Information Security Commons^™

Using Covert Means To Establish Cybercraft Command And Control, Bradley D. Sevy

Theses and Dissertations

With the increase in speed and availability of computers, our nation's computer and information systems are being attacked with increased sophistication. The Air Force Research Laboratory (AFRL) Information Directorate (RI) is researching a next generation network defense architecture, called Cybercraft, that provides automated and trusted cyber defense capabilities for AF network assets. This research we consider the issues to protect or obfuscate command and control aspects of Cybercraft. In particular, we present a methodology to hide aspects of Cybercraft platform initialization in context to formation of hierarchical, peer-to-peer groups that collectively form the Cybercraft network. Because malicious code networks (known …

Low Probability Of Intercept Waveforms Via Intersymbol Dither Performance Under Multipath Conditions, Jonathan K. Keen

Theses and Dissertations

This thesis examines the effects of multipath interference on Low Probability of Intercept (LPI) waveforms generated using intersymbol dither. LPI waveforms are designed to be difficult for non-cooperative receivers to detect and manipulate, and have many uses in secure communications applications. In prior research, such a waveform was designed using a dither algorithm to vary the time between the transmission of data symbols in a communication system. This work showed that such a method can be used to frustrate attempts to use non-cooperative receiver algorithms to recover the data. This thesis expands on prior work by examining the effects of …

Numerical Analysis For Relevant Features In Intrusion Detection (Narfid), Jose Andres Gonzalez

Theses and Dissertations

Identification of cyber attacks and network services is a robust field of study in the machine learning community. Less effort has been focused on understanding the domain space of real network data in identifying important features for cyber attack and network service classification. Motivations for such work allow for anomaly detection systems with less requirements on data “sniffed” off the network, extraction of features from the traffic, reduced learning time of algorithms, and ideally increased classification performance of anomalous behavior. This thesis evaluates the usefulness of a good feature subset for the general classification task of identifying cyber attacks and …

Automated Virtual Machine Introspection For Host-Based Intrusion Detection, Brett A. Pagel

Theses and Dissertations

This thesis examines techniques to automate configuration of an intrusion detection system utilizing hardware-assisted virtualization. These techniques are used to detect the version of a running guest operating system, automatically configure version-specific operating system information needed by the introspection library, and to locate and monitor important operating system data structures. This research simplifies introspection library configuration and is a step toward operating system independent introspection. An operating system detection algorithm and Windows virtual machine system service dispatch table monitor are implemented using the Xen hypervisor and a modified version of the XenAccess library. All detection and monitoring is implemented from …

An Fpga-Based System For Tracking Digital Information Transmitted Via Peer-To-Peer Protocols, Karl R. Schrader

Theses and Dissertations

This thesis addresses the problem of identifying and tracking digital information that is shared using peer-to-peer file transfer and Voice over IP (VoIP) protocols. The goal of the research is to develop a system for detecting and tracking the illicit dissemination of sensitive government information using file sharing applications within a target network, and tracking terrorist cells or criminal organizations that are covertly communicating using VoIP applications. A digital forensic tool is developed using an FPGA-based embedded software application. The tool is designed to process file transfers using the BitTorrent peer-to-peer protocol and VoIP phone calls made using the Session …

Multicast Encryption Infrastructure For Security In Sensor Networks, Richard R. Brooks, Brijesh Pillai, Matthew Pirretti, Michele C. Weigle

Computer Science Faculty Publications

Designing secure sensor networks is difficult. We propose an approach that uses multicast communications and requires fewer encryptions than pairwise communications. The network is partitioned into multicast regions; each region is managed by a sensor node chosen to act as a keyserver. The keyservers solicit nodes in their neighborhood to join the local multicast tree. The keyserver generates a binary tree of keys to maintain communication within the multicast region using a shared key. Our approach supports a distributed key agreement protocol that identifies the compromised keys and supports membership changes with minimum system overhead. We evaluate the overhead of …

An Analysis Of Botnet Vulnerabilities, Sean W. Hudson

Theses and Dissertations

Botnets are a significant threat to computer networks and data stored on networked computers. The ability to inhibit communication between servers controlling the botnet and individual hosts would be an effective countermeasure. The objective of this research was to find vulnerabilities in Unreal IRCd that could be used to shut down the server. Analysis revealed that Unreal IRCd is a very mature and stable IRC server and no significant vulnerabilities were found. While this research does not eliminate the possibility that a critical vulnerability is present in the Unreal IRCd software, none were identified during this effort.

Composable Distributed Access Control And Integrity Policies For Query-Based Wireless Sensor Networks, David W. Marsh

Theses and Dissertations

An expected requirement of wireless sensor networks (WSN) is the support of a vast number of users while permitting limited access privileges. While WSN nodes have severe resource constraints, WSNs will need to restrict access to data, enforcing security policies to protect data within WSNs. To date, WSN security has largely been based on encryption and authentication schemes. WSN Authorization Specification Language (WASL) is specified and implemented using tools coded in JavaTM. WASL is a mechanism{independent policy language that can specify arbitrary, composable security policies. The construction, hybridization, and composition of well{known security models is demonstrated and shown to preserve …

On-Demand Key Distribution For Mobile Ad-Hoc Networks, Daniel F. Graham

Theses and Dissertations

Mobile ad-hoc networks offer dynamic portable communication with little or no infrastructure. While this has many benefits, there are additional shortcomings specific to wireless communication that must be addressed. This research proposes gossip-based on-demand key distribution as a means to provide data encryption for mobile ad-hoc networks. This technique uses message keys to avoid encrypting and decrypting a message at every node. Other optimizations used include secure channel caching and joint rekey messages. The use of gossip makes the scheme robust to node failure. Experimental results show only a 15% increase in end-to-end delay with a node failure rate of …

Secured Network Model For Management Information System Based On Ip Security (Ipsec) Encryption Using Multilayered Approach Of Network Security, Dr. Amir Hassan Pathan, Muniza Irshad

International Conference on Information and Communication Technologies

Secured flow of information through the network and play important role in the management information systems. In this paper I describe Secured Network Model For Corporate & Business Organization In Based On Network Level IP Security (IPSec) Encryption & Its Physical Layout Using Multilayered Approach. I have four important considerations for adoption of secured network model as secured network model for management information system.

Internet Information Server Scanner : Scanning On Url Vulnerabilities, Yu Jin Tan

Student Works (2000-2009)

This dissertation analyzes weaknesses on web servers, focusing on Microsoft's Internet Information Server (HS). As part of the research, an HS scanner (HS-SCAN) has been implemented to probe only on URL vulnerabilities. The need for a vulnerability scanner stems from the alarming number of successful attacks on computer systems that are connected to the Internet. The security flaws threatening e-businesses and the Internet community has prompted bona fide defense measures. Internet firewalls - gateways controlling access between one network and all the others - became a must-have for any organization connecting to the Net. If the firewall is considered the …

Mpls Vpn Simulation Using Mp-Ibgp, Tan Fong Ang

Student Works (2000-2009)

As Internet traffic continues to increase, companies are demanding greater speeds and better services to disseminate information to their customers, partners and employees. In order to provide reliable services and to support a variety of secure communications among a wide range of locations, Multiprotocol Label Switching Virtual Private Network (MPLS VPN) has been introduced. MPLS is an emerging technology that aims to address many of the existing issues associated with packet forwarding in today's internetworking environment. Whereas, VPN provides secure private connections through public infrastructure amongst multiple locations. MPLS­ based VPN provides isolation. security, simplified routing, easier provisioning as well …

Security In Distributed Systems - A Framework For Different Application Types, Ingo Stengel

Theses

Security is a factor which decides upon the applicability of distributed applications. Therefore this thesis deals with security in distributed systems. The complexity of the existing distributed technologies makes it necessary to reduce the number of distributed technologies considered in this thesis, i.e. concentrating on: Java, Mobile Agents and CORBA, where only Java-based mobile agents will be considered.

After a short review of basic security principles including firewalls, existing security problems in the above mentioned distributed technologies are analysed. Additional generic problems in distributed systems are outlined.

Solutions are referring to two different areas: those regarding security problems with firewalls …

Network Security Versus Network Connectivity: A Framework For Addressing The Issues Facing The Air Force Medical Community, Franklin E. Cunningham Jr.

Theses and Dissertations

The Air Force has instituted Barrier Reef to protect its networks. The Air Force medical community operates network connections that are incompatible with Barrier Reef. To overcome this problem, OASD(HA) directed the Tri-Service Management Program Office (TIMPO) to develop an architecture that protects all military health systems and allows them to link with all three services and outside partners. This research studied the underlying networking issues and formed a framework based on data from network experts from the Air Force's medical centers and their base network organizations. The findings were compared TIMPO and a composite framework was developed that more …