Powered by Scholars. Published by Universities.®

Air Force Institute of Technology

Discipline
Keyword
Publication Year
Publication
Publication Type

Articles 181 - 210 of 413

Full-Text Articles in Computer Engineering

Trust Management And Security In Satellite Telecommand Processing, Mark C. Duncan Mar 2011

Trust Management And Security In Satellite Telecommand Processing, Mark C. Duncan

Theses and Dissertations

New standards and initiatives in satellite system architecture are moving the space industry to more open and efficient mission operations. Primarily, these standards allow multiple missions to share standard ground and space based resources to reduce mission development and sustainment costs. With the benefits of these new concepts comes added risk associated with threats to the security of our critical space assets in a contested space and cyberspace domain. As one method to mitigate threats to space missions, this research develops, implements, and tests the Consolidated Trust Management System (CTMS) for satellite flight software. The CTMS architecture was developed using …


Spear Phishing Attack Detection, David T. Merritt Mar 2011

Spear Phishing Attack Detection, David T. Merritt

Theses and Dissertations

This thesis addresses the problem of identifying email spear phishing attacks, which are indicative of cyber espionage. Spear phishing consists of targeted emails sent to entice a victim to open a malicious file attachment or click on a malicious link that leads to a compromise of their computer. Current detection methods fail to detect emails of this kind consistently. The SPEar phishing Attack Detection system (SPEAD) is developed to analyze all incoming emails on a network for the presence of spear phishing attacks. SPEAD analyzes the following file types: Windows Portable Executable and Common Object File Format (PE/COFF), Adobe Reader, …


Virtual Battlespace Behavior Generation Through Class Imitation, Bryon K. Fryer Jr. Mar 2011

Virtual Battlespace Behavior Generation Through Class Imitation, Bryon K. Fryer Jr.

Theses and Dissertations

Military organizations need realistic training scenarios to ensure mission readiness. Developing the skills required to differentiate combatants from non-combatants is very important for ensuring the international law of armed conflict is upheld. In Simulated Training Environments, one of the open challenges is to correctly simulate the appearance and behavior of combatant and non-combatant agents in a realistic manner. This thesis outlines the construction of a data driven agent that is capable of imitating the behaviors of the Virtual BattleSpace 2 behavior classes while our agent is configured to advance to a geographically specific goal. The approach and the resulting agent …


Routing Uavs To Co-Optimize Mission Effectiveness And Network Performance With Dynamic Programming, Spenser D. Lee Mar 2011

Routing Uavs To Co-Optimize Mission Effectiveness And Network Performance With Dynamic Programming, Spenser D. Lee

Theses and Dissertations

In support of the Air Force Research Laboratory's (AFRL) vision of the layered sensing operations center, command and control intelligence surveillance and reconnaissance (C2ISR) more focus must be placed on architectures that support information systems, rather than just the information systems themselves. By extending the role of UAVs beyond simply intelligence, surveillance, and reconnaissance (ISR) operations and into a dual-role with networking operations we can better utilize our information assets. To achieve the goal of dual-role UAVs, a concrete approach to planning must be taken. This research defines a mathematical model and a non-trivial deterministic algorithmic approach to determining UAV …


Holistic Network Defense: Fusing Host And Network Features For Attack Classification, Jenny W. Ji Mar 2011

Holistic Network Defense: Fusing Host And Network Features For Attack Classification, Jenny W. Ji

Theses and Dissertations

This work presents a hybrid network-host monitoring strategy, which fuses data from both the network and the host to recognize malware infections. This work focuses on three categories: Normal, Scanning, and Infected. The network-host sensor fusion is accomplished by extracting 248 features from network traffic using the Fullstats Network Feature generator and from the host using text mining, looking at the frequency of the 500 most common strings and analyzing them as word vectors. Improvements to detection performance are made by synergistically fusing network features obtained from IP packet flows and host features, obtained from text mining port, processor, logon …


A Multi Agent System For Flow-Based Intrusion Detection Using Reputation And Evolutionary Computation, David Hancock Mar 2011

A Multi Agent System For Flow-Based Intrusion Detection Using Reputation And Evolutionary Computation, David Hancock

Theses and Dissertations

The rising sophistication of cyber threats as well as the improvement of physical computer network properties present increasing challenges to contemporary Intrusion Detection (ID) techniques. To respond to these challenges, a multi agent system (MAS) coupled with flow-based ID techniques may effectively complement traditional ID systems. This paper develops: 1) a scalable software architecture for a new, self-organized, multi agent, flow-based ID system; and 2) a network simulation environment suitable for evaluating implementations of this MAS architecture and for other research purposes. Self-organization is achieved via 1) a reputation system that influences agent mobility in the search for effective vantage …


Polarimetric Enhancements To Electro-Optical Aided Navigation Techniques, Jeremiah D. Johnson Mar 2011

Polarimetric Enhancements To Electro-Optical Aided Navigation Techniques, Jeremiah D. Johnson

Theses and Dissertations

Navigation in indoor and urban environments by small unmanned systems is a topic of interest for the Air Force. The Advanced Navigation Technology Center at the Air Force Institute of Technology is continually looking for novel approaches to navigation in GPS deprived environments. Inertial sensors have been coupled with image aided concepts, such as feature tracking, with good results. However, feature density in areas with large, flat, smooth surfaces tends to be low. Polarimetric sensors have been used for surface reconstruction, surface characterization and outdoor navigation. This thesis combines aspects of some of these algorithms along with a realistic, micro-facet …


An Architecture For Improving Timeliness And Relevance Of Cyber Incident Notifications, James L. Miller Mar 2011

An Architecture For Improving Timeliness And Relevance Of Cyber Incident Notifications, James L. Miller

Theses and Dissertations

This research proposes a communications architecture to deliver timely and relevant cyber incident notifications to dependent mission stakeholders. This architecture, modeled in Unified Modeling Language (UML), eschews the traditional method of pushing notifications via message as dictated in Air Force Instruction 33-138. It instead shifts to a pull or publish and subscribe method of making notifications. Shifting this paradigm improves the notification process by empowering mission owners to identify those resources on which they depend for mission accomplishment, provides a direct conduit between providing and dependent mission owners for notifications when an incident occurs, and provides a shared representation for …


Defensive Cyber Battle Damage Assessment Through Attack Methodology Modeling, Ryan T. Ostler Mar 2011

Defensive Cyber Battle Damage Assessment Through Attack Methodology Modeling, Ryan T. Ostler

Theses and Dissertations

Due to the growing sophisticated capabilities of advanced persistent cyber threats, it is necessary to understand and accurately assess cyber attack damage to digital assets. This thesis proposes a Defensive Cyber Battle Damage Assessment (DCBDA) process which utilizes the comprehensive understanding of all possible cyber attack methodologies captured in a Cyber Attack Methodology Exhaustive List (CAMEL). This research proposes CAMEL to provide detailed knowledge of cyber attack actions, methods, capabilities, forensic evidence and evidence collection methods. This product is modeled as an attack tree called the Cyber Attack Methodology Attack Tree (CAMAT). The proposed DCBDA process uses CAMAT to analyze …


Simultaneous Range/Velocity Detection With An Ultra-Wideband Random Noise Radar Through Fully Digital Cross-Correlation In The Time Domain, James R. Lievsay Mar 2011

Simultaneous Range/Velocity Detection With An Ultra-Wideband Random Noise Radar Through Fully Digital Cross-Correlation In The Time Domain, James R. Lievsay

Theses and Dissertations

This research effort examines the theory, application, and results of applying two-dimensional cross-correlation in the time domain to ultra-wideband (UWB) random noise waveforms for simultaneous range and velocity estimation. When applying common Doppler processing techniques to random noise waveforms for the purpose of velocity estimation, the velocity resolution degrades as the signal bandwidth or the target speed increase. To mitigate the degradation, the Doppler approximation is not utilized, and instead, wideband signal processing theory is applied in the time domain. The results show that by accurately interpolating each sample in the digitized reference signal, a target's velocity and range can …


Creating A Network Model For The Integration Of Dynamic And Static Supervisory Control And Data Acquisition (Scada) Test Environment, Marlon Coerbell Mar 2011

Creating A Network Model For The Integration Of Dynamic And Static Supervisory Control And Data Acquisition (Scada) Test Environment, Marlon Coerbell

Theses and Dissertations

Since 9/11 protecting our critical infrastructure has become a national priority. Presidential Decision Directive 63 mandates and lays a foundation for ensuring all aspects of our nation's critical infrastructure remain secure. Key in this debate is the fact that much of our electrical power grid fails to meet the spirit of this requirement. My research leverages the power afforded by Electric Power and Communication Synchronizing Simulator (EPOCHS) developed with the assistance of Dr. Hopkinson, et al. The power environment is modeled in an electrical simulation environment called PowerWorld©. The network is modeled in OPNET® and populated with self-similar network and …


Covert Channels Within Irc, Wayne C. Henry Mar 2011

Covert Channels Within Irc, Wayne C. Henry

Theses and Dissertations

The exploration of advanced information hiding techniques is important to understand and defend against illicit data extractions over networks. Many techniques have been developed to covertly transmit data over networks, each differing in their capabilities, methods, and levels of complexity. This research introduces a new class of information hiding techniques for use over Internet Relay Chat (IRC), called the Variable Advanced Network IRC Stealth Handler (VANISH) system. Three methods for concealing information are developed under this framework to suit the needs of an attacker. These methods are referred to as the Throughput, Stealth, and Baseline scenarios. Each is designed for …


Automated Analysis Of Arm Binaries Using The Low-Level Virtual Machine Compiler Framework, Jeffrey B. Scott Mar 2011

Automated Analysis Of Arm Binaries Using The Low-Level Virtual Machine Compiler Framework, Jeffrey B. Scott

Theses and Dissertations

Binary program analysis is a critical capability for offensive and defensive operations in Cyberspace. However, many current techniques are ineffective or time-consuming and few tools can analyze code compiled for embedded processors such as those used in network interface cards, control systems and mobile phones. This research designs and implements a binary analysis system, called the Architecture-independent Binary Abstracting Code Analysis System (ABACAS), which reverses the normal program compilation process, lifting binary machine code to the Low-Level Virtual Machine (LLVM) compiler's intermediate representation, thereby enabling existing security-related analyses to be applied to binary programs. The prototype targets ARM binaries but …


An Fpga-Based System For Tracking Digital Information Transmitted Via Peer-To-Peer Protocols, Karl R. Schrader, Barry E. Mullins, Gilbert L. Peterson, Robert F. Mills Dec 2010

An Fpga-Based System For Tracking Digital Information Transmitted Via Peer-To-Peer Protocols, Karl R. Schrader, Barry E. Mullins, Gilbert L. Peterson, Robert F. Mills

Faculty Publications

This paper presents a Field Programmable Gate Array (FPGA)-based tool designed to process file transfers using the BitTorrent Peer-to-Peer (P2P) protocol and VoIP phone calls made using the Session Initiation Protocol (SIP). The tool searches selected control messages in real time and compares the unique identifier of the shared file or phone number against a list of known contraband files or phone numbers. Results show the FPGA tool processes P2P packets of interest 92% faster than a software-only configuration and is 97.6% accurate at capturing and processing messages at a traffic load of 89.6 Mbps.


Network Security Toolkit Including Heuristic Solutions For Trust System Placement And Network Obfuscation, Gabriel H. Greve Dec 2010

Network Security Toolkit Including Heuristic Solutions For Trust System Placement And Network Obfuscation, Gabriel H. Greve

Theses and Dissertations

For Part I, a supervisory control and data acquisition (SCADA) network consists of a group stations and substations in a portion of the power grid. The use of Internet technology in SCADA communications as well as other factors has caused vulnerabilities. One idea to help mitigate this risk is to strategically place trust nodes to compartmentalize and secure the SCADA systems without disturbing its finely honed processes. The trust nodes combine firewall and intrusion detection technology to provide more secure communication. An optimal solution to this problem has already been developed using a mixed-integer linear programming model. Because the problem …


Knowledge-Based Decision Support In Department Of Defense Acquisitions, Clifton L. Hicks Sep 2010

Knowledge-Based Decision Support In Department Of Defense Acquisitions, Clifton L. Hicks

Theses and Dissertations

Despite numerous reform efforts over the past 30 years, acquisition programs in the Department of Defense (DoD) continue to experience cost overruns and schedule delays. One contributing factor is the decision-making process used by defense officials. The General Accounting Office (GAO) has stated that ‘poor program outcomes are the lack of widespread adoption of a knowledge-based acquisition process within DoD despite polices that support such a process. A knowledge-based business case at the outset of each program would alleviate overpromising on cost, schedule, and performance and would empower program managers.’ Effective decision-making for acquisition programs is very important. It not …


Improving The Quality Of Service And Security Of Military Networks With A Network Tasking Order Process, Matthew D. Compton Sep 2010

Improving The Quality Of Service And Security Of Military Networks With A Network Tasking Order Process, Matthew D. Compton

Theses and Dissertations

This research presents a Network Tasking Order process that collects mission plans, network capabilities, and historical records to build a Network Tasking Order (NTO). The NTO document directs the form and usage of the network, much like an Air Tasking Order (ATO) directs the usage of air power. The NTO process is fleshed out with the content and format of the NTO given herein for the first time. Tools such as topology control algorithms are then shown through simulation to improve the quality of service of the network by finding favorable ways to connect the assets identified during the NTO …


Applying Image Matching To Video Analysis, Adam J. Behring Sep 2010

Applying Image Matching To Video Analysis, Adam J. Behring

Theses and Dissertations

Dealing with the volume of multimedia collected on a daily basis for intelligence gathering and digital forensics investigations requires significant manual analysis. A component of this problem is that a video may be reanalyzed that has already been analyzed. Identifying duplicate video sequences is difficult due to differences in videos of varying quality and size. This research uses a kd-tree structure to increase image matching speed. Keypoints are generated and added to a kd-tree of a large dimensionality (128 dimensions). All of the keypoints for the set of images are used to construct a global kd-tree, which allows nearest neighbor …


Reputation-Based Internet Protocol Security: A Multilayer Security Framework For Mobil Ad Hoc Networks, Timothy H. Lacey Sep 2010

Reputation-Based Internet Protocol Security: A Multilayer Security Framework For Mobil Ad Hoc Networks, Timothy H. Lacey

Theses and Dissertations

This research effort examines the theory, application, and results for a Reputation-based Internet Protocol Security (RIPSec) framework that provides security for an ad-hoc network operating in a hostile environment. In RIPSec, protection from external threats is provided in the form of encrypted communication links and encryption-wrapped nodes while internal threats are mitigated by behavior grading that assigns reputations to nodes based on their demonstrated participation in the routing process. Network availability is provided by behavior grading and round-robin multipath routing. If a node behaves faithfully, it earns a positive reputation over time. If a node misbehaves (for any number of …


Hijacking User Uploads To Online Persistent Data Repositories For Covert Data Exfiltration, Curtis P. Barnard Sep 2010

Hijacking User Uploads To Online Persistent Data Repositories For Covert Data Exfiltration, Curtis P. Barnard

Theses and Dissertations

As malware has evolved over the years, it has gone from harmless programs that copy themselves into other executables to modern day botnets that perform bank fraud and identity theft. Modern malware often has a need to communicate back to the author, or other machines that are also infected. Several techniques for transmitting this data covertly have been developed over the years which vary significantly in their level of sophistication. This research creates a new covert channel technique for stealing information from a network by piggybacking on user-generated network traffic. Specifically, steganography drop boxes and passive covert channels are merged …


Performance Evaluation Of A Field Programmable Gate Array-Based System For Detecting And Tracking Peer-To-Peer Protocols On A Gigabit Ethernet Network, Brennon D. Thomas Jun 2010

Performance Evaluation Of A Field Programmable Gate Array-Based System For Detecting And Tracking Peer-To-Peer Protocols On A Gigabit Ethernet Network, Brennon D. Thomas

Theses and Dissertations

Recent years have seen a massive increase in illegal, suspicious, and malicious traffic traversing government and military computer networks. Some examples include illegal file distribution and disclosure of sensitive information using the BitTorrent file sharing protocol, criminals and terrorists using Voice over Internet Protocol (VoIP) technologies to communicate, and foreign entities exfiltrating sensitive data from government, military, and Department of Defense contractor networks. As a result of these growing threats, the TRacking and Analysis for Peer-to-Peer (TRAPP) system was developed in 2008 to detect BitTorrent and VoIP traffic of interest. The TRAPP system, designed on a Xilinx Virtex-II Pro Field …


Mission Assurance: A Review Of Continuity Of Operations Guidance For Application To Cyber Incident Mission Impact Assessment (Cimia), Brian L. Hale Jun 2010

Mission Assurance: A Review Of Continuity Of Operations Guidance For Application To Cyber Incident Mission Impact Assessment (Cimia), Brian L. Hale

Theses and Dissertations

Military organizations have embedded information technology (IT) into their core mission processes as a means to increase operational efficiency, improve decision-making quality, and shorten the sensor-to-shooter cycle. This IT-to-mission dependence can place the organizational mission at risk when an information incident (e.g., the loss or manipulation of a critical information resource) occurs. Non-military organizations typically address this type of IT risk through an introspective, enterprise-wide focused risk management program that continuously identifies, prioritizes, and documents risks so an economical set of control measures (e.g., people, processes, technology) can be selected to mitigate the risks to an acceptable level. The explicit …


Developing A Hybrid Virtualization Platform Design For Cyber Warfare And Simulation, Kyle E. Stewart Jun 2010

Developing A Hybrid Virtualization Platform Design For Cyber Warfare And Simulation, Kyle E. Stewart

Theses and Dissertations

Virtualization is a technique used to model and simulate the cyber domain, as well as train and educate. Different types of virtualization techniques exist that each support a unique set of benefits and requirements. This research proposes a novel design that incorporates host and network virtualization concepts for a cyber warfare training platform. At the host level, hybrid virtualization combines full and operating system virtualization techniques in order to leverage the benefits and minimize the drawbacks of each individual technique. Network virtualization allows virtual machines to connect in flexible topologies, but it also incurs additional processing overhead. Quantitative analysis falls …


Attaining Realistic Simulations Of Mobile Ad-Hoc Networks, Derek J. Huber Jun 2010

Attaining Realistic Simulations Of Mobile Ad-Hoc Networks, Derek J. Huber

Theses and Dissertations

Mobile Ad-hoc Networks (MANET) are comprised of wireless systems that communicate without the assistance of centrally managed routers or base stations. MANET research and development has increased due to computing technologies offering smaller, faster, smarter, and more power efficient platforms to operate on. Largely the testing and evaluation of new and existing MANET protocols has resided in simulation environments. This is due in part to the complexities and expenses incurred when conducting real world tests. Many researchers have come to recognize that these current simulations tend to assume away critical components of the MANET domain. These assumptions are made either …


Deterministic, Efficient Variation Of Circuit Components To Improve Resistance To Reverse Engineering, Daniel F. Koranek Jun 2010

Deterministic, Efficient Variation Of Circuit Components To Improve Resistance To Reverse Engineering, Daniel F. Koranek

Theses and Dissertations

This research proposes two alternative methods for generating semantically equivalent circuit variants which leave the circuit's internal structure pseudo-randomly determined. Component fusion deterministically selects subcircuits using a component identification algorithm and replaces them using a deterministic algorithm that generates canonical logic forms. Component encryption seeks to alter the semantics of individual circuit components using an encoding function, but preserves the overall circuit semantics by decoding signal values later in the circuit. Experiments were conducted to examine the performance of component fusion and component encryption against representative trials of subcircuit selection-and-replacement and Boundary Blurring, two previously defined methods for circuit obfuscation. …


Use Of Negation In Search, Kristen M. Lancaster Jun 2010

Use Of Negation In Search, Kristen M. Lancaster

Theses and Dissertations

Boolean algebra was developed in the 1840s. Since that time, negation, one of the three basic concepts in Boolean algebra, has influenced the fields of information science and information retrieval, particularly in the modern computer era. In Web search engines, one of the present manifestations of information retrieval, little use is being made of this functionality and so little attention is given to it in the literature. This study aims to bolster the understanding of the use and usefulness of negation. Specifically, an Internet search task was developed for which negation was the most appropriate search strategy. This search task …


A Dynamically Configurable Log-Based Distributed Security Event Detection Methodology Using Simple Event Correlator, Justin M. Myers Jun 2010

A Dynamically Configurable Log-Based Distributed Security Event Detection Methodology Using Simple Event Correlator, Justin M. Myers

Theses and Dissertations

Log event correlation is an effective means of detecting system faults and security breaches encountered in information technology environments. Centralized, database-driven log event correlation is common, but suffers from flaws such as high network bandwidth utilization, significant requirements for system resources, and difficulty in detecting certain suspicious behaviors. This research presents a distributed event correlation system which performs security event detection, and compares it with a centralized alternative. The comparison measures the value in distributed event correlation by considering network bandwidth utilization, detection capability and database query efficiency, as well as through the implementation of remote configuration scripts and correlation …


A Distributed Network Logging Topology, Nicholas E. Fritts Mar 2010

A Distributed Network Logging Topology, Nicholas E. Fritts

Theses and Dissertations

Network logging is used to monitor computer systems for potential problems and threats by network administrators. Research has found that the more logging enabled, the more potential threats can be detected in the logs (Levoy, 2006). However, generally it is considered too costly to dedicate the manpower required to analyze the amount of logging data that it is possible to generate. Current research is working on different correlation and parsing techniques to help filter the data, but these methods function by having all of the data dumped in to a central repository. Central repositories are limited in the amount of …


Handshaking Protocols And Jamming Mechanisms For Blind Rendezvous In A Dynamic Spectrum Access Environment, Aaron A. Gross Mar 2010

Handshaking Protocols And Jamming Mechanisms For Blind Rendezvous In A Dynamic Spectrum Access Environment, Aaron A. Gross

Theses and Dissertations

Blind frequency rendezvous is an important process for bootstrapping communications between radios without the use of pre-existing infrastructure or common control channel in a Dynamic Spectrum Access (DSA) environment. In this process, radios attempt to arrive in the same frequency channel and recognize each other’s presence in changing, under-utilized spectrum. This paper refines existing blind rendezvous techniques by introducing a handshaking algorithm for setting up communications once two radios have arrived in the same frequency channel. It then investigates the effect of different jamming techniques on blind rendezvous algorithms that utilize this handshake. The handshake performance is measured by determining …


Utilizing The Digital Fingerprint Method For Secure Key Generation, Jennifer C. Anilao Mar 2010

Utilizing The Digital Fingerprint Method For Secure Key Generation, Jennifer C. Anilao

Theses and Dissertations

This research examines a new way to generate an uncloneable secure key by taking advantage of the delay characteristics of individual transistors. The user profiles the circuit to deduce the glitch count of each output line for each number of selectable buffers added to the circuit. The user can then use this information to generate a specific glitch count on each output line, which is passed to an encryption algorithm as its key. The results detail tests of two configurations for adding a selectable amount of buffers into each glitch circuit in order to induce additional delay. One configuration adds …