Computer Sciences Commons^™

Activity Pattern Discovery From Network Captures, Alan C. Lin, Gilbert L. Peterson

Faculty Publications

Investigating insider threat cases is challenging because activities are conducted with legitimate access that makes distinguishing malicious activities from normal activities difficult. To assist with identifying non-normal activities, we propose using two types of pattern discovery to identify a person's behavioral patterns in network data. The behavioral patterns serve to deemphasize normal behavior so that insider threat investigations can focus attention on potentially more relevant. Results from a controlled experiment demonstrate the highlighting of a suspicious event through the reduction of events belonging to discovered patterns. Abstract © 2016 IEEE.

Method For Determining Time-Resolved Heat Transfer Coefficient And Adiabatic Effectiveness Waveforms With Unsteady Film Cooling, James L. Rutledge, Jonathan F. Mccall

AFIT Patents

A new method for determining heat transfer coefficient (h) and adiabatic effectiveness (η) waveforms h(t) and η(t) from a single test uses a novel inverse heat transfer methodology to use surface temperature histories obtained using prior art approaches to approximate the h(t) and η(t) waveforms. The method best curve fits the data to a pair of truncated Fourier series.

Deception In Game Theory: A Survey And Multiobjective Model, Austin L. Davis

Theses and Dissertations

Game theory is the study of mathematical models of conflict. It provides tools for analyzing dynamic interactions between multiple agents and (in some cases) across multiple interactions. This thesis contains two scholarly articles. The first article is a survey of game-theoretic models of deception. The survey describes the ways researchers use game theory to measure the practicality of deception, model the mechanisms for performing deception, analyze the outcomes of deception, and respond to, or mitigate the effects of deception. The survey highlights several gaps in the literature. One important gap concerns the benefit-cost-risk trade-off made during deception planning. To address …

Position And Volume Estimation Of Atmospheric Nuclear Detonations From Video Reconstruction, Daniel T. Schmitt

Theses and Dissertations

Recent work in digitizing films of foundational atmospheric nuclear detonations from the 1950s provides an opportunity to perform deeper analysis on these historical tests. This work leverages multi-view geometry and computer vision techniques to provide an automated means to perform three-dimensional analysis of the blasts for several points in time. The accomplishment of this requires careful alignment of the films in time, detection of features in the images, matching of features, and multi-view reconstruction. Sub-explosion features can be detected with a 67% hit rate and 22% false alarm rate. Hotspot features can be detected with a 71.95% hit rate, 86.03% …

A Misuse-Based Intrusion Detection System For Itu-T G.9959 Wireless Networks, Jonathan D. Fuller

Theses and Dissertations

Wireless Sensor Networks (WSNs) provide low-cost, low-power, and low-complexity systems tightly integrating control and communication. Protocols based on the ITU-T G.9959 recommendation specifying narrow-band sub-GHz communications have significant growth potential. The Z-Wave protocol is the most common implementation. Z-Wave developers are required to sign nondisclosure and confidentiality agreements, limiting the availability of tools to perform open source research. This work discovers vulnerabilities allowing the injection of rogue devices or hiding information in Z-Wave packets as a type of covert channel attack. Given existing vulnerabilities and exploitations, defensive countermeasures are needed. A Misuse-Based Intrusion Detection System (MBIDS) is engineered, capable of …

Cross-Subject Continuous Analytic Workload Profiling Using Stochastic Discrete Event Simulation, Joseph J. Giametta

Theses and Dissertations

Operator functional state (OFS) in remotely piloted aircraft (RPA) simulations is modeled using electroencephalograph (EEG) physiological data and continuous analytic workload profiles (CAWPs). A framework is proposed that provides solutions to the limitations that stem from lengthy training data collection and labeling techniques associated with generating CAWPs for multiple operators/trials. The framework focuses on the creation of scalable machine learning models using two generalization methods: 1) the stochastic generation of CAWPs and 2) the use of cross-subject physiological training data to calibrate machine learning models. Cross-subject workload models are used to infer OFS on new subjects, reducing the need to …

Statistic Whitelisting For Enterprise Network Incident Response, Nathan E. Grunzweig

Theses and Dissertations

This research seeks to satisfy the need for the rapid evaluation of enterprise network hosts in order to identify items of significance through the introduction of a statistic whitelist based on the behavior of the processes on each host. By taking advantage of the repetition of processes and the resources they access, a whitelist can be generated using large quantities of host machines. For each process, the Modules and the TCP & UDP Connections are compared to identify which resources are most commonly accessed by each process. Results show 47% of processes receiving a whitelist score of 75% or greater …

Whitelisting System State In Windows Forensic Memory Visualizations, Joshua A. Lapso

Theses and Dissertations

Examiners in the field of digital forensics regularly encounter enormous amounts of data and must identify the few artifacts of evidentiary value. The most pressing challenge these examiners face is manual reconstruction of complex datasets with both hierarchical and associative relationships. The complexity of this data requires significant knowledge, training, and experience to correctly and efficiently examine. Current methods provide primarily text-based representations or low-level visualizations, but levee the task of maintaining global context of system state on the examiner. This research presents a visualization tool that improves analysis methods through simultaneous representation of the hierarchical and associative relationships and …

Cyberspace And Organizational Structure: An Analysis Of The Critical Infrastructure Environment, Michael D. Quigg Ii

Theses and Dissertations

Now more than ever, organizations are being created to protect the cyberspace environment. The capability of cyber organizations tasked to defend critical infrastructure has been called into question by numerous cybersecurity experts. Organizational theory states that organizations should be constructed to fit their operating environment properly. Little research in this area links existing organizational theory to cyber organizational structure. Because of the cyberspace connection to critical infrastructure assets, the factors that influence the structure of cyber organizations designed to protect these assets warrant analysis to identify opportunities for improvement.

This thesis analyzes the cyber‐connected critical infrastructure environment using the dominant …

Key Detection Rate Modeling And Analysis For Satellite-Based Quantum Key Distribution, Jonathan C. Denton

Theses and Dissertations

A satellite QKD model was developed and validated, that allows a user to determine the optimum wavelength for use in a satellite-based QKD link considering the location of ground sites, selected orbit and hardware performance. This thesis explains how the model was developed, validated and presents results from a simulated year-long study of satellite-based quantum key distribution. It was found that diffractive losses and atmospheric losses define a fundamental trade space that drives both orbit and wavelength selection. The optimal orbit is one which generates the highest detection rates while providing equal pass elevation angles and durations to multiple ground …

A Framework For Incorporating Insurance Into Critical Infrastructure Cyber Risk Strategies, Derek R. Young

Theses and Dissertations

Critical infrastructure owners and operators want to minimize their cyber risk and expenditures on cybersecurity. The insurance industry has been quantitatively assessing risk for hundreds of years in order to minimize risk and maximize profits. To achieve these goals, insurers continuously gather statistical data to improve their predictions, incentivize their clients' investment in self-protection and periodically refine their models to improve the accuracy of risk estimates. This paper presents a framework which incorporates the operating principles of the insurance industry in order to provide quantitative estimates of cyber risk. The framework implements optimization techniques to suggest levels of investment for …

Poco-Moea: Using Evolutionary Algorithms To Solve The Controller Placement Problem, Scott I. Harned

Theses and Dissertations

One of the central tenets of a Software Defined Network (SDN) is the use of controllers, which are responsible for managing how traffic flows through switches, routers, and other data-passing devices on a computer network. Most modern SDNs use multiple controllers to divide responsibility for network switches while keeping communication latency low. A problem that has emerged since approximately 2011 is the decision of where to place these controllers to create the most 'optimum' network. This is known as the Controller Placement Problem (CPP). Such a decision is subject to multiple and sometimes con_icting goals, making the CPP a type …

Analysis Of Software Design Patterns In Human Cognitive Performance Experiments, Alexander C. Roosma

Theses and Dissertations

As Air Force operations continue to move toward the use of more autonomous systems and more human-machine teaming in general, there is a corresponding need to swiftly evaluate systems with these capabilities. We support this development through software design improvements of the execution of human cognitive performance experiments. This thesis sought to answer the following two research questions addressing the core functionality that these experiments rely on for execution and analysis: 1) What data infrastructure software requirements are necessary to execute the experimental design of human cognitive performance experiments? 2) How effectively does a central data mediator design pattern meet …

Pointing Analysis And Design Drivers For Low Earth Orbit Satellite Quantum Key Distribution, Jeremiah A. Specht

Theses and Dissertations

The world relies on encryption to perform critical and sensitive tasks every day. If quantum computing matures, the capability to decode keys and decrypt messages becomes possible. Quantum key distribution (QKD) is a method of distributing secure cryptographic keys which relies on the laws of quantum mechanics. Current implementations of QKD use fiber-based channels which limit the number of users and the distance between users. Satellite-based QKD using free-space channels is proposed as a feasible secure global communication solution. Since a free-space link does not use a waveguide, pointing a transmitter to receiver is required to ensure signal arrival. In …

Framework For Evaluating The Readiness Of Cyber First Responders Responsible For Critical Infrastructure Protection, Jungsang Yoon

Theses and Dissertations

First responders go through rigorous training and evaluation to ensure they are adequately prepared for an emergency. As an example, firefighters continually evaluate the readiness of their personnel using a defined set of criteria to measure performance for fire suppression and rescue procedures. From a cyber security standpoint, however, this same set of criteria and rigor is severely lacking for the professionals that must detect, respond to and recover from a cyber-based attack against the nation's critical infrastructure. This research provides a framework for evaluating the readiness of cyber first responders responsible for critical infrastructure protection. The framework demonstrates the …

Understanding Effects Of Autonomous Agent Timing On Human-Agent Teams Using Iterative Modeling, Simulation And Human-In-The-Loop Experimentation, Tyler J. Goodman

Theses and Dissertations

Recent U.S. Air Force Research Laboratory strategy documents have suggested the need for research in human-agent teaming. Teaming supports a dynamic shift in roles between the human and the agent, depending upon human performance and mission needs. Further, because the performance of these agents will be highly dependent upon the state of the human and the mission, this strategy suggests the need for increased use of modeling to provide a broader understanding of the automated agent’s behavior. This thesis applies a combination of static modeling in SysML activity diagrams, dynamic modeling of human and agent behavior in IMPRINT, and human …

Adaptive Automation Design And Implementation, Jason M. Bindewald

Theses and Dissertations

Automations allow us to reduce the need for humans in certain environments, such as auto-pilot features on unmanned aerial vehicles. However, some situations still require human intervention. Adaptive automation is a research field that enables computer systems to adjust the amount of automation by taking over tasks from or giving tasks back to the user. This research develops processes and insights for adaptive automation designers to take theoretical adaptive automation ideas and develop them into real-world adaptive automation system. These allow developers to design better automation systems that recognize the limits of computers systems, enabling better designs for systems in …

A System-Level Throughput Model For Quantum Key Distribution, Robert C. Cernera

Theses and Dissertations

Quantum Key Distribution (QKD) is an innovative technology which exploits the laws of quantum mechanics to generate and distribute shared secret keying material. QKD systems generate and distribute key by progressing through a number of distinct phases, typically in a serial manner. The purpose of this research is to identify these phases, their relationships to each other, as well as their relationship to time, memory space, computational requirements, and hardware resources. A mathematical model is developed which enables the study of critical system parameters, identifies and demonstrates potential bottlenecks that affect the overall key generation rate of serial implementations, and …

An Analysis Of Conus Based Deployment Of Pseudolites For Positioning, Navigation And Timing (Pnt) Systems, Justin H. Deifel, Albert J. Pena

Theses and Dissertations

The Global Positioning System (GPS) developed and operated by the United States Air Force (USAF) provides a way for users to determine position, navigation and timing (PNT). GPS provides an extraordinary capability that has become instrumental in all aspects of our day to day lives. As new technologies such as automated vehicles and unmanned aircraft continue to be developed, a reliable back up to GPS is required to ensure the PNT data generated in these systems is accurate. This research studies a potential architecture for deploying a nationwide network of ground based pseudolites that would act to supplement and backup …

Evaluating Machine Learning Classifiers For Hybrid Network Intrusion Detection Systems, Michael D. Rich

Theses and Dissertations

Existing classifier evaluation methods do not fully capture the intended use of classifiers in hybrid intrusion detection systems (IDS), systems that employ machine learning alongside a signature-based IDS. This research challenges traditional classifier evaluation methods in favor of a value-focused evaluation method that incorporates evaluator-specific weights for classifier and prediction threshold selection. By allowing the evaluator to weight known and unknown threat detection by alert classification, classifier selection is optimized to evaluator values for this application. The proposed evaluation methods are applied to a Cyber Defense Exercise (CDX) dataset. Network data is processed to produce connection-level features, then labeled using …

The Unified Behavior Framework For The Simulation Of Autonomous Agents, Daniel M. Roberson

Theses and Dissertations

Since the 1980s, researchers have designed a variety of robot control architectures intending to imbue robots with some degree of autonomy. A recently developed architecture, the UBF, implements a variation of the three-layer architecture with a reactive controller to rapidly make behavior decisions. Additionally, the UBF utilizes software design patterns that promote the reuse of code and free designers to dynamically switch between behavior paradigms. This paper explores the application of the UBF to the simulation domain. By employing software engineering principles to implement the UBF architecture within an open-source simulation framework, we have extended the versatility of both. The …

Git As An Encrypted Distributed Version Control System, Russell G. Shirey

Theses and Dissertations

This thesis develops and presents a secure Git implementation, Git Virtual Vault (GV2), for users of Git to work on sensitive projects with repositories located in unsecure distributed environments, such as in cloud computing. This scenario is common within the Department of Defense, as much work is of a sensitive nature. In order to provide security to Git, additional functionality is added for confidentiality and integrity protection. This thesis examines existing Git encryption implementations and baselines their performance compared to unencrypted Git. Real-world Git repositories are examined to characterize typical Git usage and determine if the existing Git encryption implementations …

Constructing Cost-Effective And Targetable Ics Honeypots Suited For Production Networks, Michael M. Winn

Theses and Dissertations

Honeypots are a technique that can mitigate the risk of cyber threats. Effective honeypots are authentic and targetable, and their design and implementation must accommodate risk tolerance and financial constraints. The proprietary, and often expensive, hardware and software used by Industrial Control System (ICS) devices creates the challenging problem of building a flexible, economical, and scalable honeypot. This research extends Honeyd into Honeyd+, making it possible to use the proxy feature to create multiple high interaction honeypots with a single Programmable Logic Controller (PLC). Honeyd+ is tested with a network of 75 decoy PLCs, and the interactions with the decoys …

Unified Behavior Framework For Discrete Event Simulation Systems, Alexander J. Kamrud

Theses and Dissertations

Intelligent agents provide simulations a means to add lifelike behavior in place of manned entities. Generally when developed, a single intelligent agent model is chosen, such as rule based, behavior trees, etc. This choice introduces restrictions into what behaviors agents can manifest, and can require significant testing in edge cases. This thesis presents the use of the UBF in the AFSIM environment. The UBF provides the flexibility to implement any and all intelligent agent models, allowing the developer to choose the model he/she feels best fits the experiment at hand. Furthermore, the UBF demonstrates several key software engineering principles through …

Tactical Ai In Real Time Strategy Games, Donald A. Gruber

Theses and Dissertations

The real time strategy (RTS) tactical decision making problem is a difficult problem. It is generally more complex due to its high degree of time sensitivity. This research effort presents a novel approach to this problem within an educational, teaching objective. Particular decision focus is target selection for a artificial intelligence (AI) RTS game model. The use of multi-objective evolutionary algorithms (MOEAs) in this tactical decision making problem allows an AI agent to make fast, effective solutions that do not require modification to the current environment. This approach allows for the creation of a generic solution building tool that is …

Distributed Kernelized Locality-Sensitive Hashing For Faster Image Based Navigation, Scott A. Hutchison

Theses and Dissertations

Content based image retrieval (CBIR) remains one of the most heavily researched areas in computer vision. Different image retrieval techniques and algorithms have been implemented and used in localization research, object recognition applications, and commercially by companies such as Facebook, Google, and Yahoo!. Current methods for image retrieval become problematic when implemented on image datasets that can easily reach billions of images. In order to process extremely large datasets, the computation must be distributed across a cluster of machines using software such as Apache Hadoop. There are many different algorithms for conducting content based image retrieval, but this research focuses …

Con-Resistant Trust For Improved Reliability In A Smart Grid Special Protection System, Crystal M. Shipman, Kenneth M. Hopkinson, Juan L. Lopez Jr.

Faculty Publications

This paper applies a con-resistant trust mechanism to improve the performance of a communications-based special protection system to enhance its effectiveness and resiliency. Smart grids incorporate modern information technologies to increase reliability and efficiency through better situational awareness. However, with the benefits of this new technology come the added risks associated with threats and vulnerabilities to the technology and to the critical infrastructure it supports. The research in this paper uses con-resistant trust to quickly identify malicious or malfunctioning (untrustworthy) protection system nodes to mitigate instabilities. The con-resistant trust mechanism allows protection system nodes to make trust assessments based on …

A Function-To-Task Process Model For Adaptive Automation System Design, Jason M. Bindewald, Michael E. Miller, Gilbert L. Peterson

Faculty Publications

Adaptive automation systems allow the user to complete a task seamlessly with a computer performing tasks at which the human operator struggles. Unlike traditional systems that allocate functions to either the human or the machine, adaptive automation varies the allocation of functions during system operation. Creating these systems requires designers to consider issues not present during static system development. To assist in adaptive automation system design, this paper presents the concept of inherent tasks and takes advantage of this concept to create the function-to-task design process model. This process model helps the designer determine how to allocate functions to the …

Timing Mark Detection On Nuclear Detonation Video, Daniel T. Schmitt, Gilbert L. Peterson

Faculty Publications

During the 1950s and 1960s the United States conducted and filmed over 200 atmospheric nuclear tests establishing the foundations of atmospheric nuclear detonation behavior. Each explosion was documented with about 20 videos from three or four points of view. Synthesizing the videos into a 3D video will improve yield estimates and reduce error factors. The videos were captured at a nominal 2500 frames per second, but range from 2300-3100 frames per second during operation. In order to combine them into one 3D video, individual video frames need to be correlated in time with each other. When the videos were captured …

Machine Learning Nuclear Detonation Features, Daniel T. Schmitt, Gilbert L. Peterson

Faculty Publications

Nuclear explosion yield estimation equations based on a 3D model of the explosion volume will have a lower uncertainty than radius based estimation. To accurately collect data for a volume model of atmospheric explosions requires building a 3D representation from 2D images. The majority of 3D reconstruction algorithms use the SIFT (scale-invariant feature transform) feature detection algorithm which works best on feature-rich objects with continuous angular collections. These assumptions are different from the archive of nuclear explosions that have only 3 points of view. This paper reduces 300 dimensions derived from an image based on Fourier analysis and five edge …