Computer Engineering Commons^™

Rf Emitter Tracking And Intent Assessment, Benjamin J. Kuhar

Theses and Dissertations

Current research in employing pattern recognition techniques in a wireless sensor network (WSN) to detect anomalous or suspicious behavior is limited. The purpose of this research was to determine the feasibility of an accurate tracking and intent assessment system of unknown or foreign radio frequency (RF) emitters in close proximity to and within military installations as a method for physical security. 22 position tracks were collected using a hand-held Global Positioning System (GPS) unit and a training data set from five different features was generated for each position track. Each collected position track was individually classified as suspicious or non-suspicious …

Development Of A Response Planner Using The Uct Algorithm For Cyber Defense, Michael P. Knight

Theses and Dissertations

A need for a quick response to cyber attacks is a prevalent problem for computer network operators today. There is a small window to respond to a cyber attack when it occurs to prevent significant damage to a computer network. Automated response planners offer one solution to resolve this issue. This work presents Network Defense Planner System (NDPS), a planner dependent on the effectiveness of the detection of the cyber attack. This research first explores making classification of network attacks faster for real-time detection, the basic function Intrusion Detection System (IDS) provides. After identifying the type of attack, learning the …

Mobile Network Defense Interface For Cyber Defense And Situational Awareness, James C. Hannan

Theses and Dissertations

Today's computer networks are under constant attack. In order to deal with this constant threat, network administrators rely on intrusion detection and prevention services (IDS) (IPS). Most IDS and IPS implement static rule sets to automatically alert administrators and resolve intrusions. Network administrators face a difficult challenge, identifying attacks against a vast number of benign network transactions. Also after a threat is identified making even the smallest policy change to the security software potentially has far-reaching and unanticipated consequences. Finally, because the administrator is primarily responding to alerts they may lose situational awareness of the network. During this research a …

Emulation Of Industrial Control Field Device Protocols, Robert M. Jaromin

Theses and Dissertations

It has been shown that thousands of industrial control devices are exposed to the Internet, however, the extent and nature of attacks on such devices remains unknown. The first step to understanding security problems that face modern supervisory control and data acquisition (SCADA) and industrial controls networks is to understand the various attacks launched on Internet-connected field devices. This thesis describes the design and implementation of an industrial control emulator on a Gumstix single-board computer as a solution. This emulator acts as a decoy field device, or honeypot, intended to be probed and attacked via an Internet connection. Evaluation techniques …

Examining Application Components To Reveal Android Malware, John B. Guptill

Theses and Dissertations

Smartphones are becoming ubiquitous in everyday life and malware is exploiting these devices. Therefore, a means to identify the threats of malicious applications is necessary. This paper presents a method to classify and analyze Android malware through application component analysis. The experiment parses select portions from Android packages to collect features using byte sequences and permissions of the application. Multiple machine learning algorithms classify the samples of malware based on these features. The experiment utilizes instance based learner, naive Bayes, decision trees, sequential minimal optimization, boosted naive Bayes, and boosted decision trees to identify the best components that reveal malware …

Rootkit Detection Using A Cross-View Clean Boot Method, Bridget N. Flatley

Theses and Dissertations

In cyberspace, attackers commonly infect computer systems with malware to gain capabilities such as remote access, keylogging, and stealth. Many malware samples include rootkit functionality to hide attacker activities on the target system. After detection, users can remove the rootkit and associated malware from the system with commercial tools. This research describes, implements, and evaluates a clean boot method using two partitions to detect rootkits on a system. One partition is potentially infected with a rootkit while the other is clean. The method obtains directory listings of the potentially infected operating system from each partition and compares the lists to …

Airborne Network Data Availability Using Peer To Peer Database Replication On A Distributed Hash Table, Trevor J. Vranicar

Theses and Dissertations

The concept of distributing one complex task to several smaller, simpler Unmanned Aerial Vehicles (UAVs) as opposed to one complex UAV is the way of the future for a vast number of surveillance and data collection tasks. One objective for this type of application is to be able to maintain an operational picture of the overall environment. Due to high bandwidth costs, centralizing all data may not be possible, necessitating a distributed storage system such as mobile Distributed Hash Table (DHT). A difficulty with this maintenance is that for an Airborne Network (AN), nodes are vehicles and travel at high …

File Carving And Malware Identification Algorithms Applied To Firmware Reverse Engineering, Karl A . Sickendick

Theses and Dissertations

Modern society depends on critical infrastructure (CI) managed by Programmable Logic Controllers (PLCs). PLCs depend on firmware, though firmware security vulnerabilities and contents remain largely unexplored. Attackers are acquiring the knowledge required to construct and install malicious firmware on CI. To the defender, firmware reverse engineering is a critical, but tedious, process. This thesis applies machine learning algorithms, from the le carving and malware identification fields, to firmware reverse engineering. It characterizes the algorithms' performance. This research describes and characterizes a process to speed and simplify PLC firmware analysis. The system partitions binary firmwares into segments, labels each segment with …

Network Intrusion Dataset Assessment, David J. Weller-Fahy

Theses and Dissertations

Research into classification using Anomaly Detection (AD) within the field of Network Intrusion Detection (NID), or Network Intrusion Anomaly Detection (NIAD), is common, but operational use of the classifiers discovered by research is not. One reason for the lack of operational use is most published testing of AD methods uses artificial datasets: making it difficult to determine how well published results apply to other datasets and the networks they represent. This research develops a method to predict the accuracy of an AD-based classifier when applied to a new dataset, based on the difference between an already classified dataset and the …

Learning Enterprise Malware Triage From Automatic Dynamic Analysis, Jonathan S. Bristow

Theses and Dissertations

Adversaries employ malware against victims of cyber espionage with the intent of gaining unauthorized access to information. To that end, malware authors intentionally attempt to evade defensive countermeasures based on static methods. This thesis analyzes a dynamic analysis methodology for malware triage that applies at the enterprise scale. This study captures behavior reports from 64,987 samples of malware randomly selected from a large collection and 25,591 clean executable files from operating system install media. Function call information in sequences of behavior generate feature vectors from behavior reports from the les. The results of 64 experiment combinations indicate that using more …

Computer Based Behavioral Biometric Authentication Via Multi-Modal Fusion, Kyle O. Bailey

Theses and Dissertations

Biometric computer authentication has an advantage over password and access card authentication in that it is based on something you are, which is not easily copied or stolen. One way of performing biometric computer authentication is to use behavioral tendencies associated with how a user interacts with the computer. However, behavioral biometric authentication accuracy rates are much larger then more traditional authentication methods. This thesis presents a behavioral biometric system that fuses user data from keyboard, mouse, and Graphical User Interface (GUI) interactions. Combining the modalities results in a more accurate authentication decision based on a broader view of the …

Machine Conscious Architecture For State Exploitation And Decision Making, Mark M. Derriso

Theses and Dissertations

This research addressed a critical limitation in the area of computational intelligence by developing a general purpose architecture for information processing and decision making. Traditional computational intelligence methods are best suited for well-defined problems with extensive, long-term knowledge of the environmental and operational conditions the system will encounter during operation. These traditional approaches typically generate quick answers (i.e., reflexive responses) using pattern recognition methods. Most pattern recognition techniques are static processes which consist of a predefined series of computations. For these pattern recognition approaches to be effective, training data is required from all anticipated environments and operating conditions. The proposed …

Using Rf-Dna Fingerprints To Discriminate Zigbee Devices In An Operational Environment, Clay K. Dubendorfer

Theses and Dissertations

This research was performed to expand AFIT's Radio Frequency Distinct Native Attribute (RF-DNA) fingerprinting process to support IEEE 802.15.4 ZigBee communication network applications. Current ZigBee bit-level security measures include use of network keys and MAC lists which can be subverted through interception and spoofing using open-source hacking tools. This work addresses device discrimination using Physical (PHY) waveform alternatives to augment existing bit-level security mechanisms. ZigBee network vulnerability to outsider threats was assessed using Receiver Operating Characteristic (ROC) curves to characterize both Authorized Device ID Verification performance (granting network access to authorized users presenting true bit-level credentials) and Rogue Device Rejection …

Characterization Of Metal-Insulator-Transition (Mit) Phase Change Materials (Pcm) For Reconfigurable Components, Circuits, And Systems, Brent L. Danner

Theses and Dissertations

Many microelectromechanical systems (MEMS) use metal contact micro-switches as part of their reconfigurable device design. These devices utilize a mechanical component that can wear down and fail over time. Metal insulator transition (MIT) materials, also known as phase change materials (PCMs), exhibit a reversible transition that can be used to replace the mechanical component in reconfigurable devices. In the presence of a thermal or electric field stimuli, the PCMs will transition back and forth between a crystalline and amorphous state. During this transformation, the resistivity, reflectivity, and Young's modulus of the material drastically change. This research effort focuses on characterizing …

Cognitive Augmentation For Network Defense, James E. Emge

Theses and Dissertations

Traditionally, when a task is considered for automation it is a binary decision, either the task was completely automated or it remains manual. LOA is a departure from the tradition use of automation in cyber defense. When a task is automated, it removes the human administrator from the performance of the task, compromising their SA of the state of the network. When the administrator loses SA of the network performance and its current state, failure recovery time becomes much longer. This is because the administrators must orient themselves to the current state of the network at the time of failure …

Cloud Computing Trace Characterization And Synthetic Workload Generation, Salvatore Capra

Theses and Dissertations

This thesis researches cloud computing workload characteristics and synthetic workload generation. A heuristic presented in the work guides the process of workload trace characterization and synthetic workload generation. Analysis of a cloud trace provides insight into client request behaviors and statistical parameters. A versatile workload generation tool creates client connections, controls request rates, defines number of jobs, produces tasks within each job, and manages task durations. The test system consists of multiple clients creating workloads and a server receiving request, all contained within a virtual machine environment. Statistical analysis verifies the synthetic workload experimental results are consistent with real workload …

Estimating And Measuring Application Latency Of Typical Distributed Interactive Simulation (Dis) - Based Simulation Architecture, Ryan L. Drinkwater

Theses and Dissertations

One of the challenges in a distributed virtual environment stems from the requirement to simultaneously execute the simulations in realtime to support human interaction, in conjunction with maintaining a consistent view of the shared simulated environment. Maintaining a consistent set of simulation state data in the presence of network latency is difficult if individual data items are updated frequently. The principle application of DIS-based simulation environments has been in the domain of training where a consistent view or its correctness is often judged in subjective terms such as the simulation looking and feeling correct. New application areas for these systems …

An Architecture For Coexistence With Multiple Users In Frequency Hopping Cognitive Radio Networks, Ryan K. Mclean

Theses and Dissertations

The radio frequency (RF) spectrum is a limited resource. Spectrum allotment disputes stem from this scarcity as many radio devices are con confined to a fixed frequency or frequency sequence. One alternative is to incorporate cognition within a configurable radio platform, therefore enabling the radio to adapt to dynamic RF spectrum environments. In this way, the radio is able to actively observe the RF spectrum, orient itself to the current RF environment, decide on a mode of operation, and act accordingly, thereby sharing the spectrum and operating in more flexible manner. This research presents a novel framework for incorporating several …

Phylogeny And Ancestral Genome Reconstruction From Gene Order Using Maximum Likelihood And Binary Encoding, Fei Hu

Theses and Dissertations

Over the long history of genome evolution, genes get rearranged under events such as rearrangements, losses, insertions and duplications, which in all change the ordering and content along the genome. Recent progress in genome-scale sequencing renews the challenges in the reconstructions of phylogeny and ancestral genomes with gene-order data. Such problems have been proved so interesting that a large number of algorithms have been developed rigorously over the past few years in attempts to tackle these problems following various principles. However, difficulties and limitations in performance and scalability largely prevent us from analyzing emerging modern whole-genome data, our study presented …

Computational Analysis And Prediction Of Genome-Wide Protein Targeting Signals And Localization, Jhih-Rong Lin

Theses and Dissertations

Computational prediction of protein subcellular localization can greatly help to elucidate its functions. Despite the existence of dozens of protein localization prediction algorithms, the prediction accuracy and coverage are still low. Several ensemble algorithms have been proposed to improve the prediction performance, which usually include as many as 10 or more individual localization algorithms. However, their performance is still limited by the running complexity and redundancy among individual prediction algorithms. In the first part of the dissertation, we propose a novel method for rational design of minimalist ensemble algorithms for practical genome-wide protein subcellular localization prediction. The algorithm is based …

Improving Robustness And Scalability Of Available Ner Systems, Amber Mckenzie

Theses and Dissertations

The focus of this research is to study and develop techniques to adapt existing NER resources to serve the needs of a broad range of organizations without expert NLP manpower. My methods emphasize usability, robustness and scalability of existing NER systems to ensure maximum functionality to a broad range of organizations. Usability is facilitated by ensuring that the methodologies are compatible with any available open-source NER tagger or data set, thus allowing organizations to choose resources that are easy to deploy and maintain and fit their requirements. One way of making use of available tagged data would be to aggregate …

Accuracy, Cost And Performance Trade-Offs For Streaming Set-Wise Floating Point Accumulation On Fpgas, Krishna Kumar Nagar

Theses and Dissertations

The set-wise summation operation is perhaps one of the most fundamental and widely used operations in scientific applications. In these applications, maintaining the accuracy of the summation is also important as floating point operations have inherent errors associated with them. Designing floating-point accumulators presents a unique set of challenges: double-precision addition is usually deeply pipelined and without special micro-architectural or data scheduling techniques, the data hazard that exists. There have been several efforts to design floating point accumulators and accurate summation architecture using different algorithms on FPGAs but these problems have been dealt with separately. In this dissertation, we present …

An Application For Keeping Track Of Food Item Expiration, Rejin Paul James

Theses and Dissertations

Food, honestly, is too precious to waste. Food wastage is a very serious issue prevalent in the world today. American households alone throw out an equivalent of $165 billion worth of food each year. People often forget to consume food they purchased before the expiration date, or sometimes they over-purchase food they can have, then throw them away. Hence, this thesis aims to prevent food wastage with the help of a smart phone application that helps keep track of food item expiration dates and gives you notification alerts when it is about to expire. It implements a barcode scanner for …

Passive Synthetic Aperture Radar Imaging Using Commercial Ofdm Communication Networks, Jose R. Gutierrez Del Arroyo

Theses and Dissertations

Modern communication systems provide myriad opportunities for passive radar applications. OFDM is a popular waveform used widely in wireless communication networks today. Understanding the structure of these networks becomes critical in future passive radar systems design and concept development. This research develops collection and signal processing models to produce passive SAR ground images using OFDM communication networks. The OFDM-based WiMAX network is selected as a relevant example and is evaluated as a viable source for radar ground imaging. The monostatic and bistatic phase history models for OFDM are derived and validated with experimental single dimensional data. An airborne passive collection …

Effects Of Architecture On Information Leakage Of A Hardware Advanced Encryption Standard Implementation, Eric A. Koziel

Theses and Dissertations

Side-channel analysis (SCA) is a threat to many modern cryptosystems. Many countermeasures exist, but are costly to implement and still do not provide complete protection against SCA. A plausible alternative is to design the cryptosystem using architectures that are known to leak little information about the cryptosystem's operations. This research uses several common primitive architectures for the Advanced Encryption Standard (AES) and assesses the susceptibility of the full AES system to side-channel attack for various primitive configurations. A combined encryption/decryption core is also evaluated to determine if variation of high-level architectures affects leakage characteristics. These different configurations are evaluated under …

Intelligent Behavioral Action Aiding For Improved Autonomous Image Navigation, Kwee Guan Eng

Theses and Dissertations

In egomotion image navigation, errors are common especially when traversing areas with few landmarks. Since image navigation is often used as a passive navigation technique in Global Positioning System (GPS) denied environments; egomotion accuracy is important for precise navigation in these challenging environments. One of the causes of egomotion errors is inaccurate landmark distance measurements, e.g., sensor noise. This research determines a landmark location egomotion error model that quantifies the effects of landmark locations on egomotion value uncertainty and errors. The error model accounts for increases in landmark uncertainty due to landmark distance and image centrality. A robot then uses …

A Study Of Executable Model Based Systems Engineering From Dodaf Using Simulink, Weston J. Hanoka, Michael H. Ryan

Theses and Dissertations

Diagrams and visuals often cannot adequately capture a complex system’s architecture for analysis. The Department of Defense Architectural Framework (DoDAF), written to follow the Unified Modeling Language (UML), is a collection of mandated common architectural products for interoperability among the DoD components. In this study, DoDAF products from as-is Remotely Piloted Aircraft (RPA) Satellite Communication (SATCOM) systems have been utilized for the creation of executable architectures as part of an Executable Model Based Systems Engineering (EMBSE) process. EMBSE was achieved using Simulink, a software tool for modeling, simulating and analyzing dynamic systems.

This study has demonstrated that DoDAF products can …

Semantic Search And Information Retrieval Techniques For Text Repositories, Lisham L. Singh

Theses and Dissertations

Most organizations keep details of events as electronic documents. Repositories of such documents collected over the time are often used for various purposes, including critical decision making. These documents are generally used to garner information related to a specific event, or for trending or predictive analysis. This could be done manually by going through one document at a time, provided the size of repository is small and there is no time limit for the task. However, in most practical scenarios, the repository size is huge and available time is limited. Such documents typically have multiple fields, each carrying certain information, …

A Real-Time Strategy Agent Framework And Strategy Classifier For Computer Generated Forces, Lyall J. Di Trapani

Theses and Dissertations

This research effort is concerned with the advancement of computer generated forces AI for Department of Defense (DoD) military training and education. The vision of this work is agents capable of perceiving and intelligently responding to opponent strategies in real-time. Our research goal is to lay the foundations for such an agent. Six research objectives are defined: 1) Formulate a strategy definition schema effective in defining a range of RTS strategies. 2) Create eight strategy definitions via the schema. 3) Design a real-time agent framework that plays the game according to the given strategy definition. 4) Generate an RTS data …

Detecting Hardware-Assisted Hypervisor Rootkits Within Nested Virtualized Environments, Daniel B. Morabito

Theses and Dissertations

Virtual machine introspection (VMI) is intended to provide a secure and trusted platform from which forensic information can be gathered about the true behavior of malware within a guest. However, it is possible for malware to escape a guest into the host and for hypervisor rootkits, such as BluePill, to stealthily transition a native OS into a virtualized environment. This research examines the effectiveness of selected detection mechanisms against hardware-assisted virtualization rootkits (HAV-R) within a nested virtualized environment. It presents the design, implementation, analysis, and evaluation of a hypervisor rootkit detection system which exploits both processor and translation lookaside buffer-based …