Computer Sciences Commons^™

Expected Coverage (Excov): A Proposal To Compare Fuzz Test Coverage Within An Infinite Input Space, Evan V. Swihart

Theses and Dissertations

A Fuzz test is an approach used to discover vulnerabilities by intentionally sending invalid inputs to a system for the purpose of triggering some type of fault or unintended effect that renders the system vulnerable to an exploit. Fuzz testing is an important cyber-testing technique used to find and fix vulnerabilities before they are exploited. The fuzzing of military data links presents a particular challenge because existing fuzzing tools cannot be easily applied to these systems. As a result, the tools and techniques used to fuzz these links vary widely in sophistication and effectiveness. Because of the infinite, or nearly …

Securing Data In Transit Using Two Channel Communication, Clark L. Wolfe

Theses and Dissertations

Securing data in transit is critically important to the Department of Defense in todays contested environments. While encryption is often the preferred method to provide security, there exist applications for which encryption is too resource intensive, not cost-effective or simply not available. In this thesis, a two-channel communication system is proposed in which the message being sent can be intelligently and dynamically split over two or more channels to provide a measure of data security either when encryption is not available, or perhaps in addition to encryption. This data spiting technique employs multiple wireless channels operating at the physical layer, …

Target Detection Using Convolutional Neural Networks, Robert P. Loibl

Theses and Dissertations

This research explores the use of Convolutional Neural Networks (CNNs) to classify targets of interest within satellite imagery. Methods were specifically devised for the classification of airports within Landsat-8 scenes. A novel automated dataset generation technique was developed to create labeled datasets from satellite imagery using only coordinate metadata. Using this approach a very large dataset of over 132,000 labeled images was created without human input. This dataset was used to evaluate the effects of color and resolution on airport classification accuracy. Two experiments were run with the first experiment classifying large airports with 96.8% accuracy, and the second classifying …

Transferable Multiparty Computation, Michael R. Clark, Kenneth M. Hopkinson

AFIT Patents

A method and apparatus are provided for secure multiparty computation. A set of first parties is selected from a plurality of first parties for computation. Inputs for computation associated with each party in the set of first parties are divided into shares to be sent to other parties in the set of first parties. The computation on the shares is performed by the set of first parties using multiparty computation functions. In response to a trigger event, shares of the set of first parties are transferred to a set of second parties selected from a plurality of second parties. The …

A Tree Locality-Sensitive Hash For Secure Software Testing, Camdon J. Cady

Theses and Dissertations

Bugs in software that make it through testing can cost tens of millions of dollars each year, and in some cases can even result in the loss of human life. In order to eliminate bugs, developers may use symbolic execution to search through possible program states looking for anomalous states. Most of the computational effort to search through these states is spent solving path constraints in order to determine the feasibility of entering each state. State merging can make this search more efficient by combining program states, allowing multiple execution paths to be analyzed at the same time. However, a …

Biologically Inspired Network (Bionet) Authentication Using Logical And Pathological Rf-Dna Credential Pairs, Tyrone A.L. Lewis Sr.

Theses and Dissertations

The command and control (C2) of shared space resources are vulnerable to logical credential forgery and impersonation attacks among standardized and interoperable wireless radio frequency (RF) networks. Threats could come from trusted operators (insiders) or from external sources (outsiders). An attacker may gain unauthorized network access and illegally cross into C2 boundaries when conventional network authentication fails. This research proposes an integrated trust management system that uses both application-layer and physical-layer trust markers to authenticate users and their communication sources. In essence, the results from physical-layer RF-DNA fingerprinting techniques are used to improve application-level trust schemes based on command patterns, …

A Stochastic Model Of Plausibility In Live-Virtual-Constructive Environments, Jeremy Robert Millar

Theses and Dissertations

Distributed live-virtual-constructive simulation promises a number of benefits for the test and evaluation community, including reduced costs, access to simulations of limited availability assets, the ability to conduct large-scale multi-service test events, and recapitalization of existing simulation investments. However, geographically distributed systems are subject to fundamental state consistency limitations that make assessing the data quality of live-virtual-constructive experiments difficult. This research presents a data quality model based on the notion of plausible interaction outcomes. This model explicitly accounts for the lack of absolute state consistency in distributed real-time systems and offers system designers a means of estimating data quality and …

Automated Software Testing In The Dod: Current Practices And Opportunities For Improvement, Darryl K. Ahner, James Wisnowski, James R. Simpson

Faculty Publications

The concept of automating the testing of software-intensive systems has been around for decades, but the practice of automating testing is scarce in many industries, especially in the government defense sector. A one-year project initiated by the Office of the Secretary of Defense (OSD), Scientific Test and Analysis Techniques Center of Excellence (STAT COE) and sponsored by Navy OPNAV N94 set out to:

• study the degree to which the Department of Defense (DoD) has adopted automated software testing (AST);

• share the best software practices used by industry; and

• develop and distribute an AST implementation guide intended for program management and …

  ---

  Go to article

Anomalydetection: Implementation Of Augmented Network Log Anomaly Detection Procedures, Robert J. Gutierrez, Bradley C. Boehmke, Kenneth W. Bauer, Cade M. Saie, Trevor J. Bihl

Faculty Publications

As the number of cyber-attacks continues to grow on a daily basis, so does the delay in threat detection. For instance, in 2015, the Office of Personnel Management discovered that approximately 21.5 million individual records of Federal employees and contractors had been stolen. On average, the time between an attack and its discovery is more than 200 days. In the case of the OPM breach, the attack had been going on for almost a year. Currently, cyber analysts inspect numerous potential incidents on a daily basis, but have neither the time nor the resources available to perform such a task. …

Increasing Cyber Resiliency Of Industrial Control Systems, Andrew J. Chaves

Theses and Dissertations

Industrial control systems (ICS) are designed to be resilient, capable of recovering from process faults and failures with limited impact to operations. Current ICS resiliency strategies use redundant PLCs. However, these redundant PLCs, being of similar make and model, can be exploited by the same cyber attack, defeating the ICS's resiliency strategy. This research proposes a resiliency strategy for ICS that employs an active defense technique to remove the cyber common cause failure. The resiliency of the active defense strategy is compared to traditional ICS resiliency by implementing both strategies in a semi-simulated wastewater treatment plant aeration basin that experiences …

Multi-Plc Exercise Environments For Training Ics First Responders, Joseph K. Daoud

Theses and Dissertations

When systems are targeted by cyber attacks, cyber first responders must be able to react effectively, especially when dealing with critical infrastructure. Training for cyber first responders is lacking and most existing exercise platforms are expensive, inaccessible or ineffective. This paper presents a mobile training platform which incorporates a variety of programmable logic controllers into a single system which facilitates the development of the unique skills required of cyber first responders operating in the realm of industrial control systems. The platform is modeled after a jail in the northeastern United States and was developed to maximize realism. Example training scenarios …

A Framework For Categorization Of Industrial Control System Cyber Training Environments, Evan G. Plumley

Theses and Dissertations

First responders and professionals in hazardous occupations undergo training and evaluations for the purpose of mitigating risk and damage. For example, helicopter pilots train with multiple categorized simulations that increase in complexity before flying a real aircraft. However in the industrial control cyber incident response domain, where incident response professionals help detect, respond and recover from cyber incidents, no official categorization of training environments exist. To address this gap, this thesis provides a categorization of industrial control training environments based on realism. Four levels of environments are proposed and mapped to Blooms Taxonomy. This categorization will help organizations determine which …

Autoprov: An Automated File Provenance Collection Tool, Ryan A. Good

Theses and Dissertations

A file's provenance is a detailing of its origins and activities. There are tools available that are useful in maintaining the provenance of a file. Unfortunately for digital forensics, these tools require prior installation on the computer of interest while provenance generating events happen. The presented tool addresses this by reconstructing a file's provenance from several temporal artifacts. It identifies relevant temporal and user correlations between these artifacts, and presents them to the user. A variety of predefined use cases and real world data are tested against to demonstrate that this software allows examiners to draw useful conclusions about the …

Active Response Using Host-Based Intrusion Detection System And Software-Defined Networking, Jonathon S. Goodgion

Theses and Dissertations

This research proposes AHNSR: Active Host-based Network Security Response by utilizing Host-based Intrusion Detection Systems (HIDS) with Software-Defined Networking (SDN) to enhance system security by allowing dynamic active response and reconstruction from a global network topology perspective. Responses include traffic redirection, host quarantining, filtering, and more. A testable SDN-controlled network is constructed with multiple hosts, OpenFlow enabled switches, and a Floodlight controller, all linked to a custom, novel interface for the Open-Source SECurity (OSSEC) HIDS framework. OSSEC is implemented in a server-agent architecture, allowing scalability and OS independence. System effectiveness is evaluated against the following factors: alert density and a …

A Framework For Understanding, Prioritizing, And Applying Systems Security Engineering Processes, Activities, And Tasks, Stephen Khou

Theses and Dissertations

Current systems security practices lack an effective approach to prioritize and tailor systems security efforts to develop and field secure systems in challenging operational environments, which results in business and mission stakeholders becoming more susceptible to an array of disruptive events. This work informs Systems Engineers on recent developments in the field of system security engineering and provides a framework for more fully understanding the application of Systems Security Engineering (SSE) processes, activities, and tasks as described in the recently released National Institute of Standards and Technology (NIST) Special Publication 800-160. This SSE framework uniquely offers a repeatable and tailorable …

A Sandbox In Which To Learn And Develop Soar Agents, Daniel Lugo

Theses and Dissertations

It is common for military personnel to leverage simulations (and simulators) as cost-effective tools to train and become proficient at various tasks (e.g., flying an aircraft and/or performing a mission, among others). These training simulations often need to represent humans within the simulated world in a realistic manner. Realistic implies creating simulated humans that exhibit behaviors that mimic real-world decision making and actions. Typically, to create the decision-making logic, techniques developed from the domain of artificial intelligence are used. Although there are several approaches to developing intelligent agents; we focus on leveraging and open source project called Soar, to define …

Applying Cyber Threat Intelligence To Industrial Control Systems, Matthew P. Sibiga

Theses and Dissertations

A cybersecurity initiative known as cyber threat intelligence (CTI) has recently been developed and deployed. The overall goal of this new technology is to help protect network infrastructures. Threat intelligence platforms (TIPs) have also been created to help facilitate CTI effectiveness within organizations. There are many benefits that both can achieve within the information technology (IT) sector. The industrial control system (ICS) sector can also benefit from these technologies as most ICS networks are connected to IT networks. CTI and TIPs become resourceful when using indicators of compromise (IOCs) from known ICS malware attacks and an open source intrusion detection …

Whitelisting System State In Windows Forensic Memory Visualizations, Joshua A. Lapso, Gilbert L. Peterson, James S. Okolica

Faculty Publications

Examiners in the field of digital forensics regularly encounter enormous amounts of data and must identify the few artifacts of evidentiary value. One challenge these examiners face is manual reconstruction of complex datasets with both hierarchical and associative relationships. The complexity of this data requires significant knowledge, training, and experience to correctly and efficiently examine. Current methods provide text-based representations or low-level visualizations, but levee the task of maintaining global context of system state on the examiner. This research presents a visualization tool that improves analysis methods through simultaneous representation of the hierarchical and associative relationships and local detailed data …

Modeling, Simulation, And Performance Analysis Of Decoy State Enabled Quantum Key Distribution Systems, Logan O. Mailloux, Michael R. Grimaila, Douglas D. Hodson, Ryan D. Engle, Colin V. Mclaughlin, Gerald B. Baumgartner

Faculty Publications

Quantum Key Distribution (QKD) systems exploit the laws of quantum mechanics to generate secure keying material for cryptographic purposes. To date, several commercially viable decoy state enabled QKD systems have been successfully demonstrated and show promise for high-security applications such as banking, government, and military environments. In this work, a detailed performance analysis of decoy state enabled QKD systems is conducted through model and simulation of several common decoy state configurations. The results of this study uniquely demonstrate that the decoy state protocol can ensure Photon Number Splitting (PNS) attacks are detected with high confidence, while maximizing the system’s quantum …

Clustering-Based Online Player Modeling, Jason M. Bindewald, Gilbert L. Peterson, Michael E. Miller

Faculty Publications

Being able to imitate individual players in a game can benefit game development by providing a means to create a variety of autonomous agents and aid understanding of which aspects of game states influence game-play. This paper presents a clustering and locally weighted regression method for modeling and imitating individual players. The algorithm first learns a generic player cluster model that is updated online to capture an individual’s game-play tendencies. The models can then be used to play the game or for analysis to identify how different players react to separate aspects of game states. The method is demonstrated on …

Using Timing-Based Side Channels For Anomaly Detection In Industrial Control Systems, Stephen Dunlap, Jonathan W. Butts, Juan L. Lopez Jr., Mason J. Rice, Barry E. Mullins

Faculty Publications

The critical infrastructure, which includes the electric power grid, railroads and water treatment facilities, is dependent on the proper operation of industrial control systems. However, malware such as Stuxnet has demonstrated the ability to alter industrial control system parameters to create physical effects. Of particular concern is malware that targets embedded devices that monitor and control system functionality, while masking the actions from plant operators and security analysts. Indeed, system security relies on guarantees that the assurance of these devices can be maintained throughout their lifetimes. This paper presents a novel approach that uses timing-based side channel analysis to establish …

A Method For Revealing And Addressing Security Vulnerabilities In Cyber-Physical Systems By Modeling Malicious Agent Interactions With Formal Verification, Dean C. Wardell, Robert F. Mills, Gilbert L. Peterson, Mark E. Oxley

Faculty Publications

Several cyber-attacks on the cyber-physical systems (CPS) that monitor and control critical infrastructure were publically announced over the last few years. Almost without exception, the proposed security solutions focus on preventing unauthorized access to the industrial control systems (ICS) at various levels – the defense in depth approach. While useful, it does not address the problem of making the systems more capable of responding to the malicious actions of an attacker once they have gained access to the system. The first step in making an ICS more resilient to an attacker is identifying the cyber security vulnerabilities the attacker can …

Improving The Cybersecurity Of Cyber-Physical Systems Through Behavioral Game Theory And Model Checking In Practice And In Education, Seth T. Hamman

Theses and Dissertations

This dissertation presents automated methods based on behavioral game theory and model checking to improve the cybersecurity of cyber-physical systems (CPSs) and advocates teaching certain foundational principles of these methods to cybersecurity students. First, it encodes behavioral game theory's concept of level-k reasoning into an integer linear program that models a newly defined security Colonel Blotto game. This approach is designed to achieve an efficient allocation of scarce protection resources by anticipating attack allocations. A human subjects experiment based on a CPS infrastructure demonstrates its effectiveness. Next, it rigorously defines the term adversarial thinking, one of cybersecurity educations most important …

A Novel Machine Learning Classifier Based On A Qualia Modeling Agent (Qma), Sandra L. Vaughan

Theses and Dissertations

This dissertation addresses a problem found in supervised machine learning (ML) classification, that the target variable, i.e., the variable a classifier predicts, has to be identified before training begins and cannot change during training and testing. This research develops a computational agent, which overcomes this problem. The Qualia Modeling Agent (QMA) is modeled after two cognitive theories: Stanovich's tripartite framework, which proposes learning results from interactions between conscious and unconscious processes; and, the Integrated Information Theory (IIT) of Consciousness, which proposes that the fundamental structural elements of consciousness are qualia. By modeling the informational relationships of qualia, the QMA allows …

Physical Layer Defenses Against Primary User Emulation Attacks, Joan A. Betances

Theses and Dissertations

Cognitive Radio (CR) is a promising technology that works by detecting unused parts of the spectrum and automatically reconfiguring the communication system's parameters in order to operate in the available communication channels while minimizing interference. CR enables efficient use of the Radio Frequency (RF) spectrum by generating waveforms that can coexist with existing users in licensed spectrum bands. Spectrum sensing is one of the most important components of CR systems because it provides awareness of its operating environment, as well as detecting the presence of primary (licensed) users of the spectrum.

A Temporal Framework For Hypergame Analysis Of Cyber Physical Systems In Contested Environments, Nicholas S. Kovach

Theses and Dissertations

Game theory is used to model conflicts between one or more players over resources. It offers players a way to reason, allowing rationale for selecting strategies that avoid the worst outcome. Game theory lacks the ability to incorporate advantages one player may have over another player. A meta-game, known as a hypergame, occurs when one player does not know or fully understand all the strategies of a game. Hypergame theory builds upon the utility of game theory by allowing a player to outmaneuver an opponent, thus obtaining a more preferred outcome with higher utility. Recent work in hypergame theory has …

Data Driven Device Failure Prediction, Paul L. Jordan

Theses and Dissertations

As society becomes more dependent upon computer systems to perform increasingly critical tasks, ensuring those systems do not fail also becomes more important. Many organizations depend heavily on desktop computers for day to day operations. Unfortunately, the software that runs on these computers is still written by humans and as such, is still subject to human error and consequent failure. A natural solution is to use statistical machine learning to predict failure. However, since failure is still a relatively rare event, obtaining labeled training data to train these models is not trivial. This work presents new simulated fault loads with …

Quantum Key Distribution: Boon Or Bust, Logan O. Mailloux, Douglas D. Hodson, Michael R. Grimaila, Colin V. Mclaughlin, Gerald B. Baumgartner

Faculty Publications

Quantum Key Distribution (QKD) is an emerging cybersecurity technology which provides the means for two geographically separated parties to grow “unconditionally secure” symmetric cryptographic keying material. Unlike traditional key distribution techniques, the security of QKD rests on the laws of quantum mechanics and not computational complexity. This unique aspect of QKD is due to the fact that any unauthorized eavesdropping on the key distribution channel necessarily introduces detectable errors (Gisin, Ribordy, Tittel, & Zbinden, 2002). This attribute makes QKD desirable for high-security environments such as banking, government, and military applications. However, QKD is a nascent technology where implementation non-idealities can …

Synaptic Annealing: Anisotropic Simulated Annealing And Its Application To Neural Network Synaptic Weight Selection, Justin R. Fletcher

Theses and Dissertations

Machine learning algorithms have become a ubiquitous, indispensable part of modern life. Neural networks are one of the most successful classes of machine learning algorithms, and have been applied to solve problems previously considered to be the exclusive domain of human intellect. Several methods for selecting neural network configurations exist. The most common such method is error back-propagation. Backpropagation often produces neural networks that perform well, but do not achieve an optimal solution. This research explores the effectiveness of an alternative feed-forward neural network weight selection procedure called synaptic annealing. Synaptic annealing is the application of the simulated annealing algorithm …

A Multi-Objective Approach To Tactical Maneuvering Within Real Time Strategy Games, Christopher D. Ball

Theses and Dissertations

The real time strategy (RTS) environment is a strong platform for simulating complex tactical problems. The overall research goal is to develop artificial intelligence (AI) RTS planning agents for military critical decision making education. These agents should have the ability to perform at an expert level as well as to assess a players critical decision-making ability or skill-level. The nature of the time sensitivity within the RTS environment creates very complex situations. Each situation must be analyzed and orders must be given to each tactical unit before the scenario on the battlefield changes and makes the decisions no longer relevant. …