Open Access. Powered by Scholars. Published by Universities.®

Computer Sciences Commons™

Open Access. Powered by Scholars. Published by Universities.®

Air Force Institute of Technology

Discipline
Keyword
Publication Year
Publication
Publication Type
File Type

Articles 541 - 570 of 1277

Full-Text Articles in Computer Sciences

Spear Phishing Attack Detection, David T. Merritt Mar 2011

Spear Phishing Attack Detection, David T. Merritt

Theses and Dissertations

This thesis addresses the problem of identifying email spear phishing attacks, which are indicative of cyber espionage. Spear phishing consists of targeted emails sent to entice a victim to open a malicious file attachment or click on a malicious link that leads to a compromise of their computer. Current detection methods fail to detect emails of this kind consistently. The SPEar phishing Attack Detection system (SPEAD) is developed to analyze all incoming emails on a network for the presence of spear phishing attacks. SPEAD analyzes the following file types: Windows Portable Executable and Common Object File Format (PE/COFF), Adobe Reader, …

Go to article

Measuring The Utility Of A Cyber Incident Mission Impact Assessment (Cimia) Process For Mission Assurance, Christy L. Peterson Mar 2011

Measuring The Utility Of A Cyber Incident Mission Impact Assessment (Cimia) Process For Mission Assurance, Christy L. Peterson

Theses and Dissertations

Information is a critical asset on which virtually all modern organizations depend upon to meet their operational mission objectives. Military organizations, in particular, have embedded Information and Communications Technologies (ICT) into their core mission processes as a means to increase their operational efficiency, exploit automation, improve decision quality, and shorten the kill chain. However, the extreme dependence upon ICT results in an environment where a cyber incident can result in severe mission degradation, or possibly failure, with catastrophic consequences to life, limb, and property. These consequences can be minimized by maintaining real-time situational awareness of mission critical resources so appropriate …

Go to article

Determining Solution Space Characteristics For Real-Time Strategy Games And Characterizing Winning Strategies, Gary B. Lamont, Kurt Weissgerber, Brett J. Borghetti, Gilbert L. Peterson Mar 2011

Determining Solution Space Characteristics For Real-Time Strategy Games And Characterizing Winning Strategies, Gary B. Lamont, Kurt Weissgerber, Brett J. Borghetti, Gilbert L. Peterson

Faculty Publications

The underlying goal of a competing agent in a discrete real-time strategy (RTS) game is to defeat an adversary. Strategic agents or participants must define an a priori plan to maneuver their resources in order to destroy the adversary and the adversary's resources as well as secure physical regions of the environment. This a priori plan can be generated by leveraging collected historical knowledge about the environment. This knowledge is then employed in the generation of a classification model for real-time decision-making in the RTS domain. The best way to generate a classification model for a complex problem domain depends …

Go to article

Detecting Software Attacks By Monitoring Electric Power Consumption Patterns, Grant A. Jacoby, Nathaniel J. Davis Iv, Randolph C. Marchany Jan 2011

Detecting Software Attacks By Monitoring Electric Power Consumption Patterns, Grant A. Jacoby, Nathaniel J. Davis Iv, Randolph C. Marchany

AFIT Patents

Software attacks such as worms and viruses are detected in an electronic device by monitoring power consumption patterns. In a first embodiment, software attacks are detected by an increase in power consumption. The increased power consumption can be caused by increased network traffic, or by increased activity in the microprocessor. Monitoring power consumption is particularly effective for detecting DOS/flooding attacks when the electronic device is in an idle state. In a second embodiment, a power consumption signal is converted to the frequency domain (e.g., by fast Fourier transform). The highest amplitude frequencies are identified. Specific software attacks produce characteristic frequencies …

Go to article

Real-Time Behavior-Based Robot Control, Brian G. Woolley, Gilbert L. Peterson, Jared T. Kresge Jan 2011

Real-Time Behavior-Based Robot Control, Brian G. Woolley, Gilbert L. Peterson, Jared T. Kresge

Faculty Publications

Behavior-based systems form the basis of autonomous control for many robots, but there is a need to ensure these systems respond in a timely manner. Unexpected latency can adversely affect the quality of an autonomous system’s operations, which in turn can affect lives and property in the real-world. A robots ability to detect and handle external events is paramount to providing safe and dependable operation. This paper presents a concurrent version of a behavior-based system called the Real-Time Unified Behavior Framework, which establishes a responsive basis of behavior-based control that does not bind the system developer to any single behavior …

Go to article

An Fpga-Based System For Tracking Digital Information Transmitted Via Peer-To-Peer Protocols, Karl R. Schrader, Barry E. Mullins, Gilbert L. Peterson, Robert F. Mills Dec 2010

An Fpga-Based System For Tracking Digital Information Transmitted Via Peer-To-Peer Protocols, Karl R. Schrader, Barry E. Mullins, Gilbert L. Peterson, Robert F. Mills

Faculty Publications

This paper presents a Field Programmable Gate Array (FPGA)-based tool designed to process file transfers using the BitTorrent Peer-to-Peer (P2P) protocol and VoIP phone calls made using the Session Initiation Protocol (SIP). The tool searches selected control messages in real time and compares the unique identifier of the shared file or phone number against a list of known contraband files or phone numbers. Results show the FPGA tool processes P2P packets of interest 92% faster than a software-only configuration and is 97.6% accurate at capturing and processing messages at a traffic load of 89.6 Mbps.

Go to article

Electronic Image Stabilization Using Optical Flow With Inertial Fusion, Michael J. Smith, Alexander J. Boxerbaum, Gilbert L. Peterson, Roger D. Quinn Oct 2010

Electronic Image Stabilization Using Optical Flow With Inertial Fusion, Michael J. Smith, Alexander J. Boxerbaum, Gilbert L. Peterson, Roger D. Quinn

Faculty Publications

When a camera is affixed on a dynamic mobile robot, image stabilization is the first step towards more complex analysis on the video feed. This paper presents a novel electronic image stabilization (EIS) algorithm for highly dynamic mobile robotic platforms. The algorithm combines optical flow motion parameter estimation with angular rate data provided by a strapdown inertial measurement unit (IMU). A discrete Kalman filter in feedforward configuration is used for optimal fusion of the two data sources. Performance evaluations are conducted using a simulated video truth model (capturing the effects of image translation, rotation, blurring, and moving objects), and live …

Go to article

Statistical Image Recovery From Laser Speckle Patterns With Polarization Diversity, Donald B. Dixon Sep 2010

Statistical Image Recovery From Laser Speckle Patterns With Polarization Diversity, Donald B. Dixon

Theses and Dissertations

This research extends the theory and understanding of the laser speckle imaging technique. This non-traditional imaging technique may be employed to improve space situational awareness and image deep space objects from a ground-based sensor system. The use of this technique is motivated by the ability to overcome aperture size limitations and the distortion effects from Earth’s atmosphere. Laser speckle imaging is a lensless, coherent method for forming two-dimensional images from their autocorrelation functions. Phase retrieval from autocorrelation data is an ill-posed problem where multiple solutions exist. This research introduces polarization diversity as a method for obtaining additional information so the …

Go to article

Cyber Situational Awareness Using Live Hypervisor-Based Virtual Machine Introspection, Dustyn A. Dodge Sep 2010

Cyber Situational Awareness Using Live Hypervisor-Based Virtual Machine Introspection, Dustyn A. Dodge

Theses and Dissertations

In this research, a compiled memory analysis tool for virtualization (CMAT-V) is developed as a virtual machine introspection (VMI) utility to conduct live analysis during cyber attacks. CMAT-V leverages static memory dump analysis techniques to provide live dynamic system state data. Unlike some VMI applications, CMAT-V bridges the semantic gap using derivation techniques. CMAT-V detects Windows-based operating systems and uses the Microsoft Symbol Server to provide this context to the user. This research demonstrates the usefulness of CMAT-V as a situational awareness tool during cyber attacks, tests the detection of CMAT-V from the guest system level and measures its impact …

Go to article

Accelerating Malware Detection Via A Graphics Processing Unit, Nicholas S. Kovach Sep 2010

Accelerating Malware Detection Via A Graphics Processing Unit, Nicholas S. Kovach

Theses and Dissertations

Real-time malware analysis requires processing large amounts of data storage to look for suspicious files. This is a time consuming process that (requires a large amount of processing power) often affecting other applications running on a personal computer. This research investigates the viability of using Graphic Processing Units (GPUs), present in many personal computers, to distribute the workload normally processed by the standard Central Processing Unit (CPU). Three experiments are conducted using an industry standard GPU, the NVIDIA GeForce 9500 GT card. The goal of the first experiment is to find the optimal number of threads per block for calculating …

Go to article

Hijacking User Uploads To Online Persistent Data Repositories For Covert Data Exfiltration, Curtis P. Barnard Sep 2010

Hijacking User Uploads To Online Persistent Data Repositories For Covert Data Exfiltration, Curtis P. Barnard

Theses and Dissertations

As malware has evolved over the years, it has gone from harmless programs that copy themselves into other executables to modern day botnets that perform bank fraud and identity theft. Modern malware often has a need to communicate back to the author, or other machines that are also infected. Several techniques for transmitting this data covertly have been developed over the years which vary significantly in their level of sophistication. This research creates a new covert channel technique for stealing information from a network by piggybacking on user-generated network traffic. Specifically, steganography drop boxes and passive covert channels are merged …

Go to article

A Comparative Analysis Of Ascii And Xml Logging Systems, Eric C. Hanington Sep 2010

A Comparative Analysis Of Ascii And Xml Logging Systems, Eric C. Hanington

Theses and Dissertations

This research compares XML and ASCII based event logging systems in terms of their storage and processing efficiency. XML has been an emerging technology, even for security. Therefore, it is researched as a logging system with the mitigation of its verbosity. Each system consists of source content, the network transmission, database storage, and querying which are all studied as individual parts. The ASCII logging system consists of the text file as source, FTP as transport, and a relational database system for storage and querying. The XML system has the XML files and XML files in binary form using Efficient XML …

Go to article

Reputation-Based Internet Protocol Security: A Multilayer Security Framework For Mobil Ad Hoc Networks, Timothy H. Lacey Sep 2010

Reputation-Based Internet Protocol Security: A Multilayer Security Framework For Mobil Ad Hoc Networks, Timothy H. Lacey

Theses and Dissertations

This research effort examines the theory, application, and results for a Reputation-based Internet Protocol Security (RIPSec) framework that provides security for an ad-hoc network operating in a hostile environment. In RIPSec, protection from external threats is provided in the form of encrypted communication links and encryption-wrapped nodes while internal threats are mitigated by behavior grading that assigns reputations to nodes based on their demonstrated participation in the routing process. Network availability is provided by behavior grading and round-robin multipath routing. If a node behaves faithfully, it earns a positive reputation over time. If a node misbehaves (for any number of …

Go to article

Code White: A Signed Code Protection Mechanism For Smartphones, Joseph M. Hinson Iv Sep 2010

Code White: A Signed Code Protection Mechanism For Smartphones, Joseph M. Hinson Iv

Theses and Dissertations

This research develops Code White, a hardware-implemented trusted execution mechanism for the Symbian mobile operating system. Code White combines a signed whitelist approach with the execution prevention technology offered by the ARM architecture. Testing shows that it prevents all untrusted user applications from executing while allowing all trusted applications to load and run. Performance testing in contrast with an unmodified Symbian system shows that the difference in load time increases linearly as the application file size increases. The predicted load time for an application with a one megabyte code section remains well below one second, ensuring uninterrupted experience for the …

Go to article

Malware Type Recognition And Cyber Situational Awareness, Thomas E. Dube, Richard A. Raines, Gilbert L. Peterson, Kenneth W. Bauer, Michael R. Grimaila, Steven K. Rogers Aug 2010

Malware Type Recognition And Cyber Situational Awareness, Thomas E. Dube, Richard A. Raines, Gilbert L. Peterson, Kenneth W. Bauer, Michael R. Grimaila, Steven K. Rogers

Faculty Publications

Current technologies for computer network and host defense do not provide suitable information to support strategic and tactical decision making processes. Although pattern-based malware detection is an active research area, the additional context of the type of malware can improve cyber situational awareness. This additional context is an indicator of threat capability thus allowing organizations to assess information losses and focus response actions appropriately. Malware Type Recognition (MaTR) is a research initiative extending detection technologies to provide the additional context of malware types using only static heuristics. Test results with MaTR demonstrate over a 99% accurate detection rate and 59% …

Go to article

Simulating Windows-Based Cyber Attacks Using Live Virtual Machine Introspection, Dustyn A. Dodge, Barry E. Mullins, Gilbert L. Peterson, James S. Okolica Jul 2010

Simulating Windows-Based Cyber Attacks Using Live Virtual Machine Introspection, Dustyn A. Dodge, Barry E. Mullins, Gilbert L. Peterson, James S. Okolica

Faculty Publications

Static memory analysis has been proven a valuable technique for digital forensics. However, the memory capture technique halts the system causing the loss of important dynamic system data. As a result, live analysis techniques have emerged to complement static analysis. In this paper, a compiled memory analysis tool for virtualization (CMAT-V) is presented as a virtual machine introspection (VMI) utility to conduct live analysis during simulated cyber attacks. CMAT-V leverages static memory dump analysis techniques to provide live system state awareness. CMAT-V parses an arbitrary memory dump from a simulated guest operating system (OS) to extract user information, network usage, …

Go to article

Deterministic, Efficient Variation Of Circuit Components To Improve Resistance To Reverse Engineering, Daniel F. Koranek Jun 2010

Deterministic, Efficient Variation Of Circuit Components To Improve Resistance To Reverse Engineering, Daniel F. Koranek

Theses and Dissertations

This research proposes two alternative methods for generating semantically equivalent circuit variants which leave the circuit's internal structure pseudo-randomly determined. Component fusion deterministically selects subcircuits using a component identification algorithm and replaces them using a deterministic algorithm that generates canonical logic forms. Component encryption seeks to alter the semantics of individual circuit components using an encoding function, but preserves the overall circuit semantics by decoding signal values later in the circuit. Experiments were conducted to examine the performance of component fusion and component encryption against representative trials of subcircuit selection-and-replacement and Boundary Blurring, two previously defined methods for circuit obfuscation. …

Go to article

An Application Of Automated Theorem Provers To Computer System Security: The Schematic Protection Model, Mitchell D.I. Hirschfeld Jun 2010

An Application Of Automated Theorem Provers To Computer System Security: The Schematic Protection Model, Mitchell D.I. Hirschfeld

Theses and Dissertations

The Schematic Protection Model is specified in SAL and theorems about Take-Grant and New Technology File System schemes are proven. Arbitrary systems can be specified in SPM and analyzed. This is the first known automated analysis of SPM specifications in a theorem prover. The SPM specification was created in such a way that new specifications share the underlying framework and are configurable within the specifications file alone. This allows new specifications to be created with ease as demonstrated by the four unique models included within this document. This also allows future users to more easily specify models without recreating the …

Go to article

Developing A Hybrid Virtualization Platform Design For Cyber Warfare And Simulation, Kyle E. Stewart Jun 2010

Developing A Hybrid Virtualization Platform Design For Cyber Warfare And Simulation, Kyle E. Stewart

Theses and Dissertations

Virtualization is a technique used to model and simulate the cyber domain, as well as train and educate. Different types of virtualization techniques exist that each support a unique set of benefits and requirements. This research proposes a novel design that incorporates host and network virtualization concepts for a cyber warfare training platform. At the host level, hybrid virtualization combines full and operating system virtualization techniques in order to leverage the benefits and minimize the drawbacks of each individual technique. Network virtualization allows virtual machines to connect in flexible topologies, but it also incurs additional processing overhead. Quantitative analysis falls …

Go to article

Developing Cyberspace Data Understanding Using Crisp-Dm For Host-Based Ids Feature Mining, Joseph R. Erskine, Gilbert L. Peterson, Barry E. Mullins, Michael R. Grimaila Apr 2010

Developing Cyberspace Data Understanding Using Crisp-Dm For Host-Based Ids Feature Mining, Joseph R. Erskine, Gilbert L. Peterson, Barry E. Mullins, Michael R. Grimaila

Faculty Publications

Current intrusion detection systems (IDS) generate a large number of specific alerts, but typically do not provide actionable information. Compounding this problem is the fact that many alerts are false positive alerts. This paper applies the Cross Industry Standard Process for Data Mining (CRISP-DM) to develop an understanding of a host environment under attack. Data is generated by launching scans and exploits at a machine outfitted with a set of host-based forensic data collectors. Through knowledge discovery, features are selected to project human understanding of the attack process into the IDS model. By discovering relationships between the data collected and …

Go to article

Developing A Qualia-Based Multi-Agent Architecture For Use In Malware Detection, Bobby D. Birrer Mar 2010

Developing A Qualia-Based Multi-Agent Architecture For Use In Malware Detection, Bobby D. Birrer

Theses and Dissertations

Detecting network intruders and malicious software is a significant problem for network administrators and security experts. New threats are emerging at an increasing rate, and current signature and statistics-based techniques are not keeping pace. Intelligent systems that can adapt to new threats are needed to mitigate these new strains of malware as they are released. This research detects malware based on its qualia, or essence rather than its low-level implementation details. By looking for the underlying concepts that make a piece of software malicious, this research avoids the pitfalls of static solutions that focus on predefined bit sequence signatures or …

Go to article

Development Of A Methodology For Customizing Insider Threat Auditing On A Linux Operating System, William T. Bai Mar 2010

Development Of A Methodology For Customizing Insider Threat Auditing On A Linux Operating System, William T. Bai

Theses and Dissertations

Insider threats can pose a great risk to organizations and by their very nature are difficult to protect against. Auditing and system logging are capabilities present in most operating systems and can be used for detecting insider activity. However, current auditing methods are typically applied in a haphazard way, if at all, and are not conducive to contributing to an effective insider threat security policy. This research develops a methodology for designing a customized auditing and logging template for a Linux operating system. An intent-based insider threat risk assessment methodology is presented to create use case scenarios tailored to address …

Go to article

A Distributed Network Logging Topology, Nicholas E. Fritts Mar 2010

A Distributed Network Logging Topology, Nicholas E. Fritts

Theses and Dissertations

Network logging is used to monitor computer systems for potential problems and threats by network administrators. Research has found that the more logging enabled, the more potential threats can be detected in the logs (Levoy, 2006). However, generally it is considered too costly to dedicate the manpower required to analyze the amount of logging data that it is possible to generate. Current research is working on different correlation and parsing techniques to help filter the data, but these methods function by having all of the data dumped in to a central repository. Central repositories are limited in the amount of …

Go to article

Visually Managing Ipsec, Peter J. Dell'accio Mar 2010

Visually Managing Ipsec, Peter J. Dell'accio

Theses and Dissertations

The United States Air Force relies heavily on computer networks to transmit vast amounts of information throughout its organizations and with agencies throughout the Department of Defense. The data take many forms, utilize different protocols, and originate from various platforms and applications. It is not practical to apply security measures specific to individual applications, platforms, and protocols. Internet Protocol Security (IPsec) is a set of protocols designed to secure data traveling over IP networks, including the Internet. By applying security at the network layer of communications, data packets can be secured regardless of what application generated the data or which …

Go to article

Handshaking Protocols And Jamming Mechanisms For Blind Rendezvous In A Dynamic Spectrum Access Environment, Aaron A. Gross Mar 2010

Handshaking Protocols And Jamming Mechanisms For Blind Rendezvous In A Dynamic Spectrum Access Environment, Aaron A. Gross

Theses and Dissertations

Blind frequency rendezvous is an important process for bootstrapping communications between radios without the use of pre-existing infrastructure or common control channel in a Dynamic Spectrum Access (DSA) environment. In this process, radios attempt to arrive in the same frequency channel and recognize each other’s presence in changing, under-utilized spectrum. This paper refines existing blind rendezvous techniques by introducing a handshaking algorithm for setting up communications once two radios have arrived in the same frequency channel. It then investigates the effect of different jamming techniques on blind rendezvous algorithms that utilize this handshake. The handshake performance is measured by determining …

Go to article

Codifying Information Assurance Controls For Department Of Defense (Dod) Supervisory Control And Data Acquisition (Scada) Systems (U), Eddie A. Mendezllovet Mar 2010

Codifying Information Assurance Controls For Department Of Defense (Dod) Supervisory Control And Data Acquisition (Scada) Systems (U), Eddie A. Mendezllovet

Theses and Dissertations

Protecting DoD critical infrastructure resources and Supervisory Control and Data Acquisition (SCADA) systems from cyber attacks is becoming an increasingly challenging task. DoD Information Assurance controls provide a sound framework to achieve an appropriate level of confidentiality, integrity, and availability. However, these controls have not been updated since 2003 and currently do not adequately address the security of DoD SCADA systems. This research sampled U.S. Air Force Civil Engineering subject matter experts representing eight Major Commands that manage and operate SCADA systems. They ranked 30 IA controls in three categories, and evaluated eight SCADA specific IA controls for inclusion into …

Go to article

Developing Cyberspace Data Understanding: Using Crisp-Dm For Host-Based Ids Feature Mining, Joseph R. Erskine Mar 2010

Developing Cyberspace Data Understanding: Using Crisp-Dm For Host-Based Ids Feature Mining, Joseph R. Erskine

Theses and Dissertations

Current intrusion detection systems generate a large number of specific alerts, but do not provide actionable information. Many times, these alerts must be analyzed by a network defender, a time consuming and tedious task which can occur hours or days after an attack occurs. Improved understanding of the cyberspace domain can lead to great advancements in Cyberspace situational awareness research and development. This thesis applies the Cross Industry Standard Process for Data Mining (CRISP-DM) to develop an understanding about a host system under attack. Data is generated by launching scans and exploits at a machine outfitted with a set of …

Go to article

Evolutionary Artificial Neural Network Weight Tuning To Optimize Decision Making For An Abstract Game, Corey M. Miller Mar 2010

Evolutionary Artificial Neural Network Weight Tuning To Optimize Decision Making For An Abstract Game, Corey M. Miller

Theses and Dissertations

Abstract strategy games present a deterministic perfect information environment with which to test the strategic capabilities of artificial intelligence systems. With no unknowns or random elements, only the competitors’ performances impact the results. This thesis takes one such game, Lines of Action, and attempts to develop a competitive heuristic. Due to the complexity of Lines of Action, artificial neural networks are utilized to model the relative values of board states. An application, pLoGANN (Parallel Lines of Action with Genetic Algorithm and Neural Networks), is developed to train the weights of this neural network by implementing a genetic algorithm over a …

Go to article

Developing An Effective And Efficient Real Time Strategy Agent For Use As A Computer Generated Force, Kurt Weissgerber Mar 2010

Developing An Effective And Efficient Real Time Strategy Agent For Use As A Computer Generated Force, Kurt Weissgerber

Theses and Dissertations

Computer Generated Forces (CGF) are used to represent units or individuals in military training and constructive simulation. The use of CGF significantly reduces the time and money required for effective training. For CGF to be effective, they must behave as a human would in the same environment. Real Time Strategy (RTS) games place players in control of a large force whose goal is to defeat the opponent. The military setting of RTS games makes them an excellent platform for the development and testing of CGF. While there has been significant research in RTS agent development, most of the developed agents …

Go to article

Effects Of Channel Mismatches On Beamforming And Signal Detection, Christopher I. Allen Mar 2010

Effects Of Channel Mismatches On Beamforming And Signal Detection, Christopher I. Allen

Theses and Dissertations

Tuner gain measurements of a multichannel receiver are reported. A linear regression model is used to characterize the gain, as a function of channel number, tuner set-on frequency, and intermediate frequency. Residual errors of this model are characterized by a t distribution. Very strong autocorrelation of tuner gain at various frequencies is noted. Tuner performance from one channel to the next is diverse; several defects at specific frequencies are noted. The Wilcoxon signed rank test is used to test normality of tuner gain among devices; normality is rejected. Antenna directivity and phase pattern measurements are also reported. An antenna element …

Go to article

First Prev Next Last