Information Security Commons^™

Pattern-Of-Life Modeling Using Data Leakage In Smart Homes, Steven M. Beyer

Theses and Dissertations

This work investigates data leakage in smart homes by providing a Smart Home Automation Architecture (SHAA) and a device classifier and pattern-of-life analysis tool, CITIoT (Classify, Identify, and Track Internet of things). CITIoT was able to capture traffic from SHAA and classify 17 of 18 devices, identify 95% of the events that occurred, and track when users were home or away with near 100% accuracy. Additionally, a mitigation tool, MIoTL (Mitigation of IoT Leakage) is provided to defend against smart home data leakage. With mitigation, CITIoT was unable to identify motion and camera devices and was inundated with an average …

Methods Of Reverse Engineering A Bitstream For Field Programmable Gate Array Protection, Daniel J. Celebucki

Theses and Dissertations

Field Programmable Gate Arrays (FPGAs) are found in numerous industries including consumer electronics, automotive, military and aerospace, and critical infrastructure. The ability to be reprogrammed as well as large computational power and relatively low price make them a good fit for low-volume applications that cannot justify the Non-Recurring Engineering (NRE) costs associated with producing Application-Specific Integrated Circuits (ASICs). FPGAs however, have seen a variety of security issues stemming from the fact that their configuration files are not inherently protected. This research assesses the feasibility of reverse engineering the bitstream format for a previously unexplored FPGA, as well as the utilization …

Passive Radiolocation Of Ieee 802.11 Emitters Using Directional Antennae, Bradford E. Law

Theses and Dissertations

Low-cost commodity hardware and cheaper, more capable consumer-grade drones make the threat of home-made, inexpensive drone-mounted wireless attack platforms (DWAPs) greater than ever. Fences and physical security do little to impede a drone from approaching private, commercial, or government wireless access points (WAPs) and conducting wireless attacks. At the same time, unmanned aerial vehicles (UAVs) present a valuable tool for network defenders conducting site surveys and emulating threats. These platforms present near-term dangers and opportunities for corporations and governments. Despite the vast leaps in technology these capabilities represent, UAVs are noisy and consequently difficult to conceal as they approach a …

Estimating Defensive Cyber Operator Decision Confidence, Markus M. Borneman

Theses and Dissertations

As technology continues to advance the domain of cyber defense, signature and heuristic detection mechanisms continue to require human operators to make judgements about the correctness of machine decisions. Human cyber defense operators rely on their experience, expertise, and understanding of network security, when conducting cyber-based investigations, in order to detect and respond to cyber alerts. Ever growing quantities of cyber alerts and network traffic, coupled with systemic manpower issues, mean no one has the time to review or change decisions made by operators. Since these cyber alert decisions ultimately do not get reviewed again, an inaccurate decision could cause …

Assured Android Execution Environments, Brandon P. Froberg

Theses and Dissertations

Current cybersecurity best practices, techniques, tactics and procedures are insufficient to ensure the protection of Android systems. Software tools leveraging formal methods use mathematical means to assure both a design and implementation for a system and these methods can be used to provide security assurances. The goal of this research is to determine methods of assuring isolation when executing Android software in a contained environment. Specifically, this research demonstrates security properties relevant to Android software containers can be formally captured and validated, and that an implementation can be formally verified to satisfy a corresponding specification. A three-stage methodology called "The …

Variable Speed Simulation For Accelerated Industrial Control System Cyber Training, Luke M. Bradford

Theses and Dissertations

It is important for industrial control system operators to receive quality training to defend against cyber attacks. Hands-on training exercises with real-world control systems allow operators to learn various defensive techniques and see the real-world impact of changes made to a control system. Cyber attacks and operator actions can have unforeseen effects that take a significant amount of time to manifest and potentially cause physical harm to the system, making high-fidelity training exercises time-consuming and costly. This thesis presents a method for accelerating training exercises by simulating and predicting the effects of a cyber event on a partially-simulated control system. …

Securing Critical Infrastructure: A Ransomware Study, Blaine M. Jeffries

Theses and Dissertations

This thesis reviews traditional ransomware attack trends in order to present a taxonomy for ransomware targeting industrial control systems. After reviewing a critical infrastructure ransomware attack methodology, a corresponding response and recovery plan is described. The plan emphasizes security through redundancy, specifically the incorporation of standby programmable logic controllers. This thesis goes on to describe a set of experiments conducted to test the viability of defending against a specialized ransomware attack with a redundant controller network. Results support that specific redundancy schemes are effective in recovering from a successful attack. Further experimentation is conducted to test the feasibility of industrial …

Assessing And Expanding Extracurricular Cybersecurity Youth Activities' Impact On Career Interest, Michael H. Dunn

Theses and Dissertations

This thesis assesses and expands the potential of extracurricular activities to address the shortage of cybersecurity workers by increasing secondary school students’ interest in these careers. Competitions and badges, two forms of gamification often applied in extracurricular educational activities, have potential to improve motivation and increase interest in related careers, but are significantly understudied in the context of cybersecurity activities. CyberPatriot is the largest cybersecurity competition in the United States for secondary school students. Impact on participants’ career interests is assessed by analyzing responses to recent surveys conducted by the competition organizers. Analysis demonstrates significantly increased interest in cybersecurity in …

Expected Coverage (Excov): A Proposal To Compare Fuzz Test Coverage Within An Infinite Input Space, Evan V. Swihart

Theses and Dissertations

A Fuzz test is an approach used to discover vulnerabilities by intentionally sending invalid inputs to a system for the purpose of triggering some type of fault or unintended effect that renders the system vulnerable to an exploit. Fuzz testing is an important cyber-testing technique used to find and fix vulnerabilities before they are exploited. The fuzzing of military data links presents a particular challenge because existing fuzzing tools cannot be easily applied to these systems. As a result, the tools and techniques used to fuzz these links vary widely in sophistication and effectiveness. Because of the infinite, or nearly …

Securing Data In Transit Using Two Channel Communication, Clark L. Wolfe

Theses and Dissertations

Securing data in transit is critically important to the Department of Defense in todays contested environments. While encryption is often the preferred method to provide security, there exist applications for which encryption is too resource intensive, not cost-effective or simply not available. In this thesis, a two-channel communication system is proposed in which the message being sent can be intelligently and dynamically split over two or more channels to provide a measure of data security either when encryption is not available, or perhaps in addition to encryption. This data spiting technique employs multiple wireless channels operating at the physical layer, …

Developing A Cyberterrorism Policy: Incorporating Individual Values, Osama Bassam J. Rabie

Theses and Dissertations

Preventing cyberterrorism is becoming a necessity for individuals, organizations, and governments. However, current policies focus on technical and managerial aspects without asking for experts and non-experts values and preferences for preventing cyberterrorism. This study employs value focused thinking and public value forum to bare strategic measures and alternatives for complex policy decisions for preventing cyberterrorism. The strategic measures and alternatives are per socio-technical process.

Transfer Learning With Convolutional Neural Networks Applied To Periocular Biometrics, Kushal Vangara

Theses and Dissertations

Biometrics technologies are designed for recognition of the unique physiological and behavioral features of an individual for identification and verification applications. There have been noteworthy advances in this field to recognize individuals based on their biometric trait(s) for authentication and verification applications. Despite these advances, there are many challenging issues which impede the potential of biometric systems and therefore limit the systems performance. Traditional biometric system design involves a selection of handcrafted features for recognition tasks which are not efficient as the size of the system scales up. Face and iris biometrics are reliable for many identification and verification applications …

Smartphone User Privacy Preserving Through Crowdsourcing, Bahman Rashidi

Theses and Dissertations

In current Android architecture, users have to decide whether an app is safe to use or not. Expert users can make savvy decisions to avoid unnecessary private data breach. However, the majority of regular users are not technically capable or do not care to consider privacy implications to make safe decisions. To assist the technically incapable crowd, we propose a permission control framework based on crowdsourcing. At its core, our framework runs new apps under probation mode without granting their permission requests up-front. It provides recommendations on whether to accept or not the permission requests based on decisions from peer …

Big Networks: Analysis And Optimal Control, Hung The Nguyen

Theses and Dissertations

The study of networks has seen a tremendous breed of researches due to the explosive spectrum of practical problems that involve networks as the access point. Those problems widely range from detecting functionally correlated proteins in biology to finding people to give discounts and gain maximum popularity of a product in economics. Thus, understanding and further being able to manipulate/control the development and evolution of the networks become critical tasks for network scientists. Despite the vast research effort putting towards these studies, the present state-of-the-arts largely either lack of high quality solutions or require excessive amount of time in real-world …

Biologically Inspired Network (Bionet) Authentication Using Logical And Pathological Rf-Dna Credential Pairs, Tyrone A.L. Lewis Sr.

Theses and Dissertations

The command and control (C2) of shared space resources are vulnerable to logical credential forgery and impersonation attacks among standardized and interoperable wireless radio frequency (RF) networks. Threats could come from trusted operators (insiders) or from external sources (outsiders). An attacker may gain unauthorized network access and illegally cross into C2 boundaries when conventional network authentication fails. This research proposes an integrated trust management system that uses both application-layer and physical-layer trust markers to authenticate users and their communication sources. In essence, the results from physical-layer RF-DNA fingerprinting techniques are used to improve application-level trust schemes based on command patterns, …

A Longitudinal Study Of Privacy Awareness In The Digital Age And The Influence Of Knowledge, Therese L. Williams

Theses and Dissertations

Privacy, in the modern connected world, has become a much discussed topic in society ranging from privacy concerns to impacts, attitudes, practices and technologies. In today’s environment of vast social media and revelations of government spying, personal privacy is being highlighted as either non-existent or something that can be achieved to different degrees with knowledge or awareness of how our private information is collected and used. This research strives to answer the question "Using Alan Westin's privacy categories, what is the general awareness of privacy issues in social media and smartphone usage and how does it change when knowledge is …

High Fidelity Adaptive Cyber Emulation, Samir Mammadov

Theses and Dissertations

While looking for a high-level adaptive traffic generation tool, we came to realize that no such tool exists that can be used for rapid development while being platform agnostic. Having reviewed a wide array of tools to either implement user models or simulate traffic, we were unable to find a tool with the right capabilities while maintaining complexity, portability and extensibility. To overcome these issues, we introduce a new adaptive user-modelling framework for the specific use case of cyber activity emulation. Our framework supports the creation of high-level user models that can react to changes in their environments and vary …

A Framework For Categorization Of Industrial Control System Cyber Training Environments, Evan G. Plumley

Theses and Dissertations

First responders and professionals in hazardous occupations undergo training and evaluations for the purpose of mitigating risk and damage. For example, helicopter pilots train with multiple categorized simulations that increase in complexity before flying a real aircraft. However in the industrial control cyber incident response domain, where incident response professionals help detect, respond and recover from cyber incidents, no official categorization of training environments exist. To address this gap, this thesis provides a categorization of industrial control training environments based on realism. Four levels of environments are proposed and mapped to Blooms Taxonomy. This categorization will help organizations determine which …

Autoprov: An Automated File Provenance Collection Tool, Ryan A. Good

Theses and Dissertations

A file's provenance is a detailing of its origins and activities. There are tools available that are useful in maintaining the provenance of a file. Unfortunately for digital forensics, these tools require prior installation on the computer of interest while provenance generating events happen. The presented tool addresses this by reconstructing a file's provenance from several temporal artifacts. It identifies relevant temporal and user correlations between these artifacts, and presents them to the user. A variety of predefined use cases and real world data are tested against to demonstrate that this software allows examiners to draw useful conclusions about the …

Active Response Using Host-Based Intrusion Detection System And Software-Defined Networking, Jonathon S. Goodgion

Theses and Dissertations

This research proposes AHNSR: Active Host-based Network Security Response by utilizing Host-based Intrusion Detection Systems (HIDS) with Software-Defined Networking (SDN) to enhance system security by allowing dynamic active response and reconstruction from a global network topology perspective. Responses include traffic redirection, host quarantining, filtering, and more. A testable SDN-controlled network is constructed with multiple hosts, OpenFlow enabled switches, and a Floodlight controller, all linked to a custom, novel interface for the Open-Source SECurity (OSSEC) HIDS framework. OSSEC is implemented in a server-agent architecture, allowing scalability and OS independence. System effectiveness is evaluated against the following factors: alert density and a …

A Framework For Understanding, Prioritizing, And Applying Systems Security Engineering Processes, Activities, And Tasks, Stephen Khou

Theses and Dissertations

Current systems security practices lack an effective approach to prioritize and tailor systems security efforts to develop and field secure systems in challenging operational environments, which results in business and mission stakeholders becoming more susceptible to an array of disruptive events. This work informs Systems Engineers on recent developments in the field of system security engineering and provides a framework for more fully understanding the application of Systems Security Engineering (SSE) processes, activities, and tasks as described in the recently released National Institute of Standards and Technology (NIST) Special Publication 800-160. This SSE framework uniquely offers a repeatable and tailorable …

Applying Cyber Threat Intelligence To Industrial Control Systems, Matthew P. Sibiga

Theses and Dissertations

A cybersecurity initiative known as cyber threat intelligence (CTI) has recently been developed and deployed. The overall goal of this new technology is to help protect network infrastructures. Threat intelligence platforms (TIPs) have also been created to help facilitate CTI effectiveness within organizations. There are many benefits that both can achieve within the information technology (IT) sector. The industrial control system (ICS) sector can also benefit from these technologies as most ICS networks are connected to IT networks. CTI and TIPs become resourceful when using indicators of compromise (IOCs) from known ICS malware attacks and an open source intrusion detection …

Rationality, Parapsychology, And Artificial Intelligence In Military And Intelligence Research By The United States Government In The Cold War, Guy M. Lomeo

Theses and Dissertations

A study analyzing the roles of rationality, parapsychology, and artificial intelligence in military and intelligence research by the United States Government in the Cold War. An examination of the methodology behind the decisions to pursue research in two fields that were initially considered irrational.

Soteria: A Persuasive Esecurity Assistant, Punica Bhardwaj

Theses and Dissertations

“…security is only as good as the weakest link, and people are the weakest link in the chain.” – B Schneier, 2002 Humans are often referred to as the “weakest link” in the security chain because of the poor security decisions taken by them. There can be many reasons for these decisions, such as lack of understandability of the software, lack of education, and lack of relevant information required to do that particular action. In this Thesis, we focus on the lack of relevant information required at the time of performing the action. In order to provide the user with …

Cross-Spectral Biometric Performance Analysis On High-Resolution Face Images, Praveen Kumar Pandian Shanmuganathan

Theses and Dissertations

Biometrics is increasingly being used to authenticate the identity of individuals in critical use case devices like smart phones, laptops, and several other access-control systems in our day-to-day lives. Additionally, biometrics is also used in forensic and security sensitive areas to detect and identify suspects involved in bombings, robberies, and several police investigations. In each of these critical scenarios, the high-quality full-frontal face images of the subjects are not accurately captured as those subjects do not intend to register their identity to the Closed-Circuit Cameras. Hence in such cases, identification of the suspects becomes difficult even though we have the …

Physical Layer Defenses Against Primary User Emulation Attacks, Joan A. Betances

Theses and Dissertations

Cognitive Radio (CR) is a promising technology that works by detecting unused parts of the spectrum and automatically reconfiguring the communication system's parameters in order to operate in the available communication channels while minimizing interference. CR enables efficient use of the Radio Frequency (RF) spectrum by generating waveforms that can coexist with existing users in licensed spectrum bands. Spectrum sensing is one of the most important components of CR systems because it provides awareness of its operating environment, as well as detecting the presence of primary (licensed) users of the spectrum.

Whitelisting System State In Windows Forensic Memory Visualizations, Joshua A. Lapso

Theses and Dissertations

Examiners in the field of digital forensics regularly encounter enormous amounts of data and must identify the few artifacts of evidentiary value. The most pressing challenge these examiners face is manual reconstruction of complex datasets with both hierarchical and associative relationships. The complexity of this data requires significant knowledge, training, and experience to correctly and efficiently examine. Current methods provide primarily text-based representations or low-level visualizations, but levee the task of maintaining global context of system state on the examiner. This research presents a visualization tool that improves analysis methods through simultaneous representation of the hierarchical and associative relationships and …

Cyberspace And Organizational Structure: An Analysis Of The Critical Infrastructure Environment, Michael D. Quigg Ii

Theses and Dissertations

Now more than ever, organizations are being created to protect the cyberspace environment. The capability of cyber organizations tasked to defend critical infrastructure has been called into question by numerous cybersecurity experts. Organizational theory states that organizations should be constructed to fit their operating environment properly. Little research in this area links existing organizational theory to cyber organizational structure. Because of the cyberspace connection to critical infrastructure assets, the factors that influence the structure of cyber organizations designed to protect these assets warrant analysis to identify opportunities for improvement.

This thesis analyzes the cyber‐connected critical infrastructure environment using the dominant …

A Framework For Incorporating Insurance Into Critical Infrastructure Cyber Risk Strategies, Derek R. Young

Theses and Dissertations

Critical infrastructure owners and operators want to minimize their cyber risk and expenditures on cybersecurity. The insurance industry has been quantitatively assessing risk for hundreds of years in order to minimize risk and maximize profits. To achieve these goals, insurers continuously gather statistical data to improve their predictions, incentivize their clients' investment in self-protection and periodically refine their models to improve the accuracy of risk estimates. This paper presents a framework which incorporates the operating principles of the insurance industry in order to provide quantitative estimates of cyber risk. The framework implements optimization techniques to suggest levels of investment for …

Statistic Whitelisting For Enterprise Network Incident Response, Nathan E. Grunzweig

Theses and Dissertations

This research seeks to satisfy the need for the rapid evaluation of enterprise network hosts in order to identify items of significance through the introduction of a statistic whitelist based on the behavior of the processes on each host. By taking advantage of the repetition of processes and the resources they access, a whitelist can be generated using large quantities of host machines. For each process, the Modules and the TCP & UDP Connections are compared to identify which resources are most commonly accessed by each process. Results show 47% of processes receiving a whitelist score of 75% or greater …