Open Access. Powered by Scholars. Published by Universities.®

Physical Sciences and Mathematics Commons™

Open Access. Powered by Scholars. Published by Universities.®

Air Force Institute of Technology

Discipline
Keyword
Publication Year
Publication
Publication Type
File Type

Articles 1501 - 1530 of 3057

Full-Text Articles in Physical Sciences and Mathematics

Measuring The Utility Of A Cyber Incident Mission Impact Assessment (Cimia) Process For Mission Assurance, Christy L. Peterson Mar 2011

Measuring The Utility Of A Cyber Incident Mission Impact Assessment (Cimia) Process For Mission Assurance, Christy L. Peterson

Theses and Dissertations

Information is a critical asset on which virtually all modern organizations depend upon to meet their operational mission objectives. Military organizations, in particular, have embedded Information and Communications Technologies (ICT) into their core mission processes as a means to increase their operational efficiency, exploit automation, improve decision quality, and shorten the kill chain. However, the extreme dependence upon ICT results in an environment where a cyber incident can result in severe mission degradation, or possibly failure, with catastrophic consequences to life, limb, and property. These consequences can be minimized by maintaining real-time situational awareness of mission critical resources so appropriate …


Determining Solution Space Characteristics For Real-Time Strategy Games And Characterizing Winning Strategies, Gary B. Lamont, Kurt Weissgerber, Brett J. Borghetti, Gilbert L. Peterson Mar 2011

Determining Solution Space Characteristics For Real-Time Strategy Games And Characterizing Winning Strategies, Gary B. Lamont, Kurt Weissgerber, Brett J. Borghetti, Gilbert L. Peterson

Faculty Publications

The underlying goal of a competing agent in a discrete real-time strategy (RTS) game is to defeat an adversary. Strategic agents or participants must define an a priori plan to maneuver their resources in order to destroy the adversary and the adversary's resources as well as secure physical regions of the environment. This a priori plan can be generated by leveraging collected historical knowledge about the environment. This knowledge is then employed in the generation of a classification model for real-time decision-making in the RTS domain. The best way to generate a classification model for a complex problem domain depends …


Remote Quantification Of Smokestack Total Effluent Mass Flow Rates Using Imaging Fourier-Transform Spectroscopy, Jacob L. Harley Mar 2011

Remote Quantification Of Smokestack Total Effluent Mass Flow Rates Using Imaging Fourier-Transform Spectroscopy, Jacob L. Harley

Theses and Dissertations

A Telops Hyper-Cam midwave infrared (1.5 − 5.5μm) imaging Fourier-transform spectrometer (IFTS) was used to estimate industrial smokestack total effluent mass flow rates by combining spectrally-determined species concentrations with flow rates estimated via analysis of sequential images in the raw interferogram cube. Strong emissions from H2O, CO2, CO, SO2, and NO were observed in the spectrum. A previously established plume radiative transfer model was used to estimate gas concentrations, and a simple temporal cross-correlation analysis of sequential imagery enabled an estimation of the flow velocity. Final effluent mass flow rates for CO2 and …


Passive Ranging Of Dynamic Rocket Plumes Using Infrared And Visible Oxygen Attenuation, Robert Anthony Vincent Mar 2011

Passive Ranging Of Dynamic Rocket Plumes Using Infrared And Visible Oxygen Attenuation, Robert Anthony Vincent

Theses and Dissertations

Atmospheric oxygen absorption bands in observed spectra of boost phase missiles can be used to accurately estimate range from sensor to target. This work compares two oxygen absorption bands in the near-infrared (NIR) and visible (Vis) spectrum, centered at 762nm and 690 nm, to passively determine range. Spectra were observed from static tests of both surface-to-air missile simulators at 405m range and a full-scale solid rocket motor at 900m range. The NIR O2 band provided range estimates accurate to within 3% for both tests, while the Vis O2 band had range errors of 77% and 15 %, respectively. …


Shock Wave Dynamics Of Novel Aluminized Detonations And Empirical Model For Temperature Evolution From Post-Detonation Combustion Fireballs, Joe Motos Gordon Mar 2011

Shock Wave Dynamics Of Novel Aluminized Detonations And Empirical Model For Temperature Evolution From Post-Detonation Combustion Fireballs, Joe Motos Gordon

Theses and Dissertations

This research characterizes the blast wave and temperature evolution of an explosion fireball in order to improve the classification of aluminized conventional munitions based on a single explosive type such as RDX. A drag model fit to data shows initial shock velocities of 1.6-2.8 km/s and maximum fireball radii ranging from 4.3-5.8 m with most of the radii reached by 50 ms upon detonation. The Sedov-Taylor point blast model is fitted to data where a constant release (s=1) of energy upon detonation suggests shock energies of 0.5-8.9 MJ with blast dimensionalities indicative of the spherical geometry (n3) observed in visible …


Understanding The Influence Of Turbulence In Imaging Fourier-Transform Spectrometry Of Smokestack Plumes, Jennifer L. Massman Mar 2011

Understanding The Influence Of Turbulence In Imaging Fourier-Transform Spectrometry Of Smokestack Plumes, Jennifer L. Massman

Theses and Dissertations

An imaging Fourier-transform spectrometer (IFTS) was used to collect infrared hyper-spectral imagery of smokestack plume of a coal-burning power facility to assess the influence of turbulence on spectral retrieval of temperature (T) and pollutant concentrations (Ci). Radiance fluctuations due to plume turbulence introduced scene change artifacts (SCA) in the spectra. Time-averaging the spectra minimizes SCA magnitudes, but accurate T and Ci retrieval would require a priori knowledge of the statistical distribution of temperature and other stochastic flow field parameters. A method of quantile sorting in interferogram space that would allow the retrieval of the temperature distribution is …


Energy Scaling Of Nanosecond Gain-Switched Cr2+:Znse Lasers, Vladimir V. Fedorov, Igor S. Moskalev, M. S. Mirov, S. B. Mirov, Torrey J. Wagner, Matthew J. Bohn, Patrick A. Berry, K. L. Schepler Feb 2011

Energy Scaling Of Nanosecond Gain-Switched Cr2+:Znse Lasers, Vladimir V. Fedorov, Igor S. Moskalev, M. S. Mirov, S. B. Mirov, Torrey J. Wagner, Matthew J. Bohn, Patrick A. Berry, K. L. Schepler

Faculty Publications

In this paper, we report record nanosecond output energies of gain-switched CrZnSe lasers pumped by Q-switched CrTmHoYAG 100 ns at 2.096 microns and Raman shifted NdYAG lasers 7 ns at 1.906 microns. In these experiments we used Brewster cut CrZnSe gain elements with a chromium concentration of 8x1018cm-3. Under CrTmHoYAG pumping, the first CrZnSe laser demonstrated 3.1 mJ of output energy, 52 slope efficiency and 110 nm linewidth centered at a wavelength of 2.47 microns. Maximum output energy of the second CrZnSe laser reached 10.1 mJ under H2 Raman shifted NdYAG laser pumping. The slope …


Detecting Software Attacks By Monitoring Electric Power Consumption Patterns, Grant A. Jacoby, Nathaniel J. Davis Iv, Randolph C. Marchany Jan 2011

Detecting Software Attacks By Monitoring Electric Power Consumption Patterns, Grant A. Jacoby, Nathaniel J. Davis Iv, Randolph C. Marchany

AFIT Patents

Software attacks such as worms and viruses are detected in an electronic device by monitoring power consumption patterns. In a first embodiment, software attacks are detected by an increase in power consumption. The increased power consumption can be caused by increased network traffic, or by increased activity in the microprocessor. Monitoring power consumption is particularly effective for detecting DOS/flooding attacks when the electronic device is in an idle state. In a second embodiment, a power consumption signal is converted to the frequency domain (e.g., by fast Fourier transform). The highest amplitude frequencies are identified. Specific software attacks produce characteristic frequencies …


Kinetic Solution Of The Structure Of A Shock Wave In A Nonreactive Gas Mixture, Eswar Josyula, Prakash Vedula, William F. Bailey, Casmir J. Suchyta Iii Jan 2011

Kinetic Solution Of The Structure Of A Shock Wave In A Nonreactive Gas Mixture, Eswar Josyula, Prakash Vedula, William F. Bailey, Casmir J. Suchyta Iii

Faculty Publications

The multispecies Boltzmann equation is numerically integrated to characterize the internal structure of a Mach 3 shock wave in a hard sphere gas. The collision integral is evaluated by the conservative discrete ordinate method [F. G. Tcheremissine, Comput. Math. Math. Phys. 46, 315 (2006)]. There was excellent agreement of macroscopic variables [Kosuge et al., Eur. J. Mech. B/Fluids 20, 87 (2001)]. The effect of species concentration and mass ratio on the behavior of macroscopic variables and distribution functions in the structure of the shock wave is considered for both two- and three-species gas mixtures. In a binary mixture of gases …


Real-Time Behavior-Based Robot Control, Brian G. Woolley, Gilbert L. Peterson, Jared T. Kresge Jan 2011

Real-Time Behavior-Based Robot Control, Brian G. Woolley, Gilbert L. Peterson, Jared T. Kresge

Faculty Publications

Behavior-based systems form the basis of autonomous control for many robots, but there is a need to ensure these systems respond in a timely manner. Unexpected latency can adversely affect the quality of an autonomous system’s operations, which in turn can affect lives and property in the real-world. A robots ability to detect and handle external events is paramount to providing safe and dependable operation. This paper presents a concurrent version of a behavior-based system called the Real-Time Unified Behavior Framework, which establishes a responsive basis of behavior-based control that does not bind the system developer to any single behavior …


An Fpga-Based System For Tracking Digital Information Transmitted Via Peer-To-Peer Protocols, Karl R. Schrader, Barry E. Mullins, Gilbert L. Peterson, Robert F. Mills Dec 2010

An Fpga-Based System For Tracking Digital Information Transmitted Via Peer-To-Peer Protocols, Karl R. Schrader, Barry E. Mullins, Gilbert L. Peterson, Robert F. Mills

Faculty Publications

This paper presents a Field Programmable Gate Array (FPGA)-based tool designed to process file transfers using the BitTorrent Peer-to-Peer (P2P) protocol and VoIP phone calls made using the Session Initiation Protocol (SIP). The tool searches selected control messages in real time and compares the unique identifier of the shared file or phone number against a list of known contraband files or phone numbers. Results show the FPGA tool processes P2P packets of interest 92% faster than a software-only configuration and is 97.6% accurate at capturing and processing messages at a traffic load of 89.6 Mbps.


Tunable Optical Delay In Doppler-Broadened Cesium Vapor, Monte D. Anderson Dec 2010

Tunable Optical Delay In Doppler-Broadened Cesium Vapor, Monte D. Anderson

Theses and Dissertations

Variable-delay tunable optical delay line or optical buffers are critical for the development of all-optical networks components as well as interferometry and analytic instruments. Recent research on slow light may hold the key for the development of the first practical tunable optical delay device. In this research the linear dispersion delay effects in an alkali vapor. The hyperfine relaxation observations present insight into the complex bleach wave dynamics during a high-intensity pulsed pump in DPAL systems.


Scattering Matrix Elements For The Nonadiabatic Collision B (2PJₐ) + H2 (1Σ+G, Ν, Ј) ↔ B (2PJ’ₐ) + H2 (1Σ+G, Ν’, J’), Luke A. Barger Dec 2010

Scattering Matrix Elements For The Nonadiabatic Collision B (2PJₐ) + H2 (1Σ+G, Ν, Ј) ↔ B (2PJ’ₐ) + H2 (1Σ+G, Ν’, J’), Luke A. Barger

Theses and Dissertations

Scattering matrix elements are calculated for the nonadiabatic inelastic collision B (2Pjₐ) + H2 (1Σ+g, ν, ј) ↔ B (2Pj’ₐ) + H2 (1Σ+g, ν’, j’). This calculation utilizes the effective potential energy surfaces for this collision generated by Garvin along with a correction to the asymptotic H2 potential. Wavepackets are propagated on these surfaces using a split-operator propagator. This propagation yields correlation functions between reactant and product Møller states which are used to calculate the scattering …


Electronic Image Stabilization Using Optical Flow With Inertial Fusion, Michael J. Smith, Alexander J. Boxerbaum, Gilbert L. Peterson, Roger D. Quinn Oct 2010

Electronic Image Stabilization Using Optical Flow With Inertial Fusion, Michael J. Smith, Alexander J. Boxerbaum, Gilbert L. Peterson, Roger D. Quinn

Faculty Publications

When a camera is affixed on a dynamic mobile robot, image stabilization is the first step towards more complex analysis on the video feed. This paper presents a novel electronic image stabilization (EIS) algorithm for highly dynamic mobile robotic platforms. The algorithm combines optical flow motion parameter estimation with angular rate data provided by a strapdown inertial measurement unit (IMU). A discrete Kalman filter in feedforward configuration is used for optimal fusion of the two data sources. Performance evaluations are conducted using a simulated video truth model (capturing the effects of image translation, rotation, blurring, and moving objects), and live …


Measurement And Modeling Of Infrared Nonlinear Absorption Coefficients And Laser-Induced Damage Thresholds In Ge And Gasb, Torrey J. Wagner, Matthew J. Bohn, Ronald A. Coutu Jr., L. P. Gonzales, J. M. Murray, K. L. Schepler, S. Guha Oct 2010

Measurement And Modeling Of Infrared Nonlinear Absorption Coefficients And Laser-Induced Damage Thresholds In Ge And Gasb, Torrey J. Wagner, Matthew J. Bohn, Ronald A. Coutu Jr., L. P. Gonzales, J. M. Murray, K. L. Schepler, S. Guha

Faculty Publications

Using a simultaneous fitting technique to extract nonlinear absorption coefficients from data at two pulse widths, we measure two-photon and free-carrier absorption coefficients for Ge and GaSb at 2.05 and 2.5 µm for the first time, to our knowledge. Results agreed well with published theory. Single-shot damage thresholds were also measured at 2.5 µm and agreed well with modeled thresholds using experimentally determined parameters including nonlinear absorption coefficients and temperature dependent linear absorption. The damage threshold for a single-layer Al2O3 anti-reflective coating on Ge was 55% or 35% lower than the uncoated threshold for picosecond or nanosecond …


Determining The Index Of Refraction Of An Unknown Object Using Passive Polarimetric Imagery Degraded By Atmospheric Turbulence, Milo W. Hyde Iv Sep 2010

Determining The Index Of Refraction Of An Unknown Object Using Passive Polarimetric Imagery Degraded By Atmospheric Turbulence, Milo W. Hyde Iv

Theses and Dissertations

In this research, an algorithm is developed to estimate the index of refraction of an unknown object using passive polarimetric images degraded by atmospheric turbulence. The algorithm uses a variant of the maximum-likelihood blind-deconvolution algorithm developed by LeMaster and Cain to recover the true object (i.e., the first Stokes parameter), the degree of linear polarization, and the polarimetric-image point spread functions. Nonlinear least squares is then used to find the value of the complex index of refraction which best fits the theoretical degree of linear polarization, derived using a polarimetric bidirectional reflectance distribution function, to the turbulence-corrected degree of linear …


Statistical Image Recovery From Laser Speckle Patterns With Polarization Diversity, Donald B. Dixon Sep 2010

Statistical Image Recovery From Laser Speckle Patterns With Polarization Diversity, Donald B. Dixon

Theses and Dissertations

This research extends the theory and understanding of the laser speckle imaging technique. This non-traditional imaging technique may be employed to improve space situational awareness and image deep space objects from a ground-based sensor system. The use of this technique is motivated by the ability to overcome aperture size limitations and the distortion effects from Earth’s atmosphere. Laser speckle imaging is a lensless, coherent method for forming two-dimensional images from their autocorrelation functions. Phase retrieval from autocorrelation data is an ill-posed problem where multiple solutions exist. This research introduces polarization diversity as a method for obtaining additional information so the …


Cyber Situational Awareness Using Live Hypervisor-Based Virtual Machine Introspection, Dustyn A. Dodge Sep 2010

Cyber Situational Awareness Using Live Hypervisor-Based Virtual Machine Introspection, Dustyn A. Dodge

Theses and Dissertations

In this research, a compiled memory analysis tool for virtualization (CMAT-V) is developed as a virtual machine introspection (VMI) utility to conduct live analysis during cyber attacks. CMAT-V leverages static memory dump analysis techniques to provide live dynamic system state data. Unlike some VMI applications, CMAT-V bridges the semantic gap using derivation techniques. CMAT-V detects Windows-based operating systems and uses the Microsoft Symbol Server to provide this context to the user. This research demonstrates the usefulness of CMAT-V as a situational awareness tool during cyber attacks, tests the detection of CMAT-V from the guest system level and measures its impact …


Accelerating Malware Detection Via A Graphics Processing Unit, Nicholas S. Kovach Sep 2010

Accelerating Malware Detection Via A Graphics Processing Unit, Nicholas S. Kovach

Theses and Dissertations

Real-time malware analysis requires processing large amounts of data storage to look for suspicious files. This is a time consuming process that (requires a large amount of processing power) often affecting other applications running on a personal computer. This research investigates the viability of using Graphic Processing Units (GPUs), present in many personal computers, to distribute the workload normally processed by the standard Central Processing Unit (CPU). Three experiments are conducted using an industry standard GPU, the NVIDIA GeForce 9500 GT card. The goal of the first experiment is to find the optimal number of threads per block for calculating …


Hijacking User Uploads To Online Persistent Data Repositories For Covert Data Exfiltration, Curtis P. Barnard Sep 2010

Hijacking User Uploads To Online Persistent Data Repositories For Covert Data Exfiltration, Curtis P. Barnard

Theses and Dissertations

As malware has evolved over the years, it has gone from harmless programs that copy themselves into other executables to modern day botnets that perform bank fraud and identity theft. Modern malware often has a need to communicate back to the author, or other machines that are also infected. Several techniques for transmitting this data covertly have been developed over the years which vary significantly in their level of sophistication. This research creates a new covert channel technique for stealing information from a network by piggybacking on user-generated network traffic. Specifically, steganography drop boxes and passive covert channels are merged …


A Comparative Analysis Of Ascii And Xml Logging Systems, Eric C. Hanington Sep 2010

A Comparative Analysis Of Ascii And Xml Logging Systems, Eric C. Hanington

Theses and Dissertations

This research compares XML and ASCII based event logging systems in terms of their storage and processing efficiency. XML has been an emerging technology, even for security. Therefore, it is researched as a logging system with the mitigation of its verbosity. Each system consists of source content, the network transmission, database storage, and querying which are all studied as individual parts. The ASCII logging system consists of the text file as source, FTP as transport, and a relational database system for storage and querying. The XML system has the XML files and XML files in binary form using Efficient XML …


Neural Extensions To Robust Parameter Design, Bernard Jacob Loeffelholz Sep 2010

Neural Extensions To Robust Parameter Design, Bernard Jacob Loeffelholz

Theses and Dissertations

Robust parameter design (RPD) is implemented in systems in which a user wants to minimize the variance of a system response caused by uncontrollable factors while obtaining a consistent and reliable system response over time. We propose the use of artificial neural networks to compensate for highly non-linear problems that quadratic regression fails to accurately model. RPD is conducted under the assumption that the relationship between system response and controllable and uncontrollable variables does not change over time. We propose a methodology to find a new set of settings that will be robust to moderate system degradation while remaining robust …


Consistency Properties For Growth Model Parameters Under An Infill Asymptotics Domain, David T. Mills Sep 2010

Consistency Properties For Growth Model Parameters Under An Infill Asymptotics Domain, David T. Mills

Theses and Dissertations

Growth curves are used to model various processes, and are often seen in biological and agricultural studies. Underlying assumptions of many studies are that the process may be sampled forever, and that samples are statistically independent. We instead consider the case where sampling occurs in a finite domain, so that increased sampling forces samples closer together, and also assume a distance-based covariance function. We first prove that, under certain conditions, the mean parameter of a fixed-mean model cannot be estimated within a finite domain. We then numerically consider more complex growth curves, examining sample sizes, sample spacing, and quality of …


Laser Demonstration And Performance Characterization Of An Optically Pumped Alkali Laser System, Clifford V. Sulham Sep 2010

Laser Demonstration And Performance Characterization Of An Optically Pumped Alkali Laser System, Clifford V. Sulham

Theses and Dissertations

Diode Pumped Alkali Lasers (DPALs) offer a promising approach for high power lasers in military applications that will not suffer from the long logistical trails of chemical lasers or the thermal management issues of diode pumped solid state lasers. This research focuses on characterizing a DPAL-type system to gain a better understanding of using this type of laser as a directed energy weapon. A rubidium laser operating at 795 nm is optically pumped by a pulsed titanium sapphire laser to investigate the dynamics of DPALs at pump intensities between 1.3 and 45 kW/cm2. Linear scaling as high as …


Reputation-Based Internet Protocol Security: A Multilayer Security Framework For Mobil Ad Hoc Networks, Timothy H. Lacey Sep 2010

Reputation-Based Internet Protocol Security: A Multilayer Security Framework For Mobil Ad Hoc Networks, Timothy H. Lacey

Theses and Dissertations

This research effort examines the theory, application, and results for a Reputation-based Internet Protocol Security (RIPSec) framework that provides security for an ad-hoc network operating in a hostile environment. In RIPSec, protection from external threats is provided in the form of encrypted communication links and encryption-wrapped nodes while internal threats are mitigated by behavior grading that assigns reputations to nodes based on their demonstrated participation in the routing process. Network availability is provided by behavior grading and round-robin multipath routing. If a node behaves faithfully, it earns a positive reputation over time. If a node misbehaves (for any number of …


Code White: A Signed Code Protection Mechanism For Smartphones, Joseph M. Hinson Iv Sep 2010

Code White: A Signed Code Protection Mechanism For Smartphones, Joseph M. Hinson Iv

Theses and Dissertations

This research develops Code White, a hardware-implemented trusted execution mechanism for the Symbian mobile operating system. Code White combines a signed whitelist approach with the execution prevention technology offered by the ARM architecture. Testing shows that it prevents all untrusted user applications from executing while allowing all trusted applications to load and run. Performance testing in contrast with an unmodified Symbian system shows that the difference in load time increases linearly as the application file size increases. The predicted load time for an application with a one megabyte code section remains well below one second, ensuring uninterrupted experience for the …


Collisional Dynamics Of The Cesium D1 And D2 Transitions, Greg A. Pitz Sep 2010

Collisional Dynamics Of The Cesium D1 And D2 Transitions, Greg A. Pitz

Theses and Dissertations

The collisional dynamics of the 62P levels in cesium have been studied utilizing steady state laser absorption and laser induced florescence techniques. In addition the production of a blue beam produced by two photon absorption has been observed in potassium. The collisional broadening rate for cesium, λL, for He, Ne, Ar, Kr, Xe, N2, H2, HD, D2, CH4, C2H6, CF4, and 3He are 24.13, 10.85, 18.31, 17.82, 19.74, 16.64, 20.81, 20.06, 18.04, 29.00, 26.70, 18.84, and 26.00 MHz/torr, respectively for the …


All Solid-State Mid-Ir Laser Development, Nonlinear Absorption Investigation And Laser-Induced Damage Study, Torrey J. Wagner Sep 2010

All Solid-State Mid-Ir Laser Development, Nonlinear Absorption Investigation And Laser-Induced Damage Study, Torrey J. Wagner

Theses and Dissertations

In this research, nonlinear optical absorption coefficients and laser-induced damage thresholds are measured in Ge and GaSb, which are materials that are used in IR detectors. Using a simultaneous fitting technique to extract nonlinear absorption coefficients from data at two pulse widths, two-photon and free-carrier absorption coefficients are measured in Ge and GaSb at 2.05 and 2.5 μm for the first time. At these wavelengths, nonlinear absorption is the primary damage mechanism, and damage thresholds at picosecond and nanosecond pulse widths were measured and agreed well with modeled thresholds using experimentally measured parameters. The damage threshold for a single-layer Al …


Analytical Solutions For Efficient Interpretation Of Single-Well Push-Pull Tracer Tests, Junqi Huang, John A. Christ, Mark N. Goltz Aug 2010

Analytical Solutions For Efficient Interpretation Of Single-Well Push-Pull Tracer Tests, Junqi Huang, John A. Christ, Mark N. Goltz

Faculty Publications

Single-well push-pull tracer tests have been used to characterize the extent, fate, and transport of subsurface contamination. Analytical solutions provide one alternative for interpreting test results. In this work, an exact analytical solution to two-dimensional equations describing the governing processes acting on a dissolved compound during a modified push-pull test (advection, longitudinal and transverse dispersion, first-order decay, and rate-limited sorption/partitioning in steady, divergent, and convergent flow fields) is developed. The coupling of this solution with inverse modeling to estimate aquifer parameters provides an efficient methodology for subsurface characterization. Synthetic data for single-well push-pull tests are employed to demonstrate the utility …


Malware Type Recognition And Cyber Situational Awareness, Thomas E. Dube, Richard A. Raines, Gilbert L. Peterson, Kenneth W. Bauer, Michael R. Grimaila, Steven K. Rogers Aug 2010

Malware Type Recognition And Cyber Situational Awareness, Thomas E. Dube, Richard A. Raines, Gilbert L. Peterson, Kenneth W. Bauer, Michael R. Grimaila, Steven K. Rogers

Faculty Publications

Current technologies for computer network and host defense do not provide suitable information to support strategic and tactical decision making processes. Although pattern-based malware detection is an active research area, the additional context of the type of malware can improve cyber situational awareness. This additional context is an indicator of threat capability thus allowing organizations to assess information losses and focus response actions appropriately. Malware Type Recognition (MaTR) is a research initiative extending detection technologies to provide the additional context of malware types using only static heuristics. Test results with MaTR demonstrate over a 99% accurate detection rate and 59% …